V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

.preseed/preseed.yaml

@@ -423,7 +423,7 @@ grub_parameter:
 grub:
   background:                  # RECOMMENDED settings: JPG 1280 x 1024 px or JPG 1920 x 1080 px
     enable: true               # If you want to add a GRUB background.
-    path: "/includes/target/etc/default/grub.d/hexagon_1280_720.png"
+    path: "/includes/target/etc/default/grub.d/hexagon_800_600.png"
   bootdev: "/dev/sda"          # Due notably to potential USB sticks, the location of the primary drive cannot be determined
                                # safely in general, so this needs to be specified.
   force_efi: true              # Force GRUB installation to the EFI removable media path?

func/cdi_4200_boot/4210_generate_crypttab.sh

@@ -85,29 +85,39 @@ EOF
 
     if [[ "${VAR_DROPBEAR}" == "true" ]]; then
 
-      if [[ "${var_key}" == "/" ]]; then
+      case  "${var_key,,}" in
 
-        mkdir -p "${TARGET}/etc/initramfs-tools/files"
-        mkdir -p "${TARGET}/usr/lib/cryptsetup/scripts"
+        "/")
+          mkdir -p "${TARGET}/etc/initramfs-tools/files"
+          mkdir -p "${TARGET}/usr/lib/cryptsetup/scripts"
 
-        ### Install the script to be called inside initramfs environment for unlocking LUKS and NUKE Devices.
-        install -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/files/unlock_wrapper.sh" \
-          "${TARGET}/etc/initramfs-tools/files/"
-        install -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/files/unlock_wrapper.sh" \
-          "${TARGET}/lib/cryptsetup/scripts/"
+          ### Install the script to be called inside initramfs environment for unlocking LUKS and NUKE Devices.
+          install -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/files/unlock_wrapper.sh" \
+            "${TARGET}/etc/initramfs-tools/files/"
+          install -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/initramfs-tools/files/unlock_wrapper.sh" \
+            "${TARGET}/lib/cryptsetup/scripts/"
 
-        #write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=/lib/cryptsetup/scripts/unlock_wrapper.sh"
-        write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=decrypt_keyctl,tries=1"
+          #write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=/lib/cryptsetup/scripts/unlock_wrapper.sh"
+          printf "### Early-unlocked (initramfs) - single passphrase via decrypt_keyctl\n" >> "${TARGET}/etc/crypttab"
+          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=decrypt_keyctl,tries=1"
+          ;;
 
-      elif [[ "${var_key}" == "/usr" ]]; then
+        "/usr")
+          printf "### Early-unlocked (initramfs) - single passphrase via decrypt_keyctl\n" >> "${TARGET}/etc/crypttab"
+          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=decrypt_keyctl,tries=1"
+          ;;
 
-        write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=decrypt_keyctl,tries=1"
+        "/boot")
+          printf "### LUKS encrypted '/boot' – different passphrase, not in initramfs\n" >> "${TARGET}/etc/crypttab"
+          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard"
+          ;;
 
-      else
+        *)
+          printf "### Late-unlocked (userspace) – no initramfs, independent prompts / tokens\n" >> "${TARGET}/etc/crypttab"
+          write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard"
+          ;;
 
-        write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs,keyscript=decrypt_keyctl,tries=1"
-
-      fi
+      esac
 
     else
 

func/cdi_4200_boot/4230_installation_grub.sh

@@ -128,7 +128,7 @@ GRUB_BACKGROUND="/etc/default/grub.d/${var_background}"
 # note that you can use only modes which your graphic card supports via VBE
 # you can see them in real GRUB with the command 'vbeinfo'
 # GRUB_GFXMODE=1920x1080,1280x1024,1024x768,800x600
-GRUB_GFXMODE=auto
+GRUB_GFXMODE=800x600
 GRUB_GFXPAYLOAD_LINUX=keep
 
 EOF

func/cdi_4300_network/4312_dropbear_setup.sh

@@ -36,7 +36,8 @@ guard_sourcing
 #######################################
 dropbear_setup() {
   ### Declare Arrays, HashMaps, and Variables.
-  declare     network_static_ipv4ntpserver_0="192.53.103.108"
+  declare     network_static_ipv4ntpserver_0="192.53.103.108" \
+              var_force_command_string='command="/usr/local/bin/unlock-wrapper.sh",no-agent-forwarding,no-port-forwarding,no-X11-forwarding '
 
   ### Prepare strong dropbear host keys
   rm -f "${TARGET}"/etc/dropbear/initramfs/dropbear*key*
@@ -49,7 +50,7 @@ dropbear_setup() {
 
   ### Prepare dropbear authorized_keys
   touch "${TARGET}/etc/dropbear/initramfs/authorized_keys" && chmod 0600 "${TARGET}/etc/dropbear/initramfs/authorized_keys"
-  printf "%s\n" "${user_root_sshpubkey}" >> "${TARGET}/etc/dropbear/initramfs/authorized_keys"
+  printf "%s\n" "${var_force_command_string}${user_root_sshpubkey}" >> "${TARGET}/etc/dropbear/initramfs/authorized_keys"
   install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/banner" "${TARGET}/etc/dropbear/initramfs/"
 
   ### Check for initramfs "IP"-variable: static or dynamic configuration vai dhcp.