V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

.preseed/preseed.yaml

@@ -407,7 +407,7 @@ grub:
     path: "/includes/target/etc/default/grub.d/hexagon.png"
   bootdev: "/dev/sda"          # Due notably to potential USB sticks, the location of the primary drive cannot be determined
                                # safely in general, so this needs to be specified.
-  force_efi: false             # Force GRUB installation to the EFI removable media path?
+  force_efi: true              # Force GRUB installation to the EFI removable media path?
                                # Some EFI firmware implementations do not meet the EFI specification (i.e., they are buggy)
                                # and do not support proper configuration of boot options from system hard drives.
                                #

func/cdi_4300_network/4312_dropbear_setup.sh

@@ -53,7 +53,7 @@ dropbear_setup() {
   install -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/banner" "${TARGET}/etc/dropbear/initramfs/"
 
   ### Check for initramfs "IP"-variable: static or dynamic configuration vai dhcp.
-  if [[ "${network_autoconfig_enable}" = "false" ]]; then
+  if [[ "${dropbear_dhcp}" = "false" ]]; then
 
     ### "IP=<HOST IP>::<GATEWAY IP>:<SUBNET MASK>:<FQDN>:<NIC>:none:<DNS 0 IP>:<DNS 1 IP>:<NTP IP>"
     printf "IP=%s::%s:%s:%s:%s:none:%s:%s:%s\n" \

func/cdi_4400_hardening/4410_kernel_sysctl.sh

@@ -23,7 +23,7 @@ guard_sourcing
 #   0: on success
 #######################################
 kernel_sysctl() {
-  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/sysctl.d/99_local.hardened.ini" \
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/sysctl.d/99_local.hardened" \
     "${TARGET}/etc/sysctl.d/99_local.hardened"
   do_log "info" "file_only" "4410() Installed: '/etc/sysctl.d/99_local.hardened'."
   return 0

includes/target/etc/initramfs-tools/hooks/custom-initramfs.sh

@@ -11,18 +11,21 @@
 # SPDX-Security-Contact: security@coresecret.eu
 # SPDX-Comment: Hook script (initramfs) for setting up the CISS.debian.installer hardened dropbear environment, incl. Luks Nuke.
 
+# TODO: Update preseed.yaml for pgp signing key AND / OR implementation of presigned unlock-wrapper.sh
+
 set -e
 
 PREREQ=""
-prereqs() { echo "$PREREQ"; }
+prereqs() { echo "${PREREQ}"; }
 case $1 in
   prereqs) prereqs; exit 0 ;;
 esac
 
 . /usr/share/initramfs-tools/hook-functions
 
-if [ ! -e /etc/initramfs-tools/files/unlock-wrapper.sh ]; then
-  echo "Missing unlock-wrapper.sh in /etc/initramfs-tools/files/"
+# shellcheck disable=2292
+if [ ! -e /etc/initramfs-tools/files/unlock_wrapper.sh ]; then
+  echo "Missing unlock_wrapper.sh in /etc/initramfs-tools/files/"
   exit 1
 fi
 
@@ -73,15 +76,15 @@ install -m 0444 /etc/dropbear/initramfs/dropbear.conf "${DESTDIR}/etc/dropbear/d
 
 ### Install Dropbear Cryptroot Unlock Wrapper
 install -m 0555 /etc/initramfs-tools/files/unlock-wrapper.sh "${DESTDIR}/usr/local/bin/unlock-wrapper.sh"
-install -m 0444 /etc/initramfs-tools/files/unlock-wrapper.sh.sha384 "${DESTDIR}/usr/local/bin/unlock-wrapper.sh.sha384"
-install -m 0444 /etc/initramfs-tools/files/unlock-wrapper.sh.sha512 "${DESTDIR}/usr/local/bin/unlock-wrapper.sh.sha512"
-install -m 0444 /etc/initramfs-tools/files/unlock-wrapper.sh.sha384.sig "${DESTDIR}/usr/local/bin/unlock-wrapper.sh.sha384.sig"
-install -m 0444 /etc/initramfs-tools/files/unlock-wrapper.sh.sha512.sig "${DESTDIR}/usr/local/bin/unlock-wrapper.sh.sha512.sig"
+#install -m 0444 /etc/initramfs-tools/files/unlock-wrapper.sh.sha384 "${DESTDIR}/usr/local/bin/unlock-wrapper.sh.sha384"
+#install -m 0444 /etc/initramfs-tools/files/unlock-wrapper.sh.sha512 "${DESTDIR}/usr/local/bin/unlock-wrapper.sh.sha512"
+#install -m 0444 /etc/initramfs-tools/files/unlock-wrapper.sh.sha384.sig "${DESTDIR}/usr/local/bin/unlock-wrapper.sh.sha384.sig"
+#install -m 0444 /etc/initramfs-tools/files/unlock-wrapper.sh.sha512.sig "${DESTDIR}/usr/local/bin/unlock-wrapper.sh.sha512.sig"
 
 ### Install PGP Signing Keys
-install -m 0444 /root/.ciss/keys/pubring.gpg "${DESTDIR}/etc/keys/pubring.gpg"
+#install -m 0444 /root/.ciss/keys/pubring.gpg "${DESTDIR}/etc/keys/pubring.gpg"
 
 ### Install Dropbear Banner
-install -m 0444 /etc/dropbear/initramfs/banner "${DESTDIR}/etc/dropbear/banner"
+#install -m 0444 /etc/dropbear/initramfs/banner "${DESTDIR}/etc/dropbear/banner"
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh