V8.13.132.2025.10.11

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

config/hooks/live/0001_initramfs_modules.chroot

@@ -13,17 +13,6 @@ set -Ceuo pipefail
 
 printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 '%s' starting ... \e[0m\n" "${0}"
 
-#######################################
-# Simple error terminal logger.
-# Arguments:
-#   None
-#######################################
-log(){ printf '[kbd-fix] %s\n' "$*" >&2; }
-
-log "Ensuring required packages…"
-export DEBIAN_FRONTEND=noninteractive
-apt-get install -y --no-install-recommends keyboard-configuration console-setup xkb-data
-
 #######################################
 # Get all NIC drivers of the current Host machine.
 # Globals:
@@ -365,47 +354,6 @@ EOF
 
 chmod 0755 /etc/initramfs-tools/hooks/ciss_debian_live_builder
 
-log "Writing /etc/default/keyboard"
-rm -f /etc/default/keyboard
-cat << 'EOF' >| /etc/default/keyboard
-XKBMODEL="pc105"
-XKBLAYOUT="de"
-XKBVARIANT=""
-XKBOPTIONS=""
-BACKSPACE="guess"
-EOF
-
-### Remove remaps & stale caches.
-rm -f /etc/console-setup/remap.inc /etc/console-setup/*remap* 2>/dev/null || true
-rm -f /etc/console-setup/cached*.kmap.gz 2>/dev/null || true
-
-### Rebuild the cached console keymap (cache used at boot, avoids runtime warnings).
-LANG=C.UTF-8 setupcon --save-only --force --keyboard-only || true
-
-### Validate (do not fail to build on known harmless 'Unknown X keysym' warnings).
-err="$(mktemp)"
-if ! LANG=C.UTF-8 ckbcomp -model pc105 -layout de -variant '' -option '' >/dev/null 2>|"${err}"; then
-
-  printf '[kbd-fix] ERROR: ckbcomp failed hard:\n' >&2
-  sed -n '1,200p' "${err}" >&2
-  exit 127
-
-fi
-
-if grep -q 'Unknown X keysym "dead_belowmacron"' "${err}"; then
-
-  printf '[kbd-fix] WARN: ignoring xkb warning: Unknown X keysym "dead_belowmacron"\n' >&2
-
-fi
-rm -f "${err}"
-
-# Ensure keyboard-setup runs late enough on live systems
-install -d /etc/systemd/system/keyboard-setup.service.d
-cat > /etc/systemd/system/keyboard-setup.service.d/10-after-localfs.conf <<'EOF'
-[Unit]
-After=local-fs.target
-EOF
-
 ### Regenerate the initramfs for the live system kernel
 update-initramfs -u -k all -v
 

config/hooks/live/0005_tmpfile_dublette.chroot

@@ -1,72 +0,0 @@
-#!/bin/bash
-# SPDX-Version: 3.0
-# SPDX-CreationInfo: 2025-10-11; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.live.builder
-# SPDX-Security-Contact: security@coresecret.eu
-set -Ceuo pipefail
-
-printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 '%s' starting ... \e[0m\n" "${0}"
-
-# Purpose: Copy vendor 'legacy.conf' to '/etc/tmpfiles.d' and drop duplicate '/run/lock' lines.
-
-#######################################
-# Simple error terminal logger.
-# Arguments:
-#   None
-#######################################
-log() { printf '[tmpfiles-fix] %s\n' "$*" >&2; }
-
-### Locate vendor 'legacy.conf' (The path can vary).
-declare vendor=""
-
-for p in /usr/lib/tmpfiles.d/legacy.conf /lib/tmpfiles.d/legacy.conf; do
-
-  if [[ -f "${p}" ]]; then vendor="${p}"; break; fi
-
-done
-
-if [[ -z "${vendor}" ]]; then
-  log "WARN: vendor legacy.conf not found; creating a minimal override"
-  install -D -m 0644 /dev/null /etc/tmpfiles.d/legacy.conf
-
-else
-
-  install -D -m 0644 "${vendor}" /etc/tmpfiles.d/legacy.conf
-
-fi
-
-### Deduplicate: keep only the FIRST 'd /run/lock ' definition, drop subsequent ones.
-# shellcheck disable=SC2155
-declare tmpdir="$(mktemp -d)"
-declare out="${tmpdir}/legacy.conf"
-
-awk '
-BEGIN{seen=0}
-{
-  # Preserve everything by default
-  keep=1
-  # Match tmpfiles "d /run/lock ..." (allowing variable spacing and case of directive)
-  if ($1 ~ /^[dD]$/ && $2 == "/run/lock") {
-    if (seen==1) { keep=0 } else { seen=1 }
-  }
-  if (keep) print
-}' /etc/tmpfiles.d/legacy.conf >| "${out}"
-
-### Install the sanitized file atomically.
-install -m 0644 -o root -g root "${out}" /etc/tmpfiles.d/legacy.conf
-rm -rf -- "${tmpdir}"
-
-log "Deduplicated /etc/tmpfiles.d/legacy.conf (kept only first /run/lock entry)."
-
-command -v systemd-tmpfiles >/dev/null 2>&1 && systemd-tmpfiles --create --prefix /run/lock || true
-
-printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}"
-
-exit 0
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

config/hooks/live/9991_file_permissions.chroot

@@ -107,6 +107,8 @@ find /root -type f ! -perm /111 -exec chmod 0600 {} +
 ###    Ownership: UID:GID (do not dereference symlinks; stay on this filesystem)
 find /root -xdev -exec chown -h root:root {} +
 
+rm -f /etc/tmpfiles.d/legacy.conf
+
 printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' successfully applied. \e[0m\n" "${0}"
 
 exit 0

config/hooks/live/9996_auditd.chroot

@@ -389,20 +389,9 @@ cat << EOF >| /etc/systemd/system/audit-rules.service.d/10-ciss.conf
 # SPDX-PackageName: CISS.debian.live.builder
 # SPDX-Security-Contact: security@coresecret.eu
 
-#[Service]
-#ExecStart=
-#ExecStart=/sbin/auditctl -R /etc/audit/audit.rules >/dev/null 2>&1
-
-[Unit]
-After=auditd.service
-ConditionSecurity=audit
-
 [Service]
-Type=oneshot
 ExecStart=
-ExecStartPre=/bin/sh -c '/sbin/auditctl -D >/dev/null 2>&1 || true'
-ExecStart=/sbin/auditctl -R /etc/audit/audit.rules
-RemainAfterExit=yes
+ExecStart=/sbin/auditctl -R /etc/audit/audit.rules >/dev/null 2>&1
 
 EOF