V8.13.400.2025.11.08

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

config/hooks/live/0000_basic_chroot_setup.chroot

@@ -198,6 +198,7 @@ EOF
 # shellcheck disable=SC2034
 readonly -f generate_ciss_xdg_tmp_sh
 
+### Ensuring XDG compliance: https://specifications.freedesktop.org/basedir/latest/ --------------------------------------------
 generate_ciss_xdg_profile
 generate_ciss_xdg_sh
 generate_ciss_xdg_tmp_sh
@@ -207,6 +208,8 @@ export DEBIAN_FRONTEND="noninteractive" INITRD="No"
 apt-get update -qq
 apt-get install -y --no-install-suggests libpam-systemd
 
+
+### Installing microcode updates -----------------------------------------------------------------------------------------------
 if [[ -f /root/.architecture ]]; then
 
   apt-get install -y --no-install-suggests amd64-microcode intel-microcode
@@ -214,12 +217,7 @@ if [[ -f /root/.architecture ]]; then
 
 fi
 
-
-if [[ -f /root/.architecture ]]; then
-  :
-fi
-
-
+### Prepare environment --------------------------------------------------------------------------------------------------------
 mkdir -p /root/.ciss/cdlb/{backup,log,private_keys}
 chmod 0700 /root/.ciss/cdlb/{backup,log,private_keys}
 
@@ -229,7 +227,7 @@ chmod 0700 /root/git
 mkdir -p /etc/ciss/keys
 chmod 0755 /etc/ciss/keys
 
-### Mask apt show version unit and timer.
+### Mask apt show version unit and timer ---------------------------------------------------------------------------------------
 ln -sf /dev/null /etc/systemd/system/apt-show-versions.timer
 ln -sf /dev/null /etc/systemd/system/apt-show-versions.service
 rm -f /etc/cron.daily/apt-show-versions || true

config/hooks/live/0001_initramfs_modules.chroot

@@ -52,10 +52,9 @@ grep_nic_driver_modules() {
 
   return 0
 }
-
-[[ -r /root/ciss_xdg_tmp.sh ]] && . /root/ciss_xdg_tmp.sh
-export DEBIAN_FRONTEND="noninteractive" INITRD="No"
-apt-get install -y intel-microcode amd64-microcode
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f grep_nic_driver_modules
 
 # shellcheck disable=SC2155
 declare nic_driver="$(grep_nic_driver_modules)" VAR_DATE="$(date +%F)"
@@ -370,87 +369,101 @@ esac
 . /usr/share/initramfs-tools/hook-functions
 
 
-### Ensure directory structure in initramfs
-mkdir -p "${DESTDIR}/etc/ciss/keys"
-mkdir -p "${DESTDIR}/etc/initramfs-tools/conf.d"
-mkdir -p "${DESTDIR}/etc/initramfs-tools/scripts/init-premount"
-mkdir -p "${DESTDIR}/usr/bin"
-mkdir -p "${DESTDIR}/usr/local/bin"
-mkdir -p "${DESTDIR}/usr/sbin"
+### Ensure directory structure in initramfs ------------------------------------------------------------------------------------
+install -d -m 0755  "${DESTDIR}/etc/ciss/keys"
+install -d -m 0755  "${DESTDIR}/etc/initramfs-tools/conf.d"
+install -d -m 0755  "${DESTDIR}/etc/initramfs-tools/scripts/init-premount"
+install -d -m 0755  "${DESTDIR}/usr/bin"
+install -d -m 0755  "${DESTDIR}/usr/local/bin"
+install -d -m 0755  "${DESTDIR}/usr/sbin"
 
 
-### Include bash
+### Include 'bash' -------------------------------------------------------------------------------------------------------------
 copy_exec /usr/bin/bash /usr/bin/bash
 printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/bash /usr/bin/bash] \n\e[0m"
 
 
-### Include blkid
+### Include 'blkid' ------------------------------------------------------------------------------------------------------------
 copy_exec /usr/sbin/blkid /usr/sbin/blkid
 printf "\e[92mSuccessfully executed: [copy_exec /usr/sbin/blkid /usr/sbin/blkid] \n\e[0m"
 
 
-### Include busybox
+### Include 'busybox' ----------------------------------------------------------------------------------------------------------
 copy_exec /usr/bin/busybox /usr/busybox
 printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/busybox /usr/busybox] \n\e[0m"
 
 
-### Include GNU coreutils 'sort' (has -V)
+### Include GNU coreutils 'sort' (has -V) --------------------------------------------------------------------------------------
 copy_exec /usr/bin/sort /usr/bin/sort
 printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/sort /usr/bin/sort] \n\e[0m"
 
 
-### Include gpgv
+### Include 'gpgv' -------------------------------------------------------------------------------------------------------------
 copy_exec /usr/bin/gpgv /usr/bin/gpgv
 printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/gpgv /usr/bin/gpgv] \n\e[0m"
 
 
-### Include lsblk
+### Include 'lsblk' ------------------------------------------------------------------------------------------------------------
 copy_exec /usr/bin/lsblk /usr/bin/lsblk
 printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/lsblk /usr/bin/lsblk] \n\e[0m"
 
 
-### Include mkpasswd
+### Include 'mkpasswd' ---------------------------------------------------------------------------------------------------------
 copy_exec /usr/bin/mkpasswd /usr/mkpasswd
 printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/mkpasswd /usr/mkpasswd] \n\e[0m"
 copy_exec /usr/bin/mkpasswd /usr/bin/mkpasswd
 printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/mkpasswd /usr/bin/mkpasswd] \n\e[0m"
 
 
-### Include udevadm (udev management tool)
+### Include 'udevadm' (udev management tool) -----------------------------------------------------------------------------------
 copy_exec /usr/bin/udevadm /usr/bin/udevadm
 printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/udevadm /usr/bin/udevadm] \n\e[0m"
 
 
-### Include sha384sum, sha512sum
+### Include 'sha384sum' 'sha512sum' --------------------------------------------------------------------------------------------
 copy_exec /usr/bin/sha384sum /usr/bin/sha384sum
 printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/sha384sum /usr/bin/sha384sum ] \n\e[0m"
 copy_exec /usr/bin/sha512sum /usr/bin/sha512sum
 printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/sha512sum /usr/bin/sha512sum] \n\e[0m"
 
 
-### Include tree
+### Include 'tree' -------------------------------------------------------------------------------------------------------------
 copy_exec /usr/bin/tree /usr/bin/tree
 printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/tree /usr/bin/tree] \n\e[0m"
 
 
-### Include whois
+### Include 'whois' ------------------------------------------------------------------------------------------------------------
 copy_exec /usr/bin/whois /usr/bin/whois
 printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/whois /usr/bin/whois] \n\e[0m"
 
 
-### Link busybox applets for compatibility
+### Link busybox applets for compatibility -------------------------------------------------------------------------------------
 for dir in bin usr/bin; do
   ln -sf busybox "${DESTDIR}/${dir}/cat"
   ln -sf busybox "${DESTDIR}/${dir}/sleep"
 done
 
 
-### Install PGP Signing Keys
-install -m 0444 /etc/ciss/keys/0x8733B021_public.gpg "${DESTDIR}/etc/ciss/keys/0x8733B021_public.gpg"
-printf "\e[92mSuccessfully executed: [install -m 0444 /etc/ciss/keys/0x8733B021_public.gpg %s/etc/ciss/keys/0x8733B021_public.gpg] \n\e[0m" "${DESTDIR}"
-install -m 0444 /etc/ciss/keys/0xE62E84F8_public.gpg "${DESTDIR}/etc/ciss/keys/0xE62E84F8_public.gpg"
-printf "\e[92mSuccessfully executed: [install -m 0444 /etc/ciss/keys/0xE62E84F8_public.gpg %s/etc/ciss/keys/0xE62E84F8_public.gpg] \n\e[0m" "${DESTDIR}"
+### Install GPG signing keys ---------------------------------------------------------------------------------------------------
+src_dir="/etc/ciss/keys"
+dst_dir="${DESTDIR}/etc/ciss/keys"
+key=""
 
+if [ -d "${src_dir}" ]; then
+
+    install -d -m 0755 "${dst_dir}"
+
+    for key in "${src_dir}"/*.gpg; do
+
+        [ -e "${key}" ] || continue
+
+        install -m 0444 "${key}" "${dst_dir}/"
+
+        printf '\e[92mSuccessfully executed: [install -m 0444 %s %s]\n\e[0m' "${key}" "${dst_dir}"
+
+    done
+
+fi
 
 printf "\e[92mSuccessfully executed: [ciss_debian_live_builder] \n\e[0m"
 
@@ -459,10 +472,6 @@ EOF
 
 chmod 0755 /etc/initramfs-tools/hooks/ciss_debian_live_builder
 
-# TODO: Move to 9999_zzzz.chroot
-### Regenerate the initramfs for the live system kernel.
-update-initramfs -u -k all -v
-
 printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}"
 
 exit 0

config/hooks/live/9999_zzzz.chroot

@@ -15,10 +15,16 @@ printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 '%s' starting ... \e[0m\n" "
 
 declare var_dm="" var_unit_dir="" var_link="/etc/systemd/system/default.target"
 
-### Regenerate the initramfs for the live system kernel.
+### Remove CDLB artifacts ------------------------------------------------------------------------------------------------------
+rm -f /root/ciss_xdg_tmp.sh
+
+### Securing '/etc/ciss/keys' --------------------------------------------------------------------------------------------------
+find /etc/ciss/keys -type f -exec chmod 0444 {} +
+
+### Regenerate the initramfs for the live system kernel ------------------------------------------------------------------------
 update-initramfs -u -k all -v
 
-### Determine the canonical systemd unit dir inside chroot.
+### Determine the canonical systemd unit dir inside chroot ---------------------------------------------------------------------
 if [[ -d /lib/systemd/system ]]; then
 
   var_unit_dir=/lib/systemd/system
@@ -76,8 +82,6 @@ for var_dm in "${ary_dm_units[@]}"; do
 
 done
 
-rm -f /root/ciss_xdg_tmp.sh
-
 printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}"
 
 exit 0