V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

includes/target/etc/initramfs-tools/files/unlock_wrapper.sh

@@ -35,7 +35,7 @@ declare -g PASSPHRASE=''
 #   1: Color code.
 #   *: Text to print.
 #######################################
-color_echo() { declare c="$1"; shift; declare msg="${*}"; printf "%s%s %s%s" "${c}" "${msg}" "${RES}" "${NL}"; }
+color_echo() { declare c="${1}"; shift; declare msg="${*}"; printf "%b%s %b%b" "${c}" "${msg}" "${RES}" "${NL}"; }
 
 #######################################
 # Die helper: print and exit hard.
@@ -45,7 +45,7 @@ color_echo() { declare c="$1"; shift; declare msg="${*}"; printf "%s%s %s%s" "${
 # Arguments:
 #   1: Message string to print.
 #######################################
-die() { printf "%s✘ %s %s%s" "${RED}" "$1" "${RES}" "${NL}" >&2; power_off 3; }
+die() { printf "%b✘ %s %b%b" "${RED}" "$1" "${RES}" "${NL}" >&2; power_off 3; }
 
 #######################################
 # Drop to bash environment.
@@ -71,22 +71,32 @@ extract_nuke_hash() {
 
   ### Read '/proc/cmdline' into a single line safely.
   read -r CMDLINE < /proc/cmdline
+
   for ARG in ${CMDLINE}; do
+
     case "${ARG}" in
+
       nuke=*)
         NUKE_HASH="${ARG#nuke=}"
         if [[ "${NUKE_HASH}" =~ ${REGEX} ]]; then
+
           NUKE_ENABLED="true"
           return 0
+
         else
+
           ### If there is a malformed Grub Bootparameter 'nuke=HASH', drop to bash.
           color_echo "${RED}" "✘ Nuke Hash Malformat : [${REGEX}] [${NUKE_HASH}]." >&2
           color_echo "${RED}" "✘ Dropping to bash ...:" >&2
           drop_bash
+
         fi
       ;;
+
     esac
+
   done
+
   ### No 'nuke=HASH' entry found.
   return 1
 }
@@ -101,6 +111,7 @@ gather_luks_devices() {
   declare -i  tries=0
 
   while ((tries < 10)); do
+
     # shellcheck disable=SC2312
     mapfile -t curr < <(blkid -t TYPE=crypto_LUKS -o device | sort)
 
@@ -127,12 +138,18 @@ gather_luks_devices() {
 #######################################
 nuke() {
   declare     dev=""
+
   for dev in "${DEVICES_LUKS[@]}"; do
+
     cryptsetup erase --batch-mode "${dev}" || true
     color_echo "${RED}" "✘ Error: LUKS Device Header malfunction: [${dev}]."
+
   done
+
   secure_unset_pass
+
   color_echo "${RED}" "✘ Error: LUKS Device malfunction. System Power Off in 16 seconds."
+
   power_off 16
 }
 
@@ -168,15 +185,17 @@ print_scr_err() {
   declare -r  scr_err_errline="$3"
   declare -r  scr_err_errfunc="$4"
   declare -r  scr_err_errcmmd="$5"
-  printf "%s" "${NL}"
+
+  printf "%b" "${NL}"
+
   color_echo "${RED}" "✘ System caught an 'ERROR'. System Power Off in 16 seconds." >&2
-  printf "%s" "${NL}"
+  printf "%b" "${NL}"
   color_echo "${RED}" "✘ Error               : [${scr_err_errcode}]" >&2
   color_echo "${RED}" "✘ Line                : [${scr_err_errline}]" >&2
   color_echo "${RED}" "✘ Script              : [${scr_err_errscrt}]" >&2
   color_echo "${RED}" "✘ Function            : [${scr_err_errfunc}]" >&2
   color_echo "${RED}" "✘ Command             : [${scr_err_errcmmd}]" >&2
-  printf "%s" "${NL}"
+  printf "%b" "${NL}"
 }
 
 #######################################
@@ -229,15 +248,24 @@ read_passphrase() {
   PASSPHRASE="$(${ASKPASS} "Enter passphrase: ")"
 
   if [[ "${NUKE_ENABLED,,}" == 'true' ]]; then
+
     ### Validate NUKE_HASH format (e.g., $id$salt$hash)
     if [[ "${NUKE_HASH}" =~ ${REGEX} ]]; then
+
       SALT="$(cut -d'$' -f3 <<< "${NUKE_HASH}")"
+
       for METHOD in "${METHODS[@]}"; do
+
         if mkpasswd -m "${METHOD}" -S "${SALT}" "${PASSPHRASE}" 2>/dev/null | grep -qF -- "${NUKE_HASH}"; then
+
           nuke
+
         fi
+
       done
+
     fi
+
   fi
 
   return 0
@@ -267,6 +295,7 @@ trap_on_err() {
   declare -r  errline="$3"
   declare -r  errfunc="$4"
   declare -r  errcmmd="$5"
+
   trap - ERR INT TERM
   stty echo
   print_scr_err "${errcode}" "${errscrt}" "${errline}" "${errfunc}" "${errcmmd}"
@@ -307,11 +336,13 @@ verify_script() {
   declare     cmd="" computed="" expected="" hashfile="" item="" sigfile=""
 
   for item in "${algo[@]}"; do
+
     hashfile="${dir}/${script}.${item}"
     sigfile="${hashfile}.sig"
     cmd="${item}sum"
 
     color_echo "${MAG}" "🔏 Verifying signature of: [${hashfile}]"
+
     gpgv --keyring /etc/keys/pubring.gpg "${sigfile}" "${hashfile}" || {
       color_echo "${RED}" "✘ Signature verification failed for: [${hashfile}]"
       color_echo "${RED}" "✘ System Power Off in 3 seconds ...."
@@ -320,6 +351,7 @@ verify_script() {
     color_echo "${GRE}" "🔏 Verifying signature of: [${hashfile}] successful."
 
     color_echo "${MAG}" "🔢 Recomputing Hash: [${item}]"
+
     computed=$(${cmd} "${dir}/${script}" | awk '{print $1}')
     expected=$(cat "${hashfile}")
 
@@ -329,6 +361,7 @@ verify_script() {
       power_off 3
     fi
     color_echo "${GRE}" "🔢 Recomputing Hash: [${item}] successful."
+
   done
 
   color_echo "${GRE}" "🔏 All signatures and hashes verified successfully. Proceeding."
@@ -354,13 +387,13 @@ main() {
   color_echo "${RED}" "Coresecret Connection established."
   color_echo "${RED}" "Starting Time: ${CURRENTDATE}"
   color_echo "${MAG}" "Integrity self-check ..."
-  printf "%s" "${NL}"
+  printf "%b" "${NL}"
 
   verify_script
 
   ### Read newline-separated output into an array.
   color_echo "${MAG}" "Scanning for LUKS devices ..."
-  printf "%s" "${NL}"
+  printf "%b" "${NL}"
   # shellcheck disable=SC2312
   mapfile -t DEVICES_LUKS < <(gather_luks_devices)
 
@@ -383,7 +416,7 @@ main() {
 
   else
 
-    printf "%s" "${NL}"
+    printf "%b" "${NL}"
     color_echo "${RED}" "✘ Unsuccessful command 'cryptroot-unlock'."
     color_echo "${GRE}" "✘ No LUKS operations performed. Dropping to bash ..."
     color_echo "${GRE}" "✘ To unlock 'root' partition, and maybe others like 'swap', run 'cryptroot-unlock'."