V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m47s
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m47s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
@@ -19,13 +19,16 @@ installer:
|
||||
version: "V8.00.000.2025.06.17"
|
||||
log: "info"
|
||||
|
||||
###########################################################################################
|
||||
# APT settings #
|
||||
###########################################################################################
|
||||
################################################################################################################################
|
||||
# APT settings
|
||||
################################################################################################################################
|
||||
apt:
|
||||
# You can choose to install contrib software:
|
||||
contrib: true
|
||||
|
||||
# Optionally includes deb-src entries for source repositories. If set to true, source repos are enabled.
|
||||
deb-sources: true
|
||||
|
||||
# By default, source repositories are listed in /etc/apt/sources.list. This MUST be true:
|
||||
default-list: true
|
||||
|
||||
@@ -132,7 +135,7 @@ firmware-install: true
|
||||
firmware-lookup: "missing"
|
||||
|
||||
# The kernel image to be installed; "none" can be used if no kernel is to be installed:
|
||||
kernel: "linux-image-6.12.12+bpo-amd64"
|
||||
kernel: "linux-image-6.12.30+bpo-amd64"
|
||||
|
||||
###########################################################################################
|
||||
# GRUB2 settings #
|
||||
|
||||
142
func/4080_generate_sources.sh
Normal file
142
func/4080_generate_sources.sh
Normal file
@@ -0,0 +1,142 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||
# SPDX-PackageName: CISS.debian.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
guard_sourcing
|
||||
|
||||
###########################################################################################
|
||||
# Generate target ${TARGET}/etc/apt/sources.list entries
|
||||
generate_sources() {
|
||||
declare var_contrib var_dir var_hostname var_hostsecure var_non_free var_non_free_firmware var_protocol var_codename var_arch
|
||||
|
||||
var_arch="${arch}"
|
||||
var_codename=$(lsb_release --codename --short)
|
||||
var_dir="${apt_mirror_directory}"
|
||||
var_hostname="${apt_mirror_hostname}"
|
||||
var_hostsecure="${apt_security_string}"
|
||||
|
||||
[[ "${apt_contrib,,}" == "true" ]] && var_contrib="contrib"
|
||||
|
||||
[[ "${apt_non_free,,}" == "true" ]] && var_non_free="non-free"
|
||||
|
||||
[[ "${apt_non_free_firmware,,}" == "true" ]] && var_non_free_firmware="non-free-firmware"
|
||||
|
||||
if [[ ${apt_mirror_protocol,,} == "https" ]]; then
|
||||
var_protocol="https"
|
||||
elif [[ ${apt_mirror_protocol,,} == "http" ]]; then
|
||||
var_protocol="http"
|
||||
fi
|
||||
|
||||
: >| "${TARGET}/etc/apt/sources.list"
|
||||
chmod 0644 "${TARGET}/etc/apt/sources.list"
|
||||
|
||||
cat << EOF >> "${TARGET}"/etc/apt/sources.list
|
||||
# /etc/apt/sources.list : Generated by CISS.debian.installer
|
||||
# Architecture : ${var_arch}
|
||||
# Distribution : ${var_codename}
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------#
|
||||
# OFFICIAL DEBIAN REPOS #
|
||||
#------------------------------------------------------------------------------------------------------------------------------#
|
||||
deb ${var_protocol}://${var_hostname}${var_dir} ${var_codename} main ${var_contrib} ${var_non_free} ${var_non_free_firmware}
|
||||
deb-src ${var_protocol}://${var_hostname}${var_dir} ${var_codename} main ${var_contrib} ${var_non_free} ${var_non_free_firmware}
|
||||
|
||||
EOF
|
||||
|
||||
do_log "info" "true" "${TARGET}/etc/apt/sources.list entry generated: 'deb ${var_protocol}://${var_hostname}${var_dir} ${var_codename} main ${var_contrib} ${var_non_free} ${var_non_free_firmware}'."
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb-src ${var_protocol}://${var_hostname}${var_dir} ${var_codename} main ${var_contrib} ${var_non_free} ${var_non_free_firmware}'."
|
||||
|
||||
if [[ "${apt_updates_security,,}" == "true" ]]; then
|
||||
|
||||
cat << EOF >> "${TARGET}"/etc/apt/sources.list
|
||||
deb ${var_protocol}://${var_hostsecure}/debian-security ${var_codename}-security main ${var_contrib} ${var_non_free} ${var_non_free_firmware}
|
||||
deb-src ${var_protocol}://${var_hostsecure}/debian-security ${var_codename}-security main ${var_contrib} ${var_non_free} ${var_non_free_firmware}
|
||||
|
||||
EOF
|
||||
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb ${var_protocol}://${var_hostsecure}/debian-security ${var_codename}-security main ${var_contrib} ${var_non_free} ${var_non_free_firmware}'."
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb-src ${var_protocol}://${var_hostsecure}/debian-security ${var_codename}-security main ${var_contrib} ${var_non_free} ${var_non_free_firmware}'."
|
||||
|
||||
fi
|
||||
|
||||
if [[ ${apt_updates_release,,} == "true" ]]; then
|
||||
|
||||
cat << EOF >> "${TARGET}"/etc/apt/sources.list
|
||||
deb ${var_protocol}://${var_hostname}${var_dir} ${var_codename}-updates main ${var_contrib} ${var_non_free} ${var_non_free_firmware}
|
||||
deb-src ${var_protocol}://${var_hostname}${var_dir} ${var_codename}-updates main ${var_contrib} ${var_non_free} ${var_non_free_firmware}
|
||||
|
||||
EOF
|
||||
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb ${var_protocol}://${var_hostname}${var_dir} ${var_codename}-updates main ${var_contrib} ${var_non_free} ${var_non_free_firmware}'."
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb-src ${var_protocol}://${var_hostname}${var_dir} ${var_codename}-updates main ${var_contrib} ${var_non_free} ${var_non_free_firmware}'."
|
||||
|
||||
fi
|
||||
|
||||
if [[ ${apt_updates_backports,,} == "true" ]]; then
|
||||
|
||||
cat << EOF >> "${TARGET}"/etc/apt/sources.list
|
||||
deb ${var_protocol}://${var_hostname}${var_dir} ${var_codename}-backports main ${var_contrib} ${var_non_free} ${var_non_free_firmware}
|
||||
deb-src ${var_protocol}://${var_hostname}${var_dir} ${var_codename}-backports main ${var_contrib} ${var_non_free} ${var_non_free_firmware}
|
||||
|
||||
EOF
|
||||
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb ${var_protocol}://${var_hostname}${var_dir} ${var_codename}-backports main ${var_contrib} ${var_non_free} ${var_non_free_firmware}'."
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb-src ${var_protocol}://${var_hostname}${var_dir} ${var_codename}-backports main ${var_contrib} ${var_non_free} ${var_non_free_firmware}'."
|
||||
|
||||
fi
|
||||
|
||||
# Clean up 'source.list'
|
||||
sed -i '/^#/!s/[[:space:]]\+/ /g' "${TARGET}"/etc/apt/sources.list
|
||||
|
||||
cat << EOF >> "${TARGET}"/etc/apt/sources.list
|
||||
# Copyright 2018-2025; WEIDNER, Marc S., <msw@coresecret.dev>
|
||||
EOF
|
||||
|
||||
if do_in_target "${TARGET}" apt-get update -y; then
|
||||
do_log "info" "true" "Command: 'apt-get update -y' executed in: '${TARGET}'."
|
||||
else
|
||||
do_log "emergency" "true" "Failed: Command: 'apt-get update -y' executed in: '${TARGET}'."
|
||||
fi
|
||||
|
||||
if [[ ${apt_updates_policy,,} == "unattended" ]]; then
|
||||
|
||||
if do_in_target "${TARGET}" apt-get install -y unattended-upgrades; then
|
||||
do_log "info" "true" "Command: 'apt-get install -y unattended-upgrades' executed in: '${TARGET}'."
|
||||
else
|
||||
do_log "emergency" "true" "Failed: Command: 'apt-get install -y unattended-upgrades' executed in: '${TARGET}'."
|
||||
fi
|
||||
do_log "info" "false" "The update policy was set at installation time to: '${apt_updates_policy}' executed in: '${TARGET}'."
|
||||
|
||||
elif [[ ${apt_updates_policy,,} == "security" ]]; then
|
||||
|
||||
if do_in_target "${TARGET}" apt-get install -y unattended-upgrades; then
|
||||
do_log "info" "true" "Command: 'apt-get install -y unattended-upgrades' executed in: '${TARGET}'."
|
||||
else
|
||||
do_log "emergency" "true" "Failed: Command: 'apt-get install -y unattended-upgrades' executed in: '${TARGET}'."
|
||||
fi
|
||||
|
||||
# shellcheck disable=SC2016
|
||||
sed -i 's/^\s*"origin=Debian,codename=\${distro_codename},label=Debian";/\/\/ &/' "${TARGET}"/etc/apt/apt.conf.d/50unattended-upgrades
|
||||
do_log "info" "false" "The update policy was set at installation time to '${apt_updates_policy}' executed in: '${TARGET}'."
|
||||
|
||||
elif [[ ${apt_updates_policy,,} == "none" ]]; then
|
||||
|
||||
do_log "info" "false" "The update policy was set at installation to: '${apt_updates_policy}'."
|
||||
|
||||
else
|
||||
|
||||
do_log "warning" "false" "Update policy '${apt_updates_policy}': is not supported. Using 'none' as default."
|
||||
|
||||
fi
|
||||
|
||||
do_show_footer "${MODULE_TXT}"
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -1,176 +0,0 @@
|
||||
#!/bin/bash
|
||||
# SPDX-Version: 3.0
|
||||
# SPDX-CreationInfo: 2025-02-13; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-ExternalRef: GIT https://cendev.eu/marc.weidner/CISS.2025.debian.installer.git
|
||||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <cendev@coresecret.eu>
|
||||
# SPDX-FileType: SOURCE
|
||||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||
# SPDX-LicenseComment: This file is part of the CISS.2025.hardened.installer framework.
|
||||
# SPDX-PackageName: CISS.2025.hardened.installer
|
||||
# SPDX-Security-Contact: security@coresecret.eu
|
||||
|
||||
###########################################################################################
|
||||
# 3.7.4. Functions - installation - generate sources #
|
||||
###########################################################################################
|
||||
|
||||
###########################################################################################
|
||||
# Generate target ${TARGET}/etc/apt/sources.list entries
|
||||
# Globals:
|
||||
# MODULE_ERR
|
||||
# MODULE_TXT
|
||||
# TARGET
|
||||
# apt_contrib
|
||||
# apt_mirror_directory
|
||||
# apt_mirror_hostname
|
||||
# apt_mirror_protocol
|
||||
# apt_non_free
|
||||
# apt_non_free_firmware
|
||||
# apt_security_string
|
||||
# apt_updates_backports
|
||||
# apt_updates_policy
|
||||
# apt_updates_release
|
||||
# apt_updates_security
|
||||
# Arguments:
|
||||
# None
|
||||
###########################################################################################
|
||||
3_7_4_functions_installation_generate_sources() {
|
||||
declare -g -x MODULE_ERR="3_7_4_functions_installation_generate_sources"
|
||||
declare -g -x MODULE_TXT="Generating '${TARGET}/etc/apt/sources.list'"
|
||||
do_show_header "${MODULE_TXT}"
|
||||
|
||||
declare CONTRIB=""
|
||||
declare DIR=""
|
||||
declare HOSTNAME=""
|
||||
declare HOSTSECURE=""
|
||||
declare NON_FREE=""
|
||||
declare NON_FREE_FIRMWARE=""
|
||||
declare PROTOCOL=""
|
||||
|
||||
DIR="${apt_mirror_directory}"
|
||||
HOSTNAME="${apt_mirror_hostname}"
|
||||
HOSTSECURE="${apt_security_string}"
|
||||
|
||||
if [[ ${apt_contrib,,} == "true" ]]; then
|
||||
CONTRIB="contrib"
|
||||
fi
|
||||
|
||||
if [[ ${apt_non_free,,} == "true" ]]; then
|
||||
NON_FREE="non-free"
|
||||
fi
|
||||
|
||||
if [[ ${apt_non_free_firmware,,} == "true" ]]; then
|
||||
NON_FREE_FIRMWARE="non-free-firmware"
|
||||
fi
|
||||
|
||||
if [[ ${apt_mirror_protocol,,} == "https" ]]; then
|
||||
PROTOCOL="https"
|
||||
elif [[ ${apt_mirror_protocol,,} == "http" ]]; then
|
||||
PROTOCOL="http"
|
||||
fi
|
||||
|
||||
declare CODENAME
|
||||
# apt-get install -y lsb-release
|
||||
CODENAME=$(lsb_release --codename --short)
|
||||
|
||||
touch "${TARGET}"/etc/apt/sources.list
|
||||
chmod 0644 "${TARGET}"/etc/apt/sources.list
|
||||
|
||||
cat << EOF >> "${TARGET}"/etc/apt/sources.list
|
||||
#-----------------------------------------------------------------------------------------#
|
||||
# OFFICIAL DEBIAN REPOS #
|
||||
#-----------------------------------------------------------------------------------------#
|
||||
deb ${PROTOCOL}://${HOSTNAME}${DIR} ${CODENAME} main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}
|
||||
deb-src ${PROTOCOL}://${HOSTNAME}${DIR} ${CODENAME} main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}
|
||||
|
||||
EOF
|
||||
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb ${PROTOCOL}://${HOSTNAME}${DIR} ${CODENAME} main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}'."
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb-src ${PROTOCOL}://${HOSTNAME}${DIR} ${CODENAME} main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}'."
|
||||
|
||||
if [[ ${apt_updates_security,,} == "true" ]]; then
|
||||
|
||||
cat << EOF >> "${TARGET}"/etc/apt/sources.list
|
||||
deb ${PROTOCOL}://${HOSTSECURE}/debian-security ${CODENAME}-security main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}
|
||||
deb-src ${PROTOCOL}://${HOSTSECURE}/debian-security ${CODENAME}-security main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}
|
||||
|
||||
EOF
|
||||
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb ${PROTOCOL}://${HOSTSECURE}/debian-security ${CODENAME}-security main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}'."
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb-src ${PROTOCOL}://${HOSTSECURE}/debian-security ${CODENAME}-security main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}'."
|
||||
|
||||
fi
|
||||
|
||||
if [[ ${apt_updates_release,,} == "true" ]]; then
|
||||
|
||||
cat << EOF >> "${TARGET}"/etc/apt/sources.list
|
||||
deb ${PROTOCOL}://${HOSTNAME}${DIR} ${CODENAME}-updates main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}
|
||||
deb-src ${PROTOCOL}://${HOSTNAME}${DIR} ${CODENAME}-updates main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}
|
||||
|
||||
EOF
|
||||
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb ${PROTOCOL}://${HOSTNAME}${DIR} ${CODENAME}-updates main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}'."
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb-src ${PROTOCOL}://${HOSTNAME}${DIR} ${CODENAME}-updates main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}'."
|
||||
|
||||
fi
|
||||
|
||||
if [[ ${apt_updates_backports,,} == "true" ]]; then
|
||||
|
||||
cat << EOF >> "${TARGET}"/etc/apt/sources.list
|
||||
deb ${PROTOCOL}://${HOSTNAME}${DIR} ${CODENAME}-backports main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}
|
||||
deb-src ${PROTOCOL}://${HOSTNAME}${DIR} ${CODENAME}-backports main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}
|
||||
|
||||
EOF
|
||||
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb ${PROTOCOL}://${HOSTNAME}${DIR} ${CODENAME}-backports main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}'."
|
||||
do_log "info" "false" "${TARGET}/etc/apt/sources.list entry generated: 'deb-src ${PROTOCOL}://${HOSTNAME}${DIR} ${CODENAME}-backports main ${CONTRIB} ${NON_FREE} ${NON_FREE_FIRMWARE}'."
|
||||
|
||||
fi
|
||||
|
||||
# Clean up 'source.list'
|
||||
sed -i '/^#/!s/[[:space:]]\+/ /g' "${TARGET}"/etc/apt/sources.list
|
||||
|
||||
cat << EOF >> "${TARGET}"/etc/apt/sources.list
|
||||
# Copyright 2018-2025; WEIDNER, Marc S., <cendev@coresecret.eu>
|
||||
EOF
|
||||
|
||||
if do_in_target "${TARGET}" apt-get update -y; then
|
||||
do_log "info" "true" "Command: 'apt-get update -y' executed in: '${TARGET}'."
|
||||
else
|
||||
do_log "emergency" "true" "Failed: Command: 'apt-get update -y' executed in: '${TARGET}'."
|
||||
fi
|
||||
|
||||
if [[ ${apt_updates_policy,,} == "unattended" ]]; then
|
||||
|
||||
if do_in_target "${TARGET}" apt-get install -y unattended-upgrades; then
|
||||
do_log "info" "true" "Command: 'apt-get install -y unattended-upgrades' executed in: '${TARGET}'."
|
||||
else
|
||||
do_log "emergency" "true" "Failed: Command: 'apt-get install -y unattended-upgrades' executed in: '${TARGET}'."
|
||||
fi
|
||||
do_log "info" "false" "The update policy was set at installation time to: '${apt_updates_policy}' executed in: '${TARGET}'."
|
||||
|
||||
elif [[ ${apt_updates_policy,,} == "security" ]]; then
|
||||
|
||||
if do_in_target "${TARGET}" apt-get install -y unattended-upgrades; then
|
||||
do_log "info" "true" "Command: 'apt-get install -y unattended-upgrades' executed in: '${TARGET}'."
|
||||
else
|
||||
do_log "emergency" "true" "Failed: Command: 'apt-get install -y unattended-upgrades' executed in: '${TARGET}'."
|
||||
fi
|
||||
|
||||
# shellcheck disable=SC2016
|
||||
sed -i 's/^\s*"origin=Debian,codename=\${distro_codename},label=Debian";/\/\/ &/' "${TARGET}"/etc/apt/apt.conf.d/50unattended-upgrades
|
||||
do_log "info" "false" "The update policy was set at installation time to '${apt_updates_policy}' executed in: '${TARGET}'."
|
||||
|
||||
elif [[ ${apt_updates_policy,,} == "none" ]]; then
|
||||
|
||||
do_log "info" "false" "The update policy was set at installation to: '${apt_updates_policy}'."
|
||||
|
||||
else
|
||||
|
||||
do_log "warning" "false" "Update policy '${apt_updates_policy}': is not supported. Using 'none' as default."
|
||||
|
||||
fi
|
||||
|
||||
do_show_footer "${MODULE_TXT}"
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
|
||||
Reference in New Issue
Block a user