V8.13.400.2025.11.08

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

lib/lib_primordial.sh

@@ -29,46 +29,37 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 init_primordial() {
   printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
+  declare     var_dropbear_version="2025.88"
+
+  install -d -m 0700 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/build"
+  install -d -m 0700 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/dropbear"
+  install    -m 0400 "${VAR_WORKDIR}/upgrades/dropbear/dropbear-${var_dropbear_version}.tar.bz2" \
+    "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/dropbear/dropbear-${var_dropbear_version}.tar.bz2"
+  install    -m 0400 "${VAR_WORKDIR}/upgrades/dropbear/localoptions.h" \
+    "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/dropbear/localoptions.h"
+
+
+
   ### Check for SOPS AGE key integration ---------------------------------------------------------------------------------------
-  if [[ ! "${VAR_AGE,,}" == "true" ]]; then
+  if [[ "${VAR_AGE,,}" == "true" ]]; then
 
-    if compgen -G "${VAR_TMP_SECRET}/${VAR_AGE_KEY}" > /dev/null; then
-
-      shred -fzu -n 5 -- "${VAR_TMP_SECRET}/${VAR_AGE_KEY}"
-
-    fi
-
-  else
-
-    install -d -m 0700 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.config/sops/age"
+    install -d -m 0700                                 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.config/sops/age"
     install -m 0400 "${VAR_TMP_SECRET}/${VAR_AGE_KEY}" "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.config/sops/age/keys.txt"
     shred -fzu -n 5 -- "${VAR_TMP_SECRET}/${VAR_AGE_KEY}" 2>/dev/null || rm -f "${VAR_TMP_SECRET}/${VAR_AGE_KEY}"
 
   fi
 
   ### Check for SSH CISS and PhysNet primordial-workflow(tm) integration -------------------------------------------------------
-  if [[ ! "${VAR_SSHFP,,}" == "true" ]]; then
+  if [[ "${VAR_SSHFP,,}" == "true" ]]; then
 
-    if compgen -G "${VAR_TMP_SECRET}/id*" > /dev/null; then
-
-      shred -fzu -n 5 -- "${VAR_TMP_SECRET}/id"*
-
-    fi
-
-    if compgen -G "${VAR_TMP_SECRET}/ssh_host_*" > /dev/null; then
-
-      shred -fzu -n 5 -- "${VAR_TMP_SECRET}/ssh_host_"*
-
-    fi
-
-  else
-
-    install -d -m 0700 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.ssh"
+    install -d -m 0700                      "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.ssh"
     install -m 0600 "${VAR_TMP_SECRET}/id"* "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.ssh/"
+    normalize_ssh_keys_in_dir               "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/.ssh"
     shred -fzu -n 5 -- "${VAR_TMP_SECRET}/id"* 2>/dev/null || rm -f "${VAR_TMP_SECRET}/id"*
 
-    install -d -m 0700 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/ssh"
+    install -d -m 0700                             "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/ssh"
     install -m 0600 "${VAR_TMP_SECRET}/ssh_host_"* "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/ssh/"
+    normalize_ssh_keys_in_dir                      "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/ssh/"
     shred -fzu -n 5 -- "${VAR_TMP_SECRET}/ssh_host_"* 2>/dev/null || rm -f "${VAR_TMP_SECRET}/ssh_host_"*
 
   fi
@@ -80,4 +71,77 @@ init_primordial() {
 ### Prevents accidental 'unset -f'.
 # shellcheck disable=SC2034
 readonly -f init_primordial
+
+#######################################
+# Normalize SSH key files: strip CRLF.
+# Globals:
+#   None
+# Arguments:
+#   1: ssh_host_key or id file
+# Returns:
+#   0: on success
+#   1: on failure
+#######################################
+normalize_ssh_key_file() {
+  declare var_key_file="" var_tmp_file=""
+  var_key_file="$1"
+
+  [[ -f "${var_key_file}" ]] || return 0
+
+  ### If there is any CR (carriage return), strip it.
+  if grep -q $'\r' "${var_key_file}"; then
+
+    ### Use a temporary file to avoid in-place corruption-
+    var_tmp_file="${var_key_file}.noCR.$$"
+
+    ### Remove only '\r', keep everything else as-is.
+    tr -d '\r' < "${var_key_file}" > "${var_tmp_file}" || {
+      echo "ERROR: Failed to normalize CRLF in ${var_key_file}" >&2
+      rm -f "${var_tmp_file}"
+      return 1
+    }
+
+    mv "${var_tmp_file}" "${var_key_file}" || {
+      echo "ERROR: Failed to replace normalized file ${var_key_file}" >&2
+      rm -f "${var_tmp_file}"
+      return 1
+    }
+  fi
+
+  return 0
+}
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f normalize_ssh_key_file
+
+#######################################
+# Normalize SSH key files in dir.
+# Globals:
+#   None
+# Arguments:
+#   1: directory
+# Returns:
+#   0: on success
+#   1: on failure
+#######################################
+normalize_ssh_keys_in_dir() {
+  declare var_key_dir="" var_key_file=""
+  var_key_dir="$1"
+
+  [[ -d "${var_key_dir}" ]] || return 0
+
+  ### Cover both root identity keys and host keys.
+  for var_key_file in "${var_key_dir}"/id_* "${var_key_dir}"/ssh_host_*; do
+
+    [[ -e "${var_key_file}" ]] || continue
+
+    normalize_ssh_key_file "${var_key_file}" || return 1
+
+  done
+
+  return 0
+}
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f normalize_ssh_keys_in_dir
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh