V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4100_base/4133_installation_masking.sh

@@ -26,13 +26,13 @@ installation_masking() {
     systemctl mask ctrl-alt-del.target sleep.target suspend.target hibernate.target hybrid-sleep.target
   "
 
-  do_log "info" "file_only" "4133() Masked: [ctrl-alt-del.target sleep.target suspend.target hibernate.target hybrid-sleep.target]."
+  do_log "info" "file_only" "4133() Masked: [ctrl-alt-del.target sleep.target suspend.target hibernate.target hybrid-sleep.target]"
 
   chroot_script "${TARGET}" "
       systemctl mask plymouth-start.service plymouth-quit.service plymouth-quit-wait.service plymouth-read-write.service
   "
 
-  do_log "info" "file_only" "4133() Masked: [plymouth-start.service plymouth-quit.service plymouth-quit-wait.service plymouth-read-write.service]."
+  do_log "info" "file_only" "4133() Masked: [plymouth-start.service plymouth-quit.service plymouth-quit-wait.service plymouth-read-write.service]"
 
   guard_dir && return 0
 }

func/cdi_4200_boot/4210_generate_crypttab.sh

@@ -99,10 +99,14 @@ EOF
         #write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=/lib/cryptsetup/scripts/unlock_wrapper.sh"
         write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs"
 
-      else
+      elif [[ "${var_key}" == "/usr" ]]; then
 
         write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs"
 
+      else
+
+        write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard"
+
       fi
 
     else
@@ -122,11 +126,11 @@ EOF
     case "${var_key,,}" in
 
       swap)
-        write_crypttab "${var_ephemeral_enclabel}" "LABEL=${var_host_fs_label}" "/dev/random" "plain,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,discard,swap"
+        write_crypttab "${var_ephemeral_enclabel}" "LABEL=${var_host_fs_label}" "/dev/random" "offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,discard,swap"
         ;;
 
       /tmp)
-        write_crypttab "${var_ephemeral_enclabel}" "LABEL=${var_host_fs_label}" "/dev/random" "plain,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,discard,tmp=ext4"
+        write_crypttab "${var_ephemeral_enclabel}" "LABEL=${var_host_fs_label}" "/dev/random" "offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,discard,tmp=ext4"
         ;;
 
       *)

func/cdi_4300_network/4311_dropbear_initramfs.sh

@@ -51,6 +51,27 @@ dropbear_initramfs() {
     do_log "debug" "file_only" "4311() Installation [${var_file}] successful."
   done
 
+  insert_header   "${TARGET}/etc/apt/preferences.d/99-prefer-openssh"
+  insert_comments "${TARGET}/etc/apt/preferences.d/99-prefer-openssh"
+  cat << EOF >>   "${TARGET}/etc/apt/preferences.d/99-prefer-openssh"
+# Prevent the dropbear *daemon* from being installed at all.
+# DO NOT block dropbear-bin — needed by dropbear-initramfs.
+
+Package: dropbear
+Pin: release *
+Pin-Priority: -1
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
+EOF
+
+  chroot_script "${TARGET}" "
+    systemctl mask dropbear.service dropbear.socket
+  "
+
+  do_log "info" "file_only" "4133() Masked: [dropbear.service dropbear.socket]"
+
+
+
   guard_dir && return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh