V8.13.294.2025.10.28

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

ciss_live_builder.sh

@@ -150,6 +150,7 @@ declare -gx VAR_SETUP="true"
   source_guard "./lib/lib_sanitizer.sh"
   source_guard "./lib/lib_trap_on_err.sh"
   source_guard "./lib/lib_trap_on_exit.sh"
+  source_guard "./lib/lib_update_microcode.sh"
   source_guard "./lib/lib_usage.sh"
 }
 
@@ -246,6 +247,7 @@ check_dhcp
 cdi
 provider_netcup
 note_target
+update_microcode
 
 ### Start the build process
 set +o errtrace

config/hooks/live/0000_basic_chroot_setup.chroot

@@ -198,7 +198,13 @@ generate_ciss_xdg_tmp_sh
 [[ -r /root/ciss_xdg_tmp.sh ]] && . /root/ciss_xdg_tmp.sh
 export DEBIAN_FRONTEND="noninteractive"
 apt-get update -qq
-apt-get install -y --no-install-suggests libpam-systemd amd64-microcode intel-microcode
+apt-get install -y --no-install-suggests libpam-systemd
+
+if [[ -f /root/.architecture ]]; then
+  apt-get install -y --no-install-suggests amd64-microcode intel-microcode
+fi
+
+[[ -f /root/.architecture ]] && rm -f /root/.architecture
 
 mkdir -p /root/.ciss/dlb/{backup,log}
 chmod 0700 /root/.ciss/dlb/{backup,log}

config/package-lists/live.list.amd64.chroot

@@ -9,8 +9,6 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-amd64-microcode
 grub-efi-amd64-signed
-intel-microcode
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

docs/CHANGELOG.md

@@ -14,7 +14,8 @@ include_toc: true
 
 ## V8.13.294.2025.10.28
 * **Added**: [lib_lb_config_write_trixie.sh](../lib/lib_lb_config_write_trixie.sh) + mksquashfs-excludes
-* **Added**: [lib_lb_ciss_upgrades.sh](../lib/lib_ciss_upgrades.sh) + modifies '/usr/lib/live/build/...' scripts
+* **Added**: [lib_ciss_upgrades.sh](../lib/lib_ciss_upgrades.sh) + modifies '/usr/lib/live/build/...' scripts
+* **Added**: [lib_update_microcode.sh](../lib/lib_update_microcode.sh)
 * **Added**: [binary_rootfs.sh](../scripts/usr/lib/live/build/binary_rootfs.sh) + modifies binary_rootfs script
 * **Updated**: [generate_PRIVATE_trixie_1.yaml](../.gitea/workflows/generate_PRIVATE_trixie_1.yaml) + --sshfp
 * **Updated**: [0001_initramfs_modules.chroot](../config/hooks/live/0001_initramfs_modules.chroot) + update_initramfs=all COMPRESSLEVEL=10

lib/lib_update_microcode.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-10-07; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu
+
+#######################################
+# Generates artifact inside the target for microcode updates.
+# Globals:
+#   BASH_SOURCE
+#   VAR_ARCHITECTURE
+#   VAR_HANDLER_BUILD_DIR
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+update_microcode() {
+  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+
+  if [[ "${VAR_ARCHITECTURE,,}" == "amd64" ]]; then
+
+    cat << EOF >| "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.architecture"
+${VAR_ARCHITECTURE,,}
+EOF
+    chmod 0600 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.architecture"
+
+  fi
+
+  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+
+  return 0
+}
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f update_microcode
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh