V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

includes/target/etc/initramfs-tools/files/unlock_wrapper.sh

@@ -11,7 +11,12 @@
 # SPDX-Security-Contact: security@coresecret.eu
 # SPDX-Comment: unlock_wrapper.sh to be executed as '/etc/crypttab' keyscript and as dropbear SSH forced command.
 
-set -Ceuo pipefail
+set -Ceu -o pipefail -o ignoreeof
+shopt -s failglob
+shopt -s lastpipe
+shopt -u nullglob
+umask 0077
+export PATH="/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr"
 
 #######################################
 # Variable declaration
@@ -265,7 +270,7 @@ read_passphrase() {
   ### Read from SSH STDIN (or TTY fallback), never via '/lib/cryptsetup/askpass'.
   ask_via_stdin "Enter passphrase: " PASSPHRASE
 
-  ### NUKE pre-check
+  ### NUKE pre-check.
   if [[ "${NUKE_ENABLED,,}" == "true" ]]; then
 
     ROUNDS="$(cut -d'$' -f3 <<< "${NUKE_HASH}")"
@@ -275,8 +280,6 @@ read_passphrase() {
 
     if [[ "${CAND}" == "${NUKE_HASH}" ]]; then
 
-      echo "${CAND}" "==" "${NUKE_HASH}"
-
       nuke
 
     fi
@@ -330,6 +333,7 @@ trap_on_term() {
   stty echo
   printf "%s" "${NL}"
   color_echo "${RED}" "✘ Received termination signal. System Power Off in 3 seconds." >&2
+  # TODO: REMOVE DEBUGGER FOR PRODUCTION
   drop_bash
   #power_off 3
 }
@@ -344,6 +348,7 @@ trap_on_term() {
 #   0: Script Name
 #######################################
 verify_script() {
+  # TODO: TEST THIS FUNC()
   declare     dir
   # shellcheck disable=SC2312
   dir="$(dirname "$(readlink -f "${0}")")"

includes/target/etc/initramfs-tools/scripts/init-top/0000-fixpath.sh

@@ -19,9 +19,11 @@ case "${1}" in
 esac
 
 mkdir -p /run/ciss
-printf '%s\n' "${PATH}" >| /run/ciss/fixpath.initial
+printf '%s\n' "${PATH}" >| /run/ciss/fixpath_early.initial
 
 ### Make sure /usr/local/bin is in front of 'PATH'.
 export PATH="/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr"
 
+printf '%s\n' "${PATH}" >| /run/ciss/fixpath_late.initial
+
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh