V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4100_base/4120_installation_kernel.sh

@@ -37,8 +37,6 @@ installation_kernel() {
     chroot_script "${TARGET}" "
       export INITRD=No
       apt-get install -y --no-install-recommends --no-install-suggests ${VAR_KERNEL} initramfs-tools 2>&1 | tee -a ${var_logfile}
-      RC=( \${PIPESTATUS[@]} )
-      echo ExitCode of PIPESTATUS[0]: \${RC[0]} >> ${var_logfile}
     "
 
     do_log "info" "file_only" "4120() Kernel image: '${VAR_KERNEL}' installed successfully."
@@ -50,8 +48,6 @@ installation_kernel() {
     chroot_script "${TARGET}" "
       export INITRD=No
       apt-get install -y --no-install-recommends --no-install-suggests ${image} initramfs-tools 2>&1 | tee -a ${var_logfile}
-      RC=( \${PIPESTATUS[@]} )
-      echo ExitCode of PIPESTATUS[0]: \${RC[0]} >> ${var_logfile}
     "
 
     do_log "info" "file_only" "4120() Kernel image: '${image}' installed successfully."
@@ -61,4 +57,7 @@ installation_kernel() {
   fi
 
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f installation_kernel
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4100_base/4130_installation_toolset.sh

@@ -97,8 +97,6 @@ installation_toolset() {
     chroot_script "${TARGET}" "
       export INITRD=No
       apt-get install -y --no-install-recommends --no-install-suggests ${ary_unique_pkgs[*]} 2>&1 | tee -a ${var_logfile}
-      RC=( \${PIPESTATUS[@]} )
-      echo ExitCode of PIPESTATUS[0]: \${RC[0]} >> ${var_logfile}
     "
 
   fi

func/cdi_4100_base/4131_installation_systemd.sh

@@ -36,8 +36,6 @@ installation_systemd() {
     chroot_script "${TARGET}" "
       export INITRD=No
       apt-get install -y --no-install-recommends --no-install-suggests systemd systemd-sysv dbus 2>&1 | tee -a ${var_logfile}
-      RC=( \${PIPESTATUS[@]} )
-      echo ExitCode of PIPESTATUS[0]: \${RC[0]} >> ${var_logfile}
     "
 
   else

func/cdi_5000_recovery/5120_installation_kernel.sh

@@ -37,7 +37,6 @@ installation_kernel_reco() {
     chroot_script "${RECOVERY}" '
       export INITRD=No
       apt-get install -y --no-install-recommends --no-install-suggests '"${VAR_KERNEL}"' initramfs-tools 2>&1 | tee -a '"${var_logfile}"'
-      echo ExitCode: $? >> '"${var_logfile}"'
     '
 
     do_log "info" "file_only" "5120() Kernel image: '${VAR_KERNEL}' installed successfully."
@@ -49,7 +48,6 @@ installation_kernel_reco() {
     chroot_script "${RECOVERY}" "
       export INITRD=No
       apt-get install -y --no-install-recommends --no-install-suggests ${image} initramfs-tools 2>&1 | tee -a ${var_logfile}
-      echo ExitCode of PIPESTATUS[0]: \${PIPESTATUS[0]} >> ${var_logfile}
     "
 
     do_log "info" "file_only" "5120() Kernel image: '${image}' installed successfully."

func/cdi_5000_recovery/5130_installation_toolset.sh

@@ -96,8 +96,6 @@ installation_toolset_reco() {
     chroot_script "${RECOVERY}" "
       export INITRD=No
       apt-get install -y --no-install-recommends --no-install-suggests ${ary_unique_pkgs[*]} 2>&1 | tee -a ${var_logfile}
-      RC=( \${PIPESTATUS[@]} )
-      echo ExitCode of PIPESTATUS[0]: \${RC[0]} >> ${var_logfile}
     "
 
   fi

func/cdi_5000_recovery/5131_installation_systemd.sh

@@ -36,7 +36,6 @@ installation_systemd_reco() {
     chroot_script "${RECOVERY}" "
       export INITRD=No
       apt-get install -y --no-install-recommends --no-install-suggests systemd systemd-sysv dbus 2>&1 | tee -a ${var_logfile}
-      echo ExitCode of PIPESTATUS[0]: \${PIPESTATUS[0]} >> ${var_logfile}
     "
 
   else

upgrades/secure-boot/ciss-sb-pki.cnf

@@ -126,6 +126,15 @@ certificatePolicies		          = @ciss_sb_policy
 crlDistributionPoints           = @ciss_sb_root_crl
 nsComment                       = "UEFI Key-Exchange Key (KEK), RSA-3072, SHA-384"
 
+[ v3_db_CA ]
+basicConstraints                = critical, CA:true, pathlen:1
+keyUsage                        = critical, digitalSignature, keyCertSign, cRLSign
+subjectKeyIdentifier            = hash
+authorityKeyIdentifier          = keyid,issuer
+authorityInfoAccess		          = @ciss_sb_pki
+certificatePolicies		          = @ciss_sb_policy
+crlDistributionPoints           = @ciss_sb_root_crl
+nsComment                       = "UEFI db Trust Anchor (CA) for Image code-signers"
 
 [ ciss_sb_pki ]
 caIssuers;URI.0                 = https://ca.quantumsign.eu/