#!/bin/sh
# bashsupport disable=BP5007
# shellcheck shell=sh

# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-11-12; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: LicenseRef-CNCL-1.1 OR LicenseRef-CCLA-1.1
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu

set -e

printf "\e[95mStarting: [/etc/initramfs-tools/hooks/9999_ciss_debian_live_builder.sh] \n\e[0m"

PREREQ=""
prereqs() { echo "${PREREQ}"; }
# shellcheck disable=SC2249
case "${1}" in
  prereqs) prereqs; exit 0 ;;
esac

. /usr/share/initramfs-tools/hook-functions


### Ensure directory structure in initramfs ------------------------------------------------------------------------------------
install -d -m 0755  "${DESTDIR}/etc/ciss/hashes"
install -d -m 0755  "${DESTDIR}/etc/ciss/keys"
install -d -m 0755  "${DESTDIR}/etc/ciss/signatures"
install -d -m 0755  "${DESTDIR}/etc/initramfs-tools/conf.d"
install -d -m 0755  "${DESTDIR}/etc/initramfs-tools/scripts/init-premount"
install -d -m 0755  "${DESTDIR}/usr/bin"
install -d -m 0755  "${DESTDIR}/usr/local/bin"
install -d -m 0755  "${DESTDIR}/usr/sbin"


### Include binaries -----------------------------------------------------------------------------------------------------------
for bin in bash blkid busybox dd dmsetup gpgv losetup lsblk mkpasswd mountpoint sha384sum sha512sum sort stty timeout tr tree udevadm whois; do

  path="$(command -v "${bin}" 2>/dev/null || true)"

  [ -z "${path}" ] && continue

  copy_exec "${path}" "${path}"
  printf "\e[92mSuccessfully executed: [copy_exec %s %s] \n\e[0m" "${path}" "${path}"

done


### Link busybox applets for compatibility -------------------------------------------------------------------------------------
for dir in bin usr/bin; do
  ln -sf busybox "${DESTDIR}/${dir}/cat"
  ln -sf busybox "${DESTDIR}/${dir}/sleep"
done


### Install GPG keys -----------------------------------------------------------------------------------------------------------
src_dir="/etc/ciss/keys"
dst_dir="${DESTDIR}/etc/ciss/keys"
key=""

if [ -d "${src_dir}" ]; then

    install -d -m 0755 "${dst_dir}"

    for key in "${src_dir}"/*.gpg; do

        [ -e "${key}" ] || continue

        install -m 0444 "${key}" "${dst_dir}/"

        printf '\e[92mSuccessfully executed: [install -m 0444 %s %s]\n\e[0m' "${key}" "${dst_dir}"

    done

fi


### Install GPG signatures -----------------------------------------------------------------------------------------------------
src_dir="/etc/ciss/signatures"
dst_dir="${DESTDIR}/etc/ciss/signatures"
sig=""

if [ -d "${src_dir}" ]; then

  install -d -m 0755 "${dst_dir}"

  for sig in "${src_dir}"/*.sig; do

    [ -e "${sig}" ] || continue

    install -m 0444 "${sig}" "${dst_dir}/"

    printf '\e[92mSuccessfully executed: [install -m 0444 %s %s]\n\e[0m' "${sig}" "${dst_dir}"

  done

fi


### Install SHA hashes ---------------------------------------------------------------------------------------------------------
src_dir="/etc/ciss/hashes"
dst_dir="${DESTDIR}/etc/ciss/hashes"
hash=""

if [ -d "${src_dir}" ]; then

  install -d -m 0755 "${dst_dir}"

  for hash in "${src_dir}"/*sha*sum.txt; do

    [ -e "${hash}" ] || continue

    install -m 0444 "${hash}" "${dst_dir}/"

    printf '\e[92mSuccessfully executed: [install -m 0444 %s %s]\n\e[0m' "${hash}" "${dst_dir}"

  done

fi


### Install Dropbear configuration ---------------------------------------------------------------------------------------------
install -m 0444 /etc/dropbear/initramfs/dropbear.conf "${DESTDIR}/etc/dropbear/dropbear.conf"
printf "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/dropbear.conf %s/etc/dropbear/dropbear.conf] \n\e[0m" "${DESTDIR}"

### Install Dropbear 'cryptroot-unlock'-Wrapper --------------------------------------------------------------------------------
install -m 0555 /etc/initramfs-tools/files/unlock_wrapper.sh "${DESTDIR}/usr/local/bin/unlock_wrapper.sh"
printf "\e[92mSuccessfully executed: [install -m 0555 /etc/initramfs-tools/files/unlock_wrapper.sh %s/usr/local/bin/unlock_wrapper.sh] \n\e[0m" "${DESTDIR}"

install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512sum.txt "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha512sum.txt"
printf "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512sum.txt %s/usr/local/bin/unlock_wrapper.sh.sha512sum.txt] \n\e[0m" "${DESTDIR}"

install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512sum.txt.sig "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha512sum.txt.sig"
printf "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512sum.txt.sig %s/usr/local/bin/unlock_wrapper.sh.sha512sum.txt.sig] \n\e[0m" "${DESTDIR}"

### Install Dropbear Banner ----------------------------------------------------------------------------------------------------
install -m 0444 /etc/banner "${DESTDIR}/etc/dropbear/banner"
printf "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/banner %s/etc/dropbear/banner] \n\e[0m" "${DESTDIR}"

### Install Dropbear Banner ----------------------------------------------------------------------------------------------------
install -m 0444 /etc/banner "${DESTDIR}/etc/dropbear/banner"
printf "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/banner %s/etc/dropbear/banner] \n\e[0m" "${DESTDIR}"

### EOS

printf "\e[92mSuccessfully executed: [/etc/initramfs-tools/hooks/9999_ciss_debian_live_builder.sh] \n\e[0m"

# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
