V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/system/4060_generate_crypttab.sh

@@ -26,8 +26,10 @@ guard_sourcing
 #######################################
 write_crypttab() {
   declare write_label="$1" write_dev="$2" write_key_file="$3" write_opts="$4"
-  printf "%-43s %-45s %-29s %s\n" "${write_label}" "${write_dev}" "${write_key_file}" "${write_opts}" >> "${TARGET}/etc/crypttab"
+
+  printf "%-43s %-46s %-30s %s\n" "${write_label}" "${write_dev}" "${write_key_file}" "${write_opts}" >> "${TARGET}/etc/crypttab"
   do_log "info" "file_only" "4060() crypttab entry generated: [${write_label} ${write_dev} ${write_key_file} ${write_opts}]."
+
   return 0
 }
 
@@ -40,6 +42,7 @@ write_crypttab() {
 #   HMP_PATH_LUKSUUID
 #   TARGET
 #   VAR_NUKE
+#   VAR_VERSION
 #   dropbear_boot
 # Arguments:
 #  None
@@ -54,7 +57,7 @@ generate_crypttab() {
   : >| "${TARGET}/etc/crypttab"
   chmod 0600 "${TARGET}/etc/crypttab"
 
-  cat << 'EOF' >> "${TARGET}/etc/crypttab"
+  cat << EOF >> "${TARGET}/etc/crypttab"
 # SPDX-Version: 3.0
 # SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
 # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
@@ -66,6 +69,10 @@ generate_crypttab() {
 # SPDX-PackageName: CISS.debian.installer
 # SPDX-Security-Contact: security@coresecret.eu
 
+# /etc/fstab            : Generated by CISS.debian.installer ${VAR_VERSION}
+# Architecture          : ${VAR_ARCHITECTURE}
+# Distribution          : ${VAR_CODENAME}
+
 # Static file system information: '/etc/crypttab'.
 #
 # Basic rule: 'discard' / 'nodiscard' are normally only set in '/etc/crypttab' when LUKS/dm-crypt is in use. Options like
@@ -77,7 +84,7 @@ generate_crypttab() {
 # not specify discard in the '/etc/crypttab', dm-crypt blocks TRIM by default. This would render a discard in the '/etc/fstab'
 # ineffective.
 #
-# <name>                                   <device>                                      <password-file-or-none>       <options>
+# <name>                                   <device>                                      <password-file-or-none>                 <options>
 
 EOF
 
@@ -91,7 +98,9 @@ EOF
 
       if [[ "${VAR_NUKE,,}" == "true" && "${var_key,,}" == "/" ]]; then
 
-        write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=/lib/cryptsetup/scripts/unlock_wrapper.sh"
+        # TODO: Check for cryptsetup installation errors while unlock_wrapper.sh is not yet installed.
+        #write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=/lib/cryptsetup/scripts/unlock_wrapper.sh"
+        write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs"
         continue
 
       fi
@@ -113,20 +122,29 @@ EOF
     var_host_uuid="${HMP_PATH_FSUUID["${var_key}"]}"
 
     case "${var_key}" in
+
       SWAP)
         write_crypttab "${var_ephemeral_enclabel}" "UUID=${var_host_uuid}" "/dev/random" "swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096"
         ;;
+
       /tmp)
         write_crypttab "${var_ephemeral_enclabel}" "UUID=${var_host_uuid}" "/dev/random" "offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4"
         ;;
+
       *)
-        do_log "error" "file_only" "Only 'SWAP' and '/tmp' are valid Partitions for Ephemeral Encryption. Given value was: '${var_key}'."
+        do_log "error" "file_only" "4060() Only 'SWAP' and '/tmp' are valid Partitions for Ephemeral Encryption. Given value was: '${var_key}'."
         continue
         ;;
+
     esac
 
   done
 
+  cat << 'EOF' >> "${TARGET}/etc/crypttab"
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=200 ft=sh
+EOF
+
   return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh