V8.13.272.2025.10.22

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

config/hooks/live/9998_sources_list_trixie.chroot

@@ -125,10 +125,10 @@ EOF
 fi
 
 apt-get update -qq
-apt-get upgrade -y
-apt-get autoclean -y
-apt-get autopurge -y
-apt-get autoremove -y
+apt-get dist-upgrade -y        # (= apt full-upgrade) allow installs/replacements/removals.
+apt-get autoremove --purge -y  # 'autopurge' == 'autoremove --purge'; don't run both.
+apt-get clean -y               # Stronger than autoclean: removes the entire '.deb'-cache.
+rm -rf /var/lib/apt/lists/*    # shrink image; apt will repopulate on next 'apt update'.
 
 printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}"
 

config/includes.chroot/etc/login.defs

@@ -171,8 +171,6 @@ CHFN_RESTRICT		rwh
 # the PAM modules configuration.
 #
 ENCRYPT_METHOD YESCRYPT
-SHA_CRYPT_MIN_ROUNDS 8388608
-SHA_CRYPT_MAX_ROUNDS 8388608
 
 #
 # Should login be allowed if we can't cd to the home directory?
@@ -206,7 +204,9 @@ NONEXISTENT	/nonexistent
 USERGROUPS_ENAB yes
 
 #
-# Added by CISS.debian.live.builder for redundance
-UMASK 077
+# Added by CISS.debian.live.builder for redundancy
+UMASK 027
+SHA_CRYPT_MIN_ROUNDS 8388608
+SHA_CRYPT_MAX_ROUNDS 8388608
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf

config/package-lists/live.list.amd64.chroot

@@ -8,5 +8,8 @@
 # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
+
+amd64-microcode
 grub-efi-amd64-signed
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

config/package-lists/live.list.arm64.chroot

@@ -8,5 +8,7 @@
 # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
+
 grub-efi-arm64-signed
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

config/package-lists/live.list.common.chroot

@@ -69,6 +69,7 @@ git
 gnupg
 htop
 iftop
+intel-microcode
 iproute2
 iputils-ping
 jitterentropy-rngd