msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-08-06 19:23:16 +02:00
parent b7a8e7174b
commit 03c63b8b87
25 changed files with 449 additions and 221 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
func/cdi_4200_boot/4220_installation_cryptsetup.sh
View File

@@ -14,6 +14,9 @@ guard_sourcing
#######################################
# Installation of 'cryptsetup' and 'cryptsetup-initramfs' after '/etc/crypttab' generation.
# Every 'apt-get install' command is invoked by adding 'export INITRD=No'
# to suppress the 'update-initramfs'-Kernel-Hooks according to the initramfs-tools manpage:
# https://manpages.debian.org/testing/initramfs-tools-core/initramfs-tools.7.en.html
# Globals:
# TARGET
# Arguments:
@@ -28,7 +31,7 @@ installation_cryptsetup() {
touch "${TARGET}${var_logfile}" && chmod 0600 "${TARGET}${var_logfile}"
do_in_target_script "${TARGET}" '
apt-get install -y -o DPkg::Options::="--no-triggers" --no-install-recommends --no-install-suggests cryptsetup cryptsetup-initramfs 2>&1 | tee -a '"${var_logfile}"'
export INITRD=No apt-get install -y --no-install-recommends --no-install-suggests cryptsetup cryptsetup-initramfs 2>&1 | tee -a '"${var_logfile}"'
echo ExitCode: $? >> '"${var_logfile}"'
'

135
func/cdi_4200_boot/4230_update_grub.sh → func/cdi_4200_boot/4230_installation_grub.sh
View File

@@ -26,6 +26,9 @@ guard_sourcing
#######################################
# Installation and setup of the GRUB2 (backported) version.
# The backported version MUST be installed for LUKS2 '/boot' encryption.
# Every 'apt-get install' command is invoked by adding 'export INITRD=No'
# to suppress the 'update-initramfs'-Kernel-Hooks according to the initramfs-tools manpage:
# https://manpages.debian.org/testing/initramfs-tools-core/initramfs-tools.7.en.html
# Globals:
# TARGET
# VAR_ARCHITECTURE
@@ -44,7 +47,7 @@ guard_sourcing
# ERR_GRUB_BACKGROUND
# ERR_GRUB_EFI_FORCE
#######################################
update_grub() {
installation_grub() {
### Declare Arrays, HashMaps, and Variables.
declare -g var_update_grub_required="false" grub_update_nvram=${grub_update_nvram:-false}
declare -r var_logfile="/root/.ciss/cdi/log/4230_update_grub.log"
@@ -52,53 +55,51 @@ update_grub() {
touch "${TARGET}${var_logfile}" && chmod 0600 "${TARGET}${var_logfile}"
do_log "debug" "file_only" "4230() Detected firmware: '${VAR_RECIPE_FIRMWARE}', architecture: '${VAR_ARCHITECTURE}'"
get_grub_modinfo_path
if [[ "${grub_skip,,}" != "true" ]]; then
ensure_lowercase "grub_skip"
ensure_lowercase "grub_latest"
ensure_lowercase "grub_background_enable"
ensure_lowercase "grub_prober"
ensure_lowercase "grub_update_nvram"
ensure_lowercase "grub_force_efi"
do_log "debug" "file_only" "4230() Preseeded firmware: '${VAR_RECIPE_FIRMWARE}', architecture: '${VAR_ARCHITECTURE}'"
if [[ "${grub_skip}" != "true" ]]; then
### Install GRUB2 package
if [[ "${grub_latest,,}" == "true" ]]; then
if [[ "${grub_latest}" == "true" ]]; then
### Install the GRUB2 backported version from the Bookworm backports repository.
if [[ "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
case "${VAR_ARCHITECTURE,,}" in
case "${VAR_ARCHITECTURE}" in
amd64)
do_log "debug" "file_only" "4230() Installing GRUB package variant: grub-efi-amd64"
do_in_target_script "${TARGET}" "
apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-efi-amd64 grub-efi-amd64-bin 2>&1 | tee -a ${var_logfile}
export INITRD=No apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-efi-amd64 grub-efi-amd64-bin 2>&1 | tee -a ${var_logfile}
echo ExitCode: \$? >> ${var_logfile}
"
;;
arm64)
do_log "debug" "file_only" "4230() Installing GRUB package variant: grub-efi-arm64"
do_in_target_script "${TARGET}" "
apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-efi-arm64 grub-efi-arm64-bin 2>&1 | tee -a ${var_logfile}
export INITRD=No apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-efi-arm64 grub-efi-arm64-bin 2>&1 | tee -a ${var_logfile}
echo ExitCode: \$? >> ${var_logfile}
"
;;
i386)
do_log "debug" "file_only" "4230() Installing GRUB package variant: grub-efi-ia32"
do_in_target_script "${TARGET}" "
apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-efi-ia32 grub-efi-ia32-bin 2>&1 | tee -a ${var_logfile}
echo ExitCode: \$? >> ${var_logfile}
"
;;
*)
do_log "emergency" "file_only" "4230() Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}"
do_log "emergency" "file_only" "4230() Unsupported architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}"
;;
esac
else
do_log "debug" "file_only" "4230() Installing GRUB package variant: grub-pc-bin"
do_in_target_script "${TARGET}" "
apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-pc grub-pc-bin 2>&1 | tee -a ${var_logfile}
export INITRD=No apt-get install -y --no-install-recommends -t bookworm-backports grub2-common grub-pc grub-pc-bin 2>&1 | tee -a ${var_logfile}
echo ExitCode: \$? >> ${var_logfile}
"
@@ -107,18 +108,17 @@ update_grub() {
else
### Install the GRUB2 stable version.
if [[ "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
case "${VAR_ARCHITECTURE,,}" in
amd64) do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-efi-amd64 grub-efi-amd64-bin ;;
arm64) do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-efi-arm64 grub-efi-arm64-bin ;;
i386) do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-efi-ia32 grub-efi-ia32-bin ;;
*) do_log "emergency" "file_only" "4230() Unsupported UEFI architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
case "${VAR_ARCHITECTURE}" in
amd64) do_in_target "${TARGET}" export INITRD=No apt-get install -y --no-install-recommends grub2-common grub-efi-amd64 grub-efi-amd64-bin ;;
arm64) do_in_target "${TARGET}" export INITRD=No apt-get install -y --no-install-recommends grub2-common grub-efi-arm64 grub-efi-arm64-bin ;;
*) do_log "emergency" "file_only" "4230() Unsupported architecture: ${VAR_ARCHITECTURE}"; return "${ERR_GRUB_ARCHITECTURE}" ;;
esac
else
do_in_target "${TARGET}" apt-get install -y --no-install-recommends grub2 grub2-common grub-pc grub-pc-bin
do_in_target "${TARGET}" export INITRD=No apt-get install -y --no-install-recommends grub2 grub2-common grub-pc grub-pc-bin
fi
@@ -135,7 +135,7 @@ EOF
var_update_grub_required="true"
### Install a boot menu background.
if [[ "${grub_background_enable,,}" == "true" ]]; then
if [[ "${grub_background_enable}" == "true" ]]; then
var_background=$(basename "${grub_background_path}")
install -m 0640 -o root -g root "${VAR_SETUP_PATH}${grub_background_path}" "${TARGET}/etc/default/grub.d/${var_background}"
@@ -157,9 +157,9 @@ EOF
fi
### Change the GRUB OS detection configuration accordingly.
if [[ "${grub_prober,,}" == "true" ]]; then
if [[ "${grub_prober}" == "true" ]]; then
do_in_target "${TARGET}" apt-get install -y --no-install-recommends os-prober
do_in_target "${TARGET}" export INITRD=No apt-get install -y --no-install-recommends os-prober
cat << EOF >> "${TARGET}/etc/default/grub"
# If your computer has multiple operating systems installed, then you
@@ -173,7 +173,7 @@ EOF
var_update_grub_required="true"
elif [[ "${grub_prober,,}" == "false" ]]; then
elif [[ "${grub_prober}" == "false" ]]; then
cat << EOF >> "${TARGET}/etc/default/grub"
# If your computer has multiple operating systems installed, then you
@@ -192,15 +192,16 @@ EOF
else
do_log "info" "file_only" "4230() GRUB2 setup skipped."
return 0
fi
### Install grub on the specific device.
if [[ "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
if [[ "${VAR_RECIPE_FIRMWARE}" == "uefi" ]]; then
install_grub_uefi
elif [[ "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
elif [[ "${VAR_RECIPE_FIRMWARE}" == "bios" ]]; then
install_grub_bios
@@ -222,6 +223,7 @@ EOF
# Installs GRUB to BIOS in BIOS mode.
# Globals:
# TARGET
# VAR_MODINFO_PATH
# grub_bootdev
# var_update_grub_required
# Arguments:
@@ -235,6 +237,11 @@ install_grub_bios() {
declare -a ary_bios_arg=()
declare var_bios_mod=""
if ! [[ -x "${TARGET}${VAR_MODINFO_PATH}" ]]; then
do_log "emergency" "file_only" "4230() Missing: [${VAR_MODINFO_PATH}]."
return "${ERR_GRUB_INSTALL}"
fi
### Cryptographic modules.
var_bios_mod+="cryptodisk gcry_rijndael gcry_sha256 gcry_sha512 gcry_whirlpool gcry_serpent gcry_twofish luks luks2 "
### Filesystem modules.
@@ -248,7 +255,7 @@ install_grub_bios() {
ary_bios_arg+=( --target=i386-pc --boot-directory=/boot "--modules=${var_bios_mod}" )
do_in_target "${TARGET}" grub-install "${ary_bios_arg[@]}" "${grub_bootdev}" || return "${ERR_GRUB_INSTALL}"
do_in_target "${TARGET}" export INITRD=No grub-install "${ary_bios_arg[@]}" "${grub_bootdev}" || return "${ERR_GRUB_INSTALL}"
do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [BIOS]."
var_update_grub_required="true"
@@ -259,6 +266,7 @@ install_grub_bios() {
# Installs GRUB to ESP in UEFI mode.
# Globals:
# TARGET
# VAR_MODINFO_PATH
# grub_bootdev
# grub_force_efi
# grub_update_nvram
@@ -272,16 +280,10 @@ install_grub_bios() {
install_grub_uefi() {
### Declare Arrays, HashMaps, and Variables.
declare -a ary_uefi_arg=()
declare var_uefi_mod="" var_modinfo_path=""
declare var_uefi_mod=""
case "${VAR_ARCHITECTURE,,}" in
amd64) var_modinfo_path="/usr/lib/grub/x86_64-efi/modinfo.sh" ;;
arm64) var_modinfo_path="/usr/lib/grub/arm64-efi/modinfo.sh" ;;
i386) var_modinfo_path="/usr/lib/grub/i386-efi/modinfo.sh" ;;
esac
if ! [[ -x "${TARGET}${var_modinfo_path}" ]]; then
do_log "emergency" "file_only" "4230() Missing: [${var_modinfo_path}]."
if ! [[ -x "${TARGET}${VAR_MODINFO_PATH}" ]]; then
do_log "emergency" "file_only" "4230() Missing: [${VAR_MODINFO_PATH}]."
return "${ERR_GRUB_INSTALL}"
fi
@@ -298,13 +300,13 @@ install_grub_uefi() {
ary_uefi_arg+=( --target=x86_64-efi --boot-directory=/boot --efi-directory=/boot/efi --bootloader-id=debian "--modules=${var_uefi_mod}" )
[[ "${grub_update_nvram,,}" == "false" ]] && ary_uefi_arg+=( --no-nvram )
[[ "${grub_update_nvram}" == "false" ]] && ary_uefi_arg+=( --no-nvram )
do_in_target "${TARGET}" grub-install "${ary_uefi_arg[@]}" "${grub_bootdev}" || return "${ERR_GRUB_INSTALL}"
do_in_target "${TARGET}" export INITRD=No grub-install "${ary_uefi_arg[@]}" "${grub_bootdev}" || return "${ERR_GRUB_INSTALL}"
do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [UEFI]."
var_update_grub_required="true"
if [[ "${grub_force_efi,,}" == "true" ]]; then
if [[ "${grub_force_efi}" == "true" ]]; then
mkdir -p "${TARGET}/boot/efi/EFI/BOOT"
cp "${TARGET}/boot/efi/EFI/debian/grubx64.efi" "${TARGET}/boot/efi/EFI/BOOT/BOOTX64.EFI"
@@ -314,4 +316,43 @@ install_grub_uefi() {
return 0
}
#######################################
# Get the path of the required Grub modules.
# Globals:
# VAR_ARCHITECTURE
# VAR_MODINFO_PATH
# VAR_RECIPE_FIRMWARE
# Arguments:
# None
# Returns:
# 0: on success
#######################################
get_grub_modinfo_path() {
### Declare Arrays, HashMaps, and Variables.
delcare -gx VAR_MODINFO_PATH=""
case "${VAR_RECIPE_FIRMWARE}" in
uefi)
case "${VAR_ARCHITECTURE}" in
amd64) VAR_MODINFO_PATH="/usr/lib/grub/x86_64-efi/modinfo.sh" ;;
arm64) VAR_MODINFO_PATH="/usr/lib/grub/arm64-efi/modinfo.sh" ;;
i386) VAR_MODINFO_PATH="/usr/lib/grub/i386-efi/modinfo.sh" ;;
*) ;;
esac
;;
bios)
VAR_MODINFO_PATH="/usr/lib/grub/i386-pc/modinfo.sh"
;;
esac
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

7
func/cdi_4200_boot/4240_update_grub_password.sh
View File

@@ -16,9 +16,7 @@ guard_sourcing
# Append the GRUB superuser block to '/etc/grub.d/40_custom'.
# Globals:
# DIR_CNF
# ERR_READ_GRUB_FILE
# TARGET
# VAR_DEBUG_TRACE
# Arguments:
# None
# Returns:
@@ -29,13 +27,14 @@ update_grub_password() {
declare var_username="superadmin" var_password="" var_password_file="${DIR_CNF}/password_grub.txt" \
var_of="${TARGET}/etc/grub.d/40_custom" var_grub_entry=""
# TODO: Reactivate XTRACE Password Truncation
### No tracing for security reasons
[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set +x
#[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set +x
if [[ ! -f "${var_password_file}" ]] || ! IFS= read -r var_password < "${var_password_file}"; then
return "${ERR_READ_GRUB_FILE}"
fi
### Turn on tracing again
[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set -x
#[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set -x
var_grub_entry=$(generate_grub_password_pbkdf2 "${var_username}" "${var_password}")