V9.14.008.2026.06.04

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

lib/lib_primordial.sh

@@ -13,13 +13,14 @@
 guard_sourcing || return "${ERR_GUARD_SRCE}"
 
 #######################################
-# Integrates CISS dropbear and SOPS Age Key and CISS and PhysNet primordial SSH identity files.
+# Integrates CISS dropbear, SOPS version, SOPS Age Key, and CISS and PhysNet primordial SSH identity files.
 # Globals:
 #   BASH_SOURCE
 #   VAR_AGE
 #   VAR_AGE_KEY
 #   VAR_DROPBEAR_VERSION
 #   VAR_HANDLER_BUILD_DIR
+#   VAR_SOPS_VERSION
 #   VAR_SSHFP
 #   VAR_TMP_SECRET
 #   VAR_WORKDIR
@@ -27,28 +28,40 @@ guard_sourcing || return "${ERR_GUARD_SRCE}"
 #   None
 # Returns:
 #   0: on success
+#   ERR_DROPBEAR_V: on failure
+#   ERR__SOPS__VER: on failure
 #######################################
 init_primordial() {
-  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[95m🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
 
   ### Prepare CISS dropbear integration ----------------------------------------------------------------------------------------
   declare var_dropbear_version="${VAR_DROPBEAR_VERSION}"
   declare var_dropbear_tar="${VAR_WORKDIR}/upgrades/dropbear/dropbear-${var_dropbear_version}.tar.bz2"
+  # shellcheck disable=SC2153,SC2154
+  declare var_sops_version="${VAR_SOPS_VERSION#v}"
 
   if [[ ! "${var_dropbear_version}" =~ ^[0-9]{4}\.[0-9]+$ ]]; then
 
-    printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ ERROR: Invalid Dropbear version: [%s] \e[0m\n" "${var_dropbear_version}" >&2
+    printf "\e[91m❌ ERROR: Invalid Dropbear version: [%s] \e[0m\n" "${var_dropbear_version}" >&2
     return "${ERR_DROPBEAR_V}"
 
   fi
 
   if [[ ! -r "${var_dropbear_tar}" ]]; then
 
-    printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ ERROR: Dropbear tarball not found: [%s] \e[0m\n" "${var_dropbear_tar}" >&2
+    printf "\e[91m❌ ERROR: Dropbear tarball not found: [%s] \e[0m\n" "${var_dropbear_tar}" >&2
     return "${ERR_DROPBEAR_V}"
 
   fi
 
+  if [[ ! "${var_sops_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+
+    printf "\e[91m❌ ERROR: Invalid SOPS version: [%s] \e[0m\n" "${var_sops_version}" >&2
+    # shellcheck disable=SC2154
+    return "${ERR__SOPS__VER}"
+
+  fi
+
   install -d -m 0755 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/etc/initramfs-tools/files"
   install -d -m 0755 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/build"
   install -d -m 0755 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/dropbear"
@@ -57,6 +70,10 @@ init_primordial() {
     >| "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/dropbear.env"
   chmod 0444 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/dropbear.env"
 
+  printf 'CISS_SOPS_VERSION="%s"\n' "${var_sops_version}" \
+    >| "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/sops.env"
+  chmod 0444 "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/sops.env"
+
   install    -m 0444 "${var_dropbear_tar}" \
     "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/root/dropbear/dropbear-${var_dropbear_version}.tar.bz2"
   install    -m 0444 "${VAR_WORKDIR}/upgrades/dropbear/localoptions.h" \
@@ -88,7 +105,7 @@ init_primordial() {
 
   fi
 
-  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
+  printf "\e[92m✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
 
   return 0
 }
@@ -129,7 +146,7 @@ normalize_ssh_key_file() {
     ### Remove only '\r', keep everything else as-is.
     if ! tr -d '\r' < "${var_key_file}" >| "${var_tmp_file}"; then
 
