msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 43s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-07-26 22:30:11 +02:00
parent 35e7ea588f
commit 106ed253f4
5 changed files with 70 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
func/partitioning/3200_partitioning.sh
View File

@@ -51,26 +51,26 @@ partitioning() {
### All current data for the respective device will be deleted.
if ! blkdiscard "/dev/${var_dev}"; then
do_log "warn" "file_only" "Partition table: '/dev/${var_dev}' deletion failed with: 'blkdiscard' trying 'sgdisk' fallback."
do_log "warn" "file_only" "3200() Partition table: '/dev/${var_dev}' deletion failed with: 'blkdiscard' trying 'sgdisk' fallback."
if command -v sgdisk >/dev/null && sgdisk --zap-all "/dev/${var_dev}"; then
do_log "info" "file_only" "Partition table: '/dev/${var_dev}' wiped with 'sgdisk --zap-all'."
do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' wiped with 'sgdisk --zap-all'."
elif dd if=/dev/zero of="/dev/${var_dev}" bs=1M count=8 status=none; then
do_log "info" "file_only" "Partition table: '/dev/${var_dev}' overwritten with zeros."
do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' overwritten with zeros."
else
do_log "fatal" "file_only" "Partition table: '/dev/${var_dev}' deletion failed with: [blkdiscard, sgdisk and dd]."
do_log "fatal" "file_only" "3200() Partition table: '/dev/${var_dev}' deletion failed with: [blkdiscard, sgdisk and dd]."
return "${ERR_TABLE_DELETE}"
fi
else
do_log "info" "file_only" "Partition table: '/dev/${var_dev}' discarded (blkdiscard)."
do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' discarded (blkdiscard)."
fi
@@ -79,16 +79,16 @@ partitioning() {
gpt|mbr)
if ! parted -s "/dev/${var_dev}" mklabel "${VAR_RECIPE_TABLE,,}"; then
do_log "fatal" "file_only" "Partition table: '/dev/${var_dev}' creation failed."
do_log "fatal" "file_only" "3200() Partition table: '/dev/${var_dev}' creation failed."
return "${ERR_TABLE_CREATE}"
fi
do_log "info" "file_only" "Partition table: '/dev/${var_dev}' generated: '${VAR_RECIPE_TABLE}'."
do_log "info" "file_only" "3200() Partition table: '/dev/${var_dev}' generated: '${VAR_RECIPE_TABLE}'."
;;
*)
do_log "fatal" "file_only" "No valid partition table chosen. String was '${VAR_RECIPE_TABLE}'."
do_log "fatal" "file_only" "3200() No valid partition table chosen. String was '${VAR_RECIPE_TABLE}'."
return "${ERR_PARTITIONTBL}"
;;
@@ -118,12 +118,12 @@ partitioning() {
if ! parted -s "/dev/${var_dev}" mkpart "${var_pri}" "${var_fs}" "${var_begin}" "${var_end_arg}"; then
do_log "fatal" "file_only" "Partition: '/dev/${var_dev}${var_part}' creation failed."
do_log "fatal" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' creation failed."
return "${ERR_PART_CREATE}"
fi
do_log "info" "file_only" "Partition: '/dev/${var_dev}${var_part}' generated | begin: '${var_begin}' | end: '${var_end_arg}'."
do_log "info" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' generated | begin: '${var_begin}' | end: '${var_end_arg}'."
### Assign the correct GPT typecode via sgdisk if table is GPT.
if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" ]]; then
@@ -131,25 +131,25 @@ partitioning() {
case "${var_fs,,}" in
fat32)
typecode="EF00" ;; # EFI System Partition
typecode="EF00" ;; ### EFI System Partition
swap)
typecode="8200" ;; # Linux SWAP
typecode="8200" ;; ### Linux SWAP
bios)
typecode="EF02" ;; # BIOS Boot Partition
typecode="EF02" ;; ### BIOS Boot Partition
ext4|btrfs)
typecode="8300" ;; # Linux native FS
typecode="8300" ;; ### Linux native FS
*)
do_log "warn" "file_only" "Partition: '/dev/${var_dev}${var_part}' unknown FS type: '${var_fs}', using default GPT FS '8300'."
do_log "warn" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' unknown FS type: '${var_fs}', using default GPT FS '8300'."
;;
esac
if sgdisk --typecode="${var_part}:${typecode}" "/dev/${var_dev}" &>/dev/null; then
do_log "info" "file_only" "Partition: '/dev/${var_dev}${var_part}' GPT typecode '${typecode}' set for '${var_fs}'."
do_log "info" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' GPT typecode '${typecode}' set for '${var_fs}'."
else
do_log "warn" "file_only" "Partition: '/dev/${var_dev}${var_part}' GPT typecode '${typecode}' failed to set."
do_log "warn" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' GPT typecode '${typecode}' failed to set."
fi
@@ -162,13 +162,13 @@ partitioning() {
gpt:uefi|mbr:uefi)
do_log "info" "file_only" "Partition: '/dev/${var_dev}${var_part}' | [${VAR_RECIPE_TABLE^^}:UEFI] no bootable flag required."
do_log "info" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' | [${VAR_RECIPE_TABLE^^}:UEFI] no bootable flag required."
;;
gpt:bios|mbr:bios)
parted -s "/dev/${var_dev}" set "${var_part}" boot on
do_log "info" "file_only" "Partition: '/dev/${var_dev}${var_part}' | [${VAR_RECIPE_TABLE^^}:BIOS] marked as bootable."
do_log "info" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' | [${VAR_RECIPE_TABLE^^}:BIOS] marked as bootable."
;;
esac
@@ -183,7 +183,7 @@ partitioning() {
done
if [[ -z "${var_uuid}" ]]; then
do_log "fatal" "file_only" "Partition: '/dev/${var_dev}${var_part}' could not read PARTUUID."
do_log "fatal" "file_only" "3200() Partition: '/dev/${var_dev}${var_part}' could not read PARTUUID."
return "${ERR_PART_READ}"
else
HMP_PATH_PARTUUID["PARTUUID_${var_mount_path}"]="${var_uuid}"

28
func/partitioning/3220_partition_encryption.sh
View File

@@ -44,6 +44,9 @@ partition_encryption() {
readarray -t ary_devs < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev | keys | .[]" "${VAR_SETUP_PART}")
for var_dev in "${ary_devs[@]}"; do
touch "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
chmod 0600 "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
### Iterate over all partitions for this device.
# shellcheck disable=SC2312
readarray -t ary_parts < <(yq e -r ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev} | keys | .[]" "${VAR_SETUP_PART}")
@@ -69,10 +72,8 @@ partition_encryption() {
fi
if [[ "${var_mount_path,,}" == "/boot" ]]; then
#ary_luks_opts=( "--key-file=$(tr -d '\n' <<< "${DIR_CNF}")/password_luks_boot.txt" )
ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_boot.txt" )
else
#ary_luks_opts=( "--key-file=$(tr -d '\n' <<< "${DIR_CNF}")/password_luks_common.txt" )
ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_common.txt" )
fi
@@ -99,18 +100,20 @@ partition_encryption() {
SWAP|/tmp)
mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M
do_log "info" "file_only" "Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."
do_log "info" "file_only" "3220() Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."
HMP_EPHEMERAL_DEV["${var_mount_path}"]="/dev/${var_dev}${var_part}"
HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}"
HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]="${var_filesystem_label}"
do_log "info" "file_only" "Stored in HashMap [HMP_EPHEMERAL_DEV] : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
do_log "info" "file_only" "Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_DEV] : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_filesystem_label}"]}'"
continue
;;
*)
do_log "error" "file_only" "Invalid mount path: '${var_mount_path}' for partition: '/dev/${var_dev}${var_part}'."
do_log "error" "file_only" "3220() Invalid mount path: '${var_mount_path}' for partition: '/dev/${var_dev}${var_part}'."
continue
;;
@@ -122,16 +125,16 @@ partition_encryption() {
if [[ "${var_encryption_integrity,,}" == "true" ]]; then
do_log "info" "file_only" "Partition: '/dev/${var_dev}${var_part}' dm-integrity encrypted."
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' dm-integrity encrypted."
else
do_log "info" "file_only" "Partition: '/dev/${var_dev}${var_part}' encrypted."
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' encrypted."
fi
cryptsetup luksHeaderBackup --header-backup-file="${DIR_BAK}/luks_header_${var_dev}${var_part}.bak" "/dev/${var_dev}${var_part}"
do_log "info" "file_only" "Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' LUKS Header saved: '${DIR_BAK}/luks_header_${var_dev}${var_part}.bak'."
### Opening encrypted container.
if [[ "${var_mount_path,,}" == "/boot" ]]; then
@@ -143,7 +146,11 @@ partition_encryption() {
--key-file="${DIR_CNF}/password_luks_common.txt" \
"${var_encryption_label}"
fi
do_log "info" "file_only" "Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'."
do_log "info" "file_only" "3220() Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'."
### Create luksDump log entry.
printf "#------------------------------------------------------------------#" >> "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
crpytsetup luksDump "/dev/${var_dev}${var_part}" >> "${DIR_LOG}/${var_dev}_cryptsetup_luksdump.log"
### Store UUID of the LUKS container.
var_uuid=$(blkid -s UUID -o value "/dev/${var_dev}${var_part}")
@@ -156,6 +163,7 @@ partition_encryption() {
done
done
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

13
func/partitioning/3240_partition_formatting.sh
View File

@@ -59,8 +59,8 @@ partition_formatting() {
### Preparation of Ephemeral 'SWAP' and '/tmp' as per https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption#UUID_and_LABEL
case "${var_mount_path,,}" in
swap|/tmp)
mkfs.ext4 -L "${var_fs_label}" "/dev/${var_dev}${var_part}" 1M
do_log "info" "file_only" "Partition: '/dev/${var_dev}${var_part}' ephemeral encryption prepared for: '${var_mount_path}'."
# mkfs.ext4 -L "${var_fs_label}" "/dev/${var_dev}${var_part}" 1M
do_log "info" "file_only" "3240() Partition: '/dev/${var_dev}${var_part}' ephemeral encryption already prepared in 3220(): '${var_mount_path}'."
continue
;;
esac
@@ -77,7 +77,7 @@ partition_formatting() {
ary_opts=( -L "${var_fs_label}" -f --csum "${var_fs_btrfs_checksum}" )
[[ "${var_fs_btrfs_dedup,,}" == "true" ]] && ary_opts+=( -m dup )
mkfs.btrfs "${ary_opts[@]}" "${var_node}"
do_log "info" "file_only" "Partition: '${var_node}' formatted: btrfs."
do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: btrfs."
echo "Partition: '${var_node}':" >> "${DIR_LOG}/btrfs.log"
btrfs filesystem show "${var_node}" >> "${DIR_LOG}/btrfs.log"
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
@@ -87,7 +87,7 @@ partition_formatting() {
ext4)
read -r -a ary_fmt_opts <<< "${var_fs_options}"
mkfs.ext4 -L "${var_fs_label}" "${ary_fmt_opts[@]}" "${var_node}"
do_log "info" "file_only" "Partition: '${var_node}' formatted: ext4."
do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: ext4."
echo "Partition: '${var_node}':" >> "${DIR_LOG}/ext4.log"
tune2fs -l "${var_node}" >> "${DIR_LOG}/ext4.log"
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
@@ -96,13 +96,13 @@ partition_formatting() {
fat32)
mkfs.fat -F 32 -n "${var_fs_label}" "${var_node}"
do_log "info" "file_only" "Partition: '${var_node}' formatted: FAT32."
do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: FAT32."
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"
;;
*)
do_log "error" "file_only" "Unsupported filesystem format: '${var_fs_version}'."
do_log "error" "file_only" "3240() Unsupported filesystem format: '${var_fs_version}'."
;;
esac
@@ -110,6 +110,7 @@ partition_formatting() {
done
done
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

5
func/partitioning/3260_setup_filesystem.sh
View File

@@ -61,19 +61,20 @@ setup_filesystem() {
else
do_log "error" "file_only" "Invalid value for encryption_enable: '${var_encryption_enable}', should be true or false."
do_log "error" "file_only" "3260() Invalid value for encryption_enable: '${var_encryption_enable}', should be true or false."
continue
fi
HMP_MOUNTPATH_DEV["${var_mount_path}"]="${var_node}"
do_log "info" "file_only" "Saved in HashMap HMP_MOUNTPATH_DEV: '${var_mount_path}' -> '${HMP_MOUNTPATH_DEV["${var_mount_path}"]}'"
do_log "info" "file_only" "3260() Saved in HashMap HMP_MOUNTPATH_DEV: '${var_mount_path}' -> '${HMP_MOUNTPATH_DEV["${var_mount_path}"]}'"
done
lsblk -o NAME,MAJ:MIN,FSTYPE,FSVER,SIZE,UUID,MOUNTPOINT,PATH "/dev/${var_dev}" >| "${DIR_LOG}/${var_dev}_overview.log"
done
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

34
func/partitioning/3280_mount_partition.sh
View File

@@ -48,7 +48,7 @@ mount_with_dir() {
ary_cmd+=("${var_mount_device}" "${TARGET}${var_mount_path}")
safe_exec "${ary_cmd[@]}" "${ERR_MOUNTING_DEV}" || return
do_log "info" "file_only" "Mounted: '${var_mount_device}' on: '${TARGET}${var_mount_path}' (Options='${var_mount_options}')."
do_log "info" "file_only" "3280() Mounted: '${var_mount_device}' on: '${TARGET}${var_mount_path}' (Options='${var_mount_options}')."
}
#######################################
@@ -61,7 +61,7 @@ mount_with_dir() {
#######################################
resolve_device() {
declare local_var_dev="$1" local_var_partition="$2" local_var_enc_boolean="$3" local_var_enc_label="$4"
if [[ "${local_var_enc_boolean,,}" == true ]]; then
if [[ "${local_var_enc_boolean,,}" == "true" ]]; then
printf '/dev/mapper/%s' "${local_var_enc_label}"
else
printf '/dev/%s%s' "${local_var_dev}" "${local_var_partition}"
@@ -81,7 +81,7 @@ validate_btrfs_compression() {
declare var_algo="$1" var_level="$2"
case "${var_algo}:${var_level}" in
zstd:|zstd:[0-9]|zstd:1[0-9]|zstd:2[0-2]|lzo:) return 0 ;;
*) do_log "error" "file_only" "Invalid btrfs compression '${var_algo}:${var_level}'"; return "${ERR_BTRFS_OPTION}" ;;
*) do_log "error" "file_only" "3280() Invalid btrfs compression '${var_algo}:${var_level}'"; return "${ERR_BTRFS_OPTION}" ;;
esac
}
@@ -107,13 +107,13 @@ mount_partition() {
### Mount "/"-filesystem
declare -r var_mount_path_root="/"
if [[ -n ${HMP_MOUNTPATH_DEV[${var_mount_path_root}]} ]]; then
if [[ -n "${HMP_MOUNTPATH_DEV[${var_mount_path_root}]}" ]]; then
mount_with_dir "${var_mount_path_root}" "${HMP_MOUNTPATH_DEV[${var_mount_path_root}]}" || return "${ERR_MOUNTING_DEV}"
else
do_log "error" "file_only" "Root-filesystem '${var_mount_path_root}' not found in Hashmap."
do_log "error" "file_only" "3280() Root-filesystem '${var_mount_path_root}' not found in Hashmap."
return "${ERR_MOUNTING_ROOT}"
fi
@@ -123,13 +123,13 @@ mount_partition() {
for var_path in "/boot" "/boot/efi"; do
if [[ -n ${HMP_MOUNTPATH_DEV[${var_path}]} ]]; then
if [[ -n "${HMP_MOUNTPATH_DEV[${var_path}]}" ]]; then
mount_with_dir "${var_path}" "${HMP_MOUNTPATH_DEV[${var_path}]}" || return "${ERR_MOUNTING_DEV}"
else
do_log "info" "file_only" "Entry '${var_path}' not found in Hashmap."
do_log "info" "file_only" "3280() Entry '${var_path}' not found in Hashmap."
fi
@@ -175,7 +175,7 @@ mount_partition() {
--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
mkswap "/dev/mapper/${var_encryption_label}"
swapon "/dev/mapper/${var_encryption_label}"
do_log "info" "file_only" "Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
do_log "info" "file_only" "3280() Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
continue
elif [[ "${var_mount_path}" == "/tmp" ]]; then
@@ -192,7 +192,7 @@ mount_partition() {
ary_cmd2+=("/dev/mapper/${var_encryption_label}" "${TARGET}${var_mount_path}")
safe_exec "${ary_cmd2[@]}" "${ERR_MOUNTING_DEV}" || return "${ERR_MOUNTING_DEV}"
do_log "info" "file_only" "Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
do_log "info" "file_only" "3280() Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
continue
fi
@@ -200,23 +200,27 @@ mount_partition() {
declare var_resolved_dev
var_resolved_dev=$(resolve_device "${var_dev}" "${var_part}" "${var_encryption_enable}" "${var_encryption_label}")
if [[ "${var_fs_version,,}" == btrfs ]]; then
if [[ "${var_fs_version,,}" == "btrfs" ]]; then
### Mount toplevel (subvolid=0) *without* extra options
### Mount toplevel (subvolid=0) without extra options.
declare -a ary_cmd_mount=(mount -o "subvolid=0" "${var_resolved_dev}" "${VAR_SAFE_MNT_BASE}")
safe_exec "${ary_cmd_mount[@]}" "${ERR_BTRFS_INITPH}" || return "${ERR_BTRFS_INITPH}"
btrfs subvolume create "${VAR_SAFE_MNT_BASE}"/"${var_fs_btrfs_subvolume}"
do_log "info" "file_only" "3280() btrfs subvolid=0 created: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
if [[ -n "${var_fs_btrfs_snapshot}" ]]; then
btrfs subvolume create "${VAR_SAFE_MNT_BASE}"/"${var_fs_btrfs_snapshot}" || return "${ERR_BTRFS_SUBVOL}"
do_log "info" "file_only" "3280() btrfs subvolid=${var_fs_btrfs_snapshot} created: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
fi
umount "${VAR_SAFE_MNT_BASE}"
do_log "info" "file_only" "3280() btrfs subvolume umount: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
fi
case "${var_fs_version,,}:${var_encryption_enable,,}" in
btrfs:*)
validate_btrfs_compression "${var_fs_btrfs_compress}" "${var_fs_btrfs_level}" || return "${ERR_BTRFS_OPTION}"
declare var_btrfs_compression_options="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
@@ -224,19 +228,25 @@ mount_partition() {
mount_with_dir "${var_mount_path}" "${var_resolved_dev}" "${var_btrfs_compression_options}" || return "${ERR_MOUNTING_DEV}"
if [[ -n "${var_fs_btrfs_snapshot}" ]]; then
mkdir -p "${TARGET}${var_mount_path}/.snapshots"
do_log "info" "file_only" "3280() Created: '${TARGET}${var_mount_path}/.snapshots'."
mount -o "${var_mount_optsnap}" "${var_resolved_dev}" "${TARGET}${var_mount_path}/.snapshots"
do_log "info" "file_only" "3280() Mounted: '${var_resolved_dev}' on: '${TARGET}${var_mount_path}/.snapshots' (Options='${var_mount_optsnap}')."
fi
;;
ext4:*)
mount_with_dir "${var_mount_path}" "${var_resolved_dev}" "${var_mount_options}" || return "${ERR_MOUNTING_DEV}"
;;
*) do_log "error" "file_only" "Unsupported fs/encryption combination."
*) do_log "error" "file_only" "3280() Unsupported fs/encryption combination."
return "${ERR_MOUNTING_DEV}" ;;
esac
done
done
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh