V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

ciss_debian_installer.sh

@@ -12,6 +12,7 @@
 
 ### Contributions so far see ./docs/CREDITS.md
 
+# TODO: Update preseed.yaml for pgp signing key AND / OR implementation of presigned unlock-wrapper.sh
 # TODO: Implement Clang Build Chain and Secure Boot PK CISS.ROOT.CA Signing Workflow
 # TODO: Update preseed.yaml for pgp signing key OR implementation of presigned unlock-wrapper.sh
 # TODO: Implement Console Login Deactivation and 2fa as advertised in preseed.yaml Refactor 4500_installation_accounts.sh

func/cdi_4300_network/4311_dropbear_initramfs.sh

@@ -47,6 +47,7 @@ dropbear_initramfs() {
   for var_file in dbclient dropbearconvert dropbearkey; do
     mv "${TARGET}/usr/bin/${var_file}" "${TARGET}/usr/bin/${var_file}.2022.83"
     install -D -m 0755 -o root -g root "${DIR_TMP}/build/dropbear-2025.88/${var_file}" "${TARGET}/usr/bin/"
+    do_log "debug" "file_only" "4311() Installation [${var_file}] successful."
   done
 
   do_log "info" "file_only" "4311() Installation [dropbear dropbear-initramfs] successful."

func/cdi_4300_network/4312_dropbear_setup.sh

@@ -41,6 +41,9 @@ guard_sourcing
 #   0: on success
 #######################################
 dropbear_setup() {
+  ### Declare Arrays, HashMaps, and Variables.
+  declare     network_static_ipv4ntpserver_0="192.53.103.108" var_modules=""
+
   ### Prepare strong dropbear host keys
   rm -f "${TARGET}"/etc/dropbear/initramfs/dropbear*key
 
@@ -52,12 +55,12 @@ dropbear_setup() {
 
   ### Prepare dropbear authorized_keys
   touch "${TARGET}/etc/dropbear/initramfs/authorized_keys" && chmod 0600 "${TARGET}/etc/dropbear/initramfs/authorized_keys"
-  printf "%s\n" "${user_root_sshpubkey}" > "${TARGET}/etc/dropbear/initramfs/authorized_keys"
-  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/etc/banner" "${TARGET}/etc/dropbear/initramfs/"
+  printf "%s\n" "${user_root_sshpubkey}" >> "${TARGET}/etc/dropbear/initramfs/authorized_keys"
+  install -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/banner" "${TARGET}/etc/dropbear/initramfs/"
 
   ### Check for initramfs "IP"-variable: static or dynamic configuration vai dhcp.
-  if [[ "${dropbear_dhcp,,}" != "true" ]]; then
-    declare network_static_ipv4ntpserver_0="192.53.103.108"
+  if [[ "${VAR_DROPBEAR}" != "true" ]]; then
+
     ### "IP=<HOST IP>::<GATEWAY IP>:<SUBNET MASK>:<FQDN>:<NIC>:none:<DNS 0 IP>:<DNS 1 IP>:<NTP IP>"
     printf "IP=%s::%s:%s:%s:%s:none:%s:%s:%s\n" \
       "${VAR_FINAL_IPV4}" \
@@ -69,44 +72,44 @@ dropbear_setup() {
       "${network_static_ipv4nameserver_1:-89.58.62.53}" \
       "${network_static_ipv4ntpserver_0:-192.53.103.104}" \
       >| "${TARGET}/etc/initramfs-tools/conf.d/ip"
+
   else
+
     ### "IP=:::::<NIC>:dhcp"
     printf "IP=:::::%s:dhcp\n" "${VAR_FINAL_NIC}" >| "${TARGET}/etc/initramfs-tools/conf.d/ip"
+
   fi
 
   ### Generate dropbear configuration file
   write_dropbear_conf
 
   ### Install the script to be called by 'update-initramfs' for updating 'PATH'-variable inside initramfs.
-  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/scripts/init-top/fixpath.sh" \
+  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/scripts/init-top/fixpath.sh" \
     "${TARGET}/includes/initramfs-tools/scripts/init-top/"
 
   ### Install the script to be called by 'update-initramfs' for customizing dropbear inside initramfs.
-  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/hooks/custom-initramfs.sh" \
+  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/hooks/custom-initramfs.sh" \
     "${TARGET}/includes/initramfs-tools/hooks/"
 
   ### Install the script to be called by 'update-initramfs' for customizing prompt inside initramfs environment.
-  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/hooks/custom-prompt.sh" \
+  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/hooks/custom-prompt.sh" \
     "${TARGET}/includes/initramfs-tools/hooks/"
 
   ### Install the script to be called inside initramfs environment for unlocking LUKS and NUKE Devices.
-  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/files/unlock_wrapper.sh" \
+  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/files/unlock_wrapper.sh" \
     "${TARGET}/includes/initramfs-tools/files/"
-  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/files/unlock_wrapper.sh" \
-    "${TARGET}/usr/lib/cryptsetup/scripts/"
 
-  # TODO: Update preseed.yaml for pgp signing key AND / OR implementation of presigned unlock-wrapper.sh
-  ### Install the script to be called inside Host environment for signing 'unlock_wrapper.sh'-script.
-  install -D -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/files/unlock_wrapper_signer.sh" \
+  ### Install the script to be called inside the Host environment for signing 'unlock_wrapper.sh'-script.
+  install -D -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/files/unlock_wrapper_signer.sh" \
     "${TARGET}/includes/initramfs-tools/files/"
 
   ### Install the script to be called by 'update-initramfs' for installing the necessary modules to load into initramfs environment.
-  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/modules" \
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/modules" \
     "${TARGET}/includes/initramfs-tools/"
 
-  declare var_modules; var_modules=$(grep_nic_driver_modules)
+  var_modules=$(grep_nic_driver_modules)
 
-  cat << EOF >> "${TARGET}/includes/initramfs-tools/modules"
+  cat << EOF >> "${TARGET}/etc/initramfs-tools/modules"
 ### Custom NIC driver
 ${var_modules}
 
@@ -115,21 +118,21 @@ EOF
 
   ### Install the script to be called inside the initramfs environment for preparing dropbear execution.
   do_in_target "${TARGET}" mv /usr/share/initramfs-tools/scripts/init-premount/dropbear /usr/share/initramfs-tools/scripts/init-premount/dropbear.2022.83
-  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/usr/share/initramfs-tools/scripts/init-premount/dropbear" \
-    "${TARGET}/includes/usr/share/initramfs-tools/scripts/init-premount/"
+  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/usr/share/initramfs-tools/scripts/init-premount/dropbear" \
+    "${TARGET}/usr/share/initramfs-tools/scripts/init-premount/"
 
   ### Install the variable file to be called inside the initramfs environment for setting up dropbear firewall.
-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/files/dropbear_fw.cnf" \
-    "${TARGET}/includes/initramfs-tools/files/dropbear_fw.conf"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/files/dropbear_fw.cnf" \
+    "${TARGET}/etc/initramfs-tools/files/dropbear_fw.conf"
 
   ### Install the firewall script to be called inside initramfs environment for setting up dropbear firewall.
-  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/files/dropbear_fw.sh" \
-    "${TARGET}/includes/initramfs-tools/files/"
+  install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/files/dropbear_fw.sh" \
+    "${TARGET}/etc/initramfs-tools/files/"
 
   if [[ "${dropbear_firewall,,}" == "true" && -n "${ssh_allow_ipv4_0}" ]]; then
 
-    sed -i 's/^DROPBEAR_FIREWALL_ENABLED=0$/DROPBEAR_FIREWALL_ENABLED=1/' "${TARGET}/includes/initramfs-tools/files/dropbear_fw.cnf"
-    sed -i '/^# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh$/d' "${TARGET}/includes/initramfs-tools/files/dropbear_fw.cnf"
+    sed -i 's/^DROPBEAR_FIREWALL_ENABLED=0$/DROPBEAR_FIREWALL_ENABLED=1/' "${TARGET}/etc/initramfs-tools/files/dropbear_fw.cnf"
+    sed -i '/^# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh$/d' "${TARGET}/etc/initramfs-tools/files/dropbear_fw.cnf"
 
     cat << EOF >> "${TARGET}/includes/initramfs-tools/files/dropbear_fw.cnf"
 DROPBEAR_PORT=${dropbear_port}
@@ -140,10 +143,6 @@ EOF
 
   fi
 
-  ### Finally, deploy all changes done via 'update-grub' and 'update-initramfs'.
-  do_in_target "${TARGET}" update-grub
-  do_in_target "${TARGET}" update-initramfs -u -v -k all
-
   return 0
 }
 

func/cdi_4300_network/4320_update_initramfs.sh

@@ -13,7 +13,7 @@
 guard_sourcing
 
 #######################################
-# Calling 'update-initramfs -u -v -k all' inside Target.
+# Finally, deploy all changes done via 'update-grub' and 'update-initramfs'.
 # Globals:
 #   TARGET
 # Arguments:
@@ -27,6 +27,12 @@ update_initramfs() {
 
   touch "${TARGET}${var_logfile}" && chmod 0600 "${TARGET}${var_logfile}"
 
+  do_in_target_script "${TARGET}" "
+      update-grub 2>&1 | tee -a ${var_logfile}
+      echo ExitCode: \$? >> ${var_logfile}
+    "
+
+
   do_in_target_script "${TARGET}" "
     update-initramfs -u -v -k all 2>&1 | tee -a ${var_logfile}
     echo ExitCode: \$? >> ${var_logfile}