V9.14.022.2026.06.10: Harden checksum verification fail-closed

config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums

@@ -89,9 +89,20 @@ Verify_checksums() {
 
   _KEYFILE=""
 
+  _MANIFEST_FOUND="false"
+
   _MP=""
 
+  _RETURN_PGP=""
+
+  _RETURN_SHA=""
+
+  _VERIFICATION_EXECUTED="false"
+
+  _VERIFICATION_SUCCEEDED="false"
+
   ### Parse commandline arguments ----------------------------------------------------------------------------------------------
+  # shellcheck disable=SC2154
   for _PARAMETER in ${LIVE_BOOT_CMDLINE}; do
 
     case "${_PARAMETER}" in
@@ -244,10 +255,12 @@ Verify_checksums() {
 
       if [ -e "${_CHECKSUM}" ]; then
 
+        _MANIFEST_FOUND="true"
         log_in "Found: [${_CHECKSUM}] ..."
 
         if [ -e "/usr/bin/${_DIGEST}sum" ]; then
 
+          _VERIFICATION_EXECUTED="true"
           log_in "Found: [/usr/bin/${_DIGEST}sum] ..."
 
           if [ "${LIVE_VERIFY_CHECKSUMS_SIGNATURES}" = "true" ]; then
@@ -279,6 +292,7 @@ Verify_checksums() {
           if grep -v '^#' "${_CHECKSUM}" | LC_ALL=C /usr/bin/"${_DIGEST}"sum -c > "${_CHECKSUM_LOG}" 2>&1; then
 
             _RETURN_SHA="${?}"
+            _VERIFICATION_SUCCEEDED="true"
             cat "${_CHECKSUM_LOG}" > "${_TTY}"
             log_ok "Found: [/usr/bin/${_DIGEST}sum] successful verified: [${_CHECKSUM}]"
 
@@ -313,6 +327,33 @@ Verify_checksums() {
   log_end_msg
   printf "\n"
 
+  if [ "${_MANIFEST_FOUND}" != "true" ]; then
+
+    log_er "No supported checksum manifest found."
+    sleep 8
+    panic  "No supported checksum manifest found."
+    return 1
+
+  fi
+
+  if [ "${_VERIFICATION_EXECUTED}" != "true" ]; then
+
+    log_er "No supported checksum verification tool was available."
+    sleep 8
+    panic  "No supported checksum verification tool was available."
+    return 1
+
+  fi
+
+  if [ "${_VERIFICATION_SUCCEEDED}" != "true" ]; then
+
+    log_er "No supported checksum manifest was verified successfully."
+    sleep 8
+    panic  "No supported checksum manifest was verified successfully."
+    return 1
+
+  fi
+
   case "${_RETURN_PGP},${_RETURN_SHA}" in
 
     "0,0")
@@ -331,18 +372,28 @@ Verify_checksums() {
       log_er "Verification of [GPG signature] file successful, while verification of [sha checksum] file failed."
       sleep 8
       panic  "Verification of [GPG signature] file successful, while verification of [sha checksum] file failed."
+      return 1
       ;;
 
     *",0")
       log_er "Verification of [GPG signature] file failed, while verification of [sha checksum] file successful."
       sleep 8
       panic  "Verification of [GPG signature] file failed, while verification of [sha checksum] file successful."
+      return 1
       ;;
 
     "na,"*)
       log_er "Verification of [sha checksum] file failed."
       sleep 8
       panic  "Verification of [sha checksum] file failed."
+      return 1
+      ;;
+
+    *)
+      log_er "Checksum verification ended in an unsupported state."
+      sleep 8
+      panic  "Checksum verification ended in an unsupported state."
+      return 1
       ;;
 
   esac