V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-07-07 22:21:40 +02:00
parent 0b806e2234
commit 52d72c159d
5 changed files with 121 additions and 110 deletions
--- a/.editorconfig
+++ b/.editorconfig
@@ -18,15 +18,14 @@ indent_style = space
 indent_size = 2
 tab_width = 2
 max_line_length = 128
-
-[*.conf]
 end_of_line = lf
-charset = utf-8
-insert_final_newline = true
-trim_trailing_whitespace = true
+
+#[*.conf]
+#charset = utf-8
+#insert_final_newline = true
+#trim_trailing_whitespace = true

 [*.md]
-end_of_line = lf
 # Markdown benefits from a final newline for POSIX tools
 insert_final_newline = true
 # Do not trim trailing whitespace: two spaces at end-of-line signal a hard line break in Markdown
@@ -40,13 +39,11 @@ trim_trailing_whitespace = false
 #charset = utf-8

 [*.{yaml,yml}]
-end_of_line = lf
 insert_final_newline = true
 # Trim trailing whitespace (safe, since YAML does not rely on trailing spaces)
 trim_trailing_whitespace = true

 [*.{sh,bash,zsh}]
-end_of_line = lf
 charset = utf-8
 insert_final_newline = true
 trim_trailing_whitespace = true
--- a/.gitattributes
+++ b/.gitattributes
@@ -0,0 +1,13 @@
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+* text eol=lf
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
--- a/func/3220_partition_encryption.sh
+++ b/func/3220_partition_encryption.sh
@@ -30,11 +30,11 @@ guard_sourcing
 #######################################
 partition_encryption() {
  ### Declare Arrays and Variables.
-  declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_PATH_LUKSUUID
+  declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_EPHEMERAL_FS_LABEL HMP_PATH_LUKSUUID HMP_PATH_ENCLABEL
  declare var_dev var_part \
    var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_nuke var_encryption_cipher \
    var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta \
-    var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path
+    var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path var_uuid
  declare -a ary_devs ary_parts

  ### Iterate over all devices in the recipe.
@@ -88,17 +88,18 @@ partition_encryption() {
          SWAP|/tmp)

            mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M
-            do_log "info" "false" "Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."
+            do_log "info" "true" "Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."

            HMP_EPHEMERAL_DEV["${var_mount_path}"]="/dev/${var_dev}${var_part}"
            HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}"
-            do_log "info" "false" "Stored in HashMap [HMP_EPHEMERAL_DEV]     : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
-            do_log "info" "false" "Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
+            HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]="${var_filesystem_label}"
+            do_log "info" "true" "Stored in HashMap [HMP_EPHEMERAL_DEV]     : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
+            do_log "info" "true" "Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
            continue
            ;;

          *)
-            do_log "error" "false" "Invalid mount path: '${var_mount_path}' for partition: '/dev/${var_dev}${var_part}'."
+            do_log "error" "true" "Invalid mount path: '${var_mount_path}' for partition: '/dev/${var_dev}${var_part}'."
            continue
            ;;

@@ -141,11 +142,11 @@ partition_encryption() {
      do_log "info" "false" "Partition: '/dev/${var_dev}${var_part}' opened as '/dev/mapper/${var_encryption_label}'."

      ### Store UUID of the LUKS container.
-      # shellcheck disable=SC2155
-      declare var_uuid=$(blkid -s UUID -o value "/dev/mapper/${var_encryption_label}")
+      var_uuid=$(blkid -s UUID -o value "/dev/mapper/${var_encryption_label}")
      # shellcheck disable=SC2155
      [[ "${var_mount_path}" == "/" ]] && declare -grx VAR_CRYPT_ROOT="${var_uuid}"
      HMP_PATH_LUKSUUID["UUID_${var_mount_path}"]="${var_uuid}"
+      HMP_PATH_ENCLABEL["UUID_${var_mount_path}"]="${var_encryption_label}"

    done

--- a/func/4040_generate_fstab.sh
+++ b/func/4040_generate_fstab.sh
@@ -13,7 +13,7 @@
 guard_sourcing

 #######################################
-# /etc/fstab entry writer and logger.
+# '/etc/fstab' entry writer and logger.
 # Globals:
 #   TARGET
 # Arguments:
@@ -21,14 +21,14 @@ guard_sourcing
 #   2: Mount Path
 #   3: Filesystem
 #   4: Mount Options
-#   5: Dump and Pass Value combined by one <space>, e.g., "0 1"
+#   5: Pass value, while Dump value is hardcoded always "0", e.g., "1"
 # Returns:
 #   0: Successfully executed commands.
 #######################################
 write_fstab() {
-  declare _uuid="$1" _path="$2" _fs="$3" _opts="$4" _dp="$5"
-  printf "UUID=%s    %s    %s    %s    %s\n" "${_uuid}" "${_path}" "${_fs}" "${_opts}" "${_dp}" >> "${TARGET}/etc/fstab"
-  do_log "info" "true" "fstab entry generated: 'UUID=${_uuid}    ${_path}    ${_fs}    ${_opts}    ${_dp}'."
+  declare _uuid="$1" _path="$2" _fs="$3" _opts="$4" _pass="$5"
+  printf "UUID=%s    %s    %s    %s    0 %s\n" "${_uuid}" "${_path}" "${_fs}" "${_opts}" "${_pass}" >> "${TARGET}/etc/fstab"
+  do_log "info" "true" "fstab entry generated: 'UUID=${_uuid}    ${_path}    ${_fs}    ${_opts}    0 ${_pass}'."
  return 0
 }

@@ -111,17 +111,17 @@ EOF
        var_btrfs_compression="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
      fi

-      write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options},${var_btrfs_compression}" "0 1"
+      write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options},${var_btrfs_compression}" "1"

      if [[ -n "${var_fs_btrfs_subvolume}" ]]; then

        if [[ "${var_path}" == "/" ]]; then

-          write_fstab "${var_uuid}" "/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0 0"
+          write_fstab "${var_uuid}" "/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0"

        else

-          write_fstab "${var_uuid}" "${var_path}/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0 0"
+          write_fstab "${var_uuid}" "${var_path}/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0"

        fi

@@ -130,12 +130,12 @@ EOF

    elif [[ "${var_fs_version,,}" == ext4 ]]; then

-      write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options}" "0 1"
+      write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options}" "1"
      continue

    elif [[ "${var_fs_version,,}" == fat32 ]]; then

-      write_fstab "${var_uuid}" "${var_path}" "vfat" "${var_mount_options}" "0 2"
+      write_fstab "${var_uuid}" "${var_path}" "vfat" "${var_mount_options}" "2"
      continue

    fi
@@ -174,21 +174,21 @@ EOF
        var_btrfs_compression="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
      fi

-      write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options},${var_btrfs_compression}" "0 2"
+      write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options},${var_btrfs_compression}" "2"

      if [[ -n "${var_fs_btrfs_subvolume}" ]]; then
-        write_fstab "${var_uuid}" "${var_path}/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0 0"
+        write_fstab "${var_uuid}" "${var_path}/.snapshots" "${var_fs_version}" "${var_mount_optsnap}" "0"
      fi
      continue

    elif [[ "${var_fs_version,,}" == ext4 ]]; then

-      write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options}" "0 2"
+      write_fstab "${var_uuid}" "${var_path}" "${var_fs_version}" "${var_mount_options}" "2"
      continue

    elif [[ "${var_fs_version,,}" == fat32 ]]; then

-      write_fstab "${var_uuid}" "${var_path}" "vfat" "${var_mount_options}" "0 2"
+      write_fstab "${var_uuid}" "${var_path}" "vfat" "${var_mount_options}" "2"
      continue

    fi
@@ -204,11 +204,11 @@ EOF

  ### Add entry for 'SWAP' device.
  var_path="SWAP"
-  write_fstab "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}" "none" "swap" "defaults" "0 0"
+  write_fstab "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}" "none" "swap" "defaults" "0"

  ### Add entry for '/tmp' device.
  var_path="/tmp"
-  write_fstab "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}" "/tmp" "ext4" "defaults,rw,nodev,nosuid,relatime" "0 0"
+  write_fstab "/dev/mapper/${HMP_EPHEMERAL_ENCLABEL["${var_path}"]}" "/tmp" "ext4" "defaults,rw,nodev,nosuid,relatime" "0"

  return 0
 }
--- a/func/4060_generate_crypttab.sh
+++ b/func/4060_generate_crypttab.sh
@@ -12,102 +12,102 @@

 guard_sourcing

-###########################################################################################
-# Generate "${TARGET}" /etc/crypttab entries.
+#######################################
+# '/etc/crypttab' entry writer and logger.
 # Globals:
-#   MAP_PATH_CRYPT
-#   MAP_UUID_CRYPT
-#   MODULE_ERR
-#   MODULE_TXT
 #   TARGET
 # Arguments:
+#   1: Encryption Label
+#   2: LUKS Container UUID
+#   3: Keyfile or none
+#   4: LUKS Options
+# Returns:
+#   0: Successfully executed commands.
+#######################################
+write_crypttab() {
+  declare _label="$1" _device="$2" _key_file="$3" _opts="$4"
+  printf "%s    %s    %s    %s    \n" "${_label}" "${_device}" "${_key_file}" "${_opts}" >> "${TARGET}/etc/crypttab"
+  do_log "info" "true" "crypttab entry generated: '${_label}    ${_device}    ${_key_file}    ${_opts}'."
+  return 0
+}
+
+#######################################
+# Generate target '/etc/crypttab' entries.
+# Globals:
+#   HMP_EPHEMERAL_ENCLABEL
+#   HMP_EPHEMERAL_FS_LABEL
+#   HMP_PATH_ENCLABEL
+#   HMP_PATH_LUKSUUID
+#   TARGET
+#   accounts_dropbear_unlock
+# Arguments:
 #   None
-###########################################################################################
-3_7_3_functions_installation_generate_crypttab() {
-  declare -g -x MODULE_ERR="3_7_3_functions_installation_generate_crypttab"
-  declare -g -x MODULE_TXT="Generating '${TARGET}/etc/crypttab' entries"
-  do_show_header "${MODULE_TXT}"
+# Returns:
+#   0: Successfully executed commands.
+#######################################
+generate_crypttab() {
+  declare var_key var_encryption_label var_luks_uuid var_ephemeral_enclabel var_ephemeral_fs_label

-  # Generate '${TARGET}/etc/crypttab'.
-  touch "${TARGET}"/etc/crypttab
-  chmod 0644 "${TARGET}"/etc/crypttab
+  ### Generate '${TARGET}/etc/crypttab' header.
+  : >| "${TARGET}/etc/crypttab"
+  chmod 0644 "${TARGET}/etc/crypttab"

-  # Generate '${TARGET}/etc/crypttab' header.
-  # shellcheck disable=SC2129
-  cat << 'EOF' >> "${TARGET}"/etc/crypttab
+  cat << 'EOF' >> "${TARGET}/etc/crypttab"
+# /etc/crypttab: static file system information.
+#
+# Basic rule: 'discard' / 'nodiscard' are normally only set in '/etc/crypttab' when LUKS/dm-crypt is in use.
+# Options like 'discard=async' or similar are typically only set in '/etc/fstab' (at the file system level).
+# The crypttab determines whether the underlying encrypted device (LUKS/dm-crypt) passes TRIM commands to the
+# physical drive or not. The fstab determines whether and how the file system itself generates the discard
+# operations and sends them down through the LUKS layer.
+#
+# RECOMMENDED: 'discard' enables the TRIM commands to be forwarded by the dm-crypt layer to the SSD/physical
+# device. If you do not specify discard in the crypttab, dm-crypt blocks TRIM by default. This would render a
+# discard in the fstab ineffective.
+#
 # <name>                                   <device>       <password-file-or-none>        <options>

 EOF

-  ### Reminder ###
-  # MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]="${UUID}"
-  # MAP_PATH_CRYPT["${MOUNT_PATH}"]="${ENCRYPTION_LABEL}"
-  # do_log "info" "false" "Saved in HashMap MAP_UUID_CRYPT: '${ENCRYPTION_LABEL}' -> '${MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]}'"
-  # do_log "info" "false" "Saved in HashMap MAP_PATH_CRYPT: '${MOUNT_PATH}' -> '${MAP_PATH_CRYPT["${MOUNT_PATH}"]}'"
+  ### Generate '${TARGET}/etc/crypttab' entries.
+  for var_key in "${HMP_PATH_LUKSUUID[@]}"; do

-  # Generate '${TARGET}/etc/crypttab' entries.
-  declare KEY=""
-  declare ENCRYPTION_LABEL=""
+    var_encryption_label="${HMP_PATH_ENCLABEL["${var_key}"]}"
+    var_luks_uuid="${HMP_PATH_LUKSUUID["${var_key}"]}"

-  for KEY in "${MAP_PATH_CRYPT[@]}"; do
+    if [[ "${accounts_dropbear_unlock,,}" == "true" ]]; then

-    ENCRYPTION_LABEL="${MAP_PATH_CRYPT["${KEY}"]}"
-
-    if [[ ${accounts_dropbear_unlock,,} == "true" ]]; then
-
-      # shellcheck disable=2129
-      echo "# ${KEY} was on /dev/mapper/${MAP_PATH_CRYPT["${KEY}"]} during installation" >> "${TARGET}"/etc/crypttab
-      echo "${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]} none luks,initramfs" >> "${TARGET}"/etc/crypttab
-      echo "" >> "${TARGET}"/etc/crypttab
-      do_log "info" "false" "'${TARGET}/etc/crypttab' entry generated: '${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT[${ENCRYPTION_LABEL}]} none luks,discard,initramfs'."
-
-    elif [[ ${accounts_dropbear_unlock,,} == "false" ]]; then
-
-       # shellcheck disable=2129
-      echo "# ${KEY} was on /dev/mapper/${MAP_PATH_CRYPT["${KEY}"]} during installation" >> "${TARGET}"/etc/crypttab
-      echo "${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT["${ENCRYPTION_LABEL}"]} none luks" >> "${TARGET}"/etc/crypttab
-      echo "" >> "${TARGET}"/etc/crypttab
-      do_log "info" "false" "'${TARGET}/etc/crypttab' entry generated: '${MAP_PATH_CRYPT["${KEY}"]} UUID=${MAP_UUID_CRYPT[${ENCRYPTION_LABEL}]} none luks,discard'."
-
-    fi
-
-  done
-
-  # TODO: Update loop to iterate thru dynamic number of ephemeral drives.
-  # Generate '${TARGET}/etc/crypttab' special ephemeral entries.
-  declare -a EPHEMERAL_MOUNT_PATH=("SWAP" "/tmp")
-  declare KEY=""
-
-  # MAP_EPHEMERAL_DEV["${MOUNT_PATH}"]="/dev/${DEV}${PARTITION}"
-  # MAP_EPHEMERAL_ENCLABEL["${MOUNT_PATH}"]="${ENCRYPTION_LABEL}"
-  for KEY in "${EPHEMERAL_MOUNT_PATH[@]}"; do
-
-    if [[ ${KEY} == "SWAP" ]]; then
-
-      # shellcheck disable=2129
-      echo "# ${KEY} was on ${MAP_EPHEMERAL_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/crypttab
-      # TODO: Change static 'LABEL=' to dynamic extraction of partitioning.yaml 'recipe_..._filesystem_label' recipe string.
-      echo "${MAP_EPHEMERAL_ENCLABEL[${KEY}]}  LABEL=SWAP  /dev/random  swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096" >> "${TARGET}"/etc/crypttab
-      echo "" >> "${TARGET}"/etc/crypttab
-      do_log "info" "false" "'${TARGET}/etc/crypttab' entry generated: '${MAP_EPHEMERAL_ENCLABEL[${KEY}]}  LABEL=SWAP  /dev/random  swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096'."
-
-    elif [[ ${KEY} == "/tmp" ]]; then
-
-      # shellcheck disable=2129
-      echo "# ${KEY} was on ${MAP_EPHEMERAL_DEV[${KEY}]} during installation" >> "${TARGET}"/etc/crypttab
-      # TODO: Change static 'LABEL=' to dynamic extraction of partitioning.yaml 'recipe_..._filesystem_label' recipe string.
-      echo "${MAP_EPHEMERAL_ENCLABEL[${KEY}]}  LABEL=ext4_tmp  /dev/random  offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4" >> "${TARGET}"/etc/crypttab
-      echo "" >> "${TARGET}"/etc/crypttab
-      do_log "info" "false" "'${TARGET}/etc/crypttab' entry generated: '${MAP_EPHEMERAL_ENCLABEL[${KEY}]}  LABEL=ext4_tmp  /dev/random  offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4'."
+      write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs"
+      contine

    else

-      do_log "info" "true" "${TARGET}/etc/crypttab entries written."
+      write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard"
+      contine

    fi

  done

-  do_show_footer "${MODULE_TXT}"
+  ### Generate '${TARGET}/etc/crypttab' ephemeral entries.
+  for var_key in "${HMP_EPHEMERAL_ENCLABEL[@]}"; do
+
+    var_ephemeral_enclabel="${HMP_EPHEMERAL_ENCLABEL["${var_key}"]}"
+    var_ephemeral_fs_label="${HMP_EPHEMERAL_FS_LABEL["${var_key}"]}"
+
+    case "${var_key}" in
+      SWAP)
+        write_crypttab "${var_ephemeral_enclabel}" "LABEL=${var_ephemeral_fs_label}" "/dev/random" "swap,offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096"
+        continue
+        ;;
+      /tmp)
+        write_crypttab "${var_ephemeral_enclabel}" "LABEL=${var_ephemeral_fs_label}" "/dev/random" "offset=2048,cipher=aes-xts-plain64,size=512,sector-size=4096,tmp=ext4"
+        continue
+        ;;
+    esac
+
+  done
+
+  return 0
 }
-# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh:
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh