V8.13.384.2025.11.06

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

lib/lib_clean_up.sh

@@ -13,33 +13,88 @@
 guard_sourcing
 
 #######################################
-# Clean Up Wrapper on Trap on 'ERR' and 'EXIT'.
+# Cleanup wrapper on the traps on 'ERR' and 'EXIT'.
 # Globals:
+#   VAR_CDLB_INSIDE_RUNNER
+#   GNUPGHOME
 #   LOG_ERROR
+#   VAR_HANDLER_BUILD_DIR
 #   VAR_KERNEL_INF
 #   VAR_KERNEL_SRT
 #   VAR_KERNEL_TMP
+#   VAR_NOTES
 #   VAR_WORKDIR
 # Arguments:
 #   1 : ${trap_on_exit_code} of trap_on_exit()
+# Returns:
+#   0: on success
 #######################################
 clean_up() {
-  declare clean_exit_code="$1"
+  declare clean_exit_code="$1" fs_type=""
+
+  shopt -s nullglob dotglob
+
   rm -f -- "${VAR_KERNEL_INF}"
   rm -f -- "${VAR_KERNEL_SRT}"
   rm -f -- "${VAR_KERNEL_TMP}"
+  rm -f -- "${VAR_NOTES}"
+
   # Release advisory lock on FD 127.
   flock -u 127
+
   # Close file descriptor 127.
   exec 127>&-
+
   # Remove the lockfile artifact.
   rm -f /run/lock/ciss_live_builder.lock
+
+  # Removes the error log on clean exit.
   if (( clean_exit_code == 0 )); then rm -f -- "${LOG_ERROR}"; fi
+
+  # Cleaning TCP wrapper artifacts.
   if [[ -f "${VAR_WORKDIR}/hosts.allow" ]]; then
     rm -f "${VAR_WORKDIR}/hosts.allow"
   fi
   if [[ -f "${VAR_WORKDIR}/hosts.deny" ]]; then
     rm -f "${VAR_WORKDIR}/hosts.deny"
   fi
+
+  # Kill gpg-agent and remove artifacts securely.
+  if [[ ! "${VAR_CDLB_INSIDE_RUNNER}" == "true" ]]; then
+
+    if [[ -n "${GNUPGHOME:-}" && -d "${GNUPGHOME}" && "${GNUPGHOME}" == /dev/shm/cdlb_*_gnupg ]]; then
+
+      gpgconf --kill gpg-agent >/dev/null 2>&1 || true
+
+      fs_type="$(stat -f -c %T "${GNUPGHOME}" 2>/dev/null || echo "GNUPGHOME: unknown fs.")"
+
+      if [[ "${fs_type}" == "tmpfs" || "${fs_type}" == "ramfs" ]]; then
+
+        rm -rf --one-file-system -- "${GNUPGHOME}" 2>/dev/null || true
+
+      else
+
+        chmod -R u+rwX "${GNUPGHOME}" >/dev/null 2>&1 || true
+        find "${GNUPGHOME}" -type f -exec shred -fuz -n 2 -- {} + 2>/dev/null || true
+        find "${GNUPGHOME}" \( -type s -o -type p -o -type l \) -delete 2>/dev/null || true
+        rm -rf --one-file-system -- "${GNUPGHOME}" 2>/dev/null || true
+
+      fi
+
+    fi
+
+  fi
+
+  # Removes secrets securely.
+  # shellcheck disable=SC2312
+  find "${VAR_TMP_SECRET}" -xdev -type f -print0 | xargs -0 -- no-run-if-empty shred -fzu -n 5 --
+  find "${VAR_TMP_SECRET}" -xdev -depth -type d -empty -delete
+
+  shopt -u nullglob dotglob
+
+  return 0
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f clean_up
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh