V8.13.440.2025.11.19

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

config/includes.chroot/etc/initramfs-tools/scripts/live-bottom/0042-ciss-post-decrypt-attest

@@ -178,6 +178,6 @@ fi
 
 eval "${_SAVED_SET_OPTS}"
 
-printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/0042-ciss-post-decrypt-attest]\n\e[0m"
+printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0042-ciss-post-decrypt-attest]\n\e[0m"
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

config/includes.chroot/usr/lib/live/boot/0022-ciss-overlay-tmpfs

@@ -47,6 +47,6 @@ mkdir -p -m 0700 "${UPPER}" "${WORK}"
 
 eval "${_SAVED_SET_OPTS}"
 
-printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/0022-ciss-overlay-tmpfs.sh] \n\e[0m"
+printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0022-ciss-overlay-tmpfs.sh] \n\e[0m"
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash

@@ -37,6 +37,76 @@ ask_pass_console() {
   PASSPHRASE=""
   SAVED_STTY=""
 
+  ### Save current console settings.
+  SAVED_STTY=$(stty -g </dev/console 2>/dev/null || printf '')
+
+  ### Non-canonical mode, no echo, 1 byte at a time.
+  stty -echo -icanon time 0 min 1 </dev/console 2>/dev/null || return 1
+
+  printf '\e[93m[INFO] Enter LUKS passphrase: \e[0m' > /dev/console
+
+  nl=$(printf '\n')
+  cr=$(printf '\r')
+  bs=$(printf '\b')
+  del=$(printf '\177')
+
+  while :; do
+
+    ### Read exactly one byte from the console.
+    c=$(dd bs=1 count=1 2>/dev/null </dev/console)
+
+    ### If nothing read (race), loop again.
+    [ -z "${c}" ] && continue
+
+    case "${c}" in
+
+      "${nl}"|"${cr}")
+        ### Enter: finish input.
+        printf '\n' > /dev/console
+        break
+        ;;
+
+      "${bs}"|"${del}")
+        ### Backspace, delete: delete one character, if available.
+        if [ -n "${PASSPHRASE}" ]; then
+
+          PASSPHRASE=${PASSPHRASE%?}
+          printf '\b \b' > /dev/console
+
+        fi
+        ;;
+
+      *)
+        ### Normal character: append and mask output.
+        PASSPHRASE="${PASSPHRASE}${c}"
+        printf '*' > /dev/console
+        ;;
+
+    esac
+
+  done
+
+  [ -n "${SAVED_STTY}" ] && stty "${SAVED_STTY}" </dev/console 2>/dev/null || :
+
+  printf '%s' "${PASSPHRASE}"
+
+  return 0
+}
+
+#######################################
+# Ask for a passphrase on /dev/console, mask input with '*'.
+# Globals:
+#   None
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#   1: on failure / empty
+#######################################
+ask_pass_console_old() {
+  PASSPHRASE=""
+  SAVED_STTY=""
+
   if command -v stty >/dev/null 2>&1; then
 
     SAVED_STTY="$(stty -g </dev/console 2>/dev/null || printf '')"
@@ -235,7 +305,7 @@ chmod 0600 /lib/cryptsetup/passfifo 2>/dev/null || true
 
     [ -n "${PASS}" ] || continue
 
-    printf "\e[93m[INFO] Trying to unlock via cryptsetup ...\n\e[0m" >/dev/console 2>/dev/null || true
+    printf "\e[93m[INFO] LUKS mapper [%s] trying to unlock via cryptsetup ... \n\e[0m" "${CDLB_MAPPER_DEV}" >/dev/console 2>/dev/null || true
 
     KEYLEN=${#PASS}
 
@@ -246,7 +316,7 @@ chmod 0600 /lib/cryptsetup/passfifo 2>/dev/null || true
 
     if [ -b "${CDLB_MAPPER_DEV}" ]; then
 
-      printf "\e[92m[INFO] LUKS mapper [%s] successfully opened.\n\e[0m" "${CDLB_MAPPER_DEV}" >/dev/console 2>/dev/null || true
+      printf "\e[92m[INFO] LUKS mapper [%s] successfully opened. \n\e[0m" "${CDLB_MAPPER_DEV}" >/dev/console 2>/dev/null || true
       break
 
     fi
@@ -293,7 +363,7 @@ REMAINING="${CDLB_REMOTE_WAIT_SECS}"
 
 if [ ! -b "${CDLB_MAPPER_DEV}" ]; then
 
-  printf "\e[93m[INFO] Waiting up to %s seconds for [%s] to be unlocked ...\n\e[0m" "${REMAINING}" "${CDLB_MAPPER_DEV}"
+  printf "\e[93m[INFO] Waiting up to %s seconds for [%s] to be unlocked ... \n\e[0m" "${REMAINING}" "${CDLB_MAPPER_DEV}"
 
 fi
 
@@ -347,6 +417,6 @@ fi
 
 eval "${_SAVED_SET_OPTS}"
 
-printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/0024-ciss-crypt-squash] \n\e[0m"
+printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0024-ciss-crypt-squash] \n\e[0m"
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl

@@ -34,6 +34,6 @@ echo 2 > /proc/sys/kernel/kptr_restrict 2>/dev/null || true
 
 eval "${_SAVED_SET_OPTS}"
 
-printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/0026-ciss-early-sysctl.sh] \n\e[0m"
+printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0026-ciss-early-sysctl.sh] \n\e[0m"
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

config/includes.chroot/usr/lib/live/boot/9990-main.sh

@@ -252,5 +252,5 @@ Live ()
     cp boot.log "${rootmnt}/var/log/live" 2>/dev/null; \
     cp fsck.log "${rootmnt}/var/log/live" 2>/dev/null )
 
-  printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/9990-main.sh] ... \n\e[0m"
+  printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/9990-main.sh] ... \n\e[0m"
 }

config/includes.chroot/usr/lib/live/boot/9990-overlay.sh

@@ -495,5 +495,5 @@ setup_unionfs ()
     done
   fi
 
-  printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/9990-overlay.sh] ... \n\e[0m"
+  printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/9990-overlay.sh] ... \n\e[0m"
 }

docs/CHANGELOG.md

@@ -18,7 +18,7 @@ include_toc: true
 * **Bugfixes**: [0024-ciss-crypt-squash](../config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash)
 * **Bugfixes**: [0026-ciss-early-sysctl](../config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl)
 * **Bugfixes**: [0030-ciss-verify-checksums](../config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums)
-* **Bugfixes**: [0042-ciss-post-decrypt-attest](../config/includes.chroot/usr/lib/live/boot/0042-ciss-post-decrypt-attest)
+* **Bugfixes**: [0042-ciss-post-decrypt-attest](../config/includes.chroot/etc/initramfs-tools/scripts/live-bottom/0042-ciss-post-decrypt-attest)
 
 ## V8.13.432.2025.11.18
 * **Bugfixes**: [0003_cdi_autostart.chroot](../config/hooks/live/0003_cdi_autostart.chroot)
@@ -34,7 +34,7 @@ include_toc: true
 * **Added**: [0022-ciss-overlay-tmpfs.sh](../config/includes.chroot/usr/lib/live/boot/0022-ciss-overlay-tmpfs) + Pre-create constrained tmpfs for OverlayFS upper/work before live-boot mounts overlay.
 * **Added**: [0024-ciss-crypt-squash](../config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash) + Open ``/live/ciss_rootfs.crypt`` (LUKS) and present its SquashFS as ``/run/live/rootfs``.
 * **Added**: [0026-ciss-early-sysctl.sh](../config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl) + Enforce early sysctls before services start.
-* **Added**: [0042-ciss-post-decrypt-attest](../config/includes.chroot/usr/lib/live/boot/0042-ciss-post-decrypt-attest) + Late rootfs attestation and dmsetup health checking.
+* **Added**: [0042-ciss-post-decrypt-attest](../config/includes.chroot/etc/initramfs-tools/scripts/live-bottom/0042-ciss-post-decrypt-attest) + Late rootfs attestation and dmsetup health checking.
 * **Added**: [MAN_CISS_ISO_BOOT_CHAIN.md](MAN_CISS_ISO_BOOT_CHAIN.md)
 * **Added**: [lib_ciss_signatures.sh](../lib/lib_ciss_signatures.sh) + integrated dynamic GPG FPR injection.
 * **Bugfixes**: [0021_dropbear_initramfs.chroot](../config/hooks/live/0021_dropbear_initramfs.chroot) + mv original files to a safe backup location.