V8.13.404.2025.11.10

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

config/hooks/live/0003_cdi_autostart.chroot

@@ -19,14 +19,14 @@ if [[ -f /root/.cdi ]]; then
 [Unit]
 Description=CISS CDI post-boot starter
 Documentation=https://git.coresecret.dev/msw/CISS.debian.live.builder.git
-ConditionPathIsExecutable=/usr/local/sbin/9999-cdi-starter.sh
+ConditionPathIsExecutable=/usr/local/sbin/9999_cdi_starter.sh
 After=live-config.service systemd-user-sessions.service getty.target
 After=network-online.target NetworkManager-wait-online.service systemd-networkd-wait-online.service
 Wants=network-online.target
 
 [Service]
 Type=idle
-ExecStart=/usr/local/sbin/9999-cdi-starter.sh
+ExecStart=/usr/local/sbin/9999_cdi_starter.sh
 TimeoutStartSec=1min
 Nice=5
 IOSchedulingClass=best-effort

config/hooks/live/zzzz_luks_squash.hook.binary

@@ -11,8 +11,122 @@
 # SPDX-Security-Contact: security@coresecret.eu
 set -Ceuo pipefail
 
+__umask=$(umask)
+umask 0077
+
+#######################################
+# Pre allocates space for LUKS container.
+# Globals:
+#   None
+# Arguments:
+#   1: LUKS Container
+#   2: LUKS Container Size
+# Returns:
+#   0: on success
+#   42: on failure
+#######################################
+preallocate() {
+  declare file="$1" size="$2"
+  declare -i blocksize=$((8*1024*1024))
+  declare -i blockcounter=$(( (size + blocksize - 1) / blocksize ))
+
+  if fallocate -l "${size}" -- "${file}" 2>/dev/null; then
+
+    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ [fallocate -l %s -- %s] successful. \e[0m\n" "${size}" "${file}"
+    return 0
+
+  else
+
+    printf "\e[93m++++ ++++ ++++ ++++ ++++ ++++ ++ ⚠️ [fallocate -l %s -- %s] NOT successful. \e[0m\n" "${size}" "${file}"
+
+  fi
+
+  if dd if=/dev/zero of="${file}" bs="${blocksize}" count="${blockcounter}" status=progress conv=fsync; then
+
+    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ [dd if=/dev/zero of=%s bs=%s count=%s status=progress conv=fsync ] successful. \e[0m\n" "${file}" "${blocksize}" "${blockcounter}"
+    return 0
+
+  else
+
+    printf "\e[93m++++ ++++ ++++ ++++ ++++ ++++ ++ ⚠️ [dd if=/dev/zero of=%s bs=%s count=%s status=progress conv=fsync ] NOT successful. \e[0m\n" "${file}" "${blocksize}" "${blockcounter}"
+    return 42
+
+  fi
+}
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f preallocate
+
 printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 '%s' starting ... \e[0m\n" "${0}"
 
+declare ROOTFS="${VAR_HANDLER_BUILD_DIR}/binary/live/filesystem.squashfs"
+declare LUKSFS="${VAR_HANDLER_BUILD_DIR}/binary/live/rootfs.crypt"
+declare KEYFD=""
+
+# shellcheck disable=SC2155
+declare -i SIZE=$(stat -c%s -- "${ROOTFS}")
+
+### Safety margin:
+#   - LUKS2-Header and Metadata
+#   - dm-integrity Overhead (Tags and Journal)
+#   - Filesystem-Slack
+declare -i OVERHEAD_FIXED=$((64 * 1024 * 1024))
+declare -i OVERHEAD_PCT=3
+declare -i ALIGN_BYTES=$(( 2048 * 1024 ))
+declare -i BASE_SIZE=$(( SIZE + OVERHEAD_FIXED + (SIZE * OVERHEAD_PCT / 100) ))
+declare -i LUKSFS_SIZE=$(( ( (BASE_SIZE + ALIGN_BYTES - 1) / ALIGN_BYTES ) * ALIGN_BYTES ))
+
+preallocate "${LUKSFS}" "${LUKSFS_SIZE}"
+
+exec {KEYFD}<"${VAR_TMP_SECRET}/luks.txt"
+
+cryptsetup luksFormat \
+  --batch-mode \
+  --cipher aes-xts-plain64 \
+  --integrity hmac-sha512 \
+  --iter-time 1000 \
+  --key-file "/proc/$$/fd/${KEYFD}" \
+  --key-size 512 \
+  --label crypt_liveiso \
+  --luks2-keyslots-size 16777216 \
+  --luks2-metadata-size 4194304 \
+  --pbkdf argon2id \
+  --sector-size 4096 \
+  --type luks2 \
+  --use-random \
+  --verbose \
+  "${LUKSFS}"
+
+cryptsetup open --key-file "/proc/$$/fd/${KEYFD}" "${LUKSFS}" crypt_liveiso
+
+# shellcheck disable=SC2155
+declare -i LUKS_FREE=$(blockdev --getsize64 /dev/mapper/crypt_liveiso)
+declare -i SQUASH_FS="${SIZE}"
+
+if (( LUKS_FREE >= SQUASH_FS )); then
+
+  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ LUKS_FREE '%s' >= SQUASH_FS '%s' \e[0m\n" "${LUKS_FREE}" "${SQUASH_FS}"
+
+else
+
+  printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ LUKS_FREE '%s' <= SQUASH_FS '%s' \e[0m\n" "${LUKS_FREE}" "${SQUASH_FS}" >&2
+  exit 42
+
+fi
+
+dd if="${ROOTFS}" of=/dev/mapper/crypt_liveiso bs=8M status=progress conv=fsync
+sync
+cryptsetup close crypt_liveiso
+
+exec {KEYFD}<&-
+
+shred -fzu -n 5 -- "${VAR_TMP_SECRET}/luks.txt"
+
+#rm -f -- "${ROOTFS}"
+
+umask "${__umask}"
+__umask=""
+
 printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}"
 
 exit 0

config/includes.chroot/etc/initramfs-tools/files/unlock_wrapper.sh

@@ -98,6 +98,7 @@ extract_nuke_hash() {
 
   for ARG in ${CMDLINE}; do
 
+    # shellcheck disable=SC2249
     case "${ARG,,}" in
 
       nuke=*)
@@ -397,9 +398,10 @@ verify_script() {
 
     color_echo "${MAG}" "🔢 Recomputing Hash: [${item}]"
 
+    declare _=""
     # shellcheck disable=SC2312
     read -r computed _ < <("${cmd}" "${dir}/${script}")
-    read -r expected < "${hashfile}"
+    read -r expected _ < "${hashfile}"
 
     if [[ "${computed}" != "${expected}" ]]; then
 

docs/CHANGELOG.md

@@ -22,6 +22,7 @@ include_toc: true
 * **Added**: [0000_ciss_fixpath.sh](../config/includes.chroot/etc/initramfs-tools/scripts/init-top/0000_ciss_fixpath.sh)
 * **Added**: [dropbear](../config/includes.chroot/usr/share/initramfs-tools/scripts/init-premount/dropbear)
 * **Added**: [MAN_SSH_Host_Key_Policy.md](MAN_SSH_Host_Key_Policy.md)
+* **Added**: [zzzz_luks_squash.hook.binary](../config/hooks/live/zzzz_luks_squash.hook.binary) + Preparing squashfs LUKS encryption
 * **Bugfixes**: [generate_PRIVATE_trixie_0.yaml](../.gitea/workflows/generate_PRIVATE_trixie_0.yaml) + updated: Preparing SSH Setup, SSH Deploy Key, Known Hosts, .config.
 * **Bugfixes**: [generate_PRIVATE_trixie_1.yaml](../.gitea/workflows/generate_PRIVATE_trixie_1.yaml) + updated: Preparing SSH Setup, SSH Deploy Key, Known Hosts, .config.
 * **Bugfixes**: [generate_PUBLIC_iso.yaml](../.gitea/workflows/generate_PUBLIC_iso.yaml) + updated: Preparing SSH Setup, SSH Deploy Key, Known Hosts, .config.

lib/lib_check_secrets.sh

@@ -32,6 +32,7 @@ x_remove() {
     # shellcheck disable=SC2312
     find "${VAR_TMP_SECRET}" -xdev -type f \
       ! -path "${VAR_TMP_SECRET}/signing_key_pass.txt" \
+      ! -path "${VAR_TMP_SECRET}/luks.txt" \
       -print0 \
       | xargs -0 --no-run-if-empty shred -fzu -n 5 --
 

lib/lib_clean_up.sh

@@ -40,6 +40,10 @@ clean_up() {
   shopt -s nullglob dotglob
   shopt -u failglob
 
+  if [[ -e /dev/mapper/crypt_liveiso ]]; then
+    cryptsetup close crypt_liveiso || true
+  fi
+
   rm -f -- "${VAR_KERNEL_INF}"
   rm -f -- "${VAR_KERNEL_SRT}"
   rm -f -- "${VAR_KERNEL_TMP}"