Skip to content

Instantly share code, notes, and snippets.

@tabletseeker

tabletseeker/gist:29eaf62d24be327f15bc27c534ea3d1d

Last active July 12, 2026 11:50
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save tabletseeker/29eaf62d24be327f15bc27c534ea3d1d to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save tabletseeker/29eaf62d24be327f15bc27c534ea3d1d to your computer and use it in GitHub Desktop.
Download ZIP
calamares
Raw
gistfile1.txt
# SPDX-FileCopyrightText: no
# SPDX-License-Identifier: CC0-1.0
# /etc/calamares/modules/shellprocess/shellprocess@luksfix.conf
---
id: luksfix
dontChroot: false
timeout: 90
name: "Configuring single-passphrase boot bypass..."
script:
# 1. Write the clean, standalone script file using a literal text block
- |
cat << 'EOF' > /tmp/luks-bypass.sh
#!/bin/bash
set -x
set -e
mkdir -p /boot/cryptsetup-keys.d
dd bs=512 count=8 if=/dev/urandom of=/boot/cryptsetup-keys.d/root.key iflag=fullblock
chmod 400 /boot/cryptsetup-keys.d/root.key
echo "# Automatically generated by Mobian FDE Fix" > /etc/crypttab
ls /dev/mapper/luks-* 2>/dev/null | while read -r mapper_path; do
MAP_NAME=$(basename "$mapper_path")
UUID_HEX=$(cryptsetup luksUUID "$mapper_path" 2>/dev/null || echo "")
if [ -n "$UUID_HEX" ]; then
PHYS_PART=$(blkid -U "$UUID_HEX" 2>/dev/null || echo "")
if [ -n "$PHYS_PART" ]; then
echo "Enrolling keyfile into LUKS slot for: $PHYS_PART"
echo -n "$PASSPHRASE_TOKEN" | cryptsetup luksAddKey "$PHYS_PART" /boot/cryptsetup-keys.d/root.key
echo "${MAP_NAME} UUID=${UUID_HEX} /boot/cryptsetup-keys.d/root.key luks,initramfs" >> /etc/crypttab
fi
fi
done
mkdir -p /etc/cryptsetup-initramfs
echo 'KEYFILE_PATTERN="/boot/cryptsetup-keys.d/*.key"' >> /etc/cryptsetup-initramfs/conf-hook
EOF
# 2. Make the script executable
- "chmod +x /tmp/luks-bypass.sh"
# 3. Execute the script while safely injecting the Calamares password variable from the host
- "PASSPHRASE_TOKEN=${PASSWORD} /tmp/luks-bypass.sh"
# 4. Clean up the temporary script file
- "rm -f /tmp/luks-bypass.sh"
Raw
gistfile2.txt
# /etc/calamares/modules/shellprocess@cryptfix.conf
---
dontChroot: true # Keep this TRUE so the script can map the host's real disk layout
timeout: 30
script:
- description: "Dynamically mapping host LUKS parameters to the target configuration..."
command: |
# 1. Locate where Calamares has currently mounted the target root image on the live host
TARGET_MOUNT=$(mount | grep 'calamares-root' | grep 'on /tmp/' | head -n 1 | awk '{print $3}')
# Validate that a mount target was actually discovered before continuing
if [ -z "$TARGET_MOUNT" ]; then
echo "ERROR: Calamares target mount point could not be detected!"
exit 1
fi
# 2. Extract the underlying mapper device node handling the filesystem
TARGET_DEV=$(mount | grep "on ${TARGET_MOUNT}" | awk '{print $1}')
# 3. Retrieve the matching true physical LUKS disk partition UUID
REAL_UUID=$(blkid -o value -s UUID ${TARGET_DEV})
if [ -z "$REAL_UUID" ]; then
echo "ERROR: Failed to resolve the underlying LUKS container UUID!"
exit 1
fi
# 4. Mount target is on the host, so write directly to its absolute path offset
echo "cryptroot UUID=${REAL_UUID} none luks,initramfs" > "${TARGET_MOUNT}/etc/crypttab"
# Output confirmation directly to Calamares logs for clean debugging
echo "SUCCESS: Wrote cryptroot entry with UUID=${REAL_UUID} directly to ${TARGET_MOUNT}/etc/crypttab"
@tabletseeker

tabletseeker commented Jul 11, 2026

Copy link
Copy Markdown
Author

echo "--> 1. Re-opening storage container cleanly..."
sudo cryptsetup open /dev/vda2 luks-0c349def-f79f-4dc7-934c-4fc12238ae44

echo "--> 2. Remounting core system directory sectors cleanly..."
sudo mount /dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 /mnt/target_clean
sudo mount /dev/vda1 /mnt/target_clean/boot/efi
sudo mount --bind /dev /mnt/target_clean/dev
sudo mount --bind /proc /mnt/target_clean/proc
sudo mount --bind /sys /mnt/target_clean/sys

echo "--> 3. Overwriting the initramfs hook with the correct DESTDIR variable..."
sudo mkdir -p /mnt/target_clean/etc/initramfs-tools/hooks
sudo tee /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile << 'EOF'
#!/bin/sh
PREREQ=""
prereqs() { echo "$PREREQ"; }
case $1 in prereqs) prereqs; exit 0;; esac
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
EOF
sudo chmod +x /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile

echo "--> 4. Compiling the final, verified boot image..."
sudo chroot /mnt/target_clean sh -c "update-initramfs -u -k all && update-grub"

echo "--> 5. VERIFYING SUCCESS: Confirming key footprint inside the image..."
sudo chroot /mnt/target_clean sh -c "lsinitramfs /boot/initrd.img-* | grep boot.key"

echo "--> 6. Safely unmounting and locking all device descriptors..."
sudo umount -R /mnt/target_clean
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44
echo "======================================================="
echo " VICTORY: Single-passphrase boot is officially active! "
echo "======================================================="

@tabletseeker

tabletseeker commented Jul 11, 2026

Copy link
Copy Markdown
Author

mobian@mobian:~$ echo "--> 1. Re-opening storage container cleanly..."
sudo cryptsetup open /dev/vda2 luks-0c349def-f79f-4dc7-934c-4fc12238ae44

echo "--> 2. Remounting core system directory sectors cleanly..."
sudo mount /dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 /mnt/target_clean
sudo mount /dev/vda1 /mnt/target_clean/boot/efi
sudo mount --bind /dev /mnt/target_clean/dev
sudo mount --bind /proc /mnt/target_clean/proc
sudo mount --bind /sys /mnt/target_clean/sys

echo "--> 3. Overwriting the initramfs hook with the correct DESTDIR variable..."
sudo mkdir -p /mnt/target_clean/etc/initramfs-tools/hooks
sudo tee /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile << 'EOF'
#!/bin/sh
PREREQ=""
prereqs() { echo "$PREREQ"; }
case $1 in prereqs) prereqs; exit 0;; esac
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
EOF
sudo chmod +x /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile

echo "--> 4. Compiling the final, verified boot image..."
sudo chroot /mnt/target_clean sh -c "update-initramfs -u -k all && update-grub"

echo "--> 5. VERIFYING SUCCESS: Confirming key footprint inside the image..."
sudo chroot /mnt/target_clean sh -c "lsinitramfs /boot/initrd.img-* | grep boot.key"

echo "--> 6. Safely unmounting and locking all device descriptors..."
sudo umount -R /mnt/target_clean
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44
echo "======================================================="
echo " VICTORY: Single-passphrase boot is officially active! "
echo "======================================================="
--> 1. Re-opening storage container cleanly...
Enter passphrase for /dev/vda2:
--> 2. Remounting core system directory sectors cleanly...
--> 3. Overwriting the initramfs hook with the correct DESTDIR variable...
#!/bin/sh
PREREQ=""
prereqs() { echo "$PREREQ"; }
case $1 in prereqs) prereqs; exit 0;; esac
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
--> 4. Compiling the final, verified boot image...
update-initramfs: Generating /boot/initrd.img-6.19.8-surface-3
Generating grub configuration file ...
Found background image: /usr/share/images/desktop-base/desktop-grub.png
Found linux image: /boot/vmlinuz-6.19.8-surface-3
Found initrd image: /boot/initrd.img-6.19.8-surface-3
Warning: os-prober will be executed to detect other bootable partitions.
Its output will be used to detect bootable binaries on them and create new boot entries.
Found Debian GNU/Linux forky/sid on /dev/sda3
Adding boot menu entry for UEFI Firmware Settings ...
done
--> 5. VERIFYING SUCCESS: Confirming key footprint inside the image...
etc/cryptsetup-initramfs/boot.key
--> 6. Safely unmounting and locking all device descriptors...

VICTORY: Single-passphrase boot is officially active!

@tabletseeker

tabletseeker commented Jul 11, 2026

Copy link
Copy Markdown
Author

#!/bin/bash
set -e

A. Migrate the key file to the standard initramfs folder layout

mkdir -p /etc/cryptsetup-initramfs
mv /crypto_keyfile.bin /etc/cryptsetup-initramfs/boot.key 2>/dev/null || true
chmod 400 /etc/cryptsetup-initramfs/boot.key

B. Grab the real runtime UUID and write a clean single-prompt crypttab

REAL_UUID=$(blkid -o value -s UUID /dev/vda2)
echo "luks-${REAL_UUID} UUID=${REAL_UUID} /etc/cryptsetup-initramfs/boot.key luks,initramfs,keyslot=0" > /etc/crypttab
echo "KEYFILE_PATTERN="/etc/cryptsetup-initramfs/boot.key"" > /etc/cryptsetup-initramfs/conf-hook
echo "UMASK=0077" >> /etc/cryptsetup-initramfs/conf-hook

C. Rewrite fstab to route swap to the physical device with zero-timeout overrides

sed -i '/swap/d; /luks