msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V8.13.408.2025.11.13
All checks were successful
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Successful in 1m8s
Details
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m31s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-11-13 06:26:44 +01:00
parent a362db3d78
commit 5f370c2cdb
83 changed files with 1422 additions and 877 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
lib/lib_ciss_upgrades_boot.sh
View File

@@ -1,6 +1,6 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-11-06; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-CreationInfo: 2025-11-12; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
@@ -13,7 +13,10 @@
guard_sourcing || return "${ERR_GUARD_SRCE}"
#######################################
# Integrates primordial SSH identity- and / or ssh_host-files.
# Integrates and generates sha512sum and GPG signatures on CISS specific LIVE boot artifacts:
# - /.ciss/attestation/VAR_SIGNING_KEY_FPR.*
# - /etc/initramfs-tools/files/unlock_wrapper.sh
# - /usr/lib/live/boot/0030-ciss-verify-checksums
# Globals:
# BASH_SOURCE
# VAR_HANDLER_BUILD_DIR
@@ -28,25 +31,30 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
ciss_upgrades_boot() {
printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
### Updates '/usr/lib/live/boot/0030-verify-checksums'.
if [[ ! -f "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/live/boot/0030-verify-checksums" ]]; then
declare -ar _ary_target=(
"/.ciss/attestation/${VAR_SIGNING_KEY_FPR}.gpg"
"/etc/initramfs-tools/files/unlock_wrapper.sh"
"/usr/lib/live/boot/0030-ciss-verify-checksums"
)
install -d -m 0755 -o root -g root "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/live/boot"
declare _target="" target=""
install -m 0755 -o root -g root "${VAR_WORKDIR}/scripts/usr/lib/live/boot/0030-verify-checksums" "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/live/boot/0030-verify-checksums"
for _target in "${_ary_target[@]}"; do
fi
declare target="${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/${_target}"
declare var_sha="${VAR_HANDLER_BUILD_DIR}/config/includes.binary/0030-verify-checksums.sha512sum.txt"
declare var_sig="${VAR_HANDLER_BUILD_DIR}/config/includes.binary/0030-verify-checksums.sha512sum.txt.sig"
declare var_fil="${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/live/boot/0030-verify-checksums"
declare var_prefix="${VAR_HANDLER_BUILD_DIR}/config/includes.chroot"
declare var_sha="${target}sha512sum.txt"
declare var_sig="${var_sig}.sig"
declare var_fil="${target}"
declare var_prefix="${VAR_HANDLER_BUILD_DIR}/config/includes.chroot"
# shellcheck disable=SC2312
sha512sum "${var_fil}" | sed "s|${var_prefix}||" >| "${var_sha}"
# shellcheck disable=SC2312
sha512sum "${var_fil}" | sed "s|${var_prefix}||" >| "${var_sha}"
gpg --batch --yes --pinentry-mode loopback --passphrase-file "${VAR_SIGNING_KEY_PASSFILE}" --local-user "${VAR_SIGNING_KEY_FPR}" \
--detach-sign --output "${var_sig}" "${var_sha}"
gpg --batch --yes --pinentry-mode loopback --passphrase-file "${VAR_SIGNING_KEY_PASSFILE}" --local-user "${VAR_SIGNING_KEY_FPR}" \
--detach-sign --output "${var_sig}" "${var_sha}"
done
printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"