msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V8.13.032.2025.10.03
Some checks failed
🔐 Generating a Private Live ISO TRIXIE. / 🔐 Generating a Private Live ISO TRIXIE. (push) Failing after 1m0s
Details
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m23s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-10-03 19:33:22 +01:00
parent 036fefdd3e
commit 720eede478
2 changed files with 23 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitea/trigger/t_generate_PRIVATE_trixie_1.yaml
View File

@@ -10,6 +10,6 @@
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
build: build:
counter: 1024 counter: 1023
version: V8.13.032.2025.10.03 version: V8.13.032.2025.10.03
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml

36
.gitea/workflows/generate_PRIVATE_trixie_1.yaml
View File

@@ -94,9 +94,9 @@ jobs:
git clone --branch "${GITHUB_REF_NAME}" ssh://git@git.coresecret.dev:42842/msw/CISS.debian.live.builder.git . git clone --branch "${GITHUB_REF_NAME}" ssh://git@git.coresecret.dev:42842/msw/CISS.debian.live.builder.git .
git fetch --unshallow || echo "Nothing to fetch - already full clone." git fetch --unshallow || echo "Nothing to fetch - already full clone."
- name: 🔧 Render live hook with secrets. - name: 🔧 Render live hook with secrets.
shell: bash shell: bash
working-directory: ${{ github.workspace }}
env: env:
ED25519_PRIV: ${{ secrets.CISS_DLB_SSH_HOST_ED25519_KEY }} ED25519_PRIV: ${{ secrets.CISS_DLB_SSH_HOST_ED25519_KEY }}
ED25519_PUB: ${{ secrets.CISS_DLB_SSH_HOST_ED25519_KEY_PUB }} ED25519_PUB: ${{ secrets.CISS_DLB_SSH_HOST_ED25519_KEY_PUB }}
@@ -106,28 +106,32 @@ jobs:
set -Ceuo pipefail set -Ceuo pipefail
umask 077 umask 077
tmpl="CISS.debian.live.builder/config/hooks/live/9935_hardening_ssh.chroot.tmpl" REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd -P)"
out="CISS.debian.live.builder/config/hooks/live/9935_hardening_ssh.chroot"
test -f "${tmpl}" TPL="${REPO_ROOT}/config/hooks/live/9935_hardening_ssh.chroot.tmpl"
OUT="${REPO_ROOT}/config/hooks/live/9935_hardening_ssh.chroot"
if [[ ! -f "${TPL}" ]]; then
echo "Template not found: ${TPL}"
echo "::group::Tree of config/hooks/live"
ls -la "${REPO_ROOT}/config/hooks/live" || true
echo "::endgroup::"
exit 2
fi
perl -0777 -pe ' perl -0777 -pe '
BEGIN { BEGIN{
$ed = $ENV{ED25519_PRIV}; $ed=$ENV{ED25519_PRIV}; $edpub=$ENV{ED25519_PUB};
$edpub = $ENV{ED25519_PUB}; $rsa=$ENV{RSA_PRIV}; $rsapub=$ENV{RSA_PUB};
$rsa = $ENV{RSA_PRIV};
$rsapub = $ENV{RSA_PUB};
} }
s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_ED25519_KEY\s*\}\}/$ed/g; s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_ED25519_KEY\s*\}\}/$ed/g;
s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_ED25519_KEY_PUB\s*\}\}/$edpub/g; s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_ED25519_KEY_PUB\s*\}\}/$edpub/g;
s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_RSA_KEY\s*\}\}/$rsa/g; s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_RSA_KEY\s*\}\}/$rsa/g;
s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_RSA_KEY_PUB\s*\}\}/$rsapub/g; s/\{\{\s*secrets\.CISS_DLB_SSH_HOST_RSA_KEY_PUB\s*\}\}/$rsapub/g;
' "$tmpl" >| "$out" ' "${TPL}" >| "{$OUT}"
grep -q "ssh_host_ed25519_key" "${out}" chmod 0755 "${OUT}"
grep -q "ssh_host_rsa_key" "${out}" echo "Hook rendered: ${OUT}"
chmod 0755 "${out}"
- name: 🛠️ Cleaning the workspace. - name: 🛠️ Cleaning the workspace.
shell: bash shell: bash
@@ -191,6 +195,10 @@ jobs:
--sshfp \ --sshfp \
--trixie --trixie
REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd -P)"
OUT="${REPO_ROOT}/config/hooks/live/9935_hardening_ssh.chroot"
rm -f "${OUT}"
- name: 📥 Checking Centurion Cloud for existing LIVE ISOs. - name: 📥 Checking Centurion Cloud for existing LIVE ISOs.
shell: bash shell: bash
env: env: