V8.13.294.2025.10.28

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

ciss_live_builder.sh

@@ -219,7 +219,7 @@ fi
 
 check_hooks
 hardening_ssh
-#ciss_upgrades
+ciss_upgrades
 lb_config_start
 
 if [[ "${VAR_SUITE}" == "bookworm" ]]; then

config/hooks/live/0000_basic_chroot_setup.chroot

@@ -49,6 +49,9 @@ EOF
 
   return 0
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f generate_ciss_xdg_profile
 
 #######################################
 # Generates '/etc/profile.d/ciss-xdg.sh'
@@ -124,6 +127,9 @@ EOF
 
   return 0
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f generate_ciss_xdg_sh
 
 #######################################
 # Generates '/root/ciss_xdg_tmp.sh'
@@ -181,6 +187,9 @@ EOF
 
   return 0
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f generate_ciss_xdg_tmp_sh
 
 generate_ciss_xdg_profile
 generate_ciss_xdg_sh

config/package-lists/live.list.amd64.chroot

@@ -9,6 +9,8 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
+amd64-microcode
 grub-efi-amd64-signed
+intel-microcode
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

lib/lib_lb_config_write_trixie.sh

@@ -115,10 +115,12 @@ lb_config_write_trixie() {
   ### https://wiki.debian.org/ReproducibleInstalls/LiveImages
   ### https://reproducible-builds.org/docs/system-images/
   ### https://gitlab.tails.boum.org/tails/tails/-/blob/stable/config/chroot_local-includes/usr/share/tails/build/mksquashfs-excludes
-  #mkdir -p "${VAR_HANDLER_BUILD_DIR}/config/rootfs"
-  #cat << 'EOF' >| "${VAR_HANDLER_BUILD_DIR}/config/rootfs/excludes"
-#EOF
-  #chmod 0644 "${VAR_HANDLER_BUILD_DIR}/config/rootfs/excludes"
+  mkdir -p "${VAR_HANDLER_BUILD_DIR}/config/rootfs"
+  cat << 'EOF' >| "${VAR_HANDLER_BUILD_DIR}/config/rootfs/excludes"
+root/.wget-hsts
+tmp/*
+EOF
+  chmod 0644 "${VAR_HANDLER_BUILD_DIR}/config/rootfs/excludes"
 
   printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Writing new config done.\e[0m\n"
 

scripts/9999-cdi-starter

@@ -119,9 +119,12 @@ main() {
   declare    var_log="" var_mode=""
 
   var_log="/root/.ciss/cdi/log/9999-cdi-starter_$(date +"%Y-%m-%d_%H-%M-%S").log"
+  touch "${var_log}"
 
   ### Prepare logging.
+  install -d -m 0700 /root/.ciss/cdi
   install -d -m 0700 /root/.ciss/cdi/log
+
   # shellcheck disable=SC2312
   exec > >(tee -a "${var_log}") 2>&1