msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V8.13.384.2025.11.06
Some checks failed
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m37s
Details
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Successful in 1m9s
Details
🔐 Generating a Private Live ISO TRIXIE. / 🔐 Generating a Private Live ISO TRIXIE. (push) Failing after 1m0s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-11-06 19:59:22 +01:00
parent d436346343
commit ef87becefe
93 changed files with 2021 additions and 1229 deletions
Download Patch File Download Diff File Expand all files Collapse all files

98
lib/lib_usage.sh
View File

@@ -39,13 +39,13 @@ usage() {
# shellcheck disable=SC2155
declare var_header=$(center "CLB(1) CISS.debian.live.builder CLB(1)" "${var_cols}")
# shellcheck disable=SC2155
declare var_footer=$(center "V8.13.296.2025.10.29 2025-10-07 CLB(1)" "${var_cols}")
declare var_footer=$(center "V8.13.384.2025.11.06 2025-11-07 CLB(1)" "${var_cols}")
{
echo -e "\e[1;97m${var_header}\e[0m"
echo
echo -e "\e[92mCISS.debian.live.builder from https://git.coresecret.dev/msw \e[0m"
echo -e "\e[92mMaster V8.13.296.2025.10.29\e[0m"
echo -e "\e[92mMaster V8.13.384.2025.11.06\e[0m"
echo -e "\e[92mA lightweight Shell Wrapper for building a hardened Debian Live ISO Image.\e[0m"
echo
echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2025 \e[0m"
@@ -57,70 +57,64 @@ usage() {
echo " What you're looking at."
echo
echo -e "\e[97m --autobuild=*, -a=* \e[0m"
echo " Headless mode. Skip the dialog wrapper, provider note screen and interactive kernel"
echo " selector dialog. Change '*' to your desired Linux kernel and trim the"
echo " 'linux-image-' string to select a specific kernel, e.g. '--autobuild=6.12.30+bpo-amd64'."
echo " Headless mode. Skip the dialog wrapper, provider note screen and interactive kernel selector dialog."
echo " Change '*' to your desired Linux kernel and trim the 'linux-image-' string to select a specific kernel,"
echo " e.g. '--autobuild=6.12.30+bpo-amd64'."
echo
echo -e "\e[97m --architecture <STRING> one of <amd64 | arm64> \e[0m"
echo " A string reflecting the architecture of the Live System."
echo " MUST be provided."
echo
echo -e "\e[97m --build-directory </path/to/build_directory> \e[0m"
echo " RECOMMENDED path: </opt/cdlb>"
echo " Where the Debian Live Build Image should be generated."
echo " MUST be provided."
echo
echo -e "\e[97m --change-splash <STRING> one of <club | hexagon>\e[0m"
echo " A string reflecting the Grub Boot Screen Splash you want to use."
echo " If omitted defaults to './.archive/background/club.png'."
echo " A string reflecting the Grub Boot Screen Splash you want to use. If omitted defaults to:"
echo " <./.archive/background/club.png>"
echo
echo -e "\e[97m --cdi (Experimental Feature)\e[0m"
echo " This option generates a boot menu entry to start the forthcoming"
echo " 'CISS.debian.installer', which will be executed after"
echo " the system has successfully booted up."
echo " This option creates a boot menu entry that starts the forthcoming 'CISS.debian.installer', which is executed"
echo " once the system has successfully booted up."
echo
echo -e "\e[97m --contact, -c\ e[0m"
echo " Show author contact information."
echo
echo -e "\e[97m --control <INTEGER>\e[0m"
echo " An integer that reflects the version of your Live ISO Image."
echo -e "\e[97m --control <STRING>\e[0m"
echo " A string, that reflects the version of your Live ISO Image."
echo " MUST be provided."
echo
echo -e "\e[97m --debug, -d \e[0m"
echo " Enables debug logging for the main program routine. Detailed logging"
echo " information are written to '/tmp/ciss_live_builder_$$.log'."
echo " Enables debug logging for the main program routine. Detailed logging information are written to:"
echo " </tmp/ciss_live_builder_$$.log>"
echo
echo -e "\e[97m --dhcp-centurion \e[0m"
echo " If a DHCP lease is provided, the provider's nameserver will be overridden,"
echo " and only the hardened, privacy-focused Centurion DNS servers will be used:"
echo " If a DHCP lease is provided, the provider's name server will be overridden and the hardened, privacy-focused "
echo " Centurion DNS servers will be used instead:"
echo " - https://dns01.eddns.eu/"
echo " - https://dns02.eddns.de/"
echo " - https://dns03.eddns.eu/"
echo
echo -e "\e[97m --jump-host <IP | IP | ... > \e[0m"
echo " Provide up to 10 IPs for /etc/host.allow whitelisting of SSH access."
echo " Could be either IPv4 and / or IPv6 addresses and / or CCDIR notation."
echo " If provided, than it MUST be a <SPACE> separated list."
echo " Provide up to 10 IPs for '/etc/host.allow' whitelisting of SSH access. Could be either IPv4 and / or IPv6 "
echo " addresses and / or CCDIR notation. If provided, than it MUST be a <SPACE> separated list."
echo " IPv6 addresses MUST be encapsulated with [], e.g., [1234::abcd]/64."
echo
echo -e "\e[97m --log-statistics-only\e[0m"
echo " Provides statistic only after successful building a"
echo " CISS.debian.live-ISO. While enabling '--log-statistics-only'"
echo " the argument '--build-directory' MUST be provided while"
echo " all further options MUST be omitted."
echo " Provides statistic only after successful building a CISS.debian.live-ISO. While enabling '--log-statistics-only'"
echo " the argument '--build-directory' MUST be provided."
echo
echo -e "\e[97m --provider-netcup-ipv6 \e[0m"
echo " Activates IPv6 support for Netcup Root Server. One unique"
echo " IPv6 address MUST be provided in this case and MUST be encapsulated"
echo " with [], e.g., [1234::abcd]."
echo " Activates IPv6 support for Netcup Root Server. One unique IPv6 address MUST be provided in this case and MUST be"
echo " encapsulated with [], e.g., [1234::abcd]."
echo
echo -e "\e[97m --renice-priority <PRIORITY> \e[0m"
echo " Reset the nice priority value of the script and all its children"
echo " to the desired <PRIORITY>. MUST be an integer (between '-19' and 19)."
echo " Negative (higher) values MUST be enclosed in double quotes '\"'."
echo " Reset the nice priority value of the script and all its children to the desired <PRIORITY>. MUST be an integer"
echo " between '-19' and 19. Negative (higher) values MUST be enclosed in double quotes '\"'."
echo
echo -e "\e[97m --reionice-priority <CLASS> <PRIORITY> \e[0m"
echo " Reset the ionice priority value of the script and all its children"
echo " to the desired <CLASS>. MUST be an integer:"
echo " Reset the ionice priority value of the script and all its children to the desired <CLASS>. MUST be an integer:"
echo " 1: realtime"
echo " 2: best-effort"
echo " 3: idle"
@@ -129,31 +123,39 @@ usage() {
echo " 0: highest priority and"
echo " 7: lowest priority."
echo " Defaults to '4'."
echo " A real-time I/O process can significantly slow down other processes"
echo " or even cause them to starve if it continuously requests I/O."
echo " A real-time I/O process can significantly slow down other processes or even cause them to starve if it"
echo " continuously requests I/O."
echo
echo -e "\e[97m --root-password-file </path/to/password.txt> \e[0m"
echo " Password file for 'root', if given, MUST be a string of 20 to 64 characters,"
echo " and MUST NOT contain the special character '\"'."
echo " If the argument is omitted, no further login authentication is required for"
echo " the local console. The root password is hashed with an 16 Byte '/dev/random'"
echo " generated SALT and SHA512 Hashing function and 8,388,608 rounds. Immediately"
echo " after Hash generation all Variables containing plain password fragments are"
echo " deleted. Password file SHOULD be '0400' and 'root:root' and is deleted without"
echo " further prompt after password hash has been successfully generated via:"
echo " 'shred -vfzu 5 -f'."
echo " 'No tracing of any plain text password fragment in any debug log."
echo -e "\e[97m --root-password-file </dev/shm/cdlb_secrets/password.txt>> \e[0m"
echo " Password file for 'root', if given, MUST be a string of 42 to 64 characters."
echo " If the argument is omitted, no further login authentication is required for the local console."
echo " MUST be placed in:"
echo " </dev/shm/cdlb_secrets/password.txt>"
echo
echo -e "\e[97m --signing_key=* and --signing_key_fpr=*; if desired then additionally --signing_key_pass=* \e[0m"
echo " The GPG private keyring that should be used for signing artifacts such as checksum hashes and scripts is"
echo " specified via '--signing_key=*'. If the keyring is passphrase protected provide the passphrase in its own file."
echo " Specify the fingerprint of the key to use via '--signing_key_fpr=*'."
echo " Change '*' to your desired files / fingerprint. Files MUST be placed in:"
echo " </dev/shm/cdlb_secrets>"
echo
echo -e "\e[97m --sshfp \e[0m"
echo " Desired SSH id-files that should be incorporated in '/root/.ssh/id*'."
echo " Desired SSH host-files that should be incorporated in '/etc/ssh/ssh_host_*'."
echo " The respective id-files and / or host-files MUST be placed in:"
echo " </dev/shm/cdlb_secrets/id*> / </dev/shm/cdlb_secrets/ssh_host_*>"
echo
echo -e "\e[97m --ssh-port <INTEGER> \e[0m"
echo " The desired Port SSH should listen to."
echo " If not provided defaults to Port '22'."
echo
echo -e "\e[97m --ssh-pubkey </path/to/.ssh/> \e[0m"
echo " Imports the SSH Public Key from the FILE 'authorized_keys' of the"
echo " specified PATH into the Live ISO. MUST be provided."
echo -e "\e[97m --ssh-pubkey </dev/shm/cdlb_secrets/> \e[0m"
echo " Imports the SSH Public Key from the file 'authorized_keys' into the Live ISO."
echo " Key file MUST be placed in:"
echo " </dev/shm/cdlb_secrets/authorized_keys>"
echo
echo -e "\e[97m --trixie \e[0m"
echo " Create a Debian Trixie Live ISO."
echo " Creates a Debian Trixie Live ISO. If omitted defaults to 'Trixie'. No other Debian Version is supported."
echo
echo -e "\e[97m --version, -v \e[0m"
echo " Show version of ${0}."