V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

includes/target/etc/initramfs-tools/files/unlock_wrapper.sh

@@ -345,7 +345,7 @@ trap_on_exit() {
 trap_on_term() {
   trap - ERR INT TERM
   stty echo
-  printf "%s" "${NL}"
+  printf "%b" "${NL}"
   color_echo "${RED}" "✘ Received termination signal. System Power Off in 3 seconds." >&2
   # TODO: REMOVE DEBUGGER FOR PRODUCTION
   drop_bash
@@ -362,7 +362,6 @@ trap_on_term() {
 #   0: Script Name
 #######################################
 verify_script() {
-  # TODO: TEST THIS FUNC()
   declare     dir
   # shellcheck disable=SC2312
   dir="$(dirname "$(readlink -f "${0}")")"
@@ -378,10 +377,11 @@ verify_script() {
 
     color_echo "${MAG}" "🔏 Verifying signature of: [${hashfile}]"
 
-    if ! gpgv --keyring /etc/keys/pubring.gpg "${sigfile}" "${hashfile}"; then
+    if ! gpgv --keyring /etc/keys/unlock_wrapper_pubring.gpg "${sigfile}" "${hashfile}"; then
       color_echo "${RED}" "✘ Signature verification failed for: [${hashfile}]"
       color_echo "${RED}" "✘ System Power Off in 3 seconds ...."
-      power_off 3
+      drop_bash
+      #power_off 3
     else
       color_echo "${GRE}" "🔏 Verifying signature of: [${hashfile}] successful."
     fi
@@ -395,7 +395,8 @@ verify_script() {
     if [[ "${computed}" != "${expected}" ]]; then
       color_echo "${RED}" "✘ Recomputed hash mismatch for     : [${item}]" >&2
       color_echo "${RED}" "✘ System Power Off in 3 seconds ...." >&2
-      power_off 3
+      drop_bash
+      #power_off 3
     fi
     color_echo "${GRE}" "🔢 Recomputing Hash: [${item}] successful."
 
@@ -422,13 +423,20 @@ main() {
   trap 'trap_on_exit' EXIT
   trap 'trap_on_term' INT TERM
 
+  if [[ -r /etc/dropbear/banner ]]; then
+    cat /etc/dropbear/banner >&2
+  elif [[ -r /etc/dropbear/initramfs/banner ]]; then
+    cat /etc/dropbear/initramfs/banner >&2
+  fi
+  uname -a
+
   printf "%b" "${NL}"
   color_echo "${RED}" "Coresecret Connection established."
   color_echo "${RED}" "Starting Time: ${CURRENTDATE}"
 
   printf "%b" "${NL}"
   color_echo "${MAG}" "Integrity self-check ..."
-  #verify_script
+  verify_script
 
   ### Read newline-separated output into an array.
   printf "%b" "${NL}"

includes/target/etc/initramfs-tools/hooks/9999-custom-initramfs.sh

@@ -31,7 +31,6 @@ fi
 
 ### Ensure directory structure in initramfs
 mkdir -p "${DESTDIR}/usr/bin"
-mkdir -p "${DESTDIR}/etc/dropbear/initramfs"
 mkdir -p "${DESTDIR}/etc/keys"
 mkdir -p "${DESTDIR}/usr/local/bin"
 mkdir -p "${DESTDIR}/etc/initramfs-tools/conf.d"
@@ -98,21 +97,22 @@ printf "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files
 install -m 0444 /etc/dropbear/initramfs/dropbear.conf "${DESTDIR}/etc/dropbear/dropbear.conf"
 printf "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/dropbear.conf %s/etc/dropbear/dropbear.conf] \n\e[0m" "${DESTDIR}"
 
-### Install Dropbear Cryptroot Unlock Wrapper
+### Install Dropbear 'cryptroot-unlock'-Wrapper
 install -m 0555 /etc/initramfs-tools/files/unlock_wrapper.sh "${DESTDIR}/usr/local/bin/unlock_wrapper.sh"
 printf "\e[92mSuccessfully executed: [install -m 0555 /etc/initramfs-tools/files/unlock_wrapper.sh %s/usr/local/bin/unlock_wrapper.sh] \n\e[0m" "${DESTDIR}"
-# TODO: Update preseed.yaml for pgp signing key AND / OR implementation of presigned unlock_wrapper.sh
-#install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512 "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha512"
-#install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512.sig "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha512.sig"
+
+install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512 "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha512"
+printf "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512 %s/usr/local/bin/unlock_wrapper.sh.sha512] \n\e[0m" "${DESTDIR}"
+
+install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512.sig "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha512.sig"
+printf "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512.sig %s/usr/local/bin/unlock_wrapper.sh.sha512.sig] \n\e[0m" "${DESTDIR}"
 
 ### Install PGP Signing Keys
-#install -m 0444 /root/.ciss/keys/pubring.gpg "${DESTDIR}/etc/keys/pubring.gpg"
+install -m 0444 /root/.ciss/keys/unlock_wrapper_pubring.pgp "${DESTDIR}/etc/keys/unlock_wrapper_pubring.gpg"
 
 ### Install Dropbear Banner
 install -m 0444 /etc/dropbear/initramfs/banner "${DESTDIR}/etc/dropbear/banner"
 printf "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/banner %s/etc/dropbear/banner] \n\e[0m" "${DESTDIR}"
-install -m 0444 /etc/dropbear/initramfs/banner "${DESTDIR}/etc/dropbear/initramfs/banner"
-printf "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/banner %s/etc/dropbear/initramfs/banner] \n\e[0m" "${DESTDIR}"
 
 printf "\e[92mSuccessfully executed: [/etc/initramfs-tools/hooks/9999-custom-initramfs.sh] \n\e[0m"
 

includes/target/etc/initramfs-tools/scripts/init-premount/1000-fixpath.sh

@@ -19,11 +19,11 @@ case "${1}" in
 esac
 
 mkdir -p /run/ciss
-printf '%s\n' "${PATH}" >| /run/ciss/fixpath_init_bottom_early.log
+printf '%s\n' "${PATH}" >| /run/ciss/fixpath_init_premount_early.log
 
 ### Make sure /usr/local/bin is in front of 'PATH'.
 export PATH="/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr"
 
-printf '%s\n' "${PATH}" >| /run/ciss/fixpath_init_bottom_late.log
+printf '%s\n' "${PATH}" >| /run/ciss/fixpath_init_premount_late.log
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh