V8.13.384.2025.11.06

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

scripts/usr/lib/live/boot/0030-verify-checksums

@@ -0,0 +1,212 @@
+#!/bin/sh
+# bashsupport disable=BP5007
+# shellcheck shell=sh
+
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-10-28; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu
+
+### Modified Version of the original file:
+### https://salsa.debian.org/live-team/live-boot 'components/0030-verify-checksums'
+### In case of successful verification of the offered checksum, proceed with booting; otherwise panic.
+
+#######################################
+# Modified checksum-integrity and authenticity-verification-script for continuing the boot process.
+# Globals:
+#   LIVE_BOOT_CMDLINE
+#   _TTY
+# Arguments:
+#   1: _MOUNTPOINT
+# Returns:
+#   0 : Successful verification
+#######################################
+Verify_checksums() {
+  _MOUNTPOINT="${1}"
+
+  _TTY="/dev/tty8"
+
+  LIVE_VERIFY_CHECKSUMS_DIGESTS="${LIVE_VERIFY_CHECKSUMS_DIGESTS:-sha512 sha384 sha256}"
+
+  LIVE_VERIFY_CHECKSUMS_SIGNATURES="false"
+
+  for _PARAMETER in ${LIVE_BOOT_CMDLINE}; do
+
+    case "${_PARAMETER}" in
+
+      live-boot.verify-checksums=* | verify-checksums=*)
+
+        LIVE_VERIFY_CHECKSUMS="true"
+        LIVE_VERIFY_CHECKSUMS_DIGESTS="${_PARAMETER#*verify-checksums=}"
+        ;;
+
+      live-boot.verify-checksums | verify-checksums)
+
+        LIVE_VERIFY_CHECKSUMS="true"
+        ;;
+
+      live-boot.verify-checksums-signatures | verify-checksums-signatures)
+
+        LIVE_VERIFY_CHECKSUMS_SIGNATURES="true"
+        ;;
+
+    esac
+
+  done
+
+  case "${LIVE_VERIFY_CHECKSUMS}" in
+
+    true)
+      :
+      ;;
+
+    *)
+      return 0
+      ;;
+
+  esac
+
+  # shellcheck disable=SC2164
+  cd "${_MOUNTPOINT}"
+
+  ### CDLB verification of script integrity itself -----------------------------------------------------------------------------
+  if [ "${LIVE_VERIFY_CHECKSUMS_SIGNATURES}" = "true" ]; then
+
+    log_begin_msg "Verifying integrity of '0030-verify-checksums' ..."
+    printf "\n"
+
+    CDLB_SCRIPT="$(basename "${0}")"
+    CDLB_SHA="sha512"
+    CDLB_CMD="" CDLB_COMPUTED="" CDLB_EXPECTED="" CDLB_HASHFILE="" CDLB_ITEM="" CDLB_SIG_FILE=""
+
+    for CDLB_ITEM in ${CDLB_SHA}; do
+
+      CDLB_HASHFILE="${CDLB_SCRIPT}.${CDLB_ITEM}"
+      CDLB_SIG_FILE="${CDLB_HASHFILE}.sig"
+      CDLB_CMD="${CDLB_ITEM}sum"
+
+      printf "Verifying signature of: [%s]\n" "${CDLB_HASHFILE}"
+
+      if ! gpgv --keyring 0030-verify-checksums_public.gpg "${CDLB_SIG_FILE}" "${CDLB_HASHFILE}"; then
+
+        printf "Signature verification failed for: [%s]\n" "${CDLB_HASHFILE}"
+        sleep 8
+        # TODO: Remove debug mode
+        # return 0
+
+      else
+
+        printf "Signature verification successful for: [%s]\n" "${CDLB_HASHFILE}"
+
+      fi
+
+      printf "Recomputing hash for: [%s]\n" "${CDLB_ITEM}"
+
+      CDLB_COMPUTED=$("${CDLB_CMD}" "${CDLB_SCRIPT}" | { read -r first rest || exit 1; printf '%s\n' "${first}"; })
+      read -r CDLB_EXPECTED < "${CDLB_HASHFILE}"
+
+      if [ "${CDLB_COMPUTED}" != "${CDLB_EXPECTED}" ]; then
+
+        printf "Recomputed hash mismatch for: [%s]\n" "${CDLB_ITEM}"
+        sleep 8
+        # TODO: Remove debug mode
+        # return 0
+
+      fi
+
+      printf "Hash verification successful for: [%s]\n" "${CDLB_ITEM}"
+
+    done
+
+    printf "Verifying integrity of '0030-verify-checksums' successfully completed. Proceeding."
+
+    log_end_msg
+    printf "\n"
+
+  fi
+
+  ### Checksum and checksum signature verification -----------------------------------------------------------------------------
+  log_begin_msg "Verifying checksums"
+  printf "\n"
+
+  # shellcheck disable=SC2001
+  for _DIGEST in $(echo "${LIVE_VERIFY_CHECKSUMS_DIGESTS}" | sed -e 's|,| |g'); do
+
+    # shellcheck disable=SC2060
+    _CHECKSUMS="$(echo "${_DIGEST}" | tr [a-z] [A-Z])SUMS ${_DIGEST}sum.txt"
+
+    for _CHECKSUM in ${_CHECKSUMS}; do
+
+      if [ -e "${_CHECKSUM}" ]; then
+
+        printf "Found [%s] ...\n" "${_CHECKSUM}"
+
+        if [ -e "/bin/${_DIGEST}sum" ]; then
+
+          if [ "${LIVE_VERIFY_CHECKSUMS_SIGNATURES}" = "true" ]; then
+
+            printf "Checking Signature of [%s] ...\n" "${_CHECKSUM}"
+            _CHECKSUM_SIGNATURE="${_CHECKSUM}.sig"
+            gpgv --keyring 0030-verify-checksums_public.gpg "${_CHECKSUM_SIGNATURE}" "${_CHECKSUM}"
+            _RETURN_PGP="${?}"
+
+          else
+
+            _RETURN_PGP="na"
+
+          fi
+
+          printf "Checking Hashes of [%s] ...\n" "${_CHECKSUM}"
+
+          # shellcheck disable=SC2312
+          grep -v '^#' "${_CHECKSUM}" | /bin/"${_DIGEST}"sum -c > "${_TTY}"
+          _RETURN_SHA="${?}"
+
+          # Stop after the first verification.
+          break 2
+
+        else
+
+          printf "Not found [%s] ...\n" "/bin/${_DIGEST}sum"
+
+        fi
+
+      fi
+
+    done
+
+  done
+
+  log_end_msg
+
+  case "${_RETURN_PGP},${_RETURN_SHA}" in
+
+    0,0)
+      log_success_msg "Verification of signature AND checksum file successful; continuing booting in 8 seconds."
+      sleep 8
+      return 0
+      ;;
+
+    na,0)
+      log_success_msg "Verification of checksum file successful; continuing booting in 8 seconds."
+      sleep 8
+      return 0
+      ;;
+
+    *,0)
+      panic "Verification of signature file failed while verification of checksum file successful."
+      ;;
+
+    na,*)
+      panic "Verification of checksum file failed."
+      ;;
+
+  esac
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

scripts/usr/lib/live/build/binary_checksums.sh

@@ -1,11 +1,13 @@
 #!/bin/sh
 # bashsupport disable=BP5007
+# shellcheck shell=sh
 
 # SPDX-Version: 3.0
 # SPDX-CreationInfo: 2025-10-26; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
 # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
 # SPDX-FileCopyrightText: 2006-2015 Daniel Baumann <mail@daniel-baumann.ch>
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-FileType: SOURCE
 # SPDX-License-Identifier: GPL-3.0-or-later
 # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
@@ -22,10 +24,9 @@
 ## This is free software, and you are welcome to redistribute it
 ## under certain conditions; see COPYING for details.
 
-set -e
+set -Ceu
 
 ### Including common functions.
-# shellcheck disable=SC2292
 if [ -e "${LIVE_BUILD}/scripts/build.sh" ]; then
   . "${LIVE_BUILD}/scripts/build.sh"
 else
@@ -34,19 +35,17 @@ fi
 
 ### Setting static variables.
 # shellcheck disable=SC2034
-DESCRIPTION="Create binary checksums and PGP signature files."
+DESCRIPTION="[CDLB] Create binary checksums and PGP signature files."
 # shellcheck disable=SC2034
 USAGE="${PROGRAM} [--force]"
 
 ### Processing arguments and configuration files.
 Init_config_data "${@}"
 
-# shellcheck disable=SC2292
 if [ "${LB_CHECKSUMS}" = "none" ]; then
 	exit 0
 fi
 
-# shellcheck disable=SC2292
 if [ "${LB_INITRAMFS}" = "dracut-live" ]; then
 	### The checksums will be generated by binary_iso.
 	exit 0
@@ -61,7 +60,7 @@ Check_stagefile
 ### Acquire a lock file.
 Acquire_lockfile
 
-declare CHECKSUM=""
+CHECKSUM=""
 
 for CHECKSUM in ${LB_CHECKSUMS}; do
 
@@ -69,7 +68,7 @@ for CHECKSUM in ${LB_CHECKSUMS}; do
 
 	Echo_message "Begin creating binary ${CHECKSUMS} ..."
 
-	### Remove old checksums.
+  ### Remove old checksums.
   # shellcheck disable=SC2292
 	if [ -f "binary/${CHECKSUMS}" ]; then
 
@@ -91,18 +90,29 @@ for CHECKSUM in ${LB_CHECKSUMS}; do
     \! -path './*gpg' \
     \! -path './*sig' \
 		-print0 | LC_ALL=C sort -z | xargs -0 "${CHECKSUM}sum" >| "${CHECKSUMS}"
+  Echo_message "Begin creating binary ${CHECKSUMS} done."
 
-  ### sha256sum.txt
-  Echo_message "Begin creating GPG armor signature ${CHECKSUMS} ..."
-  gpg --batch --yes --local-user "${LB_GPG_SIGN_KEY}" --armor --detach-sign --output "${CHECKSUMS}.asc" "${CHECKSUMS}"
+  Echo_message "Begin verifying binary ${CHECKSUMS} ..."
+  "${CHECKSUM}sum" -c --strict --quiet "${CHECKSUMS}"
+  Echo_message "Begin verifying binary ${CHECKSUMS} done."
 
-  Echo_message "Begin creating GPG binary signature ${CHECKSUMS} ..."
-  gpg --batch --yes --local-user "${LB_GPG_SIGN_KEY}" --detach-sign --output "${CHECKSUMS}.sig" "${CHECKSUMS}"
+  if [ "${VAR_SIGNER}" = "true" ]; then
 
+    Echo_message "Begin creating GPG binary signature ${CHECKSUMS} ..."
+    gpg --batch --yes --pinentry-mode loopback --passphrase-file "${VAR_SIGNING_KEY_PASSFILE}" --local-user "${VAR_SIGNING_KEY_FPR}" \
+      --detach-sign --output "${CHECKSUMS}.sig" "${CHECKSUMS}"
+    Echo_message "Begin creating GPG binary signature ${CHECKSUMS} done."
 
+    Echo_message "Begin verifying GPG binary signature ${CHECKSUMS} ..."
+    gpgv --keyring "${VAR_VERIFY_KEYRING}" "${CHECKSUMS}.sig" "${CHECKSUMS}"
+    Echo_message "Begin verifying GPG binary signature ${CHECKSUMS} done."
+
+  fi
+
+  Echo_message "Begin creating '${CHECKSUM}sum.README' ..."
 	cat << EOF >| "${CHECKSUM}sum.README"
 # SPDX-Version: 3.0
-# SPDX-CreationInfo: 2025-10-26; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
 # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
 # SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
@@ -119,6 +129,7 @@ ${CHECKSUM}sum -c ${CHECKSUMS}
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=text
 EOF
+  Echo_message "Begin creating '${CHECKSUM}sum.README' done."
 
 	cd "${OLDPWD}"
 

scripts/usr/lib/live/build/binary_rootfs.sh

@@ -1,11 +1,13 @@
 #!/bin/sh
 # bashsupport disable=BP5007
+# shellcheck shell=sh
 
 # SPDX-Version: 3.0
 # SPDX-CreationInfo: 2025-10-28; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
 # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
 # SPDX-FileCopyrightText: 2006-2015 Daniel Baumann <mail@daniel-baumann.ch>
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-FileType: SOURCE
 # SPDX-License-Identifier: GPL-3.0-or-later
 # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
@@ -25,7 +27,6 @@
 set -e
 
 # Including common functions.
-# shellcheck disable=SC2292
 if [ -e "${LIVE_BUILD}/scripts/build.sh" ]; then
   . "${LIVE_BUILD}/scripts/build.sh"
 else
@@ -77,7 +78,6 @@ esac
 # Creating directory
 mkdir -p "binary/${INITFS}"
 
-# shellcheck disable=SC2292
 if In_list "rootfs" "${LB_CACHE_STAGES}" && [ -d cache/binary_rootfs ]
 then
 	# Removing old chroot
@@ -104,7 +104,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		Install_packages
 
 		# Remove old image
-    # shellcheck disable=SC2292
 		if [ -f "binary/${INITFS}/filesystem.${LB_CHROOT_FILESYSTEM}" ]
 		then
 			rm -f "binary/${INITFS}/filesystem.${LB_CHROOT_FILESYSTEM}"
@@ -140,7 +139,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 					FAKE_MTAB=true
 				fi
 				BLOCK_SIZE=1024
-        # shellcheck disable=SC2292
 				if [ "${LB_DM_VERITY}" = "true" ]
 				then
 					# Module dm-verity needs a block size of at least 4k
@@ -168,7 +166,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 				# Removing depends
 				Remove_packages
 
-        # shellcheck disable=SC2292
 				if [ -e chroot/chroot.cache ]
 				then
 					Remove_lockfile
@@ -215,13 +212,11 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		Install_packages
 
 		# Remove old jffs2 image
-    # shellcheck disable=SC2292
 		if [ -f "binary/${INITFS}/filesystem.jffs2" ]
 		then
 			rm -f "binary/${INITFS}/filesystem.jffs2"
 		fi
 
-    # shellcheck disable=SC2292
 		if [ -n "${LB_JFFS2_ERASEBLOCK}" ]
 		then
 			JFFS2_OPTIONS="--eraseblock=${LB_JFFS2_ERASEBLOCK}"
@@ -237,7 +232,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 				# Removing depends
 				Remove_packages
 
-        # shellcheck disable=SC2292
 				if [ -e chroot/chroot.cache ]
 				then
 					Remove_lockfile
@@ -266,7 +260,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		;;
 
 	plain)
-    # shellcheck disable=SC2292
 		if [ -d "binary/${INITFS}/filesystem.dir" ]
 		then
 			rm -rf "binary/${INITFS}/filesystem.dir"
@@ -274,7 +267,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 
 		case "${LB_BUILD_WITH_CHROOT}" in
 			true)
-        # shellcheck disable=SC2292
 				if [ -e chroot/chroot.cache ]
 				then
 					# Different from the other LB_CHROOT_FILESYSTEM values:
@@ -310,7 +302,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		Echo_message "This may take a while."
 
 		# Remove old squashfs image
-    # shellcheck disable=SC2292
 		if [ -f "binary/${INITFS}/filesystem.squashfs" ]
 		then
 			rm -f "binary/${INITFS}/filesystem.squashfs"
@@ -322,19 +313,16 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		# Do not display the progress bar if:
 		# - Run with --quiet, or
 		# - stdin is not a terminal (e.g., in CI, cron, etc.)
-    # shellcheck disable=SC2292
 		if [ "${_QUIET}" = "true" ] || [ ! -t 0 ]
 		then
 			MKSQUASHFS_OPTIONS="-no-progress ${MKSQUASHFS_OPTIONS}"
 		fi
 
-    # shellcheck disable=SC2292
 		if [ "${_VERBOSE}" = "true" ]
 		then
 			MKSQUASHFS_OPTIONS="-info ${MKSQUASHFS_OPTIONS}"
 		fi
 
-    # shellcheck disable=SC2292
 		if [ -f config/rootfs/squashfs.sort ]
 		then
 			MKSQUASHFS_OPTIONS="-sort squashfs.sort ${MKSQUASHFS_OPTIONS}"
@@ -351,7 +339,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		fi
 
 		# Set squashfs compression type or default to xz
-    # shellcheck disable=SC2292
 		if [ -n "${LB_CHROOT_SQUASHFS_COMPRESSION_TYPE}" ]
 		then
 			MKSQUASHFS_OPTIONS="-comp ${LB_CHROOT_SQUASHFS_COMPRESSION_TYPE} ${MKSQUASHFS_OPTIONS}"
@@ -359,7 +346,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 			MKSQUASHFS_OPTIONS="-comp xz ${MKSQUASHFS_OPTIONS}"
 		fi
 
-    # shellcheck disable=SC2292
 		if [ -n "${LB_CHROOT_SQUASHFS_COMPRESSION_LEVEL}" ]
 		then
 			MKSQUASHFS_OPTIONS="-Xcompression-level ${LB_CHROOT_SQUASHFS_COMPRESSION_LEVEL} ${MKSQUASHFS_OPTIONS}"
@@ -367,7 +353,9 @@ case "${LB_CHROOT_FILESYSTEM}" in
 
 		case "${LB_BUILD_WITH_CHROOT}" in
 			true)
-        # shellcheck disable=SC2292
+        ### https://wiki.debian.org/ReproducibleInstalls/LiveImages
+        ### https://reproducible-builds.org/docs/system-images/
+        ### https://gitlab.tails.boum.org/tails/tails/-/blob/stable/config/chroot_local-includes/usr/share/tails/build/mksquashfs-excludes
 				if [ -e config/rootfs/excludes ]
 				then
 
@@ -403,7 +391,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 				# Removing depends
 				Remove_packages
 
-        # shellcheck disable=SC2292
 				if [ -e chroot/chroot.cache ]
 				then
 					Remove_lockfile
@@ -423,7 +410,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 				;;
 
 			false)
-        # shellcheck disable=SC2292
 				if [ -e config/rootfs/excludes ]
 				then
 					MKSQUASHFS_OPTIONS="-wildcards -ef config/rootfs/excludes ${MKSQUASHFS_OPTIONS}"
@@ -440,7 +426,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		;;
 
 	none)
-    # shellcheck disable=SC2292
 		if [ -d binary ]
 		then
 			rm -rf binary
@@ -466,7 +451,6 @@ then
 
 	mkdir -p cache/binary_rootfs
 
-  # shellcheck disable=SC2292
 	if [ "${LB_CHROOT_FILESYSTEM}" != "none" ]
 	then
 		cp -a binary/"${INITFS}"/filesystem.* cache/binary_rootfs

scripts/usr/local/sbin/9999-cdi-starter

@@ -127,7 +127,7 @@ main() {
   # shellcheck disable=SC2312
   exec > >(tee -a "${var_log}") 2>&1
 
-  printf "CISS.debian.installer Master V8.13.296.2025.10.29 is up! \n" >> "${var_log}"
+  printf "CISS.debian.installer Master V8.13.384.2025.11.06 is up! \n" >> "${var_log}"
 
   ### Sleep a moment to settle boot artifacts.
   sleep 8
@@ -182,7 +182,7 @@ main() {
 
   ### Timeout reached without acceptable semaphore.
   logger -t cdi-watcher "No valid semaphore ${VAR_SEMAPHORE} (mode 0600) within ${VAR_TIMEOUT}s; exiting idle."
-  printf "CISS.debian.installer Master V8.13.296.2025.10.29: No valid semaphore [%s] within [%s]s.\n" "${VAR_SEMAPHORE}" "${VAR_TIMEOUT}" >> "${var_log}"
+  printf "CISS.debian.installer Master V8.13.384.2025.11.06: No valid semaphore [%s] within [%s]s.\n" "${VAR_SEMAPHORE}" "${VAR_TIMEOUT}" >> "${var_log}"
 
   exit 0
 }