msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 41s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-07-27 17:07:27 +02:00
parent 6caacb541b
commit 9be2bc1083
13 changed files with 774 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files

503
.archive/0000_partitioning.yaml Normal file
View File

@@ -0,0 +1,503 @@
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
recipe:
guben0afx256r: # g=GPT || m=MBR
# u=UEFI || b=BIOS
# b=btrfs || 4=ext4 only
# e=ephemeral "/tmp" and "SWAP" || n=non-ephemeral "/tmp" and "SWAP" (yet not supported)
# n0=non RAID || m6=mdadm RAID6 || m5=mdadm RAID5 || b1=btrfs RAID1 (yet not supported)
# a="/dev/sda" only setup || b="/dev/sdb" || c="/dev/sdc" and so forth
# f=fixed size || a=automatic size (yet not supported)
# x256=size of device in GiB
# r=rescue partition || n=no rescue partition
#######################################
# EFI System Partition | EF00 | UEFI Bootloader (ESP, FAT32) | filesystem.version: fat32
# BIOS Boot Partition | EF02 | BIOS Bootloader area (GRUB) | filesystem.version: BIOS
# Linux SWAP | 8200 | Linux Swap | filesystem.version: SWAP
# Linux ext4/btrfs | 8300 | Linux Filesystem (root, home)| filesystem.version: ext4 || btrfs
#######################################
active: true # Choose this recipe.
control:
description: "CISS 2025 - GPT - BTRFS - Ephemeral - non RAID - 256GiB - rescue"
firmware: "UEFI" # MUST be "UEFI" for "gpt" || "BIOS":
id: "guben0afx256r" # MUST be equal to the second part of the recipe-variables string.
name: "ciss.2025.gpt.btrfs.ephemeral.non-raid.256GiB.rescue"
nuke: true # Activates Nuke-Mechanism in '/etc/crypttab' keyscript and via dropbear SSH forced command.
raid: # mdadm RAID settings only (not yet supported).
enable: false
disks:
member: 4
spare: 1
level: 6 # Only Level "1", "5", "6" and "10" are supported.
meta: 1.2 # Metadata Format. Default to '1.2'.
table: "gpt" # MUST be "gpt" for "UEFI" || "msdos":
syntax: true # This is set to "false" by default, otherwise if the recipe is tested by the authors to "true".
### Version of the specific recipe.
version: "1.1.7"
dev:
sda:
1:
begin: "2MiB"
end: "1024MiB"
bootable: false
encryption:
enable: false # MUST be "false" for "/boot/efi"
ephemeral: false # MUST be "false" for "/boot/efi"
integrity: false # MUST be "false" for "/boot/efi"
cipher: ""
hash: ""
itertime: ""
key: ""
label: ""
metadatasize: ""
pbkdf: ""
rng: ""
filesystem:
btrfs:
checksum: ""
compress: ""
level: ""
mdup: ""
subvolume: ""
snapshot: ""
format: true
label: "ESP"
options: ""
version: "fat32"
label: ""
mount:
enable: true # MUST be "true" for "/boot/efi"
options: "umask=0077,uid=0,gid=0"
optsnap: ""
path: "/boot/efi"
primary: primary
2:
begin: "1024MiB"
end: "2GiB"
bootable: false
encryption:
enable: true
ephemeral: false # MUST be "false" for "/boot"
integrity: false # MUST be "false" for "/boot"
cipher: "aes-xts-plain64"
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_boot"
metadatasize: "4096k"
pbkdf: "pbkdf2" # MUST be "pbkdf2" for "/boot"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "0"
mdup: true
subvolume: "@boot"
snapshot: ""
format: true
version: "btrfs"
label: "btrfs_boot"
options: ""
label: "part_boot"
mount:
enable: true # MUST be "true" for "/boot"
options: "defaults,nodev,nosuid,noexec,noatime,compress=no,discard=async,subvol=@boot"
optsnap: ""
path: "/boot"
primary: primary
3:
begin: "2GiB"
end: "10GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_rescue"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: ""
compress: ""
level: ""
mdup: ""
subvolume: ""
snapshot: ""
format: true
label: "ext4_rescue"
options: ""
version: "ext4"
label: "part_recovery"
mount:
enable: true
options: "defaults,nodev"
optsnap: ""
path: "/recovery"
primary: primary
4:
begin: "10GiB"
end: "14GiB"
bootable: false
encryption:
enable: true # MUST be "true" for ephemeral "SWAP"
ephemeral: true # MUST be "true" for ephemeral "SWAP"
integrity: false # MUST be "false" for ephemeral "SWAP"
cipher: "aes-xts-plain64"
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_ephemeral_swap"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: ""
compress: ""
level: ""
mdup: ""
subvolume: ""
snapshot: ""
format: true
label: "host_swap" # MUST be "host_swap" for ephemeral "SWAP"
options: ""
version: "ext4" # MUST be "ext4" for ephemeral "SWAP"
label: "part_ephem_swap"
mount:
enable: true
options: "defaults,discard"
optsnap: ""
path: "SWAP"
primary: primary
5:
begin: "14GiB"
end: "18GiB"
bootable: false
encryption:
enable: true # MUST be "true" for ephemeral "/tmp"
ephemeral: true # MUST be "true" for ephemeral "/tmp"
integrity: false # MUST be "false" for ephemeral "/tmp"
cipher: "aes-xts-plain64"
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_ephemeral_tmp"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: ""
compress: ""
level: ""
mdup: ""
subvolume: ""
snapshot: ""
format: true
label: "host_tmp" # MUST be "host_tmp" for ephemeral "/tmp"
options: ""
version: "ext4" # MUST be "ext4" for ephemeral "/tmp"
label: "part_ephem_tmp"
mount:
enable: true
options: "defaults,rw,nodev,nosuid,noatime,discard,mode=1777"
optsnap: ""
path: "/tmp"
primary: primary
6:
begin: "18GiB"
end: "42GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_root"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
subvolume: "@root"
snapshot: "@root_snap"
format: true
label: "btrfs_root"
options: ""
version: "btrfs"
label: "part_root"
mount:
enable: true
options: "defaults,errors=remount-ro,noatime,discard=async,autodefrag,subvol=@root"
optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@root_snap"
path: "/"
primary: primary
7:
begin: "42GiB"
end: "84GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_home"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
subvolume: "@home"
snapshot: "@home_snap"
format: true
label: "btrfs_home"
options: ""
version: "btrfs"
label: "part_home"
mount:
enable: true
options: "defaults,nodev,nosuid,relatime,discard=async,autodefrag,subvol=@home"
optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@home_snap"
path: "/home"
primary: primary
8:
begin: "84GiB"
end: "126GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_usr"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
subvolume: "@usr"
snapshot: ""
format: true
label: "btrfs_usr"
options: ""
version: "btrfs"
label: "part_usr"
mount:
enable: true
options: "defaults,nodev,relatime,discard=async,subvol=@usr"
optsnap: ""
path: "/usr"
primary: primary
9:
begin: "126GiB"
end: "190GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_var"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
subvolume: "@var"
snapshot: "@var_snap"
format: true
label: "btrfs_var"
options: ""
version: "btrfs"
label: "part_var"
mount:
enable: true
options: "defaults,nodev,nosuid,relatime,discard=async,subvol=@var"
optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@var_snap"
path: "/var"
primary: primary
10:
begin: "190GiB"
end: "206GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_var_log"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
subvolume: "@var_log"
snapshot: ""
format: true
label: "btrfs_var_log"
options: ""
version: "btrfs"
label: "part_var_log"
mount:
enable: true
options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async,subvol=@var_log"
optsnap: ""
path: "/var/log"
primary: primary
11:
begin: "206GiB"
end: "222GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_var_log_audit"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
subvolume: "@var_log_audit"
snapshot: ""
format: true
label: "btrfs_var_log_audit"
options: ""
version: "btrfs"
label: "part_var_log_audit"
mount:
enable: true
options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async,subvol=@var_log_audit"
optsnap: ""
path: "/var/log/audit"
primary: primary
12:
begin: "222GiB"
end: "238GiB"
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_var_tmp"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
subvolume: "@var_tmp"
snapshot: ""
format: true
label: "btrfs_var_tmp"
options: ""
version: "btrfs"
label: "part_var_tmp"
mount:
enable: true
options: "defaults,nodev,nosuid,noatime,nodatacow,discard=async,subvol=@var_tmp"
optsnap: ""
path: "/var/tmp"
primary: primary
13:
begin: "238GiB"
end: "max" # The last 16 MiB will be reserved for GPT metadata.
bootable: false
encryption:
enable: true
ephemeral: false
integrity: false
cipher: "aes-xts-plain64"
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_opt"
metadatasize: "4096k"
pbkdf: "argon2id"
rng: "use-random"
filesystem:
btrfs:
checksum: "sha256"
compress: "zstd"
level: "7"
mdup: true
subvolume: "@opt"
snapshot: ""
format: true
label: "btrfs_opt"
options: ""
version: "btrfs"
label: "part_opt"
mount:
enable: true
options: "defaults,nodev,nosuid,relatime,discard=async,subvol=@opt"
optsnap: ""
path: "/opt"
primary: primary
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml

130
.preseed/partitioning.yaml
View File

@@ -41,11 +41,11 @@ recipe:
table: "gpt" # MUST be "gpt" for "UEFI" || "msdos":
syntax: true # This is set to "false" by default, otherwise if the recipe is tested by the authors to "true".
### Version of the specific recipe.
version: "1.1.7"
version: "1.1.8b"
dev:
sda:
1:
begin: "2MiB"
begin: "min"
end: "1024MiB"
bootable: false
encryption:
@@ -56,9 +56,10 @@ recipe:
hash: ""
itertime: ""
key: ""
label: ""
keyslotssize: ""
metadatasize: ""
pbkdf: ""
pbkdfparallel: ""
rng: ""
filesystem:
btrfs:
@@ -66,13 +67,10 @@ recipe:
compress: ""
level: ""
mdup: ""
subvolume: ""
snapshot: ""
snapshot: false
format: true
label: "ESP"
options: ""
version: "fat32"
label: ""
mount:
enable: true # MUST be "true" for "/boot/efi"
options: "umask=0077,uid=0,gid=0"
@@ -91,9 +89,10 @@ recipe:
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_boot"
keyslotssize: "32MB"
metadatasize: "4096k"
pbkdf: "pbkdf2" # MUST be "pbkdf2" for "/boot"
pbkdfparallel: 1
rng: "use-random"
filesystem:
btrfs:
@@ -101,16 +100,13 @@ recipe:
compress: "zstd"
level: "0"
mdup: true
subvolume: "@boot"
snapshot: ""
snapshot: false
format: true
version: "btrfs"
label: "btrfs_boot"
options: ""
label: "part_boot"
mount:
enable: true # MUST be "true" for "/boot"
options: "defaults,nodev,nosuid,noexec,noatime,compress=no,discard=async,subvol=@boot"
options: "defaults,nodev,nosuid,noexec,noatime,compress=no,discard=async"
optsnap: ""
path: "/boot"
primary: primary
@@ -126,9 +122,10 @@ recipe:
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_rescue"
keyslotssize: "32MB"
metadatasize: "4096k"
pbkdf: "argon2id"
pbkdfparallel: 1
rng: "use-random"
filesystem:
btrfs:
@@ -136,13 +133,11 @@ recipe:
compress: ""
level: ""
mdup: ""
subvolume: ""
snapshot: ""
snapshot: false
format: true
label: "ext4_rescue"
options: ""
version: "ext4"
label: "part_recovery"
mount:
enable: true
options: "defaults,nodev"
@@ -161,9 +156,10 @@ recipe:
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_ephemeral_swap"
keyslotssize: "32MB"
metadatasize: "4096k"
pbkdf: "argon2id"
pbkdfparallel: 1
rng: "use-random"
filesystem:
btrfs:
@@ -171,13 +167,11 @@ recipe:
compress: ""
level: ""
mdup: ""
subvolume: ""
snapshot: ""
snapshot: false
format: true
label: "host_swap" # MUST be "host_swap" for ephemeral "SWAP"
options: ""
version: "ext4" # MUST be "ext4" for ephemeral "SWAP"
label: "part_ephem_swap"
mount:
enable: true
options: "defaults,discard"
@@ -196,9 +190,10 @@ recipe:
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_ephemeral_tmp"
keyslotssize: "32MB"
metadatasize: "4096k"
pbkdf: "argon2id"
pbkdfparallel: 1
rng: "use-random"
filesystem:
btrfs:
@@ -206,13 +201,10 @@ recipe:
compress: ""
level: ""
mdup: ""
subvolume: ""
snapshot: ""
snapshot: false
format: true
label: "host_tmp" # MUST be "host_tmp" for ephemeral "/tmp"
options: ""
version: "ext4" # MUST be "ext4" for ephemeral "/tmp"
label: "part_ephem_tmp"
mount:
enable: true
options: "defaults,rw,nodev,nosuid,noatime,discard,mode=1777"
@@ -231,9 +223,10 @@ recipe:
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_root"
keyslotssize: "32MB"
metadatasize: "4096k"
pbkdf: "argon2id"
pbkdfparallel: 1
rng: "use-random"
filesystem:
btrfs:
@@ -241,17 +234,14 @@ recipe:
compress: "zstd"
level: "7"
mdup: true
subvolume: "@root"
snapshot: "@root_snap"
snapshot: true
format: true
label: "btrfs_root"
options: ""
version: "btrfs"
label: "part_root"
mount:
enable: true
options: "defaults,errors=remount-ro,noatime,discard=async,autodefrag,subvol=@root"
optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@root_snap"
options: "defaults,errors=remount-ro,noatime,discard=async,autodefrag"
optsnap: "nodev,nosuid,noexec,nodatacow"
path: "/"
primary: primary
7:
@@ -266,9 +256,10 @@ recipe:
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_home"
keyslotssize: "32MB"
metadatasize: "4096k"
pbkdf: "argon2id"
pbkdfparallel: 1
rng: "use-random"
filesystem:
btrfs:
@@ -276,17 +267,14 @@ recipe:
compress: "zstd"
level: "7"
mdup: true
subvolume: "@home"
snapshot: "@home_snap"
snapshot: true
format: true
label: "btrfs_home"
options: ""
version: "btrfs"
label: "part_home"
mount:
enable: true
options: "defaults,nodev,nosuid,relatime,discard=async,autodefrag,subvol=@home"
optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@home_snap"
options: "defaults,nodev,nosuid,relatime,discard=async,autodefrag"
optsnap: "nodev,nosuid,noexec,nodatacow"
path: "/home"
primary: primary
8:
@@ -301,9 +289,10 @@ recipe:
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_usr"
keyslotssize: "32MB"
metadatasize: "4096k"
pbkdf: "argon2id"
pbkdfparallel: 1
rng: "use-random"
filesystem:
btrfs:
@@ -311,16 +300,13 @@ recipe:
compress: "zstd"
level: "7"
mdup: true
subvolume: "@usr"
snapshot: ""
snapshot: false
format: true
label: "btrfs_usr"
options: ""
version: "btrfs"
label: "part_usr"
mount:
enable: true
options: "defaults,nodev,relatime,discard=async,subvol=@usr"
options: "defaults,nodev,relatime,discard=async"
optsnap: ""
path: "/usr"
primary: primary
@@ -336,9 +322,10 @@ recipe:
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_var"
keyslotssize: "32MB"
metadatasize: "4096k"
pbkdf: "argon2id"
pbkdfparallel: 1
rng: "use-random"
filesystem:
btrfs:
@@ -346,17 +333,14 @@ recipe:
compress: "zstd"
level: "7"
mdup: true
subvolume: "@var"
snapshot: "@var_snap"
snapshot: true
format: true
label: "btrfs_var"
options: ""
version: "btrfs"
label: "part_var"
mount:
enable: true
options: "defaults,nodev,nosuid,relatime,discard=async,subvol=@var"
optsnap: "ro,nodev,nosuid,noexec,nodatacow,subvol=@var_snap"
options: "defaults,nodev,nosuid,relatime,discard=async"
optsnap: "nodev,nosuid,noexec,nodatacow"
path: "/var"
primary: primary
10:
@@ -371,9 +355,10 @@ recipe:
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_var_log"
keyslotssize: "32MB"
metadatasize: "4096k"
pbkdf: "argon2id"
pbkdfparallel: 1
rng: "use-random"
filesystem:
btrfs:
@@ -381,16 +366,13 @@ recipe:
compress: "zstd"
level: "7"
mdup: true
subvolume: "@var_log"
snapshot: ""
snapshot: false
format: true
label: "btrfs_var_log"
options: ""
version: "btrfs"
label: "part_var_log"
mount:
enable: true
options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async,subvol=@var_log"
options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async"
optsnap: ""
path: "/var/log"
primary: primary
@@ -406,9 +388,10 @@ recipe:
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_var_log_audit"
keyslotssize: "32MB"
metadatasize: "4096k"
pbkdf: "argon2id"
pbkdfparallel: 1
rng: "use-random"
filesystem:
btrfs:
@@ -416,16 +399,13 @@ recipe:
compress: "zstd"
level: "7"
mdup: true
subvolume: "@var_log_audit"
snapshot: ""
snapshot: false
format: true
label: "btrfs_var_log_audit"
options: ""
version: "btrfs"
label: "part_var_log_audit"
mount:
enable: true
options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async,subvol=@var_log_audit"
options: "defaults,nodev,nosuid,noexec,noatime,nodatacow,discard=async"
optsnap: ""
path: "/var/log/audit"
primary: primary
@@ -441,9 +421,10 @@ recipe:
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_var_tmp"
keyslotssize: "32MB"
metadatasize: "4096k"
pbkdf: "argon2id"
pbkdfparallel: 1
rng: "use-random"
filesystem:
btrfs:
@@ -451,16 +432,13 @@ recipe:
compress: "zstd"
level: "7"
mdup: true
subvolume: "@var_tmp"
snapshot: ""
snapshot: false
format: true
label: "btrfs_var_tmp"
options: ""
version: "btrfs"
label: "part_var_tmp"
mount:
enable: true
options: "defaults,nodev,nosuid,noatime,nodatacow,discard=async,subvol=@var_tmp"
options: "defaults,nodev,nosuid,noatime,nodatacow,discard=async"
optsnap: ""
path: "/var/tmp"
primary: primary
@@ -476,9 +454,10 @@ recipe:
hash: "sha512"
itertime: "3000"
key: "512"
label: "crypt_opt"
keyslotssize: "32MB"
metadatasize: "4096k"
pbkdf: "argon2id"
pbkdfparallel: 1
rng: "use-random"
filesystem:
btrfs:
@@ -486,16 +465,13 @@ recipe:
compress: "zstd"
level: "7"
mdup: true
subvolume: "@opt"
snapshot: ""
snapshot: false
format: true
label: "btrfs_opt"
options: ""
version: "btrfs"
label: "part_opt"
mount:
enable: true
options: "defaults,nodev,nosuid,relatime,discard=async,subvol=@opt"
options: "defaults,nodev,nosuid,relatime,discard=async"
optsnap: ""
path: "/opt"
primary: primary

14
ciss_debian_installer.sh
View File

@@ -33,14 +33,14 @@ declare -grx VAR_SETUP_FULL="$(cd "$(dirname "${0}")" && pwd)/${0##*/}" # '/opt/
### No ash, dash, ksh, sh, zsh.
# shellcheck disable=2292
[ -z "${BASH_VERSINFO[0]}" ] && {
. /../../meta_loader_early.sh
. ./meta_loader_early.sh
printf "%b❌ Please make sure you are using 'bash'! Bye... %b%b" "${RED}" "${RES}" "${NL}" >&2
exit "${ERR_UNSUPPORTED_BASH}"
}
### Not root.
[[ ${EUID} -ne 0 ]] && {
. /../../meta_loader_early.sh
. ./meta_loader_early.sh
printf "%b❌ Please make sure you are 'root'! Bye... %b%b" "${RED}" "${RES}" "${NL}" >&2
exit "${ERR_USER_IS_NOT_ROOT}"
}
@@ -48,35 +48,35 @@ declare -grx VAR_SETUP_FULL="$(cd "$(dirname "${0}")" && pwd)/${0##*/}" # '/opt/
### Not called by sh.
# shellcheck disable=2312
[[ $(kill -l | grep -c SIG) -eq 0 ]] && {
. /../../meta_loader_early.sh
. ./meta_loader_early.sh
printf "%b❌ Please make sure you are calling the script without leading 'sh'! Bye... %b%b" "${RED}" "${RES}" "${NL}" >&2
exit "${ERR_UNSUPPORTED_BASH}"
}
### Not sourced.
[[ "${BASH_SOURCE[0]}" != "$0" ]] && {
. /../../meta_loader_early.sh
. ./meta_loader_early.sh
printf "%b❌ This script must be executed, not sourced. Please run './setup.sh' directly. %b%b" "${RED}" "${RES}" "${NL}" >&2
exit "${ERR_UNSUPPORTED_BASH}"
}
### Minimum Bash version 5.
[[ ${BASH_VERSINFO[0]} -lt 5 ]] && {
. /../../meta_loader_early.sh
. ./meta_loader_early.sh
printf "%b❌ Minimum requirement is bash 5.1. You are using '%s'! Bye... %b%b" "${RED}" "${BASH_VERSION}" "${RES}" "${NL}" >&2
exit "${ERR_UNSUPPORTED_BASH}"
}
### Minimum Bash version 5.1.
[[ ${BASH_VERSINFO[0]} -le 5 ]] && [[ ${BASH_VERSINFO[1]} -le 1 ]] && {
. /../../meta_loader_early.sh
. ./meta_loader_early.sh
printf "%b❌ Minimum requirement is bash 5.1. You are using '%s'! Bye... %b%b" "${RED}" "${BASH_VERSION}" "${RES}" "${NL}" >&2
exit "${ERR_UNSUPPORTED_BASH}"
}
### No arguments.
[[ ${#} -eq 0 ]] && {
. . /../../meta_loader_early.sh
. ./meta_loader_early.sh
usage >&2
exit 1
}

11
func/partitioning/3200_partitioning.sh
View File

@@ -109,9 +109,13 @@ partitioning() {
var_boot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.bootable" "${VAR_SETUP_PART}")
var_pri=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.primary" "${VAR_SETUP_PART}")
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
var_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.label" "${VAR_SETUP_PART}")
### Assign the landing zone of each partition.
### Assign the start zone of the first partition and skip the first 2 MiB as best practice.
if [[ "${var_begin,,}" == "min" ]]; then
var_begin="2MiB"
fi
### Assign the landing zone of the last partition and reserve 16 MiB for GPT and mdadm binary metadata.
if [[ "${var_end,,}" == "max" ]]; then
var_dev_size=$(blockdev --getsize64 "/dev/${var_dev}")
var_dev_end=$(( var_dev_size - 16 * 1024 * 1024 ))
@@ -124,6 +128,9 @@ partitioning() {
case "${VAR_RECIPE_TABLE,,}" in
gpt)
var_label=$(get_label "${var_mount_path}" "${var_fs}" "part")
if ! parted -s "/dev/${var_dev}" mkpart "${var_label}" "${var_fs}" "${var_begin}" "${var_end_arg}"; then
do_log "fatal" "file_only" "3200() [parted -s /dev/${var_dev} mkpart ${var_label} ${var_fs} ${var_begin} ${var_end_arg}] failed."

33
func/partitioning/3220_partition_encryption.sh
View File

@@ -35,8 +35,8 @@ partition_encryption() {
declare -Ag HMP_EPHEMERAL_DEV HMP_EPHEMERAL_ENCLABEL HMP_EPHEMERAL_FS_LABEL HMP_PATH_LUKSUUID HMP_PATH_ENCLABEL
declare var_dev var_part \
var_encryption_enable var_encryption_ephemeral var_encryption_integrity var_encryption_cipher \
var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta \
var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path var_uuid
var_encryption_hash var_encryption_iter var_encryption_key var_encryption_label var_encryption_meta var_encryption_cores \
var_encryption_slot var_encryption_pbkdf var_encryption_rng var_filesystem_label var_mount_path var_uuid var_fs
declare -a ary_devs=() ary_parts=() ary_luks_opts=()
### Iterate over all devices in the recipe.
@@ -60,17 +60,20 @@ partition_encryption() {
var_encryption_hash=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.hash" "${VAR_SETUP_PART}")
var_encryption_iter=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.itertime" "${VAR_SETUP_PART}")
var_encryption_key=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.key" "${VAR_SETUP_PART}")
var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label" "${VAR_SETUP_PART}")
var_encryption_slot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.keyslotssize" "${VAR_SETUP_PART}")
var_encryption_meta=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.metadatasize" "${VAR_SETUP_PART}")
var_encryption_pbkdf=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.pbkdf" "${VAR_SETUP_PART}")
var_encryption_cores=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.pbkdfparallel" "${VAR_SETUP_PART}")
var_encryption_rng=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.rng" "${VAR_SETUP_PART}")
var_filesystem_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label" "${VAR_SETUP_PART}")
var_fs=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
if [[ "${var_encryption_enable,,}" != "true" ]]; then
continue
fi
var_encryption_label=$(get_label "${var_mount_path}" "${var_fs}" "luks")
if [[ "${var_mount_path,,}" == "/boot" ]]; then
ary_luks_opts=( --key-file "${DIR_CNF}/password_luks_boot.txt" )
else
@@ -79,13 +82,15 @@ partition_encryption() {
ary_luks_opts+=(
--type luks2
--cipher "${var_encryption_cipher}"
--hash "${var_encryption_hash}"
--iter-time "${var_encryption_iter}"
--key-size "${var_encryption_key}"
--cipher "${var_encryption_cipher:-aes-xts-plain64}"
--hash "${var_encryption_hash:-sha512}"
--iter-time "${var_encryption_iter:-3000}"
--key-size "${var_encryption_key:-512}"
--label "${var_encryption_label}"
--luks2-metadata-size "${var_encryption_meta}"
--pbkdf "${var_encryption_pbkdf}"
--luks2-keyslots-size "${var_encryption_slot:-16777216}"
--luks2-metadata-size "${var_encryption_meta:-4194304}"
--pbkdf "${var_encryption_pbkdf:-argon2id}"
--pbkdf-parallel "${var_encryption_cores:-1}"
"--${var_encryption_rng}"
--batch-mode
--verbose
@@ -99,6 +104,8 @@ partition_encryption() {
SWAP|/tmp)
var_filesystem_label=$(get_label "${var_mount_path}" "${var_fs}" "file")
mkfs.ext4 -L "${var_filesystem_label}" "/dev/${var_dev}${var_part}" 1M
do_log "info" "file_only" "3220() Ephemeral: '${var_mount_path}' prepared on: '/dev/${var_dev}${var_part}'."
@@ -106,9 +113,9 @@ partition_encryption() {
HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]="${var_encryption_label}"
HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]="${var_filesystem_label}"
do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_DEV] : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
do_log "info" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]}'"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_DEV] : '${var_mount_path}' -> '${HMP_EPHEMERAL_DEV["${var_mount_path}"]}'"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_ENCLABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_ENCLABEL["${var_mount_path}"]}'"
do_log "debug" "file_only" "3220() Stored in HashMap [HMP_EPHEMERAL_FS_LABEL]: '${var_mount_path}' -> '${HMP_EPHEMERAL_FS_LABEL["${var_mount_path}"]}'"
continue
;;

11
func/partitioning/3240_partition_formatting.sh
View File

@@ -26,7 +26,7 @@ guard_sourcing
#######################################
partition_formatting() {
### Declare Arrays and Variables.
declare -Agx HMP_PATH_FSUUID
declare -Ag HMP_PATH_FSUUID
declare var_dev var_part \
var_encryption_enable var_encryption_label var_fs_btrfs_checksum var_fs_btrfs_compress var_fs_btrfs_mdup \
var_fs_format var_fs_label var_fs_options var_fs_version var_mount_path var_node var_fs_uuid
@@ -44,12 +44,10 @@ partition_formatting() {
### Extract parameters from YAML.
var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label" "${VAR_SETUP_PART}")
var_fs_btrfs_checksum=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.checksum" "${VAR_SETUP_PART}")
var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
var_fs_btrfs_mdup=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.mdup" "${VAR_SETUP_PART}")
var_fs_format=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.format" "${VAR_SETUP_PART}")
var_fs_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label" "${VAR_SETUP_PART}")
var_fs_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.options" "${VAR_SETUP_PART}")
var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
@@ -59,24 +57,27 @@ partition_formatting() {
### Preparation of Ephemeral 'SWAP' and '/tmp' as per https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption#UUID_and_LABEL
case "${var_mount_path,,}" in
swap|/tmp)
# mkfs.ext4 -L "${var_fs_label}" "/dev/${var_dev}${var_part}" 1M
do_log "info" "file_only" "3240() Partition: '/dev/${var_dev}${var_part}' ephemeral encryption already prepared in 3220(): '${var_mount_path}'."
continue
;;
esac
if [[ "${var_encryption_enable,,}" == "true" ]]; then
var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
var_node="/dev/mapper/${var_encryption_label}"
else
var_node="/dev/${var_dev}${var_part}"
fi
var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
case "${var_fs_version,,}" in
btrfs)
ary_opts=( -L "${var_fs_label}" -f --csum "${var_fs_btrfs_checksum}" )
[[ "${var_fs_btrfs_mdup,,}" == "true" ]] && ary_opts+=( -m dup )
mkfs.btrfs "${ary_opts[@]}" "${var_node}"
do_log "debug" "file_only" "3240() [mkfs.btrfs ${ary_opts[*]} ${var_node}]."
do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'btrfs' options: '${ary_opts[*]}'."
echo "Partition: '${var_node}':" >> "${DIR_LOG}/btrfs.log"
btrfs filesystem show "${var_node}" >> "${DIR_LOG}/btrfs.log"
@@ -87,6 +88,7 @@ partition_formatting() {
ext4)
read -r -a ary_fmt_opts <<< "${var_fs_options}"
mkfs.ext4 -L "${var_fs_label}" "${ary_fmt_opts[@]}" "${var_node}"
do_log "debug" "file_only" "3240() [mkfs.ext4 -L ${var_fs_label} ${ary_fmt_opts[*]} ${var_node}]."
do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'ext4' options: '${ary_fmt_opts[*]}'."
echo "Partition: '${var_node}':" >> "${DIR_LOG}/ext4.log"
tune2fs -l "${var_node}" >> "${DIR_LOG}/ext4.log"
@@ -96,6 +98,7 @@ partition_formatting() {
fat32)
mkfs.fat -F 32 -n "${var_fs_label}" "${var_node}"
do_log "debug" "file_only" "3240() [mkfs.fat -F 32 -n ${var_fs_label} ${var_node}]."
do_log "info" "file_only" "3240() Partition: '${var_node}' formatted: 'FAT32'."
var_fs_uuid=$(blkid -s UUID -o value "${var_node}")
HMP_PATH_FSUUID["UUID_${var_mount_path}"]="${var_fs_uuid}"

5
func/partitioning/3260_setup_filesystem.sh
View File

@@ -26,7 +26,7 @@ guard_sourcing
setup_filesystem() {
### Declare Arrays and Variables.
declare -Ag HMP_MOUNTPATH_DEV
declare var_dev var_part var_encryption_enable var_encryption_label var_mount_enable var_mount_path var_node
declare var_dev var_part var_encryption_enable var_encryption_label var_fs_version var_mount_enable var_mount_path var_node
declare -a ary_devs ary_parts
### Iterate over all devices in the recipe.
@@ -41,7 +41,7 @@ setup_filesystem() {
### Extract parameters from YAML.
var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label" "${VAR_SETUP_PART}")
var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_mount_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.enable" "${VAR_SETUP_PART}")
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
@@ -53,6 +53,7 @@ setup_filesystem() {
if [[ "${var_encryption_enable}" == "true" ]]; then
var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
var_node="/dev/mapper/${var_encryption_label}"
elif [[ "${var_encryption_enable}" == "false" ]]; then

68
func/partitioning/3280_mount_partition.sh
View File

@@ -113,7 +113,7 @@ mount_partition() {
else
do_log "error" "file_only" "3280() Root-filesystem '${var_mount_path_root}' not found in Hashmap."
do_log "error" "file_only" "3280() Root-filesystem '${var_mount_path_root}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."
return "${ERR_MOUNTING_ROOT}"
fi
@@ -129,7 +129,7 @@ mount_partition() {
else
do_log "info" "file_only" "3280() Entry '${var_path}' not found in Hashmap."
do_log "info" "file_only" "3280() Entry '${var_path}' not found in Hashmap: 'HMP_MOUNTPATH_DEV'."
fi
@@ -138,7 +138,7 @@ mount_partition() {
declare var_dev var_part \
var_fs_btrfs_compress var_fs_btrfs_level var_fs_btrfs_subvolume var_fs_btrfs_snapshot \
var_encryption_enable var_encryption_label \
var_fs_label var_fs_options var_fs_version var_mount_path var_mount_options var_mount_optsnap
var_fs_label var_fs_options var_fs_version var_mount_path var_mount_options var_snapshot var_mount_optsnap
declare -a ary_devs ary_parts
### Iterate over all devices in the recipe.
@@ -154,11 +154,8 @@ mount_partition() {
### Extract parameters from YAML.
var_fs_btrfs_compress=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.compress" "${VAR_SETUP_PART}")
var_fs_btrfs_level=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.level" "${VAR_SETUP_PART}")
var_fs_btrfs_subvolume=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.subvolume" "${VAR_SETUP_PART}")
var_fs_btrfs_snapshot=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.btrfs.snapshot" "${VAR_SETUP_PART}")
var_encryption_enable=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.enable" "${VAR_SETUP_PART}")
var_encryption_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.encryption.label" "${VAR_SETUP_PART}")
var_fs_label=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.label" "${VAR_SETUP_PART}")
var_fs_options=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.options" "${VAR_SETUP_PART}")
var_fs_version=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.filesystem.version" "${VAR_SETUP_PART}")
var_mount_path=$(yq_val ".recipe.${VAR_RECIPE_STRING}.dev.${var_dev}.${var_part}.mount.path" "${VAR_SETUP_PART}")
@@ -168,21 +165,34 @@ mount_partition() {
### Skip already mounted paths ("/", "/boot", "/boot/efi") and skip ("/recovery")
skip_path "${var_mount_path}" && continue
var_encryption_label=$(get_label "${var_mount_path}" "${var_fs_version}" "luks")
if [[ "${var_mount_path}" == "SWAP" ]]; then
var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
cryptsetup open --type plain --key-file /dev/random \
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
mkswap "/dev/mapper/${var_encryption_label}"
swapon "/dev/mapper/${var_encryption_label}"
do_log "debug" "file_only" "3280() [mkswap /dev/mapper/${var_encryption_label}]."
do_log "info" "file_only" "3280() Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
swapon "/dev/mapper/${var_encryption_label}"
do_log "debug" "file_only" "3280() [swapon /dev/mapper/${var_encryption_label}]."
do_log "info" "file_only" "3280() Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
continue
elif [[ "${var_mount_path}" == "/tmp" ]]; then
var_fs_label=$(get_label "${var_mount_path}" "${var_fs_version}" "file")
cryptsetup open --type plain --key-file /dev/random \
--offset 2048 --cipher aes-xts-plain64 --key-size 512 \
--sector-size 4096 "/dev/disk/by-label/${var_fs_label}" "${var_encryption_label}"
mkdir -p "${TARGET}/tmp"
# TODO: Remove Debug
@@ -190,10 +200,10 @@ mount_partition() {
[[ -b "/dev/mapper/${var_encryption_label}" ]] || {
do_log "error" "file_only" "Mapper-Device: '/dev/mapper/${var_encryption_label}' non-existing."
}
echo "lsblk -o NAME,SIZE,TYPE,FSTYPE,LABEL /dev/mapper/${var_encryption_label}"
lsblk -o NAME,SIZE,TYPE,FSTYPE,LABEL /dev/mapper/"${var_encryption_label}"
echo "/dev/mapper/${var_encryption_label}"
blkid /dev/mapper/"${var_encryption_label}"
echo "safe_exec mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 /dev/mapper/${var_encryption_label} ${ERR_MOUNTING_DEV}"
safe_exec mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 "/dev/mapper/${var_encryption_label}" "${ERR_MOUNTING_DEV}" || return "${ERR_MOUNTING_DEV}"
#mkfs.ext4 -E nodiscard,lazy_itable_init=1,lazy_journal_init=1 "/dev/mapper/${var_encryption_label}"
@@ -203,11 +213,13 @@ mount_partition() {
### Build the command in an array to keep word boundaries intact
declare -a ary_cmd2=(mount)
[[ -n "${var_mount_options}" ]] && ary_cmd2+=("-o" "${var_mount_options}")
#[[ -n "${var_mount_options}" ]] && ary_cmd2+=("-o" "${var_mount_options}")
ary_cmd2+=("/dev/mapper/${var_encryption_label}" "${TARGET}${var_mount_path}")
safe_exec "${ary_cmd2[@]}" "${ERR_MOUNTING_DEV}" || return "${ERR_MOUNTING_DEV}"
do_log "info" "file_only" "3280() Mounted: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
continue
fi
@@ -217,16 +229,23 @@ mount_partition() {
if [[ "${var_fs_version,,}" == "btrfs" ]]; then
var_fs_btrfs_subvolume=$(get_label "${var_mount_path}" "${var_fs_version}" "sub")
### Mount toplevel (subvolid=0) without extra options.
declare -a ary_cmd_mount=(mount -o "subvolid=0" "${var_resolved_dev}" "${VAR_SAFE_MNT_BASE}")
safe_exec "${ary_cmd_mount[@]}" "${ERR_BTRFS_INITPH}" || return "${ERR_BTRFS_INITPH}"
btrfs subvolume create "${VAR_SAFE_MNT_BASE}"/"${var_fs_btrfs_subvolume}"
btrfs subvolume create "${VAR_SAFE_MNT_BASE}/${var_fs_btrfs_subvolume}"
do_log "debug" "file_only" "3280() [btrfs subvolume create ${VAR_SAFE_MNT_BASE}/${var_fs_btrfs_subvolume}]."
do_log "info" "file_only" "3280() btrfs subvolid=0 created: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
if [[ -n "${var_fs_btrfs_snapshot}" ]]; then
btrfs subvolume create "${VAR_SAFE_MNT_BASE}"/"${var_fs_btrfs_snapshot}" || return "${ERR_BTRFS_SUBVOL}"
do_log "info" "file_only" "3280() btrfs subvolid=${var_fs_btrfs_snapshot} created: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
if [[ "${var_fs_btrfs_snapshot}" == "true" ]]; then
var_snapshot=$(get_label "${var_mount_path}" "${var_fs_version}" "snap")
btrfs subvolume create "${VAR_SAFE_MNT_BASE}/${var_snapshot}" || return "${ERR_BTRFS_SUBVOL}"
do_log "debug" "file_only" "3280() [btrfs subvolume create ${VAR_SAFE_MNT_BASE}/${var_snapshot}]."
do_log "info" "file_only" "3280() btrfs subvolid=${var_snapshot} created: '${var_mount_path}' on: '/dev/mapper/${var_encryption_label}'."
fi
umount "${VAR_SAFE_MNT_BASE}"
@@ -237,19 +256,32 @@ mount_partition() {
case "${var_fs_version,,}:${var_encryption_enable,,}" in
btrfs:*)
validate_btrfs_compression "${var_fs_btrfs_compress}" "${var_fs_btrfs_level}" || return "${ERR_BTRFS_OPTION}"
declare var_btrfs_compression_options="compress=${var_fs_btrfs_compress}:${var_fs_btrfs_level}"
[[ -n "${var_mount_options}" ]] && var_btrfs_compression_options+=",${var_mount_options}"
[[ -n "${var_mount_options}" ]] && var_btrfs_compression_options+=",${var_mount_options},subvol=${var_fs_btrfs_subvolume}"
mount_with_dir "${var_mount_path}" "${var_resolved_dev}" "${var_btrfs_compression_options}" || return "${ERR_MOUNTING_DEV}"
if [[ -n "${var_fs_btrfs_snapshot}" ]]; then
if [[ "${var_fs_btrfs_snapshot}" == "true" ]]; then
mkdir -p "${TARGET}${var_mount_path}/.snapshots"
do_log "info" "file_only" "3280() Created: '${TARGET}${var_mount_path}/.snapshots'."
mount -o "${var_mount_optsnap}" "${var_resolved_dev}" "${TARGET}${var_mount_path}/.snapshots"
var_mount_optsnap="${var_mount_optsnap},subvol=${var_snapshot}"
mount_with_dir "${var_mount_path}/.snapshots" "${var_resolved_dev}" "${var_mount_optsnap}"
do_log "info" "file_only" "3280() Mounted: '${var_resolved_dev}' on: '${TARGET}${var_mount_path}/.snapshots' (Options='${var_mount_optsnap}')."
fi
;;
ext4:*)
mount_with_dir "${var_mount_path}" "${var_resolved_dev}" "${var_mount_options}" || return "${ERR_MOUNTING_DEV}"
;;
@@ -260,6 +292,8 @@ mount_partition() {
done
lsblk -o NAME,MAJ:MIN,FSTYPE,FSVER,SIZE,UUID,MOUNTPOINT,PATH "/dev/${var_dev}" >| "${DIR_LOG}/${var_dev}_overview_full.log"
done
return 0

118
func/partitioning/3295_get_label.sh Normal file
View File

@@ -0,0 +1,118 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
guard_sourcing
#######################################
# Returns standardized labels for the provided mount path depending on filesystem and art of label.
# Globals:
# None
# Arguments:
# 1: Mount path (e.g., '/' '/boot' '/var/log/audit' 'SWAP' '/boot/efi')
# 2: Filesystem type: one of: [BIOS, btrfs ext4 fat32, swap]
# 3: Desired return label: one of: [part, luks, file, sub, snap]
# Returns:
# Prints resulting label to stdout.
#######################################
get_label() {
declare -r var_path="${1}"
declare -r var_file="${2,,}"
declare -r var_kind="${3,,}"
### Normalize 'mount.path': remove leading slash and replace slashes with underscore.
declare var_return_label=""
declare var_normalized="${var_path#/}" # Strip leading "/".
var_normalized="${var_normalized//\//_}" # Replace "/" with "_"
[[ -z "${var_normalized}" ]] && var_normalized="root" # Edge case "/".
case "${var_kind}" in
part)
case "${var_path}" in
SWAP) var_return_label="part_ephem_swap" ;;
/tmp) var_return_label="part_ephem_tmp" ;;
/boot/efi) var_return_label="part_esp" ;;
/) var_return_label="part_root" ;;
*) var_return_label="part_${var_normalized}" ;;
esac
;;
luks)
case "${var_path}" in
/tmp) var_return_label="crypt_ephem_tmp" ;;
SWAP) var_return_label="crypt_ephem_swap" ;;
/boot/efi) var_return_label="" ;;
/) var_return_label="crypt_root" ;;
*) var_return_label="crypt_${var_normalized}" ;;
esac
;;
file)
case "${var_path}:${var_file}" in
SWAP:*) var_return_label="host_swap" ;;
/tmp:*) var_return_label="host_tmp" ;;
/boot/efi:*) var_return_label="ESP" ;;
/var/log/audit:ext4) var_return_label="ext4_var_audit" ;;
*:ext4) var_return_label="ext4_${var_normalized}"
var_return_label="${var_return_label:0:16}"
do_log "warn" "file_only" "3295() Label: '${var_return_label}' of type: '${var_kind}' created for: '${var_path}' exceeds 16 chars, truncating."
;;
*:btrfs) var_return_label="btrfs_${var_normalized}" ;;
*:*) var_return_label="${var_file}_${var_normalized}" ;;
esac
;;
sub)
if [[ "${var_file}" == "btrfs" ]]; then
var_return_label="@${var_normalized}"
fi
;;
snap)
if [[ "${var_file}" == "btrfs" ]]; then
var_return_label="@${var_normalized}_snap"
fi
;;
*)
do_log "warn" "3295() File_only" "Unknown kind: ${var_kind}"
return 0
;;
esac
if [[ -n "${var_return_label}" ]]; then
do_log "info" "file_only" "3295() Label: '${var_return_label}' of type: '${var_kind}' created for: '${var_path}'."
printf "%s\n" "${var_return_label}"
return 0
else
do_log "warn" "file_only" "3295() Label not resolved: of type: '${var_kind}' for: '${var_path}' and FS: '${var_file}'."
return 0
fi
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

1
func/system/4150_setup_grub.sh
View File

@@ -39,7 +39,6 @@ setup_grub() {
declare -gx var_update_grub_required="false"
get_all_boot_devs
if [[ "${grub_skip,,}" != "true" ]]; then
### Install GRUB2 package

1
lib/0002_usage.sh
View File

@@ -75,6 +75,7 @@ usage() {
echo
echo -e "\e[97m --log, -l <LEVEL> \e[0m"
echo " This changes the default log level from 'info' to one of the following values:"
echo " debug"
echo " info"
echo " notice"
echo " warn"

2
lib/0102_arg_parser.sh
View File

@@ -53,7 +53,7 @@ arg_parser() {
-l | --log)
case "${2,,}" in
info|notice|warn|error|emergency) declare -gx VAR_DEFAULT_LOG_LEVEL="$2"; shift 2 ;;
debug|info|notice|warn|error|critical|fatal|emergency) declare -gx VAR_DEFAULT_LOG_LEVEL="$2"; shift 2 ;;
*)
if [[ "${VAR_AUTO_INSTALL}" == "false" && "${VAR_IN_DIALOG_WR}" == true ]]; then dialog_box_cleaner; fi
usage

1
meta_loader_func.sh
View File

@@ -29,6 +29,7 @@ source_guard "./func/partitioning/3240_partition_formatting.sh"
source_guard "./func/partitioning/3260_setup_filesystem.sh"
source_guard "./func/partitioning/3280_mount_partition.sh"
source_guard "./func/partitioning/3290_uuid_logger.sh"
source_guard "./func/partitioning/3295_get_label.sh"
source_guard "./func/system/4000_debootstrap.sh"
source_guard "./func/system/4020_configure_system.sh"