From 47eaa39e3dbe0488f155443b84ea1ccaf802a4fed7a316babdd77eeea7b6c27f Mon Sep 17 00:00:00 2001
From: "Marc S. Weidner" <msw@coresecret.dev>
Date: Tue, 28 Oct 2025 14:16:22 +0100
Subject: [PATCH] V8.13.294.2025.10.28

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
---
 ciss_live_builder.sh                          |  2 +
 .../hooks/live/0000_basic_chroot_setup.chroot |  8 +++-
 config/package-lists/live.list.amd64.chroot   |  2 -
 docs/CHANGELOG.md                             |  3 +-
 lib/lib_update_microcode.sh                   | 43 +++++++++++++++++++
 5 files changed, 54 insertions(+), 4 deletions(-)
 create mode 100644 lib/lib_update_microcode.sh

diff --git a/ciss_live_builder.sh b/ciss_live_builder.sh
index 0f3bde5..7ae7786 100644
--- a/ciss_live_builder.sh
+++ b/ciss_live_builder.sh
@@ -150,6 +150,7 @@ declare -gx VAR_SETUP="true"
   source_guard "./lib/lib_sanitizer.sh"
   source_guard "./lib/lib_trap_on_err.sh"
   source_guard "./lib/lib_trap_on_exit.sh"
+  source_guard "./lib/lib_update_microcode.sh"
   source_guard "./lib/lib_usage.sh"
 }
 
@@ -246,6 +247,7 @@ check_dhcp
 cdi
 provider_netcup
 note_target
+update_microcode
 
 ### Start the build process
 set +o errtrace
diff --git a/config/hooks/live/0000_basic_chroot_setup.chroot b/config/hooks/live/0000_basic_chroot_setup.chroot
index d1c69be..1d7e990 100644
--- a/config/hooks/live/0000_basic_chroot_setup.chroot
+++ b/config/hooks/live/0000_basic_chroot_setup.chroot
@@ -198,7 +198,13 @@ generate_ciss_xdg_tmp_sh
 [[ -r /root/ciss_xdg_tmp.sh ]] && . /root/ciss_xdg_tmp.sh
 export DEBIAN_FRONTEND="noninteractive"
 apt-get update -qq
-apt-get install -y --no-install-suggests libpam-systemd amd64-microcode intel-microcode
+apt-get install -y --no-install-suggests libpam-systemd
+
+if [[ -f /root/.architecture ]]; then
+  apt-get install -y --no-install-suggests amd64-microcode intel-microcode
+fi
+
+[[ -f /root/.architecture ]] && rm -f /root/.architecture
 
 mkdir -p /root/.ciss/dlb/{backup,log}
 chmod 0700 /root/.ciss/dlb/{backup,log}
diff --git a/config/package-lists/live.list.amd64.chroot b/config/package-lists/live.list.amd64.chroot
index 1f8664b..310e55e 100644
--- a/config/package-lists/live.list.amd64.chroot
+++ b/config/package-lists/live.list.amd64.chroot
@@ -9,8 +9,6 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-amd64-microcode
 grub-efi-amd64-signed
-intel-microcode
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 150546e..b4d148a 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -14,7 +14,8 @@ include_toc: true
 
 ## V8.13.294.2025.10.28
 * **Added**: [lib_lb_config_write_trixie.sh](../lib/lib_lb_config_write_trixie.sh) + mksquashfs-excludes
-* **Added**: [lib_lb_ciss_upgrades.sh](../lib/lib_ciss_upgrades.sh) + modifies '/usr/lib/live/build/...' scripts
+* **Added**: [lib_ciss_upgrades.sh](../lib/lib_ciss_upgrades.sh) + modifies '/usr/lib/live/build/...' scripts
+* **Added**: [lib_update_microcode.sh](../lib/lib_update_microcode.sh)
 * **Added**: [binary_rootfs.sh](../scripts/usr/lib/live/build/binary_rootfs.sh) + modifies binary_rootfs script
 * **Updated**: [generate_PRIVATE_trixie_1.yaml](../.gitea/workflows/generate_PRIVATE_trixie_1.yaml) + --sshfp
 * **Updated**: [0001_initramfs_modules.chroot](../config/hooks/live/0001_initramfs_modules.chroot) + update_initramfs=all COMPRESSLEVEL=10
diff --git a/lib/lib_update_microcode.sh b/lib/lib_update_microcode.sh
new file mode 100644
index 0000000..b4deb50
--- /dev/null
+++ b/lib/lib_update_microcode.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-10-07; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu
+
+#######################################
+# Generates artifact inside the target for microcode updates.
+# Globals:
+#   BASH_SOURCE
+#   VAR_ARCHITECTURE
+#   VAR_HANDLER_BUILD_DIR
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+update_microcode() {
+  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+
+  if [[ "${VAR_ARCHITECTURE,,}" == "amd64" ]]; then
+
+    cat << EOF >| "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.architecture"
+${VAR_ARCHITECTURE,,}
+EOF
+    chmod 0600 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.architecture"
+
+  fi
+
+  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+
+  return 0
+}
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f update_microcode
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh