V8.13.272.2025.10.22

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

config/hooks/live/9998_sources_list_trixie.chroot

@@ -125,10 +125,10 @@ EOF
 fi
 
 apt-get update -qq
-apt-get upgrade -y
-apt-get autoclean -y
-apt-get autopurge -y
-apt-get autoremove -y
+apt-get dist-upgrade -y        # (= apt full-upgrade) allow installs/replacements/removals.
+apt-get autoremove --purge -y  # 'autopurge' == 'autoremove --purge'; don't run both.
+apt-get clean -y               # Stronger than autoclean: removes the entire '.deb'-cache.
+rm -rf /var/lib/apt/lists/*    # shrink image; apt will repopulate on next 'apt update'.
 
 printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}"
 

config/includes.chroot/etc/login.defs

@@ -171,8 +171,6 @@ CHFN_RESTRICT		rwh
 # the PAM modules configuration.
 #
 ENCRYPT_METHOD YESCRYPT
-SHA_CRYPT_MIN_ROUNDS 8388608
-SHA_CRYPT_MAX_ROUNDS 8388608
 
 #
 # Should login be allowed if we can't cd to the home directory?
@@ -206,7 +204,9 @@ NONEXISTENT	/nonexistent
 USERGROUPS_ENAB yes
 
 #
-# Added by CISS.debian.live.builder for redundance
-UMASK 077
+# Added by CISS.debian.live.builder for redundancy
+UMASK 027
+SHA_CRYPT_MIN_ROUNDS 8388608
+SHA_CRYPT_MAX_ROUNDS 8388608
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf

config/package-lists/live.list.amd64.chroot

@@ -8,5 +8,8 @@
 # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
+
+amd64-microcode
 grub-efi-amd64-signed
+
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

config/package-lists/live.list.arm64.chroot

@@ -8,5 +8,7 @@
 # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
+
 grub-efi-arm64-signed
+
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

config/package-lists/live.list.common.chroot

@@ -69,6 +69,7 @@ git
 gnupg
 htop
 iftop
+intel-microcode
 iproute2
 iputils-ping
 jitterentropy-rngd

docs/CHANGELOG.md

@@ -15,6 +15,11 @@ include_toc: true
 ## V8.13.272.2025.10.22
 * **Updated**: [0090_jitterentropy.chroot](../config/hooks/live/0090_jitterentropy.chroot) removed --sp800-90b
 * **Updated**: [9996_auditd.chroot](../config/hooks/live/9996_auditd.chroot) unified auditd configuration, removed success rules
+* **Updated**: [9998_sources_list_trixie.chroot](../config/hooks/live/9998_sources_list_trixie.chroot) + apt-get dist-upgrade -y
+* **Updated**: [login.defs](../config/includes.chroot/etc/login.defs) 
+* **Updated**: [live.list.amd64.chroot](../config/package-lists/live.list.amd64.chroot) + amd64-microcode
+* **Updated**: [live.list.common.chroot](../config/package-lists/live.list.common.chroot) + intel-microcode
+* **Updated**: [9999-cdi-starter](../scripts/9999-cdi-starter) 
 
 ## V8.13.256.2025.10.21
 * **Updated**: [0007_update_logrotate.chroot](../config/hooks/live/0007_update_logrotate.chroot)

scripts/9999-cdi-starter

@@ -74,7 +74,7 @@ main() {
 
   [[ -d "${repo_dir}" ]] && rm -rf "${repo_dir}"
 
-  git clone --depth 1 "${repo_url}" "${repo_dir}"
+  git clone "${repo_url}" "${repo_dir}"
 
   chmod 0700 "${repo_dir}/ciss_debian_installer.sh"