V8.13.384.2025.11.06

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

lib/lib_arg_parser.sh

@@ -17,6 +17,8 @@ guard_sourcing
 # Globals:
 #   ARY_HANDLER_JUMPHOST
 #   ARY_HANDLER_NETCUP_IPV6
+#   VAR_AGE
+#   VAR_AGE_KEY
 #   VAR_ARCHITECTURE
 #   VAR_BUILD_LOG
 #   VAR_EARLY_DEBUG
@@ -31,6 +33,8 @@ guard_sourcing
 #   VAR_HANDLER_STA
 #   VAR_HASHED_PWD
 #   VAR_ISO8601
+#   VAR_LUKS
+#   VAR_LUKS_KEY
 #   VAR_REIONICE_CLASS
 #   VAR_REIONICE_PRIORITY
 #   VAR_SIGNER
@@ -210,6 +214,22 @@ arg_parser() {
           fi
           ;;
 
+        --key_age=*)
+          # shellcheck disable=SC2034
+          declare -gx VAR_AGE="true"
+          # shellcheck disable=SC2034
+          declare -gx VAR_AGE_KEY="${1#*=}"
+          shift 1
+          ;;
+
+        --key_luks=*)
+          # shellcheck disable=SC2034
+          declare -gx VAR_LUKS="true"
+          # shellcheck disable=SC2034
+          declare -gx VAR_LUKS_KEY="${1#*=}"
+          shift 1
+          ;;
+
         --log-statistics-only)
           if [[ -n "${2-}" && "${2}" != -* ]]; then
             if ! ${VAR_HANDLER_AUTOBUILD}; then boot_screen_cleaner; fi

lib/lib_primordial.sh

@@ -16,6 +16,8 @@ guard_sourcing
 # Integrate primordial SSH identity files.
 # Globals:
 #   BASH_SOURCE
+#   VAR_AGE
+#   VAR_AGE_KEY
 #   VAR_HANDLER_BUILD_DIR
 #   VAR_SSHFP
 #   VAR_TMP_SECRET
@@ -27,6 +29,24 @@ guard_sourcing
 init_primordial() {
   printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
+  ### Check for SOPS AGE key integration ---------------------------------------------------------------------------------------
+  if [[ ! "${VAR_AGE,,}" == "true" ]]; then
+
+    if compgen -G "${VAR_TMP_SECRET}/${VAR_AGE_KEY}" > /dev/null; then
+
+      shred -fzu -n 5 -- "${VAR_TMP_SECRET}/${VAR_AGE_KEY}"
+
+    fi
+
+  else
+
+    install -d -m 0700 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.config/sops/age"
+    install -m 0400 "${VAR_TMP_SECRET}/${VAR_AGE_KEY}" "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.config/sops/age/keys.txt"
+    shred -fzu -n 5 -- "${VAR_TMP_SECRET}/${VAR_AGE_KEY}" 2>/dev/null || rm -f "${VAR_TMP_SECRET}/${VAR_AGE_KEY}"
+
+  fi
+
+  ### Check for SSH CISS and PhysNet primordial-workflow™ integration ----------------------------------------------------------
   if [[ ! "${VAR_SSHFP,,}" == "true" ]]; then
 
     if compgen -G "${VAR_TMP_SECRET}/id*" > /dev/null; then
@@ -53,6 +73,8 @@ init_primordial() {
 
   fi
 
+
+
   printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0

lib/lib_usage.sh

@@ -101,6 +101,16 @@ usage() {
     echo "    addresses and / or CCDIR notation. If provided, than it MUST be a <SPACE> separated list."
     echo "    IPv6 addresses MUST be encapsulated with [], e.g., [1234::abcd]/64."
     echo
+    echo -e "\e[97m  --key_age=* \e[0m"
+    echo "    The SOPS AGE private keyring for decryption operations. Change '*' to your desired SOPS AGE key file."
+    echo "    File MUST be placed in:"
+    echo "    </dev/shm/cdlb_secrets>"
+    echo
+    echo -e "\e[97m  --key_luks=* \e[0m"
+    echo "    The LUKS encryption / decryption passphrase for '/'-fs-encryption. Change '*' to your desired passphrase file."
+    echo "    File MUST be placed in:"
+    echo "    </dev/shm/cdlb_secrets>"
+    echo
     echo -e "\e[97m  --log-statistics-only\e[0m"
     echo "    Provides statistic only after successful building a CISS.debian.live-ISO. While enabling '--log-statistics-only'"
     echo "    the argument '--build-directory' MUST be provided."