V8.13.384.2025.11.06

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

scripts/usr/lib/live/build/binary_rootfs.sh

@@ -1,11 +1,13 @@
 #!/bin/sh
 # bashsupport disable=BP5007
+# shellcheck shell=sh
 
 # SPDX-Version: 3.0
 # SPDX-CreationInfo: 2025-10-28; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
 # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
 # SPDX-FileCopyrightText: 2006-2015 Daniel Baumann <mail@daniel-baumann.ch>
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-FileType: SOURCE
 # SPDX-License-Identifier: GPL-3.0-or-later
 # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
@@ -25,7 +27,6 @@
 set -e
 
 # Including common functions.
-# shellcheck disable=SC2292
 if [ -e "${LIVE_BUILD}/scripts/build.sh" ]; then
   . "${LIVE_BUILD}/scripts/build.sh"
 else
@@ -77,7 +78,6 @@ esac
 # Creating directory
 mkdir -p "binary/${INITFS}"
 
-# shellcheck disable=SC2292
 if In_list "rootfs" "${LB_CACHE_STAGES}" && [ -d cache/binary_rootfs ]
 then
 	# Removing old chroot
@@ -104,7 +104,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		Install_packages
 
 		# Remove old image
-    # shellcheck disable=SC2292
 		if [ -f "binary/${INITFS}/filesystem.${LB_CHROOT_FILESYSTEM}" ]
 		then
 			rm -f "binary/${INITFS}/filesystem.${LB_CHROOT_FILESYSTEM}"
@@ -140,7 +139,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 					FAKE_MTAB=true
 				fi
 				BLOCK_SIZE=1024
-        # shellcheck disable=SC2292
 				if [ "${LB_DM_VERITY}" = "true" ]
 				then
 					# Module dm-verity needs a block size of at least 4k
@@ -168,7 +166,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 				# Removing depends
 				Remove_packages
 
-        # shellcheck disable=SC2292
 				if [ -e chroot/chroot.cache ]
 				then
 					Remove_lockfile
@@ -215,13 +212,11 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		Install_packages
 
 		# Remove old jffs2 image
-    # shellcheck disable=SC2292
 		if [ -f "binary/${INITFS}/filesystem.jffs2" ]
 		then
 			rm -f "binary/${INITFS}/filesystem.jffs2"
 		fi
 
-    # shellcheck disable=SC2292
 		if [ -n "${LB_JFFS2_ERASEBLOCK}" ]
 		then
 			JFFS2_OPTIONS="--eraseblock=${LB_JFFS2_ERASEBLOCK}"
@@ -237,7 +232,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 				# Removing depends
 				Remove_packages
 
-        # shellcheck disable=SC2292
 				if [ -e chroot/chroot.cache ]
 				then
 					Remove_lockfile
@@ -266,7 +260,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		;;
 
 	plain)
-    # shellcheck disable=SC2292
 		if [ -d "binary/${INITFS}/filesystem.dir" ]
 		then
 			rm -rf "binary/${INITFS}/filesystem.dir"
@@ -274,7 +267,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 
 		case "${LB_BUILD_WITH_CHROOT}" in
 			true)
-        # shellcheck disable=SC2292
 				if [ -e chroot/chroot.cache ]
 				then
 					# Different from the other LB_CHROOT_FILESYSTEM values:
@@ -310,7 +302,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		Echo_message "This may take a while."
 
 		# Remove old squashfs image
-    # shellcheck disable=SC2292
 		if [ -f "binary/${INITFS}/filesystem.squashfs" ]
 		then
 			rm -f "binary/${INITFS}/filesystem.squashfs"
@@ -322,19 +313,16 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		# Do not display the progress bar if:
 		# - Run with --quiet, or
 		# - stdin is not a terminal (e.g., in CI, cron, etc.)
-    # shellcheck disable=SC2292
 		if [ "${_QUIET}" = "true" ] || [ ! -t 0 ]
 		then
 			MKSQUASHFS_OPTIONS="-no-progress ${MKSQUASHFS_OPTIONS}"
 		fi
 
-    # shellcheck disable=SC2292
 		if [ "${_VERBOSE}" = "true" ]
 		then
 			MKSQUASHFS_OPTIONS="-info ${MKSQUASHFS_OPTIONS}"
 		fi
 
-    # shellcheck disable=SC2292
 		if [ -f config/rootfs/squashfs.sort ]
 		then
 			MKSQUASHFS_OPTIONS="-sort squashfs.sort ${MKSQUASHFS_OPTIONS}"
@@ -351,7 +339,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		fi
 
 		# Set squashfs compression type or default to xz
-    # shellcheck disable=SC2292
 		if [ -n "${LB_CHROOT_SQUASHFS_COMPRESSION_TYPE}" ]
 		then
 			MKSQUASHFS_OPTIONS="-comp ${LB_CHROOT_SQUASHFS_COMPRESSION_TYPE} ${MKSQUASHFS_OPTIONS}"
@@ -359,7 +346,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 			MKSQUASHFS_OPTIONS="-comp xz ${MKSQUASHFS_OPTIONS}"
 		fi
 
-    # shellcheck disable=SC2292
 		if [ -n "${LB_CHROOT_SQUASHFS_COMPRESSION_LEVEL}" ]
 		then
 			MKSQUASHFS_OPTIONS="-Xcompression-level ${LB_CHROOT_SQUASHFS_COMPRESSION_LEVEL} ${MKSQUASHFS_OPTIONS}"
@@ -367,7 +353,9 @@ case "${LB_CHROOT_FILESYSTEM}" in
 
 		case "${LB_BUILD_WITH_CHROOT}" in
 			true)
-        # shellcheck disable=SC2292
+        ### https://wiki.debian.org/ReproducibleInstalls/LiveImages
+        ### https://reproducible-builds.org/docs/system-images/
+        ### https://gitlab.tails.boum.org/tails/tails/-/blob/stable/config/chroot_local-includes/usr/share/tails/build/mksquashfs-excludes
 				if [ -e config/rootfs/excludes ]
 				then
 
@@ -403,7 +391,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 				# Removing depends
 				Remove_packages
 
-        # shellcheck disable=SC2292
 				if [ -e chroot/chroot.cache ]
 				then
 					Remove_lockfile
@@ -423,7 +410,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 				;;
 
 			false)
-        # shellcheck disable=SC2292
 				if [ -e config/rootfs/excludes ]
 				then
 					MKSQUASHFS_OPTIONS="-wildcards -ef config/rootfs/excludes ${MKSQUASHFS_OPTIONS}"
@@ -440,7 +426,6 @@ case "${LB_CHROOT_FILESYSTEM}" in
 		;;
 
 	none)
-    # shellcheck disable=SC2292
 		if [ -d binary ]
 		then
 			rm -rf binary
@@ -466,7 +451,6 @@ then
 
 	mkdir -p cache/binary_rootfs
 
-  # shellcheck disable=SC2292
 	if [ "${LB_CHROOT_FILESYSTEM}" != "none" ]
 	then
 		cp -a binary/"${INITFS}"/filesystem.* cache/binary_rootfs