V8.13.544.2025.12.05

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

config/hooks/live/zzzz_ciss_crypt_squash.hook.binary

@@ -45,12 +45,12 @@ preallocate() {
 
   if dd if=/dev/zero of="${file}" bs="${blocksize}" count="${blockcounter}" status=progress conv=fsync; then
 
-    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ [dd if=/dev/zero of=%s bs=%s count=%s status=progress conv=fsync ] successful. \e[0m\n" "${file}" "${blocksize}" "${blockcounter}"
+    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ [dd if=/dev/zero of=%s bs=%s count=%s status=progress conv=fsync] successful. \e[0m\n" "${file}" "${blocksize}" "${blockcounter}"
     return 0
 
   else
 
-    printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ [dd if=/dev/zero of=%s bs=%s count=%s status=progress conv=fsync ] NOT successful. \e[0m\n" "${file}" "${blocksize}" "${blockcounter}"
+    printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ [dd if=/dev/zero of=%s bs=%s count=%s status=progress conv=fsync] NOT successful. \e[0m\n" "${file}" "${blocksize}" "${blockcounter}"
     return 42
 
   fi
@@ -76,11 +76,18 @@ declare -i ALIGN_BYTES=$(( 4096 * 1024 ))
 declare -i BASE_SIZE=$(( VAR_ROOTFS_SIZE + OVERHEAD_FIXED + (VAR_ROOTFS_SIZE * OVERHEAD_PCT / 100) ))
 declare -i VAR_LUKSFS_SIZE=$(( ( (BASE_SIZE + ALIGN_BYTES - 1) / ALIGN_BYTES ) * ALIGN_BYTES ))
 
-preallocate "${LUKSFS}" "${VAR_LUKSFS_SIZE}"
+declare -i TRY_SIZE="${VAR_LUKSFS_SIZE}"
+declare -i MAX_TRIES=32
+declare -i TRY=0
+declare CRYPT_RC=0
 
-exec {KEYFD}<"${VAR_TMP_SECRET}/luks.txt"
+while (( TRY < MAX_TRIES )); do
 
-cryptsetup luksFormat \
+  preallocate "${LUKSFS}" "${TRY_SIZE}"
+
+  exec {KEYFD}<"${VAR_TMP_SECRET}/luks.txt"
+
+  if cryptsetup luksFormat \
     --batch-mode \
     --cipher aes-xts-plain64 \
     --integrity hmac-sha512 \
@@ -96,7 +103,31 @@ cryptsetup luksFormat \
     --use-random \
     --verbose \
     "${LUKSFS}"
+  then
+    CRYPT_RC=0
+    exec {KEYFD}<&-
+    break
+  fi
 
+  CRYPT_RC="$?"
+  exec {KEYFD}<&-
+
+  printf "\e[93m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ [cryptsetup failed for size %s (rc=%s), increasing by %s bytes.] \e[0m\n" "${TRY_SIZE}" "${CRYPT_RC}" "${ALIGN_BYTES}"
+
+  TRY_SIZE=$(( TRY_SIZE + ALIGN_BYTES ))
+  TRY=$(( TRY + 1 ))
+
+done
+
+if (( CRYPT_RC != 0 )); then
+  printf "\e[91m++++ ++++ ++++ ++++ ++++ ++++ ++ ❌ Unable to create LUKS2+integrity container after %s attempts. \e[0m\n" "${TRY}"
+  exit 42
+fi
+
+### At this point TRY_SIZE is the actual size used.
+VAR_LUKSFS_SIZE="${TRY_SIZE}"
+
+exec {KEYFD}<"${VAR_TMP_SECRET}/luks.txt"
 cryptsetup open --key-file "/proc/$$/fd/${KEYFD}" "${LUKSFS}" crypt_liveiso
 
 # shellcheck disable=SC2155