V8.13.384.2025.11.06

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-11-06 19:59:22 +01:00
parent d436346343
commit ef87becefe
93 changed files with 2021 additions and 1229 deletions
--- a/scripts/usr/lib/live/build/binary_checksums.sh
+++ b/scripts/usr/lib/live/build/binary_checksums.sh
@@ -1,11 +1,13 @@
 #!/bin/sh
 # bashsupport disable=BP5007
+# shellcheck shell=sh

 # SPDX-Version: 3.0
 # SPDX-CreationInfo: 2025-10-26; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
 # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
 # SPDX-FileCopyrightText: 2006-2015 Daniel Baumann <mail@daniel-baumann.ch>
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-FileType: SOURCE
 # SPDX-License-Identifier: GPL-3.0-or-later
 # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
@@ -22,10 +24,9 @@
 ## This is free software, and you are welcome to redistribute it
 ## under certain conditions; see COPYING for details.

-set -e
+set -Ceu

 ### Including common functions.
-# shellcheck disable=SC2292
 if [ -e "${LIVE_BUILD}/scripts/build.sh" ]; then
  . "${LIVE_BUILD}/scripts/build.sh"
 else
@@ -34,19 +35,17 @@ fi

 ### Setting static variables.
 # shellcheck disable=SC2034
-DESCRIPTION="Create binary checksums and PGP signature files."
+DESCRIPTION="[CDLB] Create binary checksums and PGP signature files."
 # shellcheck disable=SC2034
 USAGE="${PROGRAM} [--force]"

 ### Processing arguments and configuration files.
 Init_config_data "${@}"

-# shellcheck disable=SC2292
 if [ "${LB_CHECKSUMS}" = "none" ]; then
 	exit 0
 fi

-# shellcheck disable=SC2292
 if [ "${LB_INITRAMFS}" = "dracut-live" ]; then
 	### The checksums will be generated by binary_iso.
 	exit 0
@@ -61,7 +60,7 @@ Check_stagefile
 ### Acquire a lock file.
 Acquire_lockfile

-declare CHECKSUM=""
+CHECKSUM=""

 for CHECKSUM in ${LB_CHECKSUMS}; do

@@ -69,7 +68,7 @@ for CHECKSUM in ${LB_CHECKSUMS}; do

 	Echo_message "Begin creating binary ${CHECKSUMS} ..."

-	### Remove old checksums.
+  ### Remove old checksums.
  # shellcheck disable=SC2292
 	if [ -f "binary/${CHECKSUMS}" ]; then

@@ -91,18 +90,29 @@ for CHECKSUM in ${LB_CHECKSUMS}; do
    \! -path './*gpg' \
    \! -path './*sig' \
 		-print0 | LC_ALL=C sort -z | xargs -0 "${CHECKSUM}sum" >| "${CHECKSUMS}"
+  Echo_message "Begin creating binary ${CHECKSUMS} done."

-  ### sha256sum.txt
-  Echo_message "Begin creating GPG armor signature ${CHECKSUMS} ..."
-  gpg --batch --yes --local-user "${LB_GPG_SIGN_KEY}" --armor --detach-sign --output "${CHECKSUMS}.asc" "${CHECKSUMS}"
+  Echo_message "Begin verifying binary ${CHECKSUMS} ..."
+  "${CHECKSUM}sum" -c --strict --quiet "${CHECKSUMS}"
+  Echo_message "Begin verifying binary ${CHECKSUMS} done."

-  Echo_message "Begin creating GPG binary signature ${CHECKSUMS} ..."
-  gpg --batch --yes --local-user "${LB_GPG_SIGN_KEY}" --detach-sign --output "${CHECKSUMS}.sig" "${CHECKSUMS}"
+  if [ "${VAR_SIGNER}" = "true" ]; then

+    Echo_message "Begin creating GPG binary signature ${CHECKSUMS} ..."
+    gpg --batch --yes --pinentry-mode loopback --passphrase-file "${VAR_SIGNING_KEY_PASSFILE}" --local-user "${VAR_SIGNING_KEY_FPR}" \
+      --detach-sign --output "${CHECKSUMS}.sig" "${CHECKSUMS}"
+    Echo_message "Begin creating GPG binary signature ${CHECKSUMS} done."

+    Echo_message "Begin verifying GPG binary signature ${CHECKSUMS} ..."
+    gpgv --keyring "${VAR_VERIFY_KEYRING}" "${CHECKSUMS}.sig" "${CHECKSUMS}"
+    Echo_message "Begin verifying GPG binary signature ${CHECKSUMS} done."
+
+  fi
+
+  Echo_message "Begin creating '${CHECKSUM}sum.README' ..."
 	cat << EOF >| "${CHECKSUM}sum.README"
 # SPDX-Version: 3.0
-# SPDX-CreationInfo: 2025-10-26; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
 # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
 # SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
@@ -119,6 +129,7 @@ ${CHECKSUM}sum -c ${CHECKSUMS}

 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=text
 EOF
+  Echo_message "Begin creating '${CHECKSUM}sum.README' done."

 	cd "${OLDPWD}"

--- a/scripts/usr/lib/live/build/binary_rootfs.sh
+++ b/scripts/usr/lib/live/build/binary_rootfs.sh
@@ -1,11 +1,13 @@
 #!/bin/sh
 # bashsupport disable=BP5007
+# shellcheck shell=sh

 # SPDX-Version: 3.0
 # SPDX-CreationInfo: 2025-10-28; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
 # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
 # SPDX-FileCopyrightText: 2006-2015 Daniel Baumann <mail@daniel-baumann.ch>
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-FileType: SOURCE
 # SPDX-License-Identifier: GPL-3.0-or-later
 # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
@@ -25,7 +27,6 @@
 set -e

 # Including common functions.
-# shellcheck disable=SC2292
 if [ -e "${LIVE_BUILD}/scripts/build.sh" ]; then
  . "${LIVE_BUILD}/scripts/build.sh"
 else
@@ -77,7 +78,6 @@ esac
 # Creating directory
 mkdir -p "binary/${INITFS}"

-# shellcheck disable=SC2292
 if In_list "rootfs" "${LB_CACHE_STAGES}" && [ -d cache/binary_rootfs ]
 then
 	# Removing old chroot
@@ -104,7 +104,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		Install_packages

 		# Remove old image
-    # shellcheck disable=SC2292
 		if [ -f "binary/${INITFS}/filesystem.${LB_CHROOT_FILESYSTEM}" ]
 		then
 			rm -f "binary/${INITFS}/filesystem.${LB_CHROOT_FILESYSTEM}"
@@ -140,7 +139,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 					FAKE_MTAB=true
 				fi
 				BLOCK_SIZE=1024
-        # shellcheck disable=SC2292
 				if [ "${LB_DM_VERITY}" = "true" ]
 				then
 					# Module dm-verity needs a block size of at least 4k
@@ -168,7 +166,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 				# Removing depends
 				Remove_packages

-        # shellcheck disable=SC2292
 				if [ -e chroot/chroot.cache ]
 				then
 					Remove_lockfile
@@ -215,13 +212,11 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		Install_packages

 		# Remove old jffs2 image
-    # shellcheck disable=SC2292
 		if [ -f "binary/${INITFS}/filesystem.jffs2" ]
 		then
 			rm -f "binary/${INITFS}/filesystem.jffs2"
 		fi

-    # shellcheck disable=SC2292
 		if [ -n "${LB_JFFS2_ERASEBLOCK}" ]
 		then
 			JFFS2_OPTIONS="--eraseblock=${LB_JFFS2_ERASEBLOCK}"
@@ -237,7 +232,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 				# Removing depends
 				Remove_packages

-        # shellcheck disable=SC2292
 				if [ -e chroot/chroot.cache ]
 				then
 					Remove_lockfile
@@ -266,7 +260,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		;;

 	plain)
-    # shellcheck disable=SC2292
 		if [ -d "binary/${INITFS}/filesystem.dir" ]
 		then
 			rm -rf "binary/${INITFS}/filesystem.dir"
@@ -274,7 +267,6 @@ case "${LB_CHROOT_FILESYSTEM}" in

 		case "${LB_BUILD_WITH_CHROOT}" in
 			true)
-        # shellcheck disable=SC2292
 				if [ -e chroot/chroot.cache ]
 				then
 					# Different from the other LB_CHROOT_FILESYSTEM values:
@@ -310,7 +302,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		Echo_message "This may take a while."

 		# Remove old squashfs image
-    # shellcheck disable=SC2292
 		if [ -f "binary/${INITFS}/filesystem.squashfs" ]
 		then
 			rm -f "binary/${INITFS}/filesystem.squashfs"
@@ -322,19 +313,16 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		# Do not display the progress bar if:
 		# - Run with --quiet, or
 		# - stdin is not a terminal (e.g., in CI, cron, etc.)
-    # shellcheck disable=SC2292
 		if [ "${_QUIET}" = "true" ] || [ ! -t 0 ]
 		then
 			MKSQUASHFS_OPTIONS="-no-progress ${MKSQUASHFS_OPTIONS}"
 		fi

-    # shellcheck disable=SC2292
 		if [ "${_VERBOSE}" = "true" ]
 		then
 			MKSQUASHFS_OPTIONS="-info ${MKSQUASHFS_OPTIONS}"
 		fi

-    # shellcheck disable=SC2292
 		if [ -f config/rootfs/squashfs.sort ]
 		then
 			MKSQUASHFS_OPTIONS="-sort squashfs.sort ${MKSQUASHFS_OPTIONS}"
@@ -351,7 +339,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		fi

 		# Set squashfs compression type or default to xz
-    # shellcheck disable=SC2292
 		if [ -n "${LB_CHROOT_SQUASHFS_COMPRESSION_TYPE}" ]
 		then
 			MKSQUASHFS_OPTIONS="-comp ${LB_CHROOT_SQUASHFS_COMPRESSION_TYPE} ${MKSQUASHFS_OPTIONS}"
@@ -359,7 +346,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 			MKSQUASHFS_OPTIONS="-comp xz ${MKSQUASHFS_OPTIONS}"
 		fi

-    # shellcheck disable=SC2292
 		if [ -n "${LB_CHROOT_SQUASHFS_COMPRESSION_LEVEL}" ]
 		then
 			MKSQUASHFS_OPTIONS="-Xcompression-level ${LB_CHROOT_SQUASHFS_COMPRESSION_LEVEL} ${MKSQUASHFS_OPTIONS}"
@@ -367,7 +353,9 @@ case "${LB_CHROOT_FILESYSTEM}" in

 		case "${LB_BUILD_WITH_CHROOT}" in
 			true)
-        # shellcheck disable=SC2292
+        ### https://wiki.debian.org/ReproducibleInstalls/LiveImages
+        ### https://reproducible-builds.org/docs/system-images/
+        ### https://gitlab.tails.boum.org/tails/tails/-/blob/stable/config/chroot_local-includes/usr/share/tails/build/mksquashfs-excludes
 				if [ -e config/rootfs/excludes ]
 				then

@@ -403,7 +391,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 				# Removing depends
 				Remove_packages

-        # shellcheck disable=SC2292
 				if [ -e chroot/chroot.cache ]
 				then
 					Remove_lockfile
@@ -423,7 +410,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 				;;

 			false)
-        # shellcheck disable=SC2292
 				if [ -e config/rootfs/excludes ]
 				then
 					MKSQUASHFS_OPTIONS="-wildcards -ef config/rootfs/excludes ${MKSQUASHFS_OPTIONS}"
@@ -440,7 +426,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		;;

 	none)
-    # shellcheck disable=SC2292
 		if [ -d binary ]
 		then
 			rm -rf binary
@@ -466,7 +451,6 @@ then

 	mkdir -p cache/binary_rootfs

-  # shellcheck disable=SC2292
 	if [ "${LB_CHROOT_FILESYSTEM}" != "none" ]
 	then
 		cp -a binary/"${INITFS}"/filesystem.* cache/binary_rootfs