From b4f7e533e544302cdda98f2b440f6cfbf86504c1c5d3ba2210b18ba834926afd Mon Sep 17 00:00:00 2001
From: "Marc S. Weidner" <msw@coresecret.dev>
Date: Wed, 29 Oct 2025 07:17:06 +0100
Subject: [PATCH] V8.13.294.2025.10.28

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
---
 ...er_msw+bot@coreseret.dev_0x8733B021_public.gpg | Bin 0 -> 654 bytes
 ...idner_msw@coresecret.dev_0xE62E84F8_public.gpg | Bin 0 -> 680 bytes
 config/hooks/live/0001_initramfs_modules.chroot   |   8 ++++++++
 lib/lib_lb_config_write_trixie.sh                 |   7 +++++++
 scripts/usr/lib/live/config/.keep                 |  10 ++++++++++
 5 files changed, 25 insertions(+)
 create mode 100644 .pubkey/marc_s_weidner_msw+bot@coreseret.dev_0x8733B021_public.gpg
 create mode 100644 .pubkey/marc_s_weidner_msw@coresecret.dev_0xE62E84F8_public.gpg
 create mode 100644 scripts/usr/lib/live/config/.keep

diff --git a/.pubkey/marc_s_weidner_msw+bot@coreseret.dev_0x8733B021_public.gpg b/.pubkey/marc_s_weidner_msw+bot@coreseret.dev_0x8733B021_public.gpg
new file mode 100644
index 0000000000000000000000000000000000000000000000000000000000000000..fe511157d9845a27682d7e9b6817fe04a3a74541473164234ca1675393c8dc3b
GIT binary patch
literal 654
zcmbPX%#vZwu|<qin~jl$@s>M3BO|+mxMKH`03ko69eX5<3S&3)?!B3DYhmx)@4^wQ
zjZ|$vL~qgYO)N@Q2-Z^wPt8opOD$4x@()q4$t^C|PRcKFNX{=xEly1?N-fb#NiDPM
zn8_k6#=+nyrpU4?srZb^!p*O*%|B6K^JJMtyYU7^Rwj@Gn53CmIXRYQ)v$7Na<DTo
zDKW8$a&dBSGqH#<F*7pBu``J`FmQ1Sz;p$#U}X3kS*56S;?1LV7dg0{VoUoT>uG+l
zTz-Y)kjq``Jz_c&85wqedaT-&%ssE%tLVJI-TvMQxl3*uEdPF{IZLToB;^!O#}!rq
zpwmK>6j}2x9~Sdl`y`1`W%-LUXUjWFPqS}zSbqAR+qHKl9&<Afft`7VwV7jSTZ4*7
z0|OB7GVm3p<~pS3l@_Gy<rk$pr{<NE7G>t=={S2jJ2EibHDEkuoSBd+*7m#VctzFc
zgQXhN??vr8Q+55R=mdwmJ}(p)6uhDn3|rE<ts+G-FDPtU(0}7omXFM2L2m}e<H?^)
z#3koEdvSk4%A6okE<34rp|%?jx3w=~)Dylaz55>Lt`7n6^%JL59Q)n(N_yKfMtf7?
zzT;i83_C2qaVo?Gj??L(jI5wYebg|g^V<B<O;^8is@UB=dFr~b+@uBD7e~+k(v!q?
zGu(}tk%PUXjzt0(9%=-liU$%^$no)c3nRk~)+Sqi(NDs$0@63+S&FKU*osWvt*owe
wm@8R6@*K-%MusWdEVUjRHn?WJTygkb$>uHJ$~U+ytMO#Ju%Yf@ojV5y0C=(ZRsaA1

literal 0
HcmV?d00001

diff --git a/.pubkey/marc_s_weidner_msw@coresecret.dev_0xE62E84F8_public.gpg b/.pubkey/marc_s_weidner_msw@coresecret.dev_0xE62E84F8_public.gpg
new file mode 100644
index 0000000000000000000000000000000000000000000000000000000000000000..f9bd239d9d451b9fc66351e9c1e9b85ae46d8f658d8f16556c7c105f5539bae3
GIT binary patch
literal 680
zcmbPX%#xuKu~dvxn~jl$@s>M3BO|-R`kNCE%(FONwP=k>wD7CN%?!?GCtaPe^gVYg
z2SZK%i9=gdd=rb36@v8?!c#L-@=}WwY;uds9g_2lQj1fQi&9JUQc}z8I%cv6i*YbG
ziYc<R|4~@boayy{hcTmc3)9Sr&-7Y;urh%xW|C%R<>c5P)y>My$-&OVq{PG~%EigS
z&BP+c#LUPf$Ic|)z`(^R0MivVmyuyt;Jk+NgL~J?ow-*Z8r8kRG`RZt+V$nyoM*h2
z*()^fVfbG>e}eV{JL%F7uQ(jHlq&E&<`L=B`etMKUGVzaZ>5tsI=-<A0G(E*q{y0o
z`LLMZ+9yejD$8G-Ia}UYdYXN!!}8Pj+^)Sd@tB)=2<S|6_7>J=j-_o4Dk2RGK)}nu
zSCpFTke*jskgk_sl<u6GS5jJ(nV+ZQ?CI>t%*t3H+h!9TXBVp-?VuNn2$dLcu&4k{
zm^hR1cwV6LsW=hUX96*^<@cTxUl^-owcn}#DAU5(8}=`|elnY@sz`Lgi7Sp=dzMs}
ze2D5_@uxn1?<J8L42&n{ygBo8Mw#O0Lvc1Ickhhxf7`A3_~_a-D#`~$K0g$;G?rW+
z5peD;%e^h8b!U1X#Bk^Z_|%<NIc(0b!vY-JLR{e3o*v4`3X1N(KP*yuN|bp%tlsa~
zcb5BXVa{H~2@hj=GQFnoTRnfN$;`;X-ciRQ0SqxU0+GoBiA>}eOYdX&r%+KFCuq01
z)bUQYvl4gkH<kn52ZcYo2NXoMO13}V{ELxc=k$1SIpJrM%2WMb-d?s!x;R3y<*i=X
O|GA1sCAc@~vjG5=+63eP

literal 0
HcmV?d00001

diff --git a/config/hooks/live/0001_initramfs_modules.chroot b/config/hooks/live/0001_initramfs_modules.chroot
index e2ca7b9..7e19a52 100644
--- a/config/hooks/live/0001_initramfs_modules.chroot
+++ b/config/hooks/live/0001_initramfs_modules.chroot
@@ -441,6 +441,14 @@ for dir in bin usr/bin; do
   ln -sf busybox "${DESTDIR}/${dir}/sleep"
 done
 
+
+### Install PGP Signing Keys
+install -m 0444 /root/.ciss/cdlb/keys/0x8733B021_public.gpg "${DESTDIR}/etc/keys/0x8733B021_public.gpg"
+printf "\e[92mSuccessfully executed: [install -m 0444 /root/.ciss/cdlb/keys/0x8733B021_public.gpg %s/etc/keys/0x8733B021_public.gpg] \n\e[0m" "${DESTDIR}"
+install -m 0444 /root/.ciss/cdlb/keys/0xE62E84F8_public.gpg "${DESTDIR}/etc/keys/0xE62E84F8_public.gpg"
+printf "\e[92mSuccessfully executed: [install -m 0444 /root/.ciss/cdlb/keys/0xE62E84F8_public.gpg %s/etc/keys/0xE62E84F8_public.gpg] \n\e[0m" "${DESTDIR}"
+
+
 printf "\e[92mSuccessfully executed: [0001_initramfs_modules.chroot] \n\e[0m"
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
diff --git a/lib/lib_lb_config_write_trixie.sh b/lib/lib_lb_config_write_trixie.sh
index 1fe4583..265f5d4 100644
--- a/lib/lib_lb_config_write_trixie.sh
+++ b/lib/lib_lb_config_write_trixie.sh
@@ -112,6 +112,13 @@ lb_config_write_trixie() {
   chmod 0755 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/live/boot/0030-verify-checksums"
   chown root:root "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/live/boot/0030-verify-checksums"
 
+
+  ### Installing PGP Public Keys for signature verification.
+  mkdir -p "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.ciss/cdlb/keys"
+  install -m 0444 -o root -g root "${VAR_WORKDIR}/.pubkey/marc_s_weidner_msw+bot@coreseret.dev_0x8733B021_public.gpg" "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.ciss/cdlb/keys/0x8733B021_public.gpg"
+  install -m 0444 -o root -g root "${VAR_WORKDIR}/.pubkey/marc_s_weidner_msw@coresecret.dev_0xE62E84F8_public.gpg" "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.ciss/cdlb/keys/0xE62E84F8_public.gpg"
+
+
   ### https://wiki.debian.org/ReproducibleInstalls/LiveImages
   ### https://reproducible-builds.org/docs/system-images/
   ### https://gitlab.tails.boum.org/tails/tails/-/blob/stable/config/chroot_local-includes/usr/share/tails/build/mksquashfs-excludes
diff --git a/scripts/usr/lib/live/config/.keep b/scripts/usr/lib/live/config/.keep
new file mode 100644
index 0000000..b4349f3
--- /dev/null
+++ b/scripts/usr/lib/live/config/.keep
@@ -0,0 +1,10 @@
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-10-28; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu