V8.02.512.2025.05.30

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-05-30 00:28:39 +02:00
parent 2680012395
commit b2282d3475
172 changed files with 14057 additions and 41 deletions
--- a/lib/lib_usage.sh
+++ b/lib/lib_usage.sh
@@ -0,0 +1,141 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024–2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu
+
+#######################################
+# Usage Wrapper CISS.debian.live.builder
+# Globals:
+#   ERR_UNCRITICAL
+# Arguments:
+#   $0: Script name
+#######################################
+usage() {
+  clear
+  cat << EOF
+
+$(echo -e "\e[92mCISS.debian.live.builder\e[0m")
+$(echo -e "\e[92mMaster V8.02.512.2025.05.30\e[0m")
+
+$(echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2025\e[0m")
+$(echo -e "\e[97m(p) Centurion Press, 2024 - 2025\e[0m")
+
+$(echo -e "\e[95mhttps://coresecret.eu/\e[0m")
+
+$(echo -e "\e[97mA lightweight Shell Wrapper for building a hardened Debian Bookworm Live ISO Image.\e[0m")
+
+"${0} <option>", where <option> is one or more of:
+
+  --help, -h
+    What you're looking at.
+
+  --architecture <STRING> one of <amd64 | arm64>
+    A string reflecting the architecture of the Live System.
+    MUST be provided.
+
+  --build-directory </path/to/build_directory>
+    Where the Debian Live Build Image should be generated.
+    MUST be provided.
+
+  --change-splash <STRING> one of <club | hexagon>
+    A string reflecting the GRub Boot Screen Splash you want to use.
+    If omitted defaults to "./.archive/background/club.png".
+
+  --cdi (Experimental Feature)
+    This option generates a boot menu entry to start the forthcoming
+    'CISS.debian.installer', which will be executed after
+    the system has successfully booted up.
+
+  --contact, -c
+    Displays contact information of the author.
+
+  --control <INTEGER>
+    An integer that reflects the version of your Live ISO Image.
+    MUST be provided.
+
+  --debug
+    Enables debug logging for the main program routine. Detailed logging
+    information are written to "/tmp/ciss_live_builder_$$.log"
+
+  --dhcp-centurion
+    If a DHCP lease is provided, the provider's nameserver will be overridden,
+    and only the hardened, privacy-focused Centurion DNS servers will be used:
+    - https://dns01.eddns.eu/
+    - https://dns02.eddns.de/
+
+  --jump-host <IP | IP | ... >
+    Provide up to 10 IPs for /etc/host.allow whitelisting of SSH access.
+    Could be either IPv4 and / or IPv6 addresses and / or CCDIR notation.
+    If provided, than it MUST be a <SPACE> separated list.
+    IPv6 addresses MUST be encapsulated with [], e.g., [1234::abcd/64].
+
+  --log-statistics-only
+    Provides statistic only after successful building a
+    CISS.debian.live-ISO. While enabling "--log-statistics-only"
+    the argument "--build-directory" MUST be provided while
+    all further options MUST be omitted.
+
+  --provider-netcup-ipv6
+    Activates IPv6 support for Netcup Root Server. One unique
+    IPv6 address MUST be provided in this case.
+
+  --renice-priority <PRIORITY>
+    Reset the nice priority value of the script and all its children
+    to the desired PRIORITY. MUST be an integer (between "-19" and 19).
+    Negative (higher) values MUST be enclosed in double quotes '"'.
+
+  --reionice-priority <CLASS> <PRIORITY>
+    Reset the ionice priority value of the script and all its children
+    to the desired CLASS. MUST be an integer:
+    1: realtime
+    2: best-effort
+    3: idle
+    defaults to "2".
+    PRIORITY MUST be an integer:
+    between 0 (highest) and 7 (lowest) priority.
+    defaults to "4".
+    A real-time I/O process can significantly slow down other processes
+    or even cause them to starve if it continuously requests I/O.
+
+  --root-password-file </path/to/password.txt>
+    Password file for 'root', if given, MUST be a string of 20 to 64 characters,
+    and MUST NOT contain the special character '"'.
+    If the argument is omitted, no further login authentication is required for
+    the local console. The root password is hashed with an 16 Byte '/dev/random'
+    generated SALT and SHA512 Hashing function and 8,388,608 rounds. Immediately
+    after Hash generation all Variables containing plain password fragments are
+    deleted. Password file SHOULD be 0400 and root:root and is deleted without
+    further prompt after password hash has been successfully generated via:
+    shred -vfzu 5 -f.
+    No tracing of any plain text password fragment in any debug log.
+
+  --ssh-port <INTEGER>
+    The desired Port SSH should listen to.
+    If not provided defaults to Port 22.
+
+  --ssh-pubkey </path/to/.ssh/>
+    Imports the SSH Public Key(s) from the FILE 'authorized_keys' of the
+    specified PATH into the Live ISO. MUST be provided.
+
+  --version, -v
+    Displays version of ${0}.
+
+$(echo -e "\e[93mNOTES:\e[0m")
+  - You MUST be 'root' to run this script.
+
+$(echo -e "\e[92mContact:\e[0m")
+$(echo -e "\e[95m  - https://coresecret.eu/ \e[0m")
+$(echo -e "\e[95m  - security@coresecret.eu \e[0m")
+$(echo -e "\e[95m    - PGP Key 2D98 07F4 1030 1776 597E BDC9 9F54 8853 35A3 C9AD \e[0m")
+$(echo -e "\e[95m      - https://keys.openpgp.org/vks/v1/by-fingerprint/2D9807F410301776597EBDC99F54885335A3C9AD \e[0m")
+
+EOF
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh