markmental
a582ea332b
Update PHP to 8.3.36 for the php2shell CVEs. Remove eMudhra roots from the CA bundle. Update the kernel to 6.12.114 while keeping toolchain headers at 6.12.104. Refresh release and install documentation.
80 lines
3.1 KiB
Bash
Executable file
80 lines
3.1 KiB
Bash
Executable file
#!/bin/sh
|
|
# Copyright (C) 2026 Mark Robillard Jr (MARKMENTAL)
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
#
|
|
# post-build.sh - stamp the Mentalnet root filesystem with a build id
|
|
# and scrub compromised CAs from the trust store
|
|
#
|
|
# Invoked by Buildroot (BR2_ROOTFS_POST_BUILD_SCRIPT) with the target
|
|
# directory as first argument. The same stamp is recorded in
|
|
# output/images/.mn-build-stamp so post-image.sh can name the ISO
|
|
# after the exact build that is inside it.
|
|
#
|
|
# The stamp is visible inside the guest:
|
|
# - /etc/os-release -> BUILD_ID="YYYYMMDD-HHMMSS"
|
|
# - /etc/issue -> shown above the login prompt
|
|
|
|
set -e
|
|
|
|
TARGET_DIR="${1}"
|
|
#STAMP="$(date +%Y%m%d-%H%M%S)"
|
|
RELEASE="R1"
|
|
CODENAME="Ochatime"
|
|
STAMP="${RELEASE} ${CODENAME}" # pretty form: R1 Ochatime
|
|
STAMP_SAFE="${RELEASE}-${CODENAME}" # sanitized: R1-Ochatime
|
|
IMAGES_DIR="$(dirname "${TARGET_DIR}")/images"
|
|
|
|
# record the stamp for post-image.sh
|
|
mkdir -p "${IMAGES_DIR}"
|
|
echo "${STAMP_SAFE}" > "${IMAGES_DIR}/.mn-build-stamp"
|
|
|
|
# /etc/os-release (regular file lives at /usr/lib/os-release; /etc/os-release
|
|
# is a symlink to it) - Mentalnet branding, Buildroot defaults dropped
|
|
OS_RELEASE="${TARGET_DIR}/usr/lib/os-release"
|
|
cat > "${OS_RELEASE}" <<EOF
|
|
NAME="Mentalnet GNU/Linux"
|
|
VERSION="${STAMP}"
|
|
ID=mentalnet
|
|
VERSION_ID="${RELEASE}"
|
|
PRETTY_NAME="Mentalnet GNU/Linux ${STAMP}"
|
|
BUILD_ID="${STAMP_SAFE}"
|
|
EOF
|
|
|
|
# login banner
|
|
ISSUE="${TARGET_DIR}/etc/issue"
|
|
sed -i '/^Mentalnet GNU\/Linux build /d' "${ISSUE}"
|
|
printf 'Mentalnet GNU/Linux build %s\n' "${STAMP}" >> "${ISSUE}"
|
|
|
|
# Remove the eMudhra (emSign) root CAs and rebuild the trust store.
|
|
#
|
|
# Background: R1 Ochatime security response (October 2026) - eight
|
|
# eMudhra intermediate CA keys were compromised (EM DV/OV/EV TLS and
|
|
# EM OV/OV CS code-signing authorities, e.g. CVE-2026-111943). The
|
|
# Debian/Mozilla trust store in this build does not ship intermediates,
|
|
# but it does trust the four eMudhra emSign roots below; drop them so
|
|
# nothing chaining under eMudhra can validate here.
|
|
#
|
|
# This must run in a post-build script because the ca-certificates
|
|
# bundle (/etc/ssl/certs/ca-certificates.crt) is generated during
|
|
# package finalize hooks, which execute *before* post-build scripts.
|
|
# Rebuild it here the same way CA_CERTIFICATES_GEN_BUNDLE does.
|
|
#
|
|
# Drop this once Debian ships a ca-certificates release (bump
|
|
# CA_CERTIFICATES_VERSION in package/ca-certificates/ca-certificates.mk)
|
|
# that already removed the eMudhra anchors.
|
|
EM_SIGN_ROOTS="emSign_Root_CA_-_G1 emSign_Root_CA_-_C1 emSign_ECC_Root_CA_-_G3 emSign_ECC_Root_CA_-_C3"
|
|
CERTS_DIR="${TARGET_DIR}/etc/ssl/certs"
|
|
for root in ${EM_SIGN_ROOTS}; do
|
|
rm -f "${TARGET_DIR}/usr/share/ca-certificates/mozilla/${root}.crt"
|
|
done
|
|
|
|
# Regenerate /etc/ssl/certs: hash-symlink cleanup, per-name links,
|
|
# bundle, and rehash (mirrors CA_CERTIFICATES_GEN_BUNDLE)
|
|
rm -f "${CERTS_DIR}"/*
|
|
: > "${CERTS_DIR}/ca-certificates.crt"
|
|
cd "${TARGET_DIR}" || exit 1
|
|
for i in $(find usr/share/ca-certificates -name '*.crt' | LC_COLLATE=C sort); do
|
|
ln -sf "../../../${i}" "etc/ssl/certs/$(basename "${i}" .crt).pem"
|
|
cat "${i}"
|
|
done >> "${CERTS_DIR}/ca-certificates.crt"
|
|
"${HOST_DIR}/bin/c_rehash" "${CERTS_DIR}" > /dev/null
|