V8.13.404.2025.11.10

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-11-10 11:57:27 +01:00
parent fc263c95e3
commit 6c00891cd4
62 changed files with 1419 additions and 312 deletions
--- a/config/hooks/live/0001_initramfs_modules.chroot
+++ b/config/hooks/live/0001_initramfs_modules.chroot
@@ -1,6 +1,6 @@
 #!/bin/bash
 # SPDX-Version: 3.0
-# SPDX-CreationInfo: 2025-10-11; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-CreationInfo: 2025-11-10; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
 # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
 # SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
@@ -339,138 +339,10 @@ FSTYPE=auto

 EOF

-cat << EOF >| /etc/initramfs-tools/hooks/ciss_debian_live_builder
-#!/bin/sh
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.live.builder
-# SPDX-Security-Contact: security@coresecret.eu
-
-EOF
-
-cat << 'EOF' >> /etc/initramfs-tools/hooks/ciss_debian_live_builder
-set -e
-
-printf "\e[95mStarting: [ciss_debian_live_builder] \n\e[0m"
-
-PREREQ=""
-prereqs() { echo "${PREREQ}"; }
-# shellcheck disable=SC2249
-case "${1}" in
-  prereqs) prereqs; exit 0 ;;
-esac
-
-. /usr/share/initramfs-tools/hook-functions
-
-
-### Ensure directory structure in initramfs ------------------------------------------------------------------------------------
-install -d -m 0755  "${DESTDIR}/etc/ciss/keys"
-install -d -m 0755  "${DESTDIR}/etc/initramfs-tools/conf.d"
-install -d -m 0755  "${DESTDIR}/etc/initramfs-tools/scripts/init-premount"
-install -d -m 0755  "${DESTDIR}/usr/bin"
-install -d -m 0755  "${DESTDIR}/usr/local/bin"
-install -d -m 0755  "${DESTDIR}/usr/sbin"
-
-
-### Include 'bash' -------------------------------------------------------------------------------------------------------------
-copy_exec /usr/bin/bash /usr/bin/bash
-printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/bash /usr/bin/bash] \n\e[0m"
-
-
-### Include 'blkid' ------------------------------------------------------------------------------------------------------------
-copy_exec /usr/sbin/blkid /usr/sbin/blkid
-printf "\e[92mSuccessfully executed: [copy_exec /usr/sbin/blkid /usr/sbin/blkid] \n\e[0m"
-
-
-### Include 'busybox' ----------------------------------------------------------------------------------------------------------
-copy_exec /usr/bin/busybox /usr/busybox
-printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/busybox /usr/busybox] \n\e[0m"
-
-
-### Include GNU coreutils 'sort' (has -V) --------------------------------------------------------------------------------------
-copy_exec /usr/bin/sort /usr/bin/sort
-printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/sort /usr/bin/sort] \n\e[0m"
-
-
-### Include 'gpgv' -------------------------------------------------------------------------------------------------------------
-copy_exec /usr/bin/gpgv /usr/bin/gpgv
-printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/gpgv /usr/bin/gpgv] \n\e[0m"
-
-
-### Include 'lsblk' ------------------------------------------------------------------------------------------------------------
-copy_exec /usr/bin/lsblk /usr/bin/lsblk
-printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/lsblk /usr/bin/lsblk] \n\e[0m"
-
-
-### Include 'mkpasswd' ---------------------------------------------------------------------------------------------------------
-copy_exec /usr/bin/mkpasswd /usr/mkpasswd
-printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/mkpasswd /usr/mkpasswd] \n\e[0m"
-copy_exec /usr/bin/mkpasswd /usr/bin/mkpasswd
-printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/mkpasswd /usr/bin/mkpasswd] \n\e[0m"
-
-
-### Include 'udevadm' (udev management tool) -----------------------------------------------------------------------------------
-copy_exec /usr/bin/udevadm /usr/bin/udevadm
-printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/udevadm /usr/bin/udevadm] \n\e[0m"
-
-
-### Include 'sha384sum' 'sha512sum' --------------------------------------------------------------------------------------------
-copy_exec /usr/bin/sha384sum /usr/bin/sha384sum
-printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/sha384sum /usr/bin/sha384sum ] \n\e[0m"
-copy_exec /usr/bin/sha512sum /usr/bin/sha512sum
-printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/sha512sum /usr/bin/sha512sum] \n\e[0m"
-
-
-### Include 'tree' -------------------------------------------------------------------------------------------------------------
-copy_exec /usr/bin/tree /usr/bin/tree
-printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/tree /usr/bin/tree] \n\e[0m"
-
-
-### Include 'whois' ------------------------------------------------------------------------------------------------------------
-copy_exec /usr/bin/whois /usr/bin/whois
-printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/whois /usr/bin/whois] \n\e[0m"
-
-
-### Link busybox applets for compatibility -------------------------------------------------------------------------------------
-for dir in bin usr/bin; do
-  ln -sf busybox "${DESTDIR}/${dir}/cat"
-  ln -sf busybox "${DESTDIR}/${dir}/sleep"
-done
-
-
-### Install GPG signing keys ---------------------------------------------------------------------------------------------------
-src_dir="/etc/ciss/keys"
-dst_dir="${DESTDIR}/etc/ciss/keys"
-key=""
-
-if [ -d "${src_dir}" ]; then
-
-    install -d -m 0755 "${dst_dir}"
-
-    for key in "${src_dir}"/*.gpg; do
-
-        [ -e "${key}" ] || continue
-
-        install -m 0444 "${key}" "${dst_dir}/"
-
-        printf '\e[92mSuccessfully executed: [install -m 0444 %s %s]\n\e[0m' "${key}" "${dst_dir}"
-
-    done
-
-fi
-
-printf "\e[92mSuccessfully executed: [ciss_debian_live_builder] \n\e[0m"
-
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
-EOF
-
-chmod 0755 /etc/initramfs-tools/hooks/ciss_debian_live_builder
+chmod 0755 /etc/initramfs-tools/hooks/9999_ciss_custom_prompt.sh
+chmod 0755 /etc/initramfs-tools/hooks/9999_ciss_debian_live_builder.sh
+chmod 0755 /etc/initramfs-tools/scripts/init-premount/1000_ciss_fixpath.sh
+chmod 0755 /etc/initramfs-tools/scripts/init-top/0000_ciss_fixpath.sh

 printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}"

--- a/config/hooks/live/0020_dropbear_build.chroot
+++ b/config/hooks/live/0020_dropbear_build.chroot
@@ -36,13 +36,22 @@ cd "${var_build_dir}"
 #  -Wl,-z,relro,-z,now: Enables full RELRO (symbol resolution at program startup)

 # shellcheck disable=SC2016,SC2312
-setsid bash -c '
+if ! setsid bash -c '
    ### Sterile environment for the build-process.
-    export -n SHELLOPTS
+
+    export -n SHELLOPTS || true
+
    set +u
+
    unset PATH_SEPARATOR
    PATH_SEPARATOR=":"
    PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+    if ! command -v musl-gcc >/dev/null 2>&1; then
+      echo "ERROR: musl-gcc not found. Install musl-tools in chroot." >&2
+      exit 1
+    fi
+
    CC=musl-gcc \
      CFLAGS="-Os -fPIE -Wno-undef -fstack-protector-strong -D_FORTIFY_SOURCE=2" \
      LDFLAGS="-static -pie -s -Wl,-z,relro,-z,now" \
@@ -55,6 +64,13 @@ setsid bash -c '
    # shellcheck disable=2312
    make -j"$(nproc)"
  ' >| "${var_logfile}" 2>&1
+then
+
+  printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ Dropbear build failed. See [%s] \e[0m\n" "${var_logfile}" >&2
+  tail -n 42 "${var_logfile}" >&2 || true
+  exit 42
+
+fi

  rm -rf /root/dropbear

--- a/config/hooks/live/0021_dropbear_initramfs.chroot
+++ b/config/hooks/live/0021_dropbear_initramfs.chroot
@@ -1,6 +1,6 @@
 #!/bin/bash
 # SPDX-Version: 3.0
-# SPDX-CreationInfo: 2025-10-11; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-CreationInfo: 2025-11-10; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
 # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
 # SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
@@ -13,60 +13,45 @@ set -Ceuo pipefail

 printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 '%s' starting ... \e[0m\n" "${0}"

+### Declare Arrays, HashMaps, and Variables.
+declare var_logfile="/root/.ciss/cdlb/log/0021_dropbear_initramfs.log"
+
 [[ -r /root/ciss_xdg_tmp.sh ]] && . /root/ciss_xdg_tmp.sh
 export DEBIAN_FRONTEND="noninteractive" INITRD="No"

-### Declare Arrays, HashMaps, and Variables.
-declare     var_file=""
-declare -r  var_logfile="/root/.ciss/cdi/log/4311_dropbear_initramfs.log"
-declare     var_target="${TARGET}"
+apt-get install -y --no-install-recommends --no-install-suggests dropbear-initramfs dropbear-bin 2>&1 | tee -a "${var_logfile}"
+apt-get purge -y dropbear dropbear-run 2>&1 | tee -a "${var_logfile}"
+apt-get install -y --no-install-recommends --no-install-suggests gpgv 2>&1 | tee -a "${var_logfile}"
+apt-mark hold dropbear dropbear-initramfs 2>&1 | tee -a "${var_logfile}"

-### Check for TARGET / RECOVERY.
-[[ "${VAR_RUN_RECOVERY}" == "true" ]] && var_target="${RECOVERY}"
-
-chroot_logger "${var_target}${var_logfile}"
-
-chroot_script "${var_target}" "
-    export INITRD=No
-    [[ -r /root/ciss_xdg_tmp.sh ]] && . /root/ciss_xdg_tmp.sh
-    apt-get install -y --no-install-recommends --no-install-suggests dropbear-initramfs dropbear-bin 2>&1 | tee -a ${var_logfile}
-  "
-
-chroot_script "${var_target}" "
-    export INITRD=No
-    [[ -r /root/ciss_xdg_tmp.sh ]] && . /root/ciss_xdg_tmp.sh
-    apt-get purge -y dropbear dropbear-run || true
-  "
-
-chroot_script "${var_target}" "
-    export INITRD=No
-    [[ -r /root/ciss_xdg_tmp.sh ]] && . /root/ciss_xdg_tmp.sh
-    apt-get install -y --no-install-recommends --no-install-suggests gpgv 2>&1 | tee -a ${var_logfile}
-  "
-
-chroot_script "${var_target}" "
-    export INITRD=No
-    [[ -r /root/ciss_xdg_tmp.sh ]] && . /root/ciss_xdg_tmp.sh
-    apt-mark hold dropbear dropbear-initramfs 2>&1 | tee -a ${var_logfile}
-  "
-
-mv "${var_target}/usr/sbin/dropbear" "${var_target}/usr/sbin/dropbear.trixie"
-install -D -m 0755 -o root -g root "${DIR_TMP}/build/dropbear-2025.88/dropbear" "${var_target}/usr/sbin/"
-do_log "debug" "file_only" "4311() Installation [dropbear] successful."
+mv /usr/share/initramfs-tools/scripts/init-premount/dropbear /usr/share/initramfs-tools/scripts/init-premount/dropbear.trixie
+install -m 0755 -o root -g root /root/dropbear /usr/share/initramfs-tools/scripts/init-premount/dropbear
+rm -f /root/dropbear

+mv /usr/sbin/dropbear /usr/sbin/dropbear.trixie
+install -m 0755 -o root -g root /root/build/dropbear-2025.88/dropbear /usr/sbin/

 for var_file in dbclient dropbearconvert dropbearkey; do

-  mv "${var_target}/usr/bin/${var_file}" "${var_target}/usr/bin/${var_file}.trixie"
-  install -D -m 0755 -o root -g root "${DIR_TMP}/build/dropbear-2025.88/${var_file}" "${var_target}/usr/bin/"
-  do_log "debug" "file_only" "4311() Installation [${var_file}] successful."
+  mv "/usr/bin/${var_file}" "/usr/bin/${var_file}.trixie"
+  install -m 0755 -o root -g root "/root/build/dropbear-2025.88/${var_file}" /usr/bin/

 done

-mkdir -p "${var_target}/etc/initramfs-tools/scripts/init-bottom"
+mkdir -p /etc/initramfs-tools/scripts/init-bottom

-cat << 'EOF' >| "${var_target}/etc/initramfs-tools/scripts/init-bottom/zzzz-dropbear-kill"
+cat << 'EOF' >| /etc/initramfs-tools/scripts/init-bottom/zzzz-dropbear-kill
 #!/bin/sh
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-11-10; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu

 PREREQ=""
 prereqs() { echo "${PREREQ}"; }
@@ -91,12 +76,22 @@ exit 0
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
 EOF

-chmod 0755 "${var_target}/etc/initramfs-tools/scripts/init-bottom/zzzz-dropbear-kill"
+chmod 0755 /etc/initramfs-tools/scripts/init-bottom/zzzz-dropbear-kill
+
+cat << EOF >| /etc/apt/preferences.d/99-mask-dropbear
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-11-10; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu

-insert_header   "${var_target}/etc/apt/preferences.d/99-mask-dropbear"
-insert_comments "${var_target}/etc/apt/preferences.d/99-mask-dropbear"
-cat << 'EOF' >> "${var_target}/etc/apt/preferences.d/99-mask-dropbear"
 # Never install the dropbear daemon package at all.
+
 Package: dropbear
 Pin: release *
 Pin-Priority: -1
@@ -104,10 +99,20 @@ Pin-Priority: -1
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF

-insert_header   "${var_target}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
-insert_comments "${var_target}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
-cat << 'EOF' >> "${var_target}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
+cat << EOF >| /etc/apt/preferences.d/99-mask-dropbear-initramfs
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-11-10; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu
+
 # Keep the currently installed initramfs integration; never upgrade it.
+
 Package: dropbear-initramfs
 Pin: release *
 Pin-Priority: -1
@@ -115,8 +120,7 @@ Pin-Priority: -1
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF

-chroot_script "${var_target}" "systemctl mask dropbear.service dropbear.socket"
-do_log "info" "file_only" "4311() Masked: [dropbear.service dropbear.socket]"
+systemctl mask dropbear.service dropbear.socket

 printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}"

--- a/config/hooks/live/0022_dropbear_setup.chroot
+++ b/config/hooks/live/0022_dropbear_setup.chroot
@@ -0,0 +1,149 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-11-10; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu
+set -Ceuo pipefail
+
+printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 '%s' starting ... \e[0m\n" "${0}"
+
+[[ -r /root/ciss_xdg_tmp.sh ]] && . /root/ciss_xdg_tmp.sh
+export DEBIAN_FRONTEND="noninteractive" INITRD="No"
+
+#######################################
+# Set up the 'dropbear-initramfs' environment.
+# Globals:
+#   None
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+dropbear_setup() {
+  ### Declare Arrays, HashMaps, and Variables.
+  declare network_static_ipv4ntpserver_0="192.53.103.108"
+  # shellcheck disable=SC2155
+  declare user_root_sshpubkey="$(< /root/.ssh/authorized_keys)"
+  declare var_force_command_string='command="/usr/local/bin/unlock_wrapper.sh",no-agent-forwarding,no-port-forwarding,no-X11-forwarding '
+
+  ### Prepare strong dropbear host keys.
+  rm -f /etc/dropbear/initramfs/dropbear*key*
+
+  if [[ -d /root/ssh ]]; then
+
+    dropbearconvert openssh dropbear /root/ssh/ssh_host_ed25519_key     /etc/dropbear/initramfs/dropbear_ed25519_host_key
+    dropbearconvert openssh dropbear /root/ssh/ssh_host_rsa_key         /etc/dropbear/initramfs/dropbear_rsa_host_key
+    dropbearkey -y -f /etc/dropbear/initramfs/dropbear_ed25519_host_key /etc/dropbear/initramfs/dropbear_ed25519_host_key.pub
+    dropbearkey -y -f /etc/dropbear/initramfs/dropbear_rsa_host_key     /etc/dropbear/initramfs/dropbear_rsa_host_key.pub
+
+  else
+
+    # shellcheck disable=SC2312
+    /usr/bin/dropbearkey -t ed25519     -f /etc/dropbear/initramfs/dropbear_ed25519_host_key -C "root@live-$(date -I)"
+
+    # shellcheck disable=SC2312
+    /usr/bin/dropbearkey -t rsa -s 4096 -f /etc/dropbear/initramfs/dropbear_rsa_host_key      -C "root@live-$(date -I)"
+
+  fi
+
+  ### Prepare dropbear authorized_keys.
+  printf "%s\n" "${var_force_command_string}${user_root_sshpubkey}" >| /etc/dropbear/initramfs/authorized_keys
+  chmod 0600 /etc/dropbear/initramfs/authorized_keys
+  install -m 0644 -o root -g root /etc/banner /etc/dropbear/initramfs/banner
+
+  ### "IP=<HOST IP>::<GATEWAY IP>:<SUBNET MASK>:<FQDN>:<NIC>:none:<DNS 0 IP>:<DNS 1 IP>:<NTP IP>"
+  ### "IP=:::::<NIC>:dhcp"
+  printf "IP=::::::dhcp\n" >| /etc/initramfs-tools/conf.d/ip
+
+  ### Generate dropbear configuration file.
+  write_dropbear_conf
+
+  return 0
+}
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f dropbear_setup
+
+#######################################
+# Write '/etc/dropbear/initramfs/dropbear.conf'.
+# Globals:
+#   None
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+write_dropbear_conf() {
+  # shellcheck disable=SC2155
+  declare sshport="$(< /root/sshport)"
+  rm -f /root/sshport
+
+  [[ -z "${sshport:-}" ]] && sshport="2222"
+
+  cat << EOF >| /etc/dropbear/initramfs/dropbear.conf
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-10-11; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu
+
+# Configuration options for the dropbear-initramfs boot scripts.
+# Variable assignment follow shell semantics and escaping/quoting rules.
+# You must run update-initramfs(8) to effect changes to this file (like
+# for other files in the '/etc/dropbear/initramfs' directory).
+
+# Command line options to pass to dropbear(8).
+# Dropbear options for 2025+:
+# -b: Display the contents of bannerfile before user login
+# -E: Log to stderr
+# -I: Idle timeout in seconds
+# -K: Keepalive interval in seconds
+# -p: Specify port (and optionally address)
+# -w: Disable root login (SHOULD NOT be implemented for initramfs)
+DROPBEAR_OPTIONS="-b /etc/dropbear/banner -E -I 300 -K 60 -p ${sshport}"
+
+# On local (non-NFS) mounts, interfaces matching this pattern are
+# brought down before exiting the ramdisk to avoid dirty network
+# configuration in the normal kernel.
+# The special value 'none' keeps all interfaces up and preserves routing
+# tables and addresses.
+#IFDOWN="*"
+
+# On local (non-NFS) mounts, the network stack and dropbear are started
+# asynchronously at init-premount stage.  This value specifies the
+# maximum number of seconds to wait (while the network/dropbear are
+# being configured) at init-bottom stage before terminating dropbear and
+# bringing the network down.
+# If the timeout is too short, and if the boot process is not blocking
+# on user input supplied via SSHd (ie no remote unlocking), then the
+# initrd might pivot to init(1) too early, thereby causing a race
+# condition between network configuration from initramfs vs from the
+# normal system.
+#DROPBEAR_SHUTDOWN_TIMEOUT=60
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
+EOF
+
+  return 0
+}
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f write_dropbear_conf
+
+dropbear_setup
+
+printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}"
+
+exit 0
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh