V8.13.384.2025.11.06

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

scripts/usr/lib/live/build/binary_checksums.sh

@@ -1,11 +1,13 @@
 #!/bin/sh
 # bashsupport disable=BP5007
+# shellcheck shell=sh
 
 # SPDX-Version: 3.0
 # SPDX-CreationInfo: 2025-10-26; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
 # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
 # SPDX-FileCopyrightText: 2006-2015 Daniel Baumann <mail@daniel-baumann.ch>
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-FileType: SOURCE
 # SPDX-License-Identifier: GPL-3.0-or-later
 # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
@@ -22,10 +24,9 @@
 ## This is free software, and you are welcome to redistribute it
 ## under certain conditions; see COPYING for details.
 
-set -e
+set -Ceu
 
 ### Including common functions.
-# shellcheck disable=SC2292
 if [ -e "${LIVE_BUILD}/scripts/build.sh" ]; then
   . "${LIVE_BUILD}/scripts/build.sh"
 else
@@ -34,19 +35,17 @@ fi
 
 ### Setting static variables.
 # shellcheck disable=SC2034
-DESCRIPTION="Create binary checksums and PGP signature files."
+DESCRIPTION="[CDLB] Create binary checksums and PGP signature files."
 # shellcheck disable=SC2034
 USAGE="${PROGRAM} [--force]"
 
 ### Processing arguments and configuration files.
 Init_config_data "${@}"
 
-# shellcheck disable=SC2292
 if [ "${LB_CHECKSUMS}" = "none" ]; then
 	exit 0
 fi
 
-# shellcheck disable=SC2292
 if [ "${LB_INITRAMFS}" = "dracut-live" ]; then
 	### The checksums will be generated by binary_iso.
 	exit 0
@@ -61,7 +60,7 @@ Check_stagefile
 ### Acquire a lock file.
 Acquire_lockfile
 
-declare CHECKSUM=""
+CHECKSUM=""
 
 for CHECKSUM in ${LB_CHECKSUMS}; do
 
@@ -69,7 +68,7 @@ for CHECKSUM in ${LB_CHECKSUMS}; do
 
 	Echo_message "Begin creating binary ${CHECKSUMS} ..."
 
-	### Remove old checksums.
+  ### Remove old checksums.
   # shellcheck disable=SC2292
 	if [ -f "binary/${CHECKSUMS}" ]; then
 
@@ -91,18 +90,29 @@ for CHECKSUM in ${LB_CHECKSUMS}; do
     \! -path './*gpg' \
     \! -path './*sig' \
 		-print0 | LC_ALL=C sort -z | xargs -0 "${CHECKSUM}sum" >| "${CHECKSUMS}"
+  Echo_message "Begin creating binary ${CHECKSUMS} done."
 
-  ### sha256sum.txt
-  Echo_message "Begin creating GPG armor signature ${CHECKSUMS} ..."
-  gpg --batch --yes --local-user "${LB_GPG_SIGN_KEY}" --armor --detach-sign --output "${CHECKSUMS}.asc" "${CHECKSUMS}"
+  Echo_message "Begin verifying binary ${CHECKSUMS} ..."
+  "${CHECKSUM}sum" -c --strict --quiet "${CHECKSUMS}"
+  Echo_message "Begin verifying binary ${CHECKSUMS} done."
 
-  Echo_message "Begin creating GPG binary signature ${CHECKSUMS} ..."
-  gpg --batch --yes --local-user "${LB_GPG_SIGN_KEY}" --detach-sign --output "${CHECKSUMS}.sig" "${CHECKSUMS}"
+  if [ "${VAR_SIGNER}" = "true" ]; then
 
+    Echo_message "Begin creating GPG binary signature ${CHECKSUMS} ..."
+    gpg --batch --yes --pinentry-mode loopback --passphrase-file "${VAR_SIGNING_KEY_PASSFILE}" --local-user "${VAR_SIGNING_KEY_FPR}" \
+      --detach-sign --output "${CHECKSUMS}.sig" "${CHECKSUMS}"
+    Echo_message "Begin creating GPG binary signature ${CHECKSUMS} done."
 
+    Echo_message "Begin verifying GPG binary signature ${CHECKSUMS} ..."
+    gpgv --keyring "${VAR_VERIFY_KEYRING}" "${CHECKSUMS}.sig" "${CHECKSUMS}"
+    Echo_message "Begin verifying GPG binary signature ${CHECKSUMS} done."
+
+  fi
+
+  Echo_message "Begin creating '${CHECKSUM}sum.README' ..."
 	cat << EOF >| "${CHECKSUM}sum.README"
 # SPDX-Version: 3.0
-# SPDX-CreationInfo: 2025-10-26; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
 # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
 # SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
@@ -119,6 +129,7 @@ ${CHECKSUM}sum -c ${CHECKSUMS}
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=text
 EOF
+  Echo_message "Begin creating '${CHECKSUM}sum.README' done."
 
 	cd "${OLDPWD}"