V8.13.404.2025.11.10

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

config/includes.chroot/etc/initramfs-tools/files/unlock_wrapper.sh

@@ -376,13 +376,13 @@ verify_script() {
 
   for item in "${algo[@]}"; do
 
-    hashfile="${dir}/${script}.${item}"
+    hashfile="${dir}/${script}.${item}sum.txt"
     sigfile="${hashfile}.sig"
     cmd="${item}sum"
 
     color_echo "${MAG}" "🔏 Verifying signature of: [${hashfile}]"
 
-    if ! gpgv --keyring /etc/keys/unlock_wrapper_pubring.gpg "${sigfile}" "${hashfile}"; then
+    if ! gpgv --keyring /etc/ciss/keys/unlock_wrapper_pubring.gpg "${sigfile}" "${hashfile}"; then
 
       color_echo "${RED}" "✘ Signature verification failed for: [${hashfile}]"
       color_echo "${RED}" "✘ System Power Off in 3 seconds."

config/includes.chroot/etc/initramfs-tools/files/unlock_wrapper.sh.sha512

@@ -1 +0,0 @@
-2d90783e0ffba3c6972b3a0d5335cca4a37c03b417f43b62b082a83734d4e4148390ac22509e68d63aaca11baf4fb081747f83347eab08176fb647e5445372f6

config/includes.chroot/etc/initramfs-tools/hooks/9999_ciss_debian_live_builder.sh

@@ -31,8 +31,6 @@ esac
 install -d -m 0755  "${DESTDIR}/etc/ciss/keys"
 install -d -m 0755  "${DESTDIR}/etc/initramfs-tools/conf.d"
 install -d -m 0755  "${DESTDIR}/etc/initramfs-tools/scripts/init-premount"
-# TODO: Refactor with online signing
-install -d -m 0755  "${DESTDIR}/etc/keys"
 install -d -m 0755  "${DESTDIR}/usr/bin"
 install -d -m 0755  "${DESTDIR}/usr/local/bin"
 install -d -m 0755  "${DESTDIR}/usr/sbin"
@@ -129,22 +127,15 @@ fi
 install -m 0444 /etc/dropbear/initramfs/dropbear.conf "${DESTDIR}/etc/dropbear/dropbear.conf"
 printf "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/dropbear.conf %s/etc/dropbear/dropbear.conf] \n\e[0m" "${DESTDIR}"
 
-# TODO: Update the scripts to be usable for upcoming Live ISO encryption
-# TODO: Integrate online signing
 ### Install Dropbear 'cryptroot-unlock'-Wrapper --------------------------------------------------------------------------------
 install -m 0555 /etc/initramfs-tools/files/unlock_wrapper.sh "${DESTDIR}/usr/local/bin/unlock_wrapper.sh"
 printf "\e[92mSuccessfully executed: [install -m 0555 /etc/initramfs-tools/files/unlock_wrapper.sh %s/usr/local/bin/unlock_wrapper.sh] \n\e[0m" "${DESTDIR}"
 
-install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512 "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha512"
-printf "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512 %s/usr/local/bin/unlock_wrapper.sh.sha512] \n\e[0m" "${DESTDIR}"
+install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512sum.txt "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha512sum.txt"
+printf "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512sum.txt %s/usr/local/bin/unlock_wrapper.sh.sha512sum.txt] \n\e[0m" "${DESTDIR}"
 
-install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512.sig "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha512.sig"
-printf "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512.sig %s/usr/local/bin/unlock_wrapper.sh.sha512.sig] \n\e[0m" "${DESTDIR}"
-
-# TODO: Refactor with online signing
-### Install Dropbear GPG Signing Keys ------------------------------------------------------------------------------------------
-install -m 0444 /etc/initramfs-tools/files/unlock_wrapper_pubring.gpg "${DESTDIR}/etc/keys/unlock_wrapper_pubring.gpg"
-printf "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files/unlock_wrapper_pubring.gpg %s/etc/keys/unlock_wrapper_pubring.gpg] \n\e[0m" "${DESTDIR}"
+install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512sum.txt.sig "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha512sum.txt.sig"
+printf "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512sum.txt.sig %s/usr/local/bin/unlock_wrapper.sh.sha512sum.txt.sig] \n\e[0m" "${DESTDIR}"
 
 ### Install Dropbear Banner ----------------------------------------------------------------------------------------------------
 install -m 0444 /etc/banner "${DESTDIR}/etc/dropbear/banner"

config/includes.chroot/usr/lib/live/boot/0030-verify-checksums

@@ -1,5 +1,6 @@
 #!/bin/sh
 # bashsupport disable=BP5007
+# shellcheck disable=SC2249
 # shellcheck shell=sh
 
 # SPDX-Version: 3.0