diff --git a/.gitea/trigger/t_generate_PRIVATE_trixie_1.yaml b/.gitea/trigger/t_generate_PRIVATE_trixie_1.yaml index 5ea17c4..ebc022f 100644 --- a/.gitea/trigger/t_generate_PRIVATE_trixie_1.yaml +++ b/.gitea/trigger/t_generate_PRIVATE_trixie_1.yaml @@ -10,6 +10,6 @@ # SPDX-Security-Contact: security@coresecret.eu build: - counter: 1023 + counter: 1024 version: V8.13.544.2025.12.05 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml diff --git a/.gitea/workflows/generate_PRIVATE_trixie_1.yaml b/.gitea/workflows/generate_PRIVATE_trixie_1.yaml index a339d7e..231afe1 100644 --- a/.gitea/workflows/generate_PRIVATE_trixie_1.yaml +++ b/.gitea/workflows/generate_PRIVATE_trixie_1.yaml @@ -214,6 +214,7 @@ jobs: --autobuild=6.17.8+deb13-amd64 \ --build-directory /opt/cdlb \ --cdi \ + --cicd \ --change-splash hexagon \ --control "${timestamp}" \ --jump-host ${{ secrets.CISS_DLB_JUMP_HOSTS_1 }} \ diff --git a/config/hooks/live/zzzz_ciss_crypt_squash.hook.binary b/config/hooks/live/zzzz_ciss_crypt_squash.hook.binary index 821afe7..1c7030d 100644 --- a/config/hooks/live/zzzz_ciss_crypt_squash.hook.binary +++ b/config/hooks/live/zzzz_ciss_crypt_squash.hook.binary @@ -75,37 +75,14 @@ declare -i OVERHEAD_PCT=10 declare -i ALIGN_BYTES=$(( 4096 * 1024 )) declare -i BASE_SIZE=$(( VAR_ROOTFS_SIZE + OVERHEAD_FIXED + (VAR_ROOTFS_SIZE * OVERHEAD_PCT / 100) )) declare -i VAR_LUKSFS_SIZE=$(( ( (BASE_SIZE + ALIGN_BYTES - 1) / ALIGN_BYTES ) * ALIGN_BYTES )) -declare -i rc= preallocate "${LUKSFS}" "${VAR_LUKSFS_SIZE}" exec {KEYFD}<"${VAR_TMP_SECRET}/luks.txt" -if cryptsetup luksFormat \ - --batch-mode \ - --cipher aes-xts-plain64 \ - --integrity hmac-sha512 \ - --iter-time 1000 \ - --key-file "/proc/$$/fd/${KEYFD}" \ - --key-size 512 \ - --label crypt_liveiso \ - --luks2-keyslots-size 16777216 \ - --luks2-metadata-size 4194304 \ - --pbkdf argon2id \ - --sector-size 4096 \ - --type luks2 \ - --use-random \ - --verbose \ - "${LUKSFS}" -then +if [[ "${VAR_GITEA_RUNNER}" == "false" ]]; then - printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ [cryptsetup --sector-size 4096 ] successful. \e[0m\n" - -else - - printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ [cryptsetup --sector-size 4096 ] failed. Trying [--sector-size 512]. \e[0m\n" - - if cryptsetup luksFormat \ + cryptsetup luksFormat \ --batch-mode \ --cipher aes-xts-plain64 \ --integrity hmac-sha512 \ @@ -116,23 +93,29 @@ else --luks2-keyslots-size 16777216 \ --luks2-metadata-size 4194304 \ --pbkdf argon2id \ - --sector-size 512 \ + --sector-size 4096 \ --type luks2 \ --use-random \ --verbose \ "${LUKSFS}" - then - printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ [cryptsetup --sector-size 512 ] successful. \e[0m\n" +else - else - - rc="$?" - exec {KEYFD}<&- - printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ [cryptsetup --sector-size 512 ] failed. \e[0m\n" - exit "${rc}" - - fi + cryptsetup luksFormat \ + --batch-mode \ + --cipher aes-xts-plain64 \ + --iter-time 1000 \ + --key-file "/proc/$$/fd/${KEYFD}" \ + --key-size 512 \ + --label crypt_liveiso \ + --luks2-keyslots-size 16777216 \ + --luks2-metadata-size 4194304 \ + --pbkdf argon2id \ + --sector-size 4096 \ + --type luks2 \ + --use-random \ + --verbose \ + "${LUKSFS}" fi @@ -144,11 +127,11 @@ declare -i SQUASH_FS="${VAR_ROOTFS_SIZE}" if (( LUKS_FREE >= SQUASH_FS )); then - printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ LUKS_FREE '%s' >= SQUASH_FS '%s' \e[0m\n" "${LUKS_FREE}" "${SQUASH_FS}" + printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ LUKS_FREE '%s' >= SQUASH_FS '%s' \e[0m\n" "${LUKS_FREE}" "${SQUASH_FS}" else - printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ LUKS_FREE '%s' <= SQUASH_FS '%s' \e[0m\n" "${LUKS_FREE}" "${SQUASH_FS}" >&2 + printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ LUKS_FREE '%s' <= SQUASH_FS '%s' \e[0m\n" "${LUKS_FREE}" "${SQUASH_FS}" >&2 exit 42 fi diff --git a/docs/DOCUMENTATION.md b/docs/DOCUMENTATION.md index c86ce0c..ad225d1 100644 --- a/docs/DOCUMENTATION.md +++ b/docs/DOCUMENTATION.md @@ -47,7 +47,10 @@ A lightweight Shell Wrapper for building a hardened Debian Live ISO Image. This option creates a boot menu entry that starts the forthcoming 'CISS.debian.installer', which is executed once the system has successfully booted up. - --contact, -c\ e[0m + --cicd + This option MUST be set if the CDLB is executed inside a Gitea Action Runner. + + --contact, -c Show author contact information. --control diff --git a/lib/lib_arg_parser.sh b/lib/lib_arg_parser.sh index 928bcdd..1b8eae1 100644 --- a/lib/lib_arg_parser.sh +++ b/lib/lib_arg_parser.sh @@ -157,6 +157,18 @@ arg_parser() { fi ;; + --cicd) + if [[ -n "${2-}" && "${2}" != -* ]]; then + if ! ${VAR_HANDLER_AUTOBUILD}; then boot_screen_cleaner; fi + printf "\e[91m❌ Error: --cicd MUST NOT be followed by an argument.\e[0m\n" >&2 + read -p -r $'\e[92m✅ Press \'ENTER\' to exit the script ... \e[0m' + exit "${ERR_ARG_MSMTCH}" + fi + # shellcheck disable=SC2034 + declare -g VAR_GITEA_RUNNER="true" + shift 1 + ;; + --control) if [[ -n "${2-}" ]]; then # shellcheck disable=SC2034 diff --git a/lib/lib_usage.sh b/lib/lib_usage.sh index 7cb91a7..946a8d7 100644 --- a/lib/lib_usage.sh +++ b/lib/lib_usage.sh @@ -39,7 +39,7 @@ usage() { # shellcheck disable=SC2155 declare var_header=$(center "CDLB(1) CISS.debian.live.builder CDLB(1)" "${var_cols}") # shellcheck disable=SC2155 - declare var_footer=$(center "V8.13.544.2025.12.05 2025-11-06 CDLB(1)" "${var_cols}") + declare var_footer=$(center "V8.13.544.2025.12.05 2025-12-05 CDLB(1)" "${var_cols}") { echo -e "\e[1;97m${var_header}\e[0m" @@ -77,7 +77,10 @@ usage() { echo " This option creates a boot menu entry that starts the forthcoming 'CISS.debian.installer', which is executed" echo " once the system has successfully booted up." echo - echo -e "\e[97m --contact, -c\ e[0m" + echo -e "\e[97m --cicd\e[0m" + echo " This option MUST be set if the CDLB is executed inside a Gitea Action Runner." + echo + echo -e "\e[97m --contact, -c\e[0m" echo " Show author contact information." echo echo -e "\e[97m --control \e[0m" diff --git a/var/global.var.sh b/var/global.var.sh index 274cef4..38f2b03 100644 --- a/var/global.var.sh +++ b/var/global.var.sh @@ -29,6 +29,7 @@ touch "${LOG_ERROR}" && chmod 0600 "${LOG_ERROR}" declare -g __umask="" declare -g VAR_ARCHITECTURE="" declare -g VAR_CDLB_INSIDE_RUNNER="${VAR_CDLB_INSIDE_RUNNER:-false}" +declare -g VAR_GITEA_RUNNER="false" declare -g VAR_HANDLER_BUILD_DIR="" declare -g VAR_HANDLER_CDI="false" declare -g VAR_HANDLER_NETCUP_IPV6="false"