V8.13.384.2025.11.06

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

lib/lib_primordial.sh

@@ -16,6 +16,8 @@ guard_sourcing
 # Integrate primordial SSH identity files.
 # Globals:
 #   BASH_SOURCE
+#   VAR_AGE
+#   VAR_AGE_KEY
 #   VAR_HANDLER_BUILD_DIR
 #   VAR_SSHFP
 #   VAR_TMP_SECRET
@@ -27,6 +29,24 @@ guard_sourcing
 init_primordial() {
   printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
+  ### Check for SOPS AGE key integration ---------------------------------------------------------------------------------------
+  if [[ ! "${VAR_AGE,,}" == "true" ]]; then
+
+    if compgen -G "${VAR_TMP_SECRET}/${VAR_AGE_KEY}" > /dev/null; then
+
+      shred -fzu -n 5 -- "${VAR_TMP_SECRET}/${VAR_AGE_KEY}"
+
+    fi
+
+  else
+
+    install -d -m 0700 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.config/sops/age"
+    install -m 0400 "${VAR_TMP_SECRET}/${VAR_AGE_KEY}" "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.config/sops/age/keys.txt"
+    shred -fzu -n 5 -- "${VAR_TMP_SECRET}/${VAR_AGE_KEY}" 2>/dev/null || rm -f "${VAR_TMP_SECRET}/${VAR_AGE_KEY}"
+
+  fi
+
+  ### Check for SSH CISS and PhysNet primordial-workflow™ integration ----------------------------------------------------------
   if [[ ! "${VAR_SSHFP,,}" == "true" ]]; then
 
     if compgen -G "${VAR_TMP_SECRET}/id*" > /dev/null; then
@@ -53,6 +73,8 @@ init_primordial() {
 
   fi
 
+
+
   printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0