V9.14.024.2026.06.11

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

docs/MAN_CISS_ISO_BOOT_CHAIN.md

@@ -8,13 +8,13 @@ include_toc: true
 **Centurion Intelligence Consulting Agency Information Security Standard**<br>
 *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
 **Master Version**: 9.14<br>
-**Build**: V9.14.022.2026.06.10<br>
+**Build**: V9.14.024.2026.06.11<br>
 
 # 2. CISS.debian.live.builder – Boot & Trust Chain (Technical Documentation)
 
-**Status:** 2025-11-12<br>
+**Status:** 2026-06-10<br>
 **Audience:** CICA CISO, CISS staff, technically proficient administrators<br>
-**Summary:** The **CISS.debian.live.builder** Live-ISO establishes a two-stage verification chain around the live root: an early ISO-edge check (signature and FPR pin) *before* LUKS unlock, and a late root-FS attestation *after* unlock, reinforced by `dm-crypt (AES-XTS)` and `dm-integrity (HMAC-SHA-512)`. UEFI Secure Boot can use either the default Microsoft/Debian shim chain, or a CISS-signed UKI chain for systems that trust the CISS Secure Boot key material.<br>
+**Summary:** The **CISS.debian.live.builder** Live-ISO establishes a two-stage verification chain around the live root: an early ISO-edge check (signature and FPR pin) *before* LUKS unlock, and a late root-FS attestation *after* unlock that verifies the exact final SquashFS payload bytes copied into the decrypted LUKS mapper, reinforced by `dm-crypt (AES-XTS)` and `dm-integrity (HMAC-SHA-512)`. UEFI Secure Boot can use either the default Microsoft/Debian shim chain, or a CISS-signed UKI chain for systems that trust the CISS Secure Boot key material.<br>
 
 # 3. Overview
 
@@ -22,7 +22,7 @@ include_toc: true
 * **Integrity & authenticity verification:**
 
   1. **Early:** Verify `sha512sum.txt` at the ISO edge using `gpgv` and FPR pin.
-  2. **Late:** Verify an attestation hash list inside the decrypted root FS using `gpgv` and FPR pin.
+  2. **Late:** Verify the external rootfs attestation manifest using `gpgv` and FPR pin, then verify the exact SquashFS payload bytes from the decrypted mapper with `sha512sum -c`.
 
 * **Storage-level AEAD (functional):** `dm-crypt` (AES-XTS-512) and `dm-integrity` (HMAC-SHA-512, 4 KiB).
 * **Remotely unlock:** CISS hardened and build dropbear, modern primitives only, no passwords, no agent/forwarding.
@@ -97,7 +97,7 @@ flowchart TD
     LUKS e14@--> ROOT["Assemble RootFS OverlayFS"];
     ROOT e15@--> 0126["Executing 0026-ciss: Hardening early sysctls"];
     0126 e16@--> 0130["Executing 0030-ciss: Verification of authenticity and integrity via embedded and pinned GPG of ISO edge"];
-    0130 e17@--> |SUCCESSFUL| 0142["Executing 0042-ciss: Attestation of RootFS"];
+    0130 e17@--> |SUCCESSFUL| 0142["Executing 0042-ciss: Attestation of RootFS SquashFS payload"];
     0142 e18@--> 0145["init-bottom: stop CISS.hardened dropbear, tear down initramfs net"];
     0145 e19@--> 9050["Switching root (run-init / pivot_root)"];
     9050 e20@--> 9010["Starting /sbin/init -> systemd"];
@@ -185,30 +185,34 @@ cryptsetup luksFormat \
 **Core call (initramfs):**
 
 ```sh
-/usr/bin/gpgv --no-default-keyring --keyring "$KEYFILE" --status-fd 1 --verify sha512sum.txt.sig sha512sum.txt
+/usr/bin/gpgv --keyring "$KEYFILE" --status-fd 1 sha512sum.txt.sig sha512sum.txt
 # parse [GNUPG:] VALIDSIG ... <FPR> ...
 ```
 
 # 9. Late Root-FS Attestation and dmsetup Health (CISS hook 0042_ciss_post_decrypt_attest, called by 9990-overlay.sh)
 
-**Goal:** After LUKS unlock, validate the **decrypted** contents and the **actual** mapping topology.
+**Goal:** After LUKS unlocked, validate the **decrypted** rootfs payload selected at build time and the **actual** mapping topology.
 
-* **Attestation files:** `/root/.ciss/attestation/<FPR>.sha512sum.txt[.sig]`
+* **Attested boundary:** the final `binary/live/filesystem.squashfs` byte stream, immediately before it is copied into `/dev/mapper/crypt_liveiso` by `zzzz_ciss_crypt_squash.hook.binary`.
+* **Runtime verification boundary:** the first `rootfs-size-bytes` bytes read from the decrypted mapper. Any LUKS allocation slack after the SquashFS payload is intentionally excluded.
+* **Attestation files:** `/run/live/medium/live/ciss_rootfs.sha512sum.txt[.sig]`
 * **Key source:** `/etc/ciss/keys/*.gpg` (accepted only if FPR == build-pin)
 
 **Core calls (initramfs):**
 
 ```sh
 # 1) Signature and FPR pin (no agent)
-/usr/bin/gpgv --no-default-keyring --keyring "$KEYFILE" --status-fd 1 --verify "$SIG" "$DATA"
+/usr/bin/gpgv --keyring "${KEYFILE}" --status-fd 1 "${SIG}" "${DATA}"
 
-# 2) Optional: Content hash verification
-( cd "$ROOTMP" && /usr/bin/sha512sum -c --strict --quiet "$DATA" )
+# 2) Mandatory content hash verification
+dd if="${CDLB_MAPPER_DEV}" ... | /usr/bin/sha512sum -c /run/ciss-rootfs-attestation.sha512sum
 ```
 
 # 10. Failure Policy (fail-closed, deterministic)
 
-* **Abort** on: missing `VALIDSIG`, FPR mismatch, missing key / signature.
+* **Abort** on: missing checksum manifest, unsupported checksum manifest/tool state, failed checksum, empty checksum manifest, missing `VALIDSIG`, FPR mismatch, missing key/signature, malformed rootfs attestation manifest, or rootfs payload hash mismatch.
+* A signed rootfs manifest alone is not sufficient. Boot continues only after the manifest signature/FPR, and the decrypted SquashFS payload bytes both verify successfully.
+* `dm-integrity` protects the opened LUKS mapping against sector corruption or tampering under the LUKS key, but it is not treated as origin authenticity. Origin authenticity is provided by the signed rootfs attestation manifest and pinned signer fingerprint.
 
 # 11. CISS hardened and built dropbear
 
@@ -261,8 +265,8 @@ flowchart TD
     E e04@--> F["Mounting RootFS"];
     F e05@--> G["0030 verification of authenticity and integrity via embedded and pinned GPG of ISO edge"];
     G e06@-->|SUCCESSFUL| H["ISO edge verified"];
-    H e07@--> I["0042 post-decrypt-attestation of RootFS"];
-    I e08@-->|SUCCESSFUL| J["RootFS attestation successful"];
+    H e07@--> I["0042 post-decrypt-attestation of RootFS SquashFS payload"];
+    I e08@-->|SUCCESSFUL| J["RootFS SquashFS payload attestation successful"];
     e02@{ animation: fast }
     e03@{ animation: fast }
     e04@{ animation: fast }