V8.00.000.2025.06.17
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
@@ -77,17 +77,6 @@ yaml_parser() {
|
||||
s/^(.*)=([^'\''"]+)/\1='\''\2'\''/ # wrap value in single quotes
|
||||
' "${VAR_PRESEED}"
|
||||
|
||||
# ### Delete the respective 'key:value'-variables in the global variable set.
|
||||
# sed -i '/^grub_parameter_[0-9]\+=/d' "${VAR_PRESEED}"
|
||||
# sed -i '/^locale_locale_[0-9]\+=/d' "${VAR_PRESEED}"
|
||||
# sed -i '/^ntp_server_[0-9]\+=/d' "${VAR_PRESEED}"
|
||||
# sed -i '/^software_[0-9]\+=/d' "${VAR_PRESEED}"
|
||||
|
||||
# ### Substitute all key= by key=""
|
||||
# sed -i -E 's/^(.*)=\s*$/\1=""/' "${VAR_PRESEED}"
|
||||
# ### Wrap each key=value by '' e.g., key='value'
|
||||
# sed -i -E "s/^(.*)=([^'\"]+)$/\1='\2'/" "${VAR_PRESEED}"
|
||||
|
||||
# shellcheck disable=SC1090
|
||||
. "${VAR_PRESEED}"
|
||||
|
||||
|
||||
@@ -15,15 +15,21 @@ guard_sourcing
|
||||
#######################################
|
||||
# Reading and extracting variables from "${PRESEED}".
|
||||
# Globals:
|
||||
# BASH_REMATCH
|
||||
# HMP_RECIPE_DEV_PARTITIONS
|
||||
# VAR_ARCHITECTURE
|
||||
# VAR_CODENAME
|
||||
# VAR_NEED_RUN_IN_TARGET
|
||||
# VAR_NUKE
|
||||
# VAR_PRESEED
|
||||
# VAR_RECIPE_FIRMWARE
|
||||
# VAR_RECIPE_HIGHEST_DEVICE
|
||||
# VAR_RECIPE_STRING
|
||||
# VAR_RECIPE_TABLE
|
||||
# VAR_RECOVERY
|
||||
# architecture
|
||||
# distribution
|
||||
# needrun
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
@@ -44,11 +50,11 @@ yaml_reader() {
|
||||
### Read "${var_if}" line by line.
|
||||
while IFS= read -r var_line; do
|
||||
|
||||
### Check, if line matches the search pattern.
|
||||
### Check if the line matches the search pattern.
|
||||
if [[ "${var_line}" =~ ^recipe_([^_]+)_active=\'true\' ]]; then
|
||||
|
||||
var_middle_part="${BASH_REMATCH[1]}"
|
||||
VAR_RECIPE_STRING="${var_middle_part}"
|
||||
VAR_RECIPE_STRING="${var_middle_part,,}"
|
||||
break
|
||||
|
||||
fi
|
||||
@@ -144,30 +150,30 @@ END { print max }
|
||||
|
||||
### Extract chosen firmware.
|
||||
recipe_firmware_var="recipe_${VAR_RECIPE_STRING}_control_firmware"
|
||||
VAR_RECIPE_FIRMWARE="${!recipe_firmware_var}"
|
||||
VAR_RECIPE_FIRMWARE="${!recipe_firmware_var,,}"
|
||||
|
||||
### Extract the chosen Nuke mechanism.
|
||||
recipe_nuke_var="recipe_${VAR_RECIPE_STRING}_control_nuke"
|
||||
# shellcheck disable=SC2034
|
||||
VAR_NUKE="${!recipe_nuke_var}"
|
||||
VAR_NUKE="${!recipe_nuke_var,,}"
|
||||
|
||||
### Extract chosen partition table.
|
||||
recipe_table_var="recipe_${VAR_RECIPE_STRING}_control_table"
|
||||
VAR_RECIPE_TABLE="${!recipe_table_var}"
|
||||
VAR_RECIPE_TABLE="${!recipe_table_var,,}"
|
||||
|
||||
if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
|
||||
if [[ "${VAR_RECIPE_TABLE}" == "gpt" && "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
|
||||
|
||||
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP 'EF00' necessary."
|
||||
|
||||
elif [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
|
||||
elif [[ "${VAR_RECIPE_TABLE}" == "gpt" && "${VAR_RECIPE_FIRMWARE}" == "bios" ]]; then
|
||||
|
||||
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > BIOS Boot Partition 'EF02' necessary."
|
||||
|
||||
elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
|
||||
elif [[ "${VAR_RECIPE_TABLE}" == "msdos" && "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
|
||||
|
||||
do_log "warn" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."
|
||||
|
||||
elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
|
||||
elif [[ "${VAR_RECIPE_TABLE}" == "msdos" && "${VAR_RECIPE_FIRMWARE}" == "bios" ]]; then
|
||||
|
||||
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > No special firmware partition necessary."
|
||||
|
||||
@@ -176,7 +182,7 @@ END { print max }
|
||||
### Extract the chosen Recovery mechanism.
|
||||
recipe_recovery_var="recipe_${VAR_RECIPE_STRING}_control_recovery"
|
||||
# shellcheck disable=SC2034
|
||||
VAR_RECOVERY="${!recipe_recovery_var}"
|
||||
VAR_RECOVERY="${!recipe_recovery_var,,}"
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
@@ -14,8 +14,10 @@ guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Update generated sources.
|
||||
# Every 'apt-get install' command is invoked by adding 'export INITRD=No'
|
||||
# to suppress the 'update-initramfs'-Kernel-Hooks according to the initramfs-tools manpage:
|
||||
# https://manpages.debian.org/testing/initramfs-tools-core/initramfs-tools.7.en.html
|
||||
# Globals:
|
||||
# DIR_LOG
|
||||
# TARGET
|
||||
# apt_updates_policy
|
||||
# Arguments:
|
||||
@@ -35,11 +37,11 @@ update_sources() {
|
||||
do_log "info" "file_only" "4110() Sources lists: updated successfully."
|
||||
|
||||
|
||||
### Update unattended, security or no unattended updates at all.
|
||||
### Update unattended, security, or no unattended updates at all.
|
||||
if [[ "${apt_updates_policy,,}" == "unattended" ]]; then
|
||||
|
||||
do_in_target_script "${TARGET}" "
|
||||
apt-get install -y --no-install-recommends --no-install-suggests unattended-upgrades 2>&1 | tee -a ${var_logfile}
|
||||
export INITRD=No apt-get install -y --no-install-recommends --no-install-suggests unattended-upgrades 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
do_log "info" "file_only" "4110() The update policy was set at installation time to: '${apt_updates_policy}'."
|
||||
@@ -47,7 +49,7 @@ update_sources() {
|
||||
elif [[ "${apt_updates_policy,,}" == "security" ]]; then
|
||||
|
||||
do_in_target_script "${TARGET}" "
|
||||
apt-get install -y --no-install-recommends --no-install-suggests unattended-upgrades 2>&1 | tee -a ${var_logfile}
|
||||
export INITRD=No apt-get install -y --no-install-recommends --no-install-suggests unattended-upgrades 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
|
||||
|
||||
@@ -14,9 +14,12 @@ guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Installation of the specified kernel.
|
||||
# Every 'apt-get install' command is invoked by adding 'export INITRD=No'
|
||||
# to suppress the 'update-initramfs'-Kernel-Hooks according to the initramfs-tools manpage:
|
||||
# https://manpages.debian.org/testing/initramfs-tools-core/initramfs-tools.7.en.html
|
||||
# Globals:
|
||||
# DIR_LOG
|
||||
# TARGET
|
||||
# VAR_KERNEL
|
||||
# image
|
||||
# Arguments:
|
||||
# None
|
||||
@@ -32,7 +35,7 @@ installation_kernel() {
|
||||
if [[ -n "${VAR_KERNEL}" ]]; then
|
||||
|
||||
do_in_target_script "${TARGET}" '
|
||||
apt-get install -y -o DPkg::Options::="--no-triggers" --no-install-recommends --no-install-suggests '"${VAR_KERNEL}"' initramfs-tools 2>&1 | tee -a '"${var_logfile}"'
|
||||
export INITRD=No apt-get install -y --no-install-recommends --no-install-suggests '"${VAR_KERNEL}"' initramfs-tools 2>&1 | tee -a '"${var_logfile}"'
|
||||
echo ExitCode: $? >> '"${var_logfile}"'
|
||||
'
|
||||
|
||||
@@ -43,7 +46,7 @@ installation_kernel() {
|
||||
else
|
||||
|
||||
do_in_target_script "${TARGET}" "
|
||||
apt-get install -y --no-install-recommends --no-install-suggests ${image} 2>&1 | tee -a ${var_logfile}
|
||||
export INITRD=No apt-get install -y --no-install-recommends --no-install-suggests ${image} initramfs-tools 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
|
||||
|
||||
@@ -14,8 +14,10 @@ guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Check and set up the minimum required tools for the next installation steps.
|
||||
# Every 'apt-get install' command is invoked by adding 'export INITRD=No'
|
||||
# to suppress the 'update-initramfs'-Kernel-Hooks according to the initramfs-tools manpage:
|
||||
# https://manpages.debian.org/testing/initramfs-tools-core/initramfs-tools.7.en.html
|
||||
# Globals:
|
||||
# DIR_LOG
|
||||
# TARGET
|
||||
# Arguments:
|
||||
# None
|
||||
@@ -118,7 +120,7 @@ installation_toolset() {
|
||||
do_log "debug" "file_only" "4130() [ary_unique_pkgs]='${ary_unique_pkgs[*]}'."
|
||||
|
||||
do_in_target_script "${TARGET}" "
|
||||
apt-get install -y --no-install-recommends --no-install-suggests ${ary_unique_pkgs[*]} 2>&1 | tee -a ${var_logfile}
|
||||
export INITRD=No apt-get install -y --no-install-recommends --no-install-suggests ${ary_unique_pkgs[*]} 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
|
||||
|
||||
@@ -14,8 +14,10 @@ guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Ensure systemd is in place.
|
||||
# Every 'apt-get install' command is invoked by adding 'export INITRD=No'
|
||||
# to suppress the 'update-initramfs'-Kernel-Hooks according to the initramfs-tools manpage:
|
||||
# https://manpages.debian.org/testing/initramfs-tools-core/initramfs-tools.7.en.html
|
||||
# Globals:
|
||||
# DIR_LOG
|
||||
# TARGET
|
||||
# Arguments:
|
||||
# None
|
||||
@@ -32,8 +34,7 @@ installation_systemd() {
|
||||
do_log "info" "file_only" "4131() 'systemctl' NOT found, installing 'systemd' and dependencies."
|
||||
|
||||
do_in_target_script "${TARGET}" "
|
||||
apt-get update 2>&1 | tee -a ${var_logfile}
|
||||
apt-get install -y --no-install-recommends --no-install-suggests systemd systemd-sysv dbus 2>&1 | tee -a ${var_logfile}
|
||||
export INITRD=No apt-get install -y --no-install-recommends --no-install-suggests systemd systemd-sysv dbus 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
|
||||
|
||||
@@ -14,6 +14,9 @@ guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Install microcode updates depending on architecture (amd64, arm64, intel64) and environment (Baremetal, VM).
|
||||
# Every 'apt-get install' command is invoked by adding 'export INITRD=No'
|
||||
# to suppress the 'update-initramfs'-Kernel-Hooks according to the initramfs-tools manpage:
|
||||
# https://manpages.debian.org/testing/initramfs-tools-core/initramfs-tools.7.en.html
|
||||
# Globals:
|
||||
# TARGET
|
||||
# Arguments:
|
||||
@@ -52,14 +55,14 @@ installation_microcode() {
|
||||
if ! do_in_target_script "${TARGET}" "dpkg -s ${var_microcode_pkgs} >/dev/null 2>&1"; then
|
||||
|
||||
do_in_target_script "${TARGET}" "
|
||||
apt-get install -y --no-install-recommends --no-install-suggests ${var_microcode_pkgs} 2>&1 | tee -a ${var_logfile}
|
||||
export INITRD=No apt-get install -y --no-install-recommends --no-install-suggests ${var_microcode_pkgs} 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
|
||||
else
|
||||
|
||||
do_in_target_script "${TARGET}" "
|
||||
apt-get install -y --no-install-recommends --no-install-suggests --only-upgrade ${var_microcode_pkgs} 2>&1 | tee -a ${var_logfile}
|
||||
export INITRD=No apt-get install -y --no-install-recommends --no-install-suggests --only-upgrade ${var_microcode_pkgs} 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
|
||||
|
||||
@@ -14,6 +14,9 @@ guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Setup chrony NTPSec client.
|
||||
# Every 'apt-get install' command is invoked by adding 'export INITRD=No'
|
||||
# to suppress the 'update-initramfs'-Kernel-Hooks according to the initramfs-tools manpage:
|
||||
# https://manpages.debian.org/testing/initramfs-tools-core/initramfs-tools.7.en.html
|
||||
# Globals:
|
||||
# ARY_NTPSRVR
|
||||
# DIR_BAK
|
||||
@@ -44,7 +47,7 @@ installation_chrony() {
|
||||
mkdir -p "${TARGET}/var/log/chrony"
|
||||
|
||||
do_in_target_script "${TARGET}" "
|
||||
apt-get install -y --no-install-recommends --no-install-suggests chrony 2>&1 | tee -a ${var_logfile}
|
||||
export INITRD=No apt-get install -y --no-install-recommends --no-install-suggests chrony 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
|
||||
@@ -58,6 +61,9 @@ installation_chrony() {
|
||||
mv "${TARGET}/etc/chrony/chrony.conf" "${DIR_BAK}/etc/chrony/chrony.conf.bak"
|
||||
|
||||
install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/chrony/chrony.cnf" "${TARGET}/etc/chrony/chrony.conf"
|
||||
|
||||
insert_chrony_comments "${TARGET}/etc/chrony/chrony.conf"
|
||||
|
||||
cat "${var_of}" >> "${TARGET}/etc/chrony/chrony.conf"
|
||||
|
||||
do_log "debug" "file_only" "4150() Executing: [do_in_target_script ${TARGET} chronyd -Q -f /etc/chrony/chrony.conf]."
|
||||
@@ -72,4 +78,27 @@ installation_chrony() {
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
#######################################
|
||||
# Helper to insert the Metadata field into '/etc/chrony/chrony.conf'.
|
||||
# Globals:
|
||||
# VAR_ARCHITECTURE
|
||||
# VAR_CODENAME
|
||||
# VAR_VERSION
|
||||
# Arguments:
|
||||
# 1: /etc/chrony/chrony.conf
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
insert_chrony_comments() {
|
||||
declare file="${1}"
|
||||
sed -i '/^# SPDX-Security-Contact: security@coresecret\.eu$/a\
|
||||
# /etc/chrony/conf.d : Generated by CISS.debian.installer '"${VAR_VERSION}"'\
|
||||
\
|
||||
# Architecture : '"${VAR_ARCHITECTURE}"'\
|
||||
\
|
||||
# Distribution : '"${VAR_CODENAME}"'
|
||||
' "${file}"
|
||||
return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
|
||||
@@ -14,6 +14,9 @@ guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Installation of 'cryptsetup' and 'cryptsetup-initramfs' after '/etc/crypttab' generation.
|
||||
# Every 'apt-get install' command is invoked by adding 'export INITRD=No'
|
||||
# to suppress the 'update-initramfs'-Kernel-Hooks according to the initramfs-tools manpage:
|
||||
# https://manpages.debian.org/testing/initramfs-tools-core/initramfs-tools.7.en.html
|
||||
# Globals:
|
||||
# TARGET
|
||||
# Arguments:
|
||||
@@ -28,7 +31,7 @@ installation_cryptsetup() {
|
||||
touch "${TARGET}${var_logfile}" && chmod 0600 "${TARGET}${var_logfile}"
|
||||
|
||||
do_in_target_script "${TARGET}" '
|
||||
apt-get install -y -o DPkg::Options::="--no-triggers" --no-install-recommends --no-install-suggests cryptsetup cryptsetup-initramfs 2>&1 | tee -a '"${var_logfile}"'
|
||||
export INITRD=No apt-get install -y --no-install-recommends --no-install-suggests cryptsetup cryptsetup-initramfs 2>&1 | tee -a '"${var_logfile}"'
|
||||
echo ExitCode: $? >> '"${var_logfile}"'
|
||||
'
|
||||
|
||||
|
||||
@@ -26,6 +26,9 @@ guard_sourcing
|
||||
#######################################
|
||||
# Installation and setup of the GRUB2 (backported) version.
|
||||
# The backported version MUST be installed for LUKS2 '/boot' encryption.
|
||||
# Every 'apt-get install' command is invoked by adding 'export INITRD=No'
|
||||
# to suppress the 'update-initramfs'-Kernel-Hooks according to the initramfs-tools manpage:
|
||||
# https://manpages.debian.org/testing/initramfs-tools-core/initramfs-tools.7.en.html
|
||||
# Globals:
|
||||
# TARGET
|
||||
# VAR_ARCHITECTURE
|
||||
@@ -44,7 +47,7 @@ guard_sourcing
|
||||
# ERR_GRUB_BACKGROUND
|
||||
# ERR_GRUB_EFI_FORCE
|
||||
#######################################
|
||||
update_grub() {
|
||||
installation_grub() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -g var_update_grub_required="false" grub_update_nvram=${grub_update_nvram:-false}
|
||||
declare -r var_logfile="/root/.ciss/cdi/log/4230_update_grub.log"
|
||||
@@ -52,53 +55,51 @@ update_grub() {
|
||||
|
||||
touch "${TARGET}${var_logfile}" && chmod 0600 "${TARGET}${var_logfile}"
|
||||
|
||||
do_log "debug" "file_only" "4230() Detected firmware: '${VAR_RECIPE_FIRMWARE}', architecture: '${VAR_ARCHITECTURE}'"
|
||||
get_grub_modinfo_path
|
||||
|
||||
if [[ "${grub_skip,,}" != "true" ]]; then
|
||||
ensure_lowercase "grub_skip"
|
||||
ensure_lowercase "grub_latest"
|
||||
ensure_lowercase "grub_background_enable"
|
||||
ensure_lowercase "grub_prober"
|
||||
ensure_lowercase "grub_update_nvram"
|
||||
ensure_lowercase "grub_force_efi"
|
||||
|
||||
do_log "debug" "file_only" "4230() Preseeded firmware: '${VAR_RECIPE_FIRMWARE}', architecture: '${VAR_ARCHITECTURE}'"
|
||||
|
||||
if [[ "${grub_skip}" != "true" ]]; then
|
||||
|
||||
### Install GRUB2 package
|
||||
if [[ "${grub_latest,,}" == "true" ]]; then
|
||||
if [[ "${grub_latest}" == "true" ]]; then
|
||||
|
||||
### Install the GRUB2 backported version from the Bookworm backports repository.
|
||||
if [[ "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
|
||||
if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
|
||||
|
||||
case "${VAR_ARCHITECTURE,,}" in
|
||||
case "${VAR_ARCHITECTURE}" in
|
||||
|
||||
amd64)
|
||||
do_log "debug" "file_only" "4230() Installing GRUB package variant: grub-efi-amd64"
|
||||
do_in_target_script "${TARGET}" "
|
||||
apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-efi-amd64 grub-efi-amd64-bin 2>&1 | tee -a ${var_logfile}
|
||||
export INITRD=No apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-efi-amd64 grub-efi-amd64-bin 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
;;
|
||||
|
||||
arm64)
|
||||
do_log "debug" "file_only" "4230() Installing GRUB package variant: grub-efi-arm64"
|
||||
do_in_target_script "${TARGET}" "
|
||||
apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-efi-arm64 grub-efi-arm64-bin 2>&1 | tee -a ${var_logfile}
|
||||
export INITRD=No apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-efi-arm64 grub-efi-arm64-bin 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
;;
|
||||
|
||||
i386)
|
||||
do_log "debug" "file_only" "4230() Installing GRUB package variant: grub-efi-ia32"
|
||||
do_in_target_script "${TARGET}" "
|
||||
apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-efi-ia32 grub-efi-ia32-bin 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
;;
|
||||
|
||||
*)
|
||||
do_log "emergency" "file_only" "4230() Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}"
|
||||
do_log "emergency" "file_only" "4230() Unsupported architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}"
|
||||
;;
|
||||
|
||||
esac
|
||||
|
||||
else
|
||||
|
||||
do_log "debug" "file_only" "4230() Installing GRUB package variant: grub-pc-bin"
|
||||
do_in_target_script "${TARGET}" "
|
||||
apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-pc grub-pc-bin 2>&1 | tee -a ${var_logfile}
|
||||
export INITRD=No apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-pc grub-pc-bin 2>&1 | tee -a ${var_logfile}
|
||||
echo ExitCode: \$? >> ${var_logfile}
|
||||
"
|
||||
|
||||
@@ -107,18 +108,17 @@ update_grub() {
|
||||
else
|
||||
|
||||
### Install the GRUB2 stable version.
|
||||
if [[ "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
|
||||
if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
|
||||
|
||||
case "${VAR_ARCHITECTURE,,}" in
|
||||
amd64) do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-efi-amd64 grub-efi-amd64-bin ;;
|
||||
arm64) do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-efi-arm64 grub-efi-arm64-bin ;;
|
||||
i386) do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-efi-ia32 grub-efi-ia32-bin ;;
|
||||
*) do_log "emergency" "file_only" "4230() Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
|
||||
case "${VAR_ARCHITECTURE}" in
|
||||
amd64) do_in_target "${TARGET}" export INITRD=No apt-get install -y --no-install-recommends grub2-common grub-efi-amd64 grub-efi-amd64-bin ;;
|
||||
arm64) do_in_target "${TARGET}" export INITRD=No apt-get install -y --no-install-recommends grub2-common grub-efi-arm64 grub-efi-arm64-bin ;;
|
||||
*) do_log "emergency" "file_only" "4230() Unsupported architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
|
||||
esac
|
||||
|
||||
else
|
||||
|
||||
do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-pc grub-pc-bin
|
||||
do_in_target "${TARGET}" export INITRD=No apt-get install -y --no-install-recommends grub2 grub2-common grub-pc grub-pc-bin
|
||||
|
||||
fi
|
||||
|
||||
@@ -135,7 +135,7 @@ EOF
|
||||
var_update_grub_required="true"
|
||||
|
||||
### Install a boot menu background.
|
||||
if [[ "${grub_background_enable,,}" == "true" ]]; then
|
||||
if [[ "${grub_background_enable}" == "true" ]]; then
|
||||
|
||||
var_background=$(basename "${grub_background_path}")
|
||||
install -m 0640 -o root -g root "${VAR_SETUP_PATH}${grub_background_path}" "${TARGET}/etc/default/grub.d/${var_background}"
|
||||
@@ -157,9 +157,9 @@ EOF
|
||||
fi
|
||||
|
||||
### Change the GRUB OS detection configuration accordingly.
|
||||
if [[ "${grub_prober,,}" == "true" ]]; then
|
||||
if [[ "${grub_prober}" == "true" ]]; then
|
||||
|
||||
do_in_target "${TARGET}" apt-get install -y --no-install-recommends os-prober
|
||||
do_in_target "${TARGET}" export INITRD=No apt-get install -y --no-install-recommends os-prober
|
||||
|
||||
cat << EOF >> "${TARGET}/etc/default/grub"
|
||||
# If your computer has multiple operating systems installed, then you
|
||||
@@ -173,7 +173,7 @@ EOF
|
||||
|
||||
var_update_grub_required="true"
|
||||
|
||||
elif [[ "${grub_prober,,}" == "false" ]]; then
|
||||
elif [[ "${grub_prober}" == "false" ]]; then
|
||||
|
||||
cat << EOF >> "${TARGET}/etc/default/grub"
|
||||
# If your computer has multiple operating systems installed, then you
|
||||
@@ -192,15 +192,16 @@ EOF
|
||||
else
|
||||
|
||||
do_log "info" "file_only" "4230() GRUB2 setup skipped."
|
||||
return 0
|
||||
|
||||
fi
|
||||
|
||||
### Install grub on the specific device.
|
||||
if [[ "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
|
||||
if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
|
||||
|
||||
install_grub_uefi
|
||||
|
||||
elif [[ "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
|
||||
elif [[ "${VAR_RECIPE_FIRMWARE}" == "bios" ]]; then
|
||||
|
||||
install_grub_bios
|
||||
|
||||
@@ -222,6 +223,7 @@ EOF
|
||||
# Installs GRUB to BIOS in BIOS mode.
|
||||
# Globals:
|
||||
# TARGET
|
||||
# VAR_MODINFO_PATH
|
||||
# grub_bootdev
|
||||
# var_update_grub_required
|
||||
# Arguments:
|
||||
@@ -235,6 +237,11 @@ install_grub_bios() {
|
||||
declare -a ary_bios_arg=()
|
||||
declare var_bios_mod=""
|
||||
|
||||
if ! [[ -x "${TARGET}${VAR_MODINFO_PATH}" ]]; then
|
||||
do_log "emergency" "file_only" "4230() Missing: [${VAR_MODINFO_PATH}]."
|
||||
return "${ERR_GRUB_INSTALL}"
|
||||
fi
|
||||
|
||||
### Cryptographic modules.
|
||||
var_bios_mod+="cryptodisk gcry_rijndael gcry_sha256 gcry_sha512 gcry_whirlpool gcry_serpent gcry_twofish luks luks2 "
|
||||
### Filesystem modules.
|
||||
@@ -248,7 +255,7 @@ install_grub_bios() {
|
||||
|
||||
ary_bios_arg+=( --target=i386-pc --boot-directory=/boot "--modules=${var_bios_mod}" )
|
||||
|
||||
do_in_target "${TARGET}" grub-install "${ary_bios_arg[@]}" "${grub_bootdev}" || return "${ERR_GRUB_INSTALL}"
|
||||
do_in_target "${TARGET}" export INITRD=No grub-install "${ary_bios_arg[@]}" "${grub_bootdev}" || return "${ERR_GRUB_INSTALL}"
|
||||
do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [BIOS]."
|
||||
var_update_grub_required="true"
|
||||
|
||||
@@ -259,6 +266,7 @@ install_grub_bios() {
|
||||
# Installs GRUB to ESP in UEFI mode.
|
||||
# Globals:
|
||||
# TARGET
|
||||
# VAR_MODINFO_PATH
|
||||
# grub_bootdev
|
||||
# grub_force_efi
|
||||
# grub_update_nvram
|
||||
@@ -272,16 +280,10 @@ install_grub_bios() {
|
||||
install_grub_uefi() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
declare -a ary_uefi_arg=()
|
||||
declare var_uefi_mod="" var_modinfo_path=""
|
||||
declare var_uefi_mod=""
|
||||
|
||||
case "${VAR_ARCHITECTURE,,}" in
|
||||
amd64) var_modinfo_path="/usr/lib/grub/x86_64-efi/modinfo.sh" ;;
|
||||
arm64) var_modinfo_path="/usr/lib/grub/arm64-efi/modinfo.sh" ;;
|
||||
i386) var_modinfo_path="/usr/lib/grub/i386-efi/modinfo.sh" ;;
|
||||
esac
|
||||
|
||||
if ! [[ -x "${TARGET}${var_modinfo_path}" ]]; then
|
||||
do_log "emergency" "file_only" "4230() Missing: [${var_modinfo_path}]."
|
||||
if ! [[ -x "${TARGET}${VAR_MODINFO_PATH}" ]]; then
|
||||
do_log "emergency" "file_only" "4230() Missing: [${VAR_MODINFO_PATH}]."
|
||||
return "${ERR_GRUB_INSTALL}"
|
||||
fi
|
||||
|
||||
@@ -298,13 +300,13 @@ install_grub_uefi() {
|
||||
|
||||
ary_uefi_arg+=( --target=x86_64-efi --boot-directory=/boot --efi-directory=/boot/efi --bootloader-id=debian "--modules=${var_uefi_mod}" )
|
||||
|
||||
[[ "${grub_update_nvram,,}" == "false" ]] && ary_uefi_arg+=( --no-nvram )
|
||||
[[ "${grub_update_nvram}" == "false" ]] && ary_uefi_arg+=( --no-nvram )
|
||||
|
||||
do_in_target "${TARGET}" grub-install "${ary_uefi_arg[@]}" "${grub_bootdev}" || return "${ERR_GRUB_INSTALL}"
|
||||
do_in_target "${TARGET}" export INITRD=No grub-install "${ary_uefi_arg[@]}" "${grub_bootdev}" || return "${ERR_GRUB_INSTALL}"
|
||||
do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [UEFI]."
|
||||
var_update_grub_required="true"
|
||||
|
||||
if [[ "${grub_force_efi,,}" == "true" ]]; then
|
||||
if [[ "${grub_force_efi}" == "true" ]]; then
|
||||
|
||||
mkdir -p "${TARGET}/boot/efi/EFI/BOOT"
|
||||
cp "${TARGET}/boot/efi/EFI/debian/grubx64.efi" "${TARGET}/boot/efi/EFI/BOOT/BOOTX64.EFI"
|
||||
@@ -314,4 +316,43 @@ install_grub_uefi() {
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
#######################################
|
||||
# Get the path of the required Grub modules.
|
||||
# Globals:
|
||||
# VAR_ARCHITECTURE
|
||||
# VAR_MODINFO_PATH
|
||||
# VAR_RECIPE_FIRMWARE
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
#######################################
|
||||
get_grub_modinfo_path() {
|
||||
### Declare Arrays, HashMaps, and Variables.
|
||||
delcare -gx VAR_MODINFO_PATH=""
|
||||
|
||||
case "${VAR_RECIPE_FIRMWARE}" in
|
||||
|
||||
uefi)
|
||||
|
||||
case "${VAR_ARCHITECTURE}" in
|
||||
|
||||
amd64) VAR_MODINFO_PATH="/usr/lib/grub/x86_64-efi/modinfo.sh" ;;
|
||||
arm64) VAR_MODINFO_PATH="/usr/lib/grub/arm64-efi/modinfo.sh" ;;
|
||||
i386) VAR_MODINFO_PATH="/usr/lib/grub/i386-efi/modinfo.sh" ;;
|
||||
*) ;;
|
||||
|
||||
esac
|
||||
;;
|
||||
|
||||
bios)
|
||||
|
||||
VAR_MODINFO_PATH="/usr/lib/grub/i386-pc/modinfo.sh"
|
||||
;;
|
||||
|
||||
esac
|
||||
|
||||
return 0
|
||||
}
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
@@ -16,9 +16,7 @@ guard_sourcing
|
||||
# Append the GRUB superuser block to '/etc/grub.d/40_custom'.
|
||||
# Globals:
|
||||
# DIR_CNF
|
||||
# ERR_READ_GRUB_FILE
|
||||
# TARGET
|
||||
# VAR_DEBUG_TRACE
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
@@ -29,13 +27,14 @@ update_grub_password() {
|
||||
declare var_username="superadmin" var_password="" var_password_file="${DIR_CNF}/password_grub.txt" \
|
||||
var_of="${TARGET}/etc/grub.d/40_custom" var_grub_entry=""
|
||||
|
||||
# TODO: Reactivate XTRACE Password Truncation
|
||||
### No tracing for security reasons
|
||||
[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set +x
|
||||
#[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set +x
|
||||
if [[ ! -f "${var_password_file}" ]] || ! IFS= read -r var_password < "${var_password_file}"; then
|
||||
return "${ERR_READ_GRUB_FILE}"
|
||||
fi
|
||||
### Turn on tracing again
|
||||
[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set -x
|
||||
#[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set -x
|
||||
|
||||
var_grub_entry=$(generate_grub_password_pbkdf2 "${var_username}" "${var_password}")
|
||||
|
||||
|
||||
Reference in New Issue
Block a user