msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V8.13.440.2025.11.19
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m2s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-11-23 14:55:25 +00:00
parent 88be2bd10e
commit ea7dd1e71d
8 changed files with 97 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
config/includes.chroot/usr/lib/live/boot/0042-ciss-post-decrypt-attest → config/includes.chroot/etc/initramfs-tools/scripts/live-bottom/0042-ciss-post-decrypt-attest
View File

@@ -21,7 +21,7 @@ _SAVED_SET_OPTS="$(set +o)"
set -eu set -eu
printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/0042-ciss-post-decrypt-attest] \n\e[0m" printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/0042-ciss-post-decrypt-attest] \n\e[0m"
### Declare variables ---------------------------------------------------------------------------------------------------------- ### Declare variables ----------------------------------------------------------------------------------------------------------
@@ -178,6 +178,6 @@ fi
eval "${_SAVED_SET_OPTS}" eval "${_SAVED_SET_OPTS}"
printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/0042-ciss-post-decrypt-attest]\n\e[0m" printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0042-ciss-post-decrypt-attest]\n\e[0m"
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

4
config/includes.chroot/usr/lib/live/boot/0022-ciss-overlay-tmpfs
View File

@@ -23,7 +23,7 @@ set -eu
sleep 3 sleep 3
printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/0022-ciss-overlay-tmpfs.sh] \n\e[0m" printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/0022-ciss-overlay-tmpfs.sh] \n\e[0m"
### Declare variables ---------------------------------------------------------------------------------------------------------- ### Declare variables ----------------------------------------------------------------------------------------------------------
OVERLAY_BASE="/run/live/overlay" OVERLAY_BASE="/run/live/overlay"
@@ -47,6 +47,6 @@ mkdir -p -m 0700 "${UPPER}" "${WORK}"
eval "${_SAVED_SET_OPTS}" eval "${_SAVED_SET_OPTS}"
printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/0022-ciss-overlay-tmpfs.sh] \n\e[0m" printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0022-ciss-overlay-tmpfs.sh] \n\e[0m"
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

