msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity
Files
42e2ae6b0ee1e41d1f3da70b766378f8091a10440b868bb12ee7eebf98403664
CISS.debian.live.builder/config/hooks/live/zzzz_ciss_crypt_squash.hook.binary
T

264 lines
7.8 KiB
Bash
Raw Blame History

#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-10-11; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: LicenseRef-CNCL-1.1 OR LicenseRef-CCLA-1.1
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
# shellcheck disable=SC2154
set -Ceuo pipefail
# Final live-build binary hook for encrypted root filesystem packaging. Preallocate a LUKS2 container, format it with the
# generated build secret, copy the generated filesystem.squashfs into the opened encrypted mapping, generate and sign a
# SHA-512 attestation manifest for the complete decrypted mapper, then close the container, shred the temporary LUKS secret,
# and remove the plaintext SquashFS from the ISO payload.
printf "\e[95m🧪 '%s' starting ... \e[0m\n" "${0}"
__umask=$(umask)
umask 0077
#######################################
# Prints a fatal error message and terminates the hook.
# Globals:
# None
# Arguments:
# 1: Error message
# Returns:
# 42: always exits with failure
#######################################
die() {
declare message="${1}"
printf "\e[91m❌ %s \e[0m\n" "${message}" >&2
exit 42
}
#######################################
# Checks whether a required command exists.
# Globals:
# None
# Arguments:
# 1: Command name
# Returns:
# 0: on success
# 42: if the command is missing
#######################################
require_command() {
declare command_name="${1}"
command -v "${command_name}" >/dev/null 2>&1 || die "Required command not found: '${command_name}'."
return 0
}
#######################################
# Checks whether a required file exists and is readable.
# Globals:
# None
# Arguments:
# 1: File path
# 2: Human-readable file description
# Returns:
# 0: on success
# 42: if the file is missing or unreadable
#######################################
require_file() {
declare file_path="${1}"
declare description="${2}"
[[ -f "${file_path}" && -r "${file_path}" ]] || die "Missing or unreadable ${description}: '${file_path}'."
return 0
}
#######################################
# Checks whether a required environment variable is non-empty.
# Globals:
# None
# Arguments:
# 1: Variable name
# Returns:
# 0: on success
# 42: if the variable is empty or unset
#######################################
require_variable() {
declare variable_name="${1}"
[[ -n "${!variable_name:-}" ]] || die "Required environment variable is empty or unset: '${variable_name}'."
return 0
}
#######################################
# Pre allocates space for LUKS container.
# Globals:
# None
# Arguments:
# 1: LUKS Container
# 2: LUKS Container Size
# Returns:
# 0: on success
# 42: on failure
#######################################
preallocate() {
declare file="$1" size="$2"
declare -i blocksize=$((8*1024*1024))
declare -i blockcounter=$(( (size + blocksize - 1) / blocksize ))
if fallocate -l "${size}" -- "${file}" 2>/dev/null; then
printf "\e[92m✅ [fallocate -l %s -- %s] successful. \e[0m\n" "${size}" "${file}"
return 0
else
printf "\e[91m❌ [fallocate -l %s -- %s] NOT successful. \e[0m\n" "${size}" "${file}"
fi
if dd if=/dev/zero of="${file}" bs="${blocksize}" count="${blockcounter}" status=progress conv=fsync; then
printf "\e[92m✅ [dd if=/dev/zero of=%s bs=%s count=%s status=progress conv=fsync] successful. \e[0m\n" "${file}" "${blocksize}" "${blockcounter}"
return 0
else
printf "\e[91m❌ [dd if=/dev/zero of=%s bs=%s count=%s status=progress conv=fsync] NOT successful. \e[0m\n" "${file}" "${blocksize}" "${blockcounter}"
return 42
fi
}
### Prevents accidental 'unset -f'.
# shellcheck disable=SC2034
readonly -f preallocate
declare ROOTFS="${VAR_HANDLER_BUILD_DIR}/binary/live/filesystem.squashfs"
declare LUKSFS="${VAR_HANDLER_BUILD_DIR}/binary/live/ciss_rootfs.crypt"
declare MAPPER_DEV="/dev/mapper/crypt_liveiso"
declare ROOTFS_ATTESTATION="${LUKSFS}.decrypted.sha512sum.txt"
declare ROOTFS_ATTESTATION_SIG="${ROOTFS_ATTESTATION}.sig"
declare KEYFD=""
require_command gpg
require_command gpgv
require_command sha512sum
require_file "${ROOTFS}" "final SquashFS payload"
require_variable VAR_SIGNING_KEY_FPR
require_variable VAR_SIGNING_KEY_PASSFILE
require_variable VAR_VERIFY_KEYRING
require_file "${VAR_SIGNING_KEY_PASSFILE}" "GPG signing passphrase file"
require_file "${VAR_VERIFY_KEYRING}" "GPG verification keyring"
[[ "${VAR_SIGNER:-false}" == "true" ]] || die "Rootfs attestation requires an enabled artifact signer."
rm -f -- "${ROOTFS_ATTESTATION}" "${ROOTFS_ATTESTATION_SIG}"
# shellcheck disable=SC2155
declare -i VAR_ROOTFS_SIZE=$(stat -c%s -- "${ROOTFS}")
### Safety margin:
# - LUKS2-Header and Metadata
# - dm-integrity Overhead (Tags and Journal)
# - Filesystem-Slack
declare -i OVERHEAD_FIXED=$((64 * 1024 * 1024))
declare -i OVERHEAD_PCT=2
declare -i ALIGN_BYTES=$(( 4096 * 1024 ))
declare -i BASE_SIZE=$(( VAR_ROOTFS_SIZE + OVERHEAD_FIXED + (VAR_ROOTFS_SIZE * OVERHEAD_PCT / 100) ))
declare -i VAR_LUKSFS_SIZE=$(( ( (BASE_SIZE + ALIGN_BYTES - 1) / ALIGN_BYTES ) * ALIGN_BYTES ))
preallocate "${LUKSFS}" "${VAR_LUKSFS_SIZE}"
exec {KEYFD}<"${VAR_TMP_SECRET}/luks.txt"
if [[ "${VAR_CDLB_INSIDE_RUNNER}" == "false" ]]; then
cryptsetup luksFormat \
--batch-mode \
--cipher aes-xts-plain64 \
--integrity hmac-sha512 \
--iter-time 1000 \
--key-file "/proc/$$/fd/${KEYFD}" \
--key-size 512 \
--label crypt_liveiso \
--luks2-keyslots-size 16777216 \
--luks2-metadata-size 4194304 \
--pbkdf argon2id \
--sector-size 4096 \
--type luks2 \
--use-random \
--verbose \
"${LUKSFS}"
elif [[ "${VAR_CDLB_INSIDE_RUNNER}" == "true" ]]; then
cryptsetup luksFormat \
--batch-mode \
--cipher aes-xts-plain64 \
--iter-time 1000 \
--key-file "/proc/$$/fd/${KEYFD}" \
--key-size 512 \
--label crypt_liveiso \
--luks2-keyslots-size 16777216 \
--luks2-metadata-size 4194304 \
--pbkdf argon2id \
--sector-size 4096 \
--type luks2 \
--use-random \
--verbose \
"${LUKSFS}"
fi
cryptsetup open --key-file "/proc/$$/fd/${KEYFD}" "${LUKSFS}" crypt_liveiso
# shellcheck disable=SC2155
declare -i LUKS_FREE=$(blockdev --getsize64 "${MAPPER_DEV}")
declare -i SQUASH_FS="${VAR_ROOTFS_SIZE}"
if (( LUKS_FREE >= SQUASH_FS )); then
printf "\e[92m✅ LUKS_FREE '%s' >= SQUASH_FS '%s' \e[0m\n" "${LUKS_FREE}" "${SQUASH_FS}"
else
printf "\e[91m❌ LUKS_FREE '%s' <= SQUASH_FS '%s' \e[0m\n" "${LUKS_FREE}" "${SQUASH_FS}" >&2
exit 42
fi
dd if="${ROOTFS}" of="${MAPPER_DEV}" bs=8M status=progress conv=fsync
sync
# The selected boot root is the complete decrypted mapper. Hashing this exact block payload binds the signed manifest to the
# bytes later mounted as SquashFS, including the mapper padding after the SquashFS image.
LC_ALL=C sha512sum "${MAPPER_DEV}" >| "${ROOTFS_ATTESTATION}"
gpg --batch --yes --pinentry-mode loopback --passphrase-file "${VAR_SIGNING_KEY_PASSFILE}" --local-user "${VAR_SIGNING_KEY_FPR}" \
--detach-sign --output "${ROOTFS_ATTESTATION_SIG}" "${ROOTFS_ATTESTATION}"
gpgv --keyring "${VAR_VERIFY_KEYRING}" "${ROOTFS_ATTESTATION_SIG}" "${ROOTFS_ATTESTATION}"
(cd / && LC_ALL=C sha512sum -c --strict --quiet "${ROOTFS_ATTESTATION}")
chmod 0444 "${ROOTFS_ATTESTATION}" "${ROOTFS_ATTESTATION_SIG}"
cryptsetup close crypt_liveiso
exec {KEYFD}<&-
shred -fzu -n 5 -- "${VAR_TMP_SECRET}/luks.txt"
rm -f -- "${ROOTFS}"
umask "${__umask}"
__umask=""
printf "\e[92m✅ '%s' applied successfully. \e[0m\n" "${0}"
exit 0
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
Reference in New Issue View Git Blame Copy Permalink