msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V9.14.024.2026.06.11

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2026-06-11 17:11:22 +01:00
parent 9ef535554a
commit 97596fbcba
63 changed files with 767 additions and 200 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/hooks/live/zzzz_ciss_crypt_squash.hook.binary
+126 -15
View File
@@ -1,4 +1,5 @@
#!/bin/bash
# shellcheck disable=SC2154
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-10-11; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
@@ -11,9 +12,10 @@
# SPDX-Security-Contact: security@coresecret.eu
set -Ceuo pipefail
# Final live-build binary hook for encrypted root filesystem packaging. Preallocate a LUKS2 container, formats it with the
# generated build secret, copies the generated filesystem.squashfs into the opened encrypted mapping, then closes the container,
# shreds the temporary LUKS secret, and removes the plaintext SquashFS from the ISO payload.
# Final live-build binary hook for encrypted root filesystem packaging. It creates and signs a deterministic attestation
# manifest for the final filesystem.squashfs byte stream, preallocates a LUKS2 container, formats it with the generated build
# secret, copies the generated filesystem.squashfs into the opened encrypted mapping, then closes the container, shreds the
# temporary LUKS secret, and removes the plaintext SquashFS from the ISO payload.
printf "\e[95m🧪 '%s' starting ... \e[0m\n" "${0}"
@@ -63,12 +65,120 @@ preallocate() {
# shellcheck disable=SC2034
readonly -f preallocate
declare ROOTFS="${VAR_HANDLER_BUILD_DIR}/binary/live/filesystem.squashfs"
declare LUKSFS="${VAR_HANDLER_BUILD_DIR}/binary/live/ciss_rootfs.crypt"
declare KEYFD=""
#######################################
# Create and sign the rootfs attestation manifest for the exact SquashFS payload copied into the LUKS mapper.
# Globals:
# VAR_SIGNING_KEY_FPR
# VAR_SIGNING_KEY_PASSFILE
# VAR_VERIFY_KEYRING
# Arguments:
# 1: Final SquashFS payload file
# 2: Manifest path below binary/live
# Returns:
# 0: on success
# 42: on failure
#######################################
create_attestation() {
declare rootfs_file="$1"
declare rootfs_attestation="$2"
declare rootfs_hash=""
declare rootfs_size=""
rootfs_size="$(stat -c%s -- "${rootfs_file}")"
rootfs_hash="$(sha512sum "${rootfs_file}")"
rootfs_hash="${rootfs_hash%% *}"
# The attested boundary is the final SquashFS byte stream before LUKS wrapping. The boot verifier reads exactly this many
# bytes from the decrypted mapper and intentionally excludes the LUKS allocation slack after the SquashFS payload.
cat << EOF >| "${rootfs_attestation}"
# CISS rootfs attestation manifest v1
# boundary: final filesystem.squashfs byte stream copied into /dev/mapper/crypt_liveiso
# rootfs-size-bytes: ${rootfs_size}
${rootfs_hash} ciss-rootfs.squashfs
EOF
chmod 0444 "${rootfs_attestation}"
gpg --batch --yes --pinentry-mode loopback --passphrase-file "${VAR_SIGNING_KEY_PASSFILE}" --local-user "${VAR_SIGNING_KEY_FPR}" \
--detach-sign --output "${rootfs_attestation}.sig" "${rootfs_attestation}"
chmod 0444 "${rootfs_attestation}.sig"
gpgv --keyring "${VAR_VERIFY_KEYRING}" "${rootfs_attestation}.sig" "${rootfs_attestation}"
printf "\e[92m[INFO] Rootfs attestation manifest created and verified: [%s]. \e[0m\n" "${rootfs_attestation}"
return 0
}
### Prevents accidental 'unset -f'.
# shellcheck disable=SC2034
readonly -f create_attestation
declare LUKSFS="${VAR_HANDLER_BUILD_DIR}/binary/live/ciss_rootfs.crypt"
declare ROOTFS="${VAR_HANDLER_BUILD_DIR}/binary/live/filesystem.squashfs"
declare ROOTFS_ATTESTATION="${VAR_HANDLER_BUILD_DIR}/binary/live/filesystem.squashfs.sha512sum.txt"
declare DM_LAB="crypt_liveiso"
declare DEVMAP="/dev/mapper/${DM_LAB}"
declare LUKS_KEY_FILE="${VAR_TMP_SECRET}/${VAR_LUKS_KEY:-luks.txt}"
declare KEYFD=""
# shellcheck disable=SC2155
declare -i VAR_ROOTFS_SIZE=$(stat -c%s -- "${ROOTFS}")
declare -i VAR_ROOTFS_SIZE="$(stat -c%s -- "${ROOTFS}")"
# shellcheck disable=SC2155
declare VAR_ROOTFS_HASH="$(LC_ALL=C sha512sum "${ROOTFS}")"
declare VAR_ROOTFS_HASH="${VAR_ROOTFS_HASH%% *}"
### Attestation Boundary
# - The attested boundary is the final SquashFS byte stream before LUKS wrapping.
# - The boot verifier reads exactly this many bytes from the decrypted mapper and intentionally excludes the LUKS allocation
# slack after the SquashFS payload.
printf "\e[95m🧪 Attestation of filesystem.squashfs ... \e[0m\n"
cat << EOF >| "${ROOTFS_ATTESTATION}"
# CISS.debian.live.builder Master ${VAR_VERSION}
# Attestation file for filesystem.squashfs Version 1.0.0
# Boundary : Final filesystem.squashfs byte stream copied into /dev/mapper/crypt_liveiso
# Bytes : Final filesystem.squashfs ${VAR_ROOTFS_SIZE}
${VAR_ROOTFS_HASH} filesystem.squashfs
EOF
chmod 0444 "${ROOTFS_ATTESTATION}"
if gpg --batch --yes --pinentry-mode loopback --passphrase-file "${VAR_SIGNING_KEY_PASSFILE}" --local-user "${VAR_SIGNING_KEY_FPR}" \
--detach-sign --output "${ROOTFS_ATTESTATION}.sig" "${ROOTFS_ATTESTATION}"; then
printf "\e[92m✅ [gpg of %s] successful. \e[0m\n" "${ROOTFS_ATTESTATION}"
else
printf "\e[91m❌ [gpg of %s] NOT successful. \e[0m\n" "${ROOTFS_ATTESTATION}"
return 42
fi
chmod 0444 "${ROOTFS_ATTESTATION}.sig"
if gpgv --keyring "${VAR_VERIFY_KEYRING}" "${ROOTFS_ATTESTATION}.sig" "${ROOTFS_ATTESTATION}"; then
printf "\e[92m✅ [gpgv of %s] successful. \e[0m\n" "${ROOTFS_ATTESTATION}.sig"
else
printf "\e[91m❌ [gpgv of %s] NOT successful. \e[0m\n" "${ROOTFS_ATTESTATION}.sig"
return 42
fi
if LC_ALL=C sha512sum -c --strict --quiet "${ROOTFS_ATTESTATION}"; then
printf "\e[92m✅ [LC_ALL=C sha512sum -c --strict --quiet of %s] successful. \e[0m\n" "${ROOTFS_ATTESTATION}"
else
printf "\e[91m❌ [LC_ALL=C sha512sum -c --strict --quiet of %s] NOT successful. \e[0m\n" "${ROOTFS_ATTESTATION}"
return 42
fi
printf "\e[92m✅ Attestation of filesystem.squashfs successful. \e[0m\n"
### Safety margin:
# - LUKS2-Header and Metadata
@@ -82,7 +192,7 @@ declare -i VAR_LUKSFS_SIZE=$(( ( (BASE_SIZE + ALIGN_BYTES - 1) / ALIGN_BYTES ) *
preallocate "${LUKSFS}" "${VAR_LUKSFS_SIZE}"
exec {KEYFD}<"${VAR_TMP_SECRET}/luks.txt"
exec {KEYFD}<"${LUKS_KEY_FILE}"
if [[ "${VAR_CDLB_INSIDE_RUNNER}" == "false" ]]; then
@@ -93,7 +203,7 @@ if [[ "${VAR_CDLB_INSIDE_RUNNER}" == "false" ]]; then
--iter-time 1000 \
--key-file "/proc/$$/fd/${KEYFD}" \
--key-size 512 \
--label crypt_liveiso \
--label "${DM_LAB}" \
--luks2-keyslots-size 16777216 \
--luks2-metadata-size 4194304 \
--pbkdf argon2id \
@@ -108,10 +218,11 @@ elif [[ "${VAR_CDLB_INSIDE_RUNNER}" == "true" ]]; then
cryptsetup luksFormat \
--batch-mode \
--cipher aes-xts-plain64 \
--integrity hmac-sha512 \
--iter-time 1000 \
--key-file "/proc/$$/fd/${KEYFD}" \
--key-size 512 \
--label crypt_liveiso \
--label "${DM_LAB}" \
--luks2-keyslots-size 16777216 \
--luks2-metadata-size 4194304 \
--pbkdf argon2id \
@@ -123,10 +234,10 @@ elif [[ "${VAR_CDLB_INSIDE_RUNNER}" == "true" ]]; then
fi
cryptsetup open --key-file "/proc/$$/fd/${KEYFD}" "${LUKSFS}" crypt_liveiso
cryptsetup open --key-file "/proc/$$/fd/${KEYFD}" "${LUKSFS}" "${DM_LAB}"
# shellcheck disable=SC2155
declare -i LUKS_FREE=$(blockdev --getsize64 /dev/mapper/crypt_liveiso)
declare -i LUKS_FREE=$(blockdev --getsize64 "${DEVMAP}")
declare -i SQUASH_FS="${VAR_ROOTFS_SIZE}"
if (( LUKS_FREE >= SQUASH_FS )); then
@@ -140,13 +251,13 @@ else
fi
dd if="${ROOTFS}" of=/dev/mapper/crypt_liveiso bs=8M status=progress conv=fsync
dd if="${ROOTFS}" of="${DEVMAP}" bs=8M status=progress conv=fsync
sync
cryptsetup close crypt_liveiso
cryptsetup close "${DM_LAB}"
exec {KEYFD}<&-
shred -fzu -n 5 -- "${VAR_TMP_SECRET}/luks.txt"
shred -fzu -n 5 -- "${LUKS_KEY_FILE}"
rm -f -- "${ROOTFS}"