96
config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash
View File

@@ -21,7 +21,7 @@ _SAVED_SET_OPTS="$(set +o)"
set -eu set -eu
printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/0024-ciss-crypt-squash] \n\e[0m" printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/0024-ciss-crypt-squash] \n\e[0m"
####################################### #######################################
# Ask for a passphrase on /dev/console, mask input with '*'. # Ask for a passphrase on /dev/console, mask input with '*'.
@@ -37,6 +37,76 @@ ask_pass_console() {
PASSPHRASE="" PASSPHRASE=""
SAVED_STTY="" SAVED_STTY=""
### Save current console settings.
SAVED_STTY=$(stty -g </dev/console 2>/dev/null || printf '')
### Non-canonical mode, no echo, 1 byte at a time.
stty -echo -icanon time 0 min 1 </dev/console 2>/dev/null || return 1
printf '\e[93m[INFO] Enter LUKS passphrase: \e[0m' > /dev/console
nl=$(printf '\n')
cr=$(printf '\r')
bs=$(printf '\b')
del=$(printf '\177')
while :; do
### Read exactly one byte from the console.
c=$(dd bs=1 count=1 2>/dev/null </dev/console)
### If nothing read (race), loop again.
[ -z "${c}" ] && continue
case "${c}" in
"${nl}"|"${cr}")
### Enter: finish input.
printf '\n' > /dev/console
break
;;
"${bs}"|"${del}")
### Backspace, delete: delete one character, if available.
if [ -n "${PASSPHRASE}" ]; then
PASSPHRASE=${PASSPHRASE%?}
printf '\b \b' > /dev/console
fi
;;
*)
### Normal character: append and mask output.
PASSPHRASE="${PASSPHRASE}${c}"
printf '*' > /dev/console
;;
esac
done
[ -n "${SAVED_STTY}" ] && stty "${SAVED_STTY}" </dev/console 2>/dev/null || :
printf '%s' "${PASSPHRASE}"
return 0
}
#######################################
# Ask for a passphrase on /dev/console, mask input with '*'.
# Globals:
# None
# Arguments:
# None
# Returns:
# 0: on success
# 1: on failure / empty
#######################################
ask_pass_console_old() {
PASSPHRASE=""
SAVED_STTY=""
if command -v stty >/dev/null 2>&1; then if command -v stty >/dev/null 2>&1; then
SAVED_STTY="$(stty -g </dev/console 2>/dev/null || printf '')" SAVED_STTY="$(stty -g </dev/console 2>/dev/null || printf '')"
@@ -118,8 +188,8 @@ for _PARAMETER in ${CMDLINE}; do
done done
printf "\e[92m[INFO] CDLB_LUKS_FS : [%s] \n\e[0m" "${CDLB_LUKS_FS}" printf "\e[92m[INFO] CDLB_LUKS_FS : [%s] \n\e[0m" "${CDLB_LUKS_FS}"
printf "\e[92m[INFO] CDLB_ISO_LABEL : [%s] \n\e[0m" "${CDLB_ISO_LABEL}" printf "\e[92m[INFO] CDLB_ISO_LABEL : [%s] \n\e[0m" "${CDLB_ISO_LABEL}"
mkdir -p "${MNT_MEDIUM}" "${MNT_ROOTFS}" mkdir -p "${MNT_MEDIUM}" "${MNT_ROOTFS}"
@@ -167,7 +237,7 @@ if ! mountpoint -q "${MNT_MEDIUM}"; then
fi fi
printf "\e[92m[INFO] MNT_MEDIUM : [%s] \n\e[0m" "${MNT_MEDIUM}" printf "\e[92m[INFO] MNT_MEDIUM : [%s] \n\e[0m" "${MNT_MEDIUM}"
### Locate the encrypted root container on the medium. ------------------------------------------------------------------------- ### Locate the encrypted root container on the medium. -------------------------------------------------------------------------
if [ ! -f "${MNT_MEDIUM}${CDLB_LUKS_FS}" ]; then if [ ! -f "${MNT_MEDIUM}${CDLB_LUKS_FS}" ]; then
@@ -178,12 +248,12 @@ if [ ! -f "${MNT_MEDIUM}${CDLB_LUKS_FS}" ]; then
fi fi
printf "\e[92m[INFO] CISS LUKS FS : [%s%s] \n\e[0m" "${MNT_MEDIUM}" "${CDLB_LUKS_FS}" printf "\e[92m[INFO] CISS LUKS FS : [%s%s] \n\e[0m" "${MNT_MEDIUM}" "${CDLB_LUKS_FS}"
### Attach a loop device read-only to the encrypted file. ---------------------------------------------------------------------- ### Attach a loop device read-only to the encrypted file. ----------------------------------------------------------------------
LOOP="$(losetup -f --show -r "${MNT_MEDIUM}${CDLB_LUKS_FS}")" || { log "losetup failed"; exit 42; } LOOP="$(losetup -f --show -r "${MNT_MEDIUM}${CDLB_LUKS_FS}")" || { log "losetup failed"; exit 42; }
printf "\e[92m[INFO] Loop device : [%s] \n\e[0m" "${LOOP}" printf "\e[92m[INFO] Loop device : [%s] \n\e[0m" "${LOOP}"
### Expose the loop device for unlock-wrapper.sh, dropbear forced-command. ----------------------------------------------------- ### Expose the loop device for unlock-wrapper.sh, dropbear forced-command. -----------------------------------------------------
mkdir -p /run 2>/dev/null || true mkdir -p /run 2>/dev/null || true
@@ -192,7 +262,7 @@ echo "${LOOP}" > /run/ciss-loopdev 2>/dev/null || true
chmod 0600 /run/ciss-loopdev 2>/dev/null || true chmod 0600 /run/ciss-loopdev 2>/dev/null || true
printf "\e[92m[INFO] Exposed LOOP : [/run/ciss-loopdev] -> [%s]\n\e[0m" "${LOOP}" printf "\e[92m[INFO] Exposed LOOP : [/run/ciss-loopdev] -> [%s]\n\e[0m" "${LOOP}"
### Prepare fifo for passphrase. ----------------------------------------------------------------------------------------------- ### Prepare fifo for passphrase. -----------------------------------------------------------------------------------------------
mkdir -p /lib/cryptsetup 2>/dev/null || true mkdir -p /lib/cryptsetup 2>/dev/null || true
@@ -235,7 +305,7 @@ chmod 0600 /lib/cryptsetup/passfifo 2>/dev/null || true
[ -n "${PASS}" ] || continue [ -n "${PASS}" ] || continue
printf "\e[93m[INFO] Trying to unlock via cryptsetup ...\n\e[0m" >/dev/console 2>/dev/null || true printf "\e[93m[INFO] LUKS mapper [%s] trying to unlock via cryptsetup ... \n\e[0m" "${CDLB_MAPPER_DEV}" >/dev/console 2>/dev/null || true
KEYLEN=${#PASS} KEYLEN=${#PASS}
@@ -246,7 +316,7 @@ chmod 0600 /lib/cryptsetup/passfifo 2>/dev/null || true
if [ -b "${CDLB_MAPPER_DEV}" ]; then if [ -b "${CDLB_MAPPER_DEV}" ]; then
printf "\e[92m[INFO] LUKS mapper [%s] successfully opened.\n\e[0m" "${CDLB_MAPPER_DEV}" >/dev/console 2>/dev/null || true printf "\e[92m[INFO] LUKS mapper [%s] successfully opened. \n\e[0m" "${CDLB_MAPPER_DEV}" >/dev/console 2>/dev/null || true
break break
fi fi
@@ -293,7 +363,7 @@ REMAINING="${CDLB_REMOTE_WAIT_SECS}"
if [ ! -b "${CDLB_MAPPER_DEV}" ]; then if [ ! -b "${CDLB_MAPPER_DEV}" ]; then
printf "\e[93m[INFO] Waiting up to %s seconds for [%s] to be unlocked ...\n\e[0m" "${REMAINING}" "${CDLB_MAPPER_DEV}" printf "\e[93m[INFO] Waiting up to %s seconds for [%s] to be unlocked ... \n\e[0m" "${REMAINING}" "${CDLB_MAPPER_DEV}"
fi fi
@@ -325,7 +395,7 @@ kill "${PID_PROMPT}" 2>/dev/null || true
wait "${PID_BROKER}" 2>/dev/null || true wait "${PID_BROKER}" 2>/dev/null || true
rm -f /lib/cryptsetup/passfifo 2>/dev/null || true rm -f /lib/cryptsetup/passfifo 2>/dev/null || true
printf "\e[92m[INFO] LUKS mapper : [%s] is now present.\n\e[0m" "${CDLB_MAPPER_DEV}" printf "\e[92m[INFO] LUKS mapper : [%s] is now present.\n\e[0m" "${CDLB_MAPPER_DEV}"
### Expose the decrypted root device for live-boot overlay. The live-boot components will pick this up in '9990-overlay.sh'. --- ### Expose the decrypted root device for live-boot overlay. The live-boot components will pick this up in '9990-overlay.sh'. ---
echo "${CDLB_MAPPER_DEV}" >| /run/ciss-rootdev echo "${CDLB_MAPPER_DEV}" >| /run/ciss-rootdev
@@ -340,13 +410,13 @@ printf "\e[92m[INFO] Decrypted root device exposed at: [/run/ciss-rootdev] -> [%
if [ ! -b "${CDLB_MAPPER_DEV}" ]; then if [ ! -b "${CDLB_MAPPER_DEV}" ]; then
log "Failed to unlock encrypted root [${CDLB_LUKS_FS}] via dropbear and console." log "Failed to unlock encrypted root [${CDLB_LUKS_FS}] via dropbear and console."
printf "\e[91m[WARN] Failed unlock : [%s] via dropbear and console. \n\e[0m" "${CDLB_LUKS_FS}" printf "\e[91m[WARN] Failed unlock : [%s] via dropbear and console. \n\e[0m" "${CDLB_LUKS_FS}"
exit 42 exit 42
fi fi
eval "${_SAVED_SET_OPTS}" eval "${_SAVED_SET_OPTS}"
printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/0024-ciss-crypt-squash] \n\e[0m" printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0024-ciss-crypt-squash] \n\e[0m"
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

4
config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl
View File

@@ -21,7 +21,7 @@ _SAVED_SET_OPTS="$(set +o)"
set -eu set -eu
printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/0026-ciss-early-sysctl.sh] \n\e[0m" printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/0026-ciss-early-sysctl.sh] \n\e[0m"
echo 2 > /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || true echo 2 > /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || true
echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled 2>/dev/null || true echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled 2>/dev/null || true
@@ -34,6 +34,6 @@ echo 2 > /proc/sys/kernel/kptr_restrict 2>/dev/null || true
eval "${_SAVED_SET_OPTS}" eval "${_SAVED_SET_OPTS}"
printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/0026-ciss-early-sysctl.sh] \n\e[0m" printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/0026-ciss-early-sysctl.sh] \n\e[0m"
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

2
config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums
View File

@@ -29,7 +29,7 @@
# 0 : Successful verification # 0 : Successful verification
####################################### #######################################
Verify_checksums() { Verify_checksums() {
printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/0030-ciss-verify-checksums] \n\e[0m" printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/0030-ciss-verify-checksums] \n\e[0m"
### Declare variables -------------------------------------------------------------------------------------------------------- ### Declare variables --------------------------------------------------------------------------------------------------------

6
config/includes.chroot/usr/lib/live/boot/9990-main.sh
View File

@@ -20,11 +20,11 @@
# set -e # set -e
printf "\e[95m[INFO] Sourcing : [/usr/lib/live/boot/9990-main.sh] \n\e[0m" printf "\e[95m[INFO] Sourcing : [/usr/lib/live/boot/9990-main.sh] \n\e[0m"
Live () Live ()
{ {
printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/9990-main.sh] \n\e[0m" printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/9990-main.sh] \n\e[0m"
if [ -x /scripts/local-top/cryptroot ] if [ -x /scripts/local-top/cryptroot ]
then then
@@ -252,5 +252,5 @@ Live ()
cp boot.log "${rootmnt}/var/log/live" 2>/dev/null; \ cp boot.log "${rootmnt}/var/log/live" 2>/dev/null; \
cp fsck.log "${rootmnt}/var/log/live" 2>/dev/null ) cp fsck.log "${rootmnt}/var/log/live" 2>/dev/null )
printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/9990-main.sh] ... \n\e[0m" printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/9990-main.sh] ... \n\e[0m"
} }

4
config/includes.chroot/usr/lib/live/boot/9990-overlay.sh
View File

@@ -24,7 +24,7 @@ printf "\e[95m[INFO] Sourcing : [/usr/lib/live/boot/9990-overlay.sh]
setup_unionfs () setup_unionfs ()
{ {
printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/9990-overlay.sh] \n\e[0m" printf "\e[95m[INFO] Starting : [/usr/lib/live/boot/9990-overlay.sh] \n\e[0m"
image_directory="${1}" image_directory="${1}"
rootmnt="${2}" rootmnt="${2}"
@@ -495,5 +495,5 @@ setup_unionfs ()
done done
fi fi
printf "\e[92m[INFO] Successfully applied: [/usr/lib/live/boot/9990-overlay.sh] ... \n\e[0m" printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/9990-overlay.sh] ... \n\e[0m"
} }

4
docs/CHANGELOG.md
View File

@@ -18,7 +18,7 @@ include_toc: true
* **Bugfixes**: [0024-ciss-crypt-squash](../config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash) * **Bugfixes**: [0024-ciss-crypt-squash](../config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash)
* **Bugfixes**: [0026-ciss-early-sysctl](../config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl) * **Bugfixes**: [0026-ciss-early-sysctl](../config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl)
* **Bugfixes**: [0030-ciss-verify-checksums](../config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums) * **Bugfixes**: [0030-ciss-verify-checksums](../config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums)
* **Bugfixes**: [0042-ciss-post-decrypt-attest](../config/includes.chroot/usr/lib/live/boot/0042-ciss-post-decrypt-attest) * **Bugfixes**: [0042-ciss-post-decrypt-attest](../config/includes.chroot/etc/initramfs-tools/scripts/live-bottom/0042-ciss-post-decrypt-attest)
## V8.13.432.2025.11.18 ## V8.13.432.2025.11.18
* **Bugfixes**: [0003_cdi_autostart.chroot](../config/hooks/live/0003_cdi_autostart.chroot) * **Bugfixes**: [0003_cdi_autostart.chroot](../config/hooks/live/0003_cdi_autostart.chroot)
@@ -34,7 +34,7 @@ include_toc: true
* **Added**: [0022-ciss-overlay-tmpfs.sh](../config/includes.chroot/usr/lib/live/boot/0022-ciss-overlay-tmpfs) + Pre-create constrained tmpfs for OverlayFS upper/work before live-boot mounts overlay. * **Added**: [0022-ciss-overlay-tmpfs.sh](../config/includes.chroot/usr/lib/live/boot/0022-ciss-overlay-tmpfs) + Pre-create constrained tmpfs for OverlayFS upper/work before live-boot mounts overlay.
* **Added**: [0024-ciss-crypt-squash](../config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash) + Open ``/live/ciss_rootfs.crypt`` (LUKS) and present its SquashFS as ``/run/live/rootfs``. * **Added**: [0024-ciss-crypt-squash](../config/includes.chroot/usr/lib/live/boot/0024-ciss-crypt-squash) + Open ``/live/ciss_rootfs.crypt`` (LUKS) and present its SquashFS as ``/run/live/rootfs``.
* **Added**: [0026-ciss-early-sysctl.sh](../config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl) + Enforce early sysctls before services start. * **Added**: [0026-ciss-early-sysctl.sh](../config/includes.chroot/usr/lib/live/boot/0026-ciss-early-sysctl) + Enforce early sysctls before services start.
* **Added**: [0042-ciss-post-decrypt-attest](../config/includes.chroot/usr/lib/live/boot/0042-ciss-post-decrypt-attest) + Late rootfs attestation and dmsetup health checking. * **Added**: [0042-ciss-post-decrypt-attest](../config/includes.chroot/etc/initramfs-tools/scripts/live-bottom/0042-ciss-post-decrypt-attest) + Late rootfs attestation and dmsetup health checking.
* **Added**: [MAN_CISS_ISO_BOOT_CHAIN.md](MAN_CISS_ISO_BOOT_CHAIN.md) * **Added**: [MAN_CISS_ISO_BOOT_CHAIN.md](MAN_CISS_ISO_BOOT_CHAIN.md)
* **Added**: [lib_ciss_signatures.sh](../lib/lib_ciss_signatures.sh) + integrated dynamic GPG FPR injection. * **Added**: [lib_ciss_signatures.sh](../lib/lib_ciss_signatures.sh) + integrated dynamic GPG FPR injection.
* **Bugfixes**: [0021_dropbear_initramfs.chroot](../config/hooks/live/0021_dropbear_initramfs.chroot) + mv original files to a safe backup location. * **Bugfixes**: [0021_dropbear_initramfs.chroot](../config/hooks/live/0021_dropbear_initramfs.chroot) + mv original files to a safe backup location.