From 720eede4787a0c1832cea80f67ad19d32d122561da0624db486ba01085bb9606 Mon Sep 17 00:00:00 2001
From: "Marc S. Weidner" <msw@coresecret.dev>
Date: Fri, 3 Oct 2025 19:33:22 +0100
Subject: [PATCH] V8.13.032.2025.10.03

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
---
 .../trigger/t_generate_PRIVATE_trixie_1.yaml  |  2 +-
 .../workflows/generate_PRIVATE_trixie_1.yaml  | 36 +++++++++++--------
 2 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/.gitea/trigger/t_generate_PRIVATE_trixie_1.yaml b/.gitea/trigger/t_generate_PRIVATE_trixie_1.yaml
index 4338d20..ce18224 100644
--- a/.gitea/trigger/t_generate_PRIVATE_trixie_1.yaml
+++ b/.gitea/trigger/t_generate_PRIVATE_trixie_1.yaml
@@ -10,6 +10,6 @@
 # SPDX-Security-Contact: security@coresecret.eu
 
 build:
-  counter: 1024
+  counter: 1023
   version: V8.13.032.2025.10.03
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml
diff --git a/.gitea/workflows/generate_PRIVATE_trixie_1.yaml b/.gitea/workflows/generate_PRIVATE_trixie_1.yaml
index 03702aa..104010f 100644
--- a/.gitea/workflows/generate_PRIVATE_trixie_1.yaml
+++ b/.gitea/workflows/generate_PRIVATE_trixie_1.yaml
@@ -94,9 +94,9 @@ jobs:
           git clone --branch "${GITHUB_REF_NAME}" ssh://git@git.coresecret.dev:42842/msw/CISS.debian.live.builder.git .
           git fetch --unshallow || echo "Nothing to fetch - already full clone."
 
-
       - name: 🔧 Render live hook with secrets.
         shell: bash
+        working-directory: ${{ github.workspace }}
         env:
           ED25519_PRIV: ${{ secrets.CISS_DLB_SSH_HOST_ED25519_KEY }}
           ED25519_PUB:  ${{ secrets.CISS_DLB_SSH_HOST_ED25519_KEY_PUB }}
@@ -106,28 +106,32 @@ jobs:
           set -Ceuo pipefail
           umask 077
 
-          tmpl="CISS.debian.live.builder/config/hooks/live/9935_hardening_ssh.chroot.tmpl"
-          out="CISS.debian.live.builder/config/hooks/live/9935_hardening_ssh.chroot"
+          REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd -P)"
 
-          test -f "${tmpl}"
+          TPL="${REPO_ROOT}/config/hooks/live/9935_hardening_ssh.chroot.tmpl"
+          OUT="${REPO_ROOT}/config/hooks/live/9935_hardening_ssh.chroot"
+
+          if [[ ! -f "${TPL}" ]]; then
+            echo "Template not found: ${TPL}"
+            echo "::group::Tree of config/hooks/live"
+            ls -la "${REPO_ROOT}/config/hooks/live" || true
+            echo "::endgroup::"
+            exit 2
+          fi
 
           perl -0777 -pe '
-            BEGIN {
-              $ed      = $ENV{ED25519_PRIV};
-              $edpub   = $ENV{ED25519_PUB};
-              $rsa     = $ENV{RSA_PRIV};
-              $rsapub  = $ENV{RSA_PUB};
+            BEGIN{
+              $ed=$ENV{ED25519_PRIV}; $edpub=$ENV{ED25519_PUB};
+              $rsa=$ENV{RSA_PRIV};    $rsapub=$ENV{RSA_PUB};
             }
             s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_ED25519_KEY\s*\}\}/$ed/g;
             s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_ED25519_KEY_PUB\s*\}\}/$edpub/g;
             s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_RSA_KEY\s*\}\}/$rsa/g;
             s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_RSA_KEY_PUB\s*\}\}/$rsapub/g;
-          ' "$tmpl" >| "$out"
+          ' "${TPL}" >| "{$OUT}"
 
-          grep -q "ssh_host_ed25519_key" "${out}"
-          grep -q "ssh_host_rsa_key" "${out}"
-
-          chmod 0755 "${out}"
+          chmod 0755 "${OUT}"
+          echo "Hook rendered: ${OUT}"
 
       - name: 🛠️ Cleaning the workspace.
         shell: bash
@@ -191,6 +195,10 @@ jobs:
             --sshfp \
             --trixie
 
+          REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd -P)"
+          OUT="${REPO_ROOT}/config/hooks/live/9935_hardening_ssh.chroot"
+          rm -f "${OUT}"
+
       - name: 📥 Checking Centurion Cloud for existing LIVE ISOs.
         shell: bash
         env: