V8.13.400.2025.11.08

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

config/includes.chroot/etc/ssh/ssh_known_hosts

@@ -9,7 +9,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-# Version Master V8.13.392.2025.11.07
+# Version Master V8.13.400.2025.11.08
 
 [git.coresecret.dev]:42842 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQA107AVmg1D/jnyXiqbPf38zQRl8s3c+PM1zbfpeQl
 [git.coresecret.dev]:42842 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDYD9ysmMWZlejUnxu0qOzeWcIYezoFLbYdo6ffGUL5kqOBAYb+5CF4bJLUpA93XFYVF+TbrcMV1yJh6JaHFL0VU5CvgAzruCeedx0c4qUV6lWcJUGNk5K0yb9n2Wosdy6F/zTOxL9KXBt/TV+cscsen2Dahvx0ctMKgNbu+vvUcWxHf9lOkbYoF/uA/nW5CVXy5XUPVUDFUhEeKXL85+6gid5AEMfYT8aRl5YDGvo1iMBmBYOljN4S7MnRe14qbAZG0GDGvF22eHbSU2pILcFIjc2Lo/S5Ox/MJpbLAqpFlLPTKgr6F7yVwfNMSNwl05ysUOZfrQKSXzCU6+lfqKYCwemLALyG/n1ernpp7/8W/2RYoz3fd+TQyfhW++rx3yUHpYCkTv9A4LRYZYGSAWKMHSBEYq3EcATQUxQi0xpwmcR+u0uC9F9eta5Bim+sBZD6F2hgPJ5xgYT8LFm880g1YadAwBoD4TAkqSvl+jYW0VA2GH9CknKHJ36gc/X4eeUHDC1Hf/E8M5RBj4D6NuHfeVRik/ahHmoCqKQUW7VU/EBsWFsngDiLEHcV71iMtWiUddWOHwoAPHIzn6p9HTeLCxTwsPMG5UDGK/S9HUozqDXxexRtqbcFa7DWuzRvZ1bcZ2VQsaafuzKCkkc4NjC7h1wssel7q9aeYPFg+1vS6Q==

config/includes.chroot/etc/ssh/sshd_config

@@ -9,7 +9,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-# Version Master V8.13.392.2025.11.07
+# Version Master V8.13.400.2025.11.08
 
 ### https://www.ssh-audit.com/
 ### ssh -Q cipher | cipher-auth | compression | kex | kex-gss | key | key-cert | key-plain | key-sig | mac | protocol-version | sig

config/includes.chroot/etc/sysctl.d/99_local.hardened

@@ -11,7 +11,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-# Version Master V8.13.392.2025.11.07
+# Version Master V8.13.400.2025.11.08
 
 ### https://docs.kernel.org/
 ### https://github.com/a13xp0p0v/kernel-hardening-checker/

config/includes.chroot/preseed/.iso/preseed_hash_generator.sh

@@ -10,7 +10,7 @@
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-declare -gr VERSION="Master V8.13.392.2025.11.07"
+declare -gr VERSION="Master V8.13.400.2025.11.08"
 
 ### VERY EARLY CHECK FOR DEBUGGING
 if [[ $* == *" --debug "* ]]; then

config/includes.chroot/preseed/preseed.cfg

@@ -112,4 +112,4 @@ d-i preseed/late_command string sh /preseed/.ash/3_di_preseed_late_command.sh
 
 # Please consider donating to my work at: https://coresecret.eu/spenden/
 ###########################################################################################
-# Written by: ./preseed_hash_generator.sh Version: Master V8.13.392.2025.11.07 at: 10:18:37.9542
+# Written by: ./preseed_hash_generator.sh Version: Master V8.13.400.2025.11.08 at: 10:18:37.9542

config/includes.chroot/usr/lib/live/boot/0030-verify-checksums

@@ -28,14 +28,24 @@
 #   0 : Successful verification
 #######################################
 Verify_checksums() {
+  printf "\e[95m[INFO] CDLB modified: [/usr/lib/live/boot/0030-verify-checksums] ... \n\e[0m"
+
+  ### Declare variables --------------------------------------------------------------------------------------------------------
   _MOUNTPOINT="${1}"
 
+  _PARAMETER=""
+
   _TTY="/dev/tty8"
 
   LIVE_VERIFY_CHECKSUMS_DIGESTS="${LIVE_VERIFY_CHECKSUMS_DIGESTS:-sha512 sha384 sha256}"
 
   LIVE_VERIFY_CHECKSUMS_SIGNATURES="false"
 
+  _KEYFILE=""
+
+  _MP=""
+
+  ### Parse commandline arguments ----------------------------------------------------------------------------------------------
   for _PARAMETER in ${LIVE_BOOT_CMDLINE}; do
 
     case "${_PARAMETER}" in
@@ -60,6 +70,20 @@ Verify_checksums() {
 
   done
 
+  ### Check GPG pubkey file correct path ---------------------------------------------------------------------------------------
+  for _MP in /lib/live/mount/medium /run/live/medium /cdrom /; do
+
+    if [ -e "${_MP}/0030-verify-checksums.gpg" ]; then
+
+      _KEYFILE="${_MP}/0030-verify-checksums.gpg"
+
+      break
+
+    fi
+
+  done
+
+  ### Check if the function should be skipped ----------------------------------------------------------------------------------
   case "${LIVE_VERIFY_CHECKSUMS}" in
 
     true)
@@ -78,48 +102,58 @@ Verify_checksums() {
   ### CDLB verification of script integrity itself -----------------------------------------------------------------------------
   if [ "${LIVE_VERIFY_CHECKSUMS_SIGNATURES}" = "true" ]; then
 
-    log_begin_msg "Verifying integrity of '0030-verify-checksums' ..."
+    log_begin_msg "Verifying integrity of: [0030-verify-checksums] "
     printf "\n"
+    printf "\e[95m[INFO] Verifying integrity of: [0030-verify-checksums] ... \n\e[0m"
 
-    CDLB_SCRIPT="0030-verify-checksums"
+    _CAND=""
+    CDLB_SCRIPT_SELF=""  CDLB_CMD="" CDLB_COMPUTED="" CDLB_EXPECTED="" CDLB_HASHFILE="" CDLB_SIG_FILE=""
+
+    for _CAND in /scripts/live-bottom/0030-verify-checksums /usr/lib/live/boot/0030-verify-checksums; do
+
+      [ -e "${_CAND}" ] && { CDLB_SCRIPT_SELF="${_CAND}"; break; }
+
+    done
+    [ -n "${CDLB_SCRIPT_SELF}" ] || { echo "cannot locate 0030-verify-checksums"; exit 1; }
+
+    CDLB_CMD="/usr/bin/sha512sum"
     CDLB_SHA="sha512"
-    CDLB_CMD="" CDLB_COMPUTED="" CDLB_EXPECTED="" CDLB_HASHFILE="" CDLB_SIG_FILE=""
 
-    CDLB_HASHFILE="${CDLB_SCRIPT}.${CDLB_SHA}"
+    CDLB_SCRIPT_FILE="${CDLB_SCRIPT_SELF##*/}"
+    CDLB_SCRIPT_PATH="${CDLB_SCRIPT_SELF%/*}"
+    CDLB_SCRIPT_FULL="${CDLB_SCRIPT_PATH%/}/${CDLB_SCRIPT_FILE}"
+    CDLB_HASHFILE="${CDLB_SCRIPT_FILE}.${CDLB_SHA}sum.txt"
     CDLB_SIG_FILE="${CDLB_HASHFILE}.sig"
-    CDLB_CMD="/bin/sha512sum"
 
-    printf "Verifying signature of: [%s]\n" "${CDLB_HASHFILE}"
+    printf "\e[95m[INFO] Verifying signature of: [%s] ... \n\e[0m" "${CDLB_SIG_FILE}"
 
-    if ! /bin/gpgv --keyring 0030-verify-checksums_public.gpg "${CDLB_SIG_FILE}" "${CDLB_HASHFILE}"; then
+    if ! /usr/bin/gpgv --no-default-keyring --keyring "${_KEYFILE}" --status-fd 1 "${CDLB_SIG_FILE}" "${CDLB_HASHFILE}"; then
 
-      printf "[PANIC] Signature verification failed for: [0030-verify-checksums.sha512]\n"
+      printf "\e[91m[FATAL] Verifying signature of: [%s] failed. \n\e[0m" "${CDLB_SIG_FILE}"
       sleep 16
-      # TODO panic  "[PANIC] Signature verification failed for: [0030-verify-checksums.sha512]"
+      # TODO panic "[FATAL] Verifying signature of: [0030-verify-checksums.sha512sum.txt.sig] failed. "
 
     else
 
-      printf "Signature verification successful for: [0030-verify-checksums.sha512]\n"
+      printf "\e[92m[INFO] Verifying signature of: [%s] successful. \n\e[0m" "${CDLB_SIG_FILE}"
 
     fi
 
-    printf "Recomputing hash for: [sha512]\n"
+    printf "\e[95m[INFO] Recomputing hash for: [%s] ... \n\e[0m" "${CDLB_SHA}"
 
-    CDLB_COMPUTED=$("${CDLB_CMD}" "${CDLB_SCRIPT}" | { read -r first _ || exit 1; printf '%s\n' "${first}"; })
+    CDLB_COMPUTED=$("${CDLB_CMD}" "${CDLB_SCRIPT_FULL}" | { read -r first _ || exit 1; printf '%s\n' "${first}"; })
     IFS=' ' read -r CDLB_EXPECTED _ < "${CDLB_HASHFILE}"
 
     if [ "${CDLB_COMPUTED}" != "${CDLB_EXPECTED}" ]; then
 
-      printf "[PANIC] Recomputing hash for: [sha512] failed.\n"
+      printf "\e[91m[FATAL] Recomputing hash for: [%s] failed. \n\e[0m" "${CDLB_SHA}"
       sleep 16
-      # TODO panic  "[PANIC] Recomputing hash for: [sha512] failed."
+      # TODO panic "[FATAL] Recomputing hash for: [sha512] failed."
 
     fi
 
-    printf "Hash verification successful for: [sha512]\n"
-
-    printf "Verification of authenticity and integrity of '0030-verify-checksums' successfully completed. Proceeding."
-
+    printf "\e[92m[INFO] Recomputing hash for: [%s] successful. \n\e[0m" "${CDLB_SHA}"
+    printf "\e[92m[INFO] Verification of authenticity and integrity of [%s] successfully completed. \n\e[0m" "${CDLB_SHA}"
     log_end_msg
     printf "\n"
 
@@ -128,6 +162,7 @@ Verify_checksums() {
   ### Checksum and checksum signature verification -----------------------------------------------------------------------------
   log_begin_msg "Verifying checksums"
   printf "\n"
+  printf "\e[95m[INFO] Verifying checksums ... \n\e[0m"
 
   # shellcheck disable=SC2001
   for _DIGEST in $(echo "${LIVE_VERIFY_CHECKSUMS_DIGESTS}" | sed -e 's|,| |g'); do
@@ -139,24 +174,30 @@ Verify_checksums() {
 
       if [ -e "${_CHECKSUM}" ]; then
 
-        printf "Found [%s] ...\n" "${_CHECKSUM}"
+        printf "\e[95m[INFO] Found [%s] ... \n\e[0m" "${_CHECKSUM}"
 
-        if [ -e "/bin/${_DIGEST}sum" ]; then
+        if [ -e "/usr/bin/${_DIGEST}sum" ]; then
+
+          printf "\e[95m[INFO] Found [%s] ... \n\e[0m" "/usr/bin/${_DIGEST}sum"
 
           if [ "${LIVE_VERIFY_CHECKSUMS_SIGNATURES}" = "true" ]; then
 
-            printf "Checking Signature of [%s] ...\n" "${_CHECKSUM}"
+            printf "\e[95m[INFO] Checking signature of [%s] ... \n\e[0m" "${_CHECKSUM}"
+
             _CHECKSUM_SIGNATURE="${_CHECKSUM}.sig"
-            gpgv --keyring 0030-verify-checksums_public.gpg "${_CHECKSUM_SIGNATURE}" "${_CHECKSUM}"
+
+            /usr/bin/gpgv --no-default-keyring --keyring "${_KEYFILE}" --status-fd 1 "${_CHECKSUM_SIGNATURE}" "${_CHECKSUM}"
             _RETURN_PGP="${?}"
 
+            printf "\e[92m[INFO] Checking signature of [%s] successful. \n\e[0m" "${_CHECKSUM}"
+
           else
 
             _RETURN_PGP="na"
 
           fi
 
-          printf "Checking Hashes of [%s] ...\n" "${_CHECKSUM}"
+          printf "\e[92m[INFO] Found [%s] done. \n\e[0m" "/usr/bin/${_DIGEST}sum"
 
           # shellcheck disable=SC2312
           grep -v '^#' "${_CHECKSUM}" | /bin/"${_DIGEST}"sum -c > "${_TTY}"
@@ -167,7 +208,7 @@ Verify_checksums() {
 
         else
 
-          printf "Not found [%s] ...\n" "/bin/${_DIGEST}sum"
+          printf "\e[93m[WARN] NOT Found [%s]. \n\e[0m" "/usr/bin/${_DIGEST}sum"
 
         fi
 
@@ -178,26 +219,44 @@ Verify_checksums() {
   done
 
   log_end_msg
+  printf "\n"
 
   case "${_RETURN_PGP},${_RETURN_SHA}" in
 
     "0,0")
-      log_success_msg "Verification of signature AND checksum file successful; continuing booting in 8 seconds."
+      printf "\e[92m[INFO] Verification of [GPG signature] and [sha checksum] file successful; continuing booting in 8 seconds. \n\e[0m"
+      printf "\e[92m[INFO] CDLB modified: [%s] done. \n\e[0m" "${CDLB_SCRIPT_FULL}"
       sleep 8
+      log_success_msg "Verification of [GPG signature] and [sha checksum] file successful; continuing booting in 8 seconds."
       return 0
       ;;
 
     "na,0")
-      log_success_msg "Verification of checksum file successful; continuing booting in 8 seconds."
+      printf "\e[92m[INFO] Verification of [sha checksum] file successful; continuing booting in 8 seconds. \n\e[0m"
+      printf "\e[92m[INFO] CDLB modified: [%s] done. \n\e[0m" "${CDLB_SCRIPT_FULL}"
       sleep 8
+      log_success_msg "Verification of [sha checksum] file successful; continuing booting in 8 seconds."
       return 0
       ;;
 
+    "0,"*)
+      printf "\e[91m[FATAL] Verification of [GPG signature] file successful, while verification of [sha checksum] file failed. \n\e[0m"
+      printf "\e[91m[FATAL] CDLB modified: [%s] done. \n\e[0m" "${CDLB_SCRIPT_FULL}"
+      sleep 8
+      panic "Verification of [GPG signature] file successful, while verification of [sha checksum] file failed."
+      ;;
+
     *",0")
-      panic "Verification of signature file failed while verification of checksum file successful."
+      printf "\e[91m[FATAL] Verification of [GPG signature] file failed, while verification of [sha checksum] file successful. \n\e[0m"
+      printf "\e[91m[FATAL] CDLB modified: [%s] done. \n\e[0m" "${CDLB_SCRIPT_FULL}"
+      sleep 8
+      panic "Verification of [GPG signature] file failed, while verification of [sha checksum] file successful."
       ;;
 
     "na,"*)
+      printf "\e[91m[FATAL] Verification of [sha checksum] file failed. \n\e[0m"
+      printf "\e[91m[FATAL] CDLB modified: [%s] done. \n\e[0m" "${CDLB_SCRIPT_FULL}"
+      sleep 8
       panic "Verification of checksum file failed."
       ;;