-      printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ Failed to normalize CRLF: [%s] \e[0m\n" "${var_key_file}"
+      printf "\e[91m❌ Failed to normalize CRLF: [%s] \e[0m\n" "${var_key_file}"
       rm -f "${var_tmp_file}"
       return "${ERR_SANITIZING}"
 
@@ -153,7 +170,7 @@ normalize_ssh_key_file() {
       ### Always: fingerprint check (works for private and public keys).
       if ! ssh-keygen -lf "${var_key_file}" >/dev/null; then
 
-        printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ Failed check ssh-keygen -lf: [%s] \e[0m\n" "${var_key_file}"
+        printf "\e[91m❌ Failed check ssh-keygen -lf: [%s] \e[0m\n" "${var_key_file}"
         return "${ERR_SANITIZING}"
 
       fi
@@ -163,7 +180,7 @@ normalize_ssh_key_file() {
 
         if ! ssh-keygen -yf "${var_key_file}" >/dev/null; then
 
-          printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ Failed check ssh-keygen -yf: [%s] \e[0m\n" "${var_key_file}"
+          printf "\e[91m❌ Failed check ssh-keygen -yf: [%s] \e[0m\n" "${var_key_file}"
           return "${ERR_SANITIZING}"
 
         fi
@@ -194,21 +211,22 @@ readonly -f normalize_ssh_key_file
 #   ERR_SANITIZING: on failure
 #######################################
 normalize_ssh_keys_in_dir() {
-  declare var_key_dir="" var_key_file="" _old_nullglob="" _old_dotglob="" _old_failglob=""
+  declare var_key_dir="" var_key_file=""
+  declare -i old_nullglob=0 old_dotglob=0 old_failglob=0
   var_key_dir="$1"
 
   ### Enable nullglob/dotglob, disable failglob for safe globbing.
-  _old_nullglob="$(shopt -p nullglob || true)"
-  _old_dotglob="$( shopt -p dotglob  || true)"
-  _old_failglob="$(shopt -p failglob || true)"
+  shopt -q nullglob && old_nullglob=1
+  shopt -q dotglob  && old_dotglob=1
+  shopt -q failglob && old_failglob=1
 
   shopt -s nullglob dotglob
   shopt -u failglob
 
   if [[ ! -d "${var_key_dir}" ]]; then
-    eval "${_old_nullglob}" 2>/dev/null || true
-    eval "${_old_dotglob}"  2>/dev/null || true
-    eval "${_old_failglob}" 2>/dev/null || true
+    if (( old_nullglob )); then shopt -s nullglob; else shopt -u nullglob; fi
+    if (( old_dotglob  )); then shopt -s dotglob;  else shopt -u dotglob;  fi
+    if (( old_failglob )); then shopt -s failglob; else shopt -u failglob; fi
     return 0
   fi
 
@@ -218,17 +236,17 @@ normalize_ssh_keys_in_dir() {
     [[ -e "${var_key_file}" ]] || continue
 
     if ! normalize_ssh_key_file "${var_key_file}"; then
-      eval "${_old_nullglob}" 2>/dev/null || true
-      eval "${_old_dotglob}"  2>/dev/null || true
-      eval "${_old_failglob}" 2>/dev/null || true
+      if (( old_nullglob )); then shopt -s nullglob; else shopt -u nullglob; fi
+      if (( old_dotglob  )); then shopt -s dotglob;  else shopt -u dotglob;  fi
+      if (( old_failglob )); then shopt -s failglob; else shopt -u failglob; fi
       return "${ERR_SANITIZING}"
     fi
 
   done
 
-  eval "${_old_nullglob}" 2>/dev/null || true
-  eval "${_old_dotglob}"  2>/dev/null || true
-  eval "${_old_failglob}" 2>/dev/null || true
+  if (( old_nullglob )); then shopt -s nullglob; else shopt -u nullglob; fi
+  if (( old_dotglob  )); then shopt -s dotglob;  else shopt -u dotglob;  fi
+  if (( old_failglob )); then shopt -s failglob; else shopt -u failglob; fi
 
   return 0
 }