msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V8.13.032.2025.10.03
Some checks failed
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Successful in 1m2s
Details
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m39s
Details
🔐 Generating a Private Live ISO TRIXIE. / 🔐 Generating a Private Live ISO TRIXIE. (push) Has been cancelled
Details
💙 Generating a PUBLIC Live ISO. / 💙 Generating a PUBLIC Live ISO. (push) Has been cancelled
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-10-03 18:39:15 +01:00
parent ec171888f7
commit 0f8b894e40
91 changed files with 333 additions and 101 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
.gitea/workflows/generate_PRIVATE_trixie_0.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
### Version Master V8.13.016.2025.09.28
### Version Master V8.13.032.2025.10.03
name: 🔐 Generating a Private Live ISO TRIXIE.
@@ -51,6 +51,7 @@ jobs:
gnupg \
openssh-client \
openssl \
perl \
sudo \
util-linux
@@ -93,6 +94,40 @@ jobs:
git clone --branch "${GITHUB_REF_NAME}" ssh://git@git.coresecret.dev:42842/msw/CISS.debian.live.builder.git .
git fetch --unshallow || echo "Nothing to fetch - already full clone."
- name: 🔧 Render live hook with secrets.
shell: bash
env:
ED25519_PRIV: ${{ secrets.CISS_DLB_SSH_HOST_ED25519_KEY }}
ED25519_PUB: ${{ secrets.CISS_DLB_SSH_HOST_ED25519_KEY_PUB }}
RSA_PRIV: ${{ secrets.CISS_DLB_SSH_HOST_RSA_KEY }}
RSA_PUB: ${{ secrets.CISS_DLB_SSH_HOST_RSA_KEY_PUB }}
run: |
set -Ceuo pipefail
umask 077
tmpl="config/hooks/live/9935_hardening_ssh.chroot.tmpl"
out="config/hooks/live/9935_hardening_ssh.chroot"
test -f "${tmpl}"
perl -0777 -pe '
BEGIN {
$ed = $ENV{ED25519_PRIV};
$edpub = $ENV{ED25519_PUB};
$rsa = $ENV{RSA_PRIV};
$rsapub = $ENV{RSA_PUB};
}
s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_ED25519_KEY\s*\}\}/$ed/g;
s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_ED25519_KEY_PUB\s*\}\}/$edpub/g;
s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_RSA_KEY\s*\}\}/$rsa/g;
s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_RSA_KEY_PUB\s*\}\}/$rsapub/g;
' "$tmpl" >| "$out"
grep -q "ssh_host_ed25519_key" "${out}"
grep -q "ssh_host_rsa_key" "${out}"
chmod 0755 "${out}"
- name: 🛠️ Cleaning the workspace.
shell: bash
run: |
@@ -142,7 +177,7 @@ jobs:
set -euo pipefail
chmod 0755 ciss_live_builder.sh
timestamp=$(date -u +"%Y_%m_%dT%H_%M_%SZ")
### Change "--autobuild=" to the specific kernel version you need: '6.12.41+deb13-amd64'.
### Change "--autobuild=" to the specific kernel version you need: '6.12.48+deb13-amd64'.
./ciss_live_builder.sh \
--autobuild=6.12.48+deb13-amd64 \
--architecture amd64 \
@@ -155,6 +190,7 @@ jobs:
--root-password-file /opt/config/password.txt \
--ssh-port ${{ secrets.CISS_DLB_SSH_PORT }} \
--ssh-pubkey /opt/config \
--sshfp \
--trixie
- name: 📥 Checking Centurion Cloud for existing LIVE ISOs.