msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V8.13.520.2025.12.02
Some checks failed
💙 Generating a PUBLIC Live ISO. / 💙 Generating a PUBLIC Live ISO. (push) Has been cancelled
Details
🔐 Generating a Private Live ISO TRIXIE. / 🔐 Generating a Private Live ISO TRIXIE. (push) Has been cancelled
Details
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m37s
Details
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Successful in 53s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-12-02 05:42:14 +01:00
parent 123ff669b0
commit 9d11a1bf16
50 changed files with 101 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
config/includes.chroot/etc/ssh/ssh_known_hosts
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.512.2025.11.28
# Version Master V8.13.520.2025.12.02
[git.coresecret.dev]:42842 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQA107AVmg1D/jnyXiqbPf38zQRl8s3c+PM1zbfpeQl
[git.coresecret.dev]:42842 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDYD9ysmMWZlejUnxu0qOzeWcIYezoFLbYdo6ffGUL5kqOBAYb+5CF4bJLUpA93XFYVF+TbrcMV1yJh6JaHFL0VU5CvgAzruCeedx0c4qUV6lWcJUGNk5K0yb9n2Wosdy6F/zTOxL9KXBt/TV+cscsen2Dahvx0ctMKgNbu+vvUcWxHf9lOkbYoF/uA/nW5CVXy5XUPVUDFUhEeKXL85+6gid5AEMfYT8aRl5YDGvo1iMBmBYOljN4S7MnRe14qbAZG0GDGvF22eHbSU2pILcFIjc2Lo/S5Ox/MJpbLAqpFlLPTKgr6F7yVwfNMSNwl05ysUOZfrQKSXzCU6+lfqKYCwemLALyG/n1ernpp7/8W/2RYoz3fd+TQyfhW++rx3yUHpYCkTv9A4LRYZYGSAWKMHSBEYq3EcATQUxQi0xpwmcR+u0uC9F9eta5Bim+sBZD6F2hgPJ5xgYT8LFm880g1YadAwBoD4TAkqSvl+jYW0VA2GH9CknKHJ36gc/X4eeUHDC1Hf/E8M5RBj4D6NuHfeVRik/ahHmoCqKQUW7VU/EBsWFsngDiLEHcV71iMtWiUddWOHwoAPHIzn6p9HTeLCxTwsPMG5UDGK/S9HUozqDXxexRtqbcFa7DWuzRvZ1bcZ2VQsaafuzKCkkc4NjC7h1wssel7q9aeYPFg+1vS6Q==

2
config/includes.chroot/etc/ssh/sshd_config
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.512.2025.11.28
# Version Master V8.13.520.2025.12.02
### https://www.ssh-audit.com/
### ssh -Q cipher | cipher-auth | compression | kex | kex-gss | key | key-cert | key-plain | key-sig | mac | protocol-version | sig

2
config/includes.chroot/etc/sysctl.d/99_local.hardened
View File

@@ -11,7 +11,7 @@
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.512.2025.11.28
# Version Master V8.13.520.2025.12.02
### https://docs.kernel.org/
### https://github.com/a13xp0p0v/kernel-hardening-checker/

2
config/includes.chroot/preseed/.iso/preseed_hash_generator.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
declare -gr VERSION="Master V8.13.512.2025.11.28"
declare -gr VERSION="Master V8.13.520.2025.12.02"
### VERY EARLY CHECK FOR DEBUGGING
if [[ $* == *" --debug "* ]]; then

2
config/includes.chroot/preseed/preseed.cfg
View File

@@ -112,4 +112,4 @@ d-i preseed/late_command string sh /preseed/.ash/3_di_preseed_late_command.sh
# Please consider donating to my work at: https://coresecret.eu/spenden/
###########################################################################################
# Written by: ./preseed_hash_generator.sh Version: Master V8.13.512.2025.11.28 at: 10:18:37.9542
# Written by: ./preseed_hash_generator.sh Version: Master V8.13.520.2025.12.02 at: 10:18:37.9542

6
config/includes.chroot/etc/initramfs-tools/scripts/init-bottom/0042_ciss_post_decrypt_attest.sh → config/includes.chroot/usr/lib/live/boot/0042_ciss_post_decrypt_attest
View File

@@ -15,13 +15,13 @@
# SPDX-Security-Contact: security@coresecret.eu
# Purpose: Late rootfs attestation and dmsetup health checking.
# Phase : bottom (executed by live-boot inside the initramfs).
# Phase : executed by live-boot inside the 9990-main.sh.
_SAVED_SET_OPTS="$(set +o)"
set -eu
printf "\e[95m[INFO] Starting : [/etc/initramfs-tools/scripts/init-bottom/0042_ciss_post_decrypt_attest.sh] \n\e[0m"
printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/0042_ciss_post_decrypt_attest] \n\e[0m"
### Declare variables ----------------------------------------------------------------------------------------------------------
@@ -176,6 +176,6 @@ fi
eval "${_SAVED_SET_OPTS}"
printf "\e[92m[INFO] Successfully applied : [/etc/initramfs-tools/scripts/init-bottom/0042_ciss_post_decrypt_attest.sh] \n\e[0m"
printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0042_ciss_post_decrypt_attest] \n\e[0m"
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

32
config/includes.chroot/usr/lib/live/boot/9990-main.sh
View File

@@ -234,18 +234,20 @@ Live ()
log_end_msg
fi
if [ -L /root/etc/resolv.conf ] ; then
# assume we have resolvconf
DNSFILE="${rootmnt}/etc/resolvconf/resolv.conf.d/base"
else
DNSFILE="${rootmnt}/etc/resolv.conf"
fi
if [ -f /etc/resolv.conf ] && ! grep -E -q -v '^[[:space:]]*(#|$)' "${DNSFILE}"
then
log_begin_msg "Copying /etc/resolv.conf to ${DNSFILE}"
cp -v /etc/resolv.conf "${DNSFILE}"
log_end_msg
fi
### CISS override for systemd-networkd stack ---------------------------------------------------------------------------------
#if [ -L /root/etc/resolv.conf ] ; then
# # assume we have resolvconf
# DNSFILE="${rootmnt}/etc/resolvconf/resolv.conf.d/base"
#else
# DNSFILE="${rootmnt}/etc/resolv.conf"
#fi
#if [ -f /etc/resolv.conf ] && ! grep -E -q -v '^[[:space:]]*(#|$)' "${DNSFILE}"
#then
# log_begin_msg "Copying /etc/resolv.conf to ${DNSFILE}"
# cp -v /etc/resolv.conf "${DNSFILE}"
# log_end_msg
#fi
### CISS override for systemd-networkd stack ---------------------------------------------------------------------------------
if ! [ -d "/lib/live/boot" ]
then
@@ -264,5 +266,11 @@ Live ()
cp boot.log "${rootmnt}/var/log/live" 2>/dev/null; \
cp fsck.log "${rootmnt}/var/log/live" 2>/dev/null )
### CISS override for /usr/lib/live/boot/0042_ciss_post_decrypt_attest -------------------------------------------------------
sleep 3
[ -x /usr/lib/live/boot/0042_ciss_post_decrypt_attest ] && /usr/lib/live/boot/0042_ciss_post_decrypt_attest
### CISS override for /usr/lib/live/boot/0042_ciss_post_decrypt_attest -------------------------------------------------------
printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/9990-main.sh] \n\e[0m"
}

10
config/includes.chroot/usr/lib/systemd/.keep
View File

@@ -1,10 +0,0 @@
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-10-28; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: LicenseRef-CNCL-1.1 OR LicenseRef-CCLA-1.1
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu

19
config/includes.chroot/usr/lib/systemd/system-preset/90-ciss-networkd.preset
View File

@@ -1,19 +0,0 @@
# bashsupport disable=BP5007
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-11-26; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: LicenseRef-CNCL-1.1 OR LicenseRef-CCLA-1.1
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
enable systemd-networkd.service
enable systemd-resolved.service
disable networking.service
disable NetworkManager.service
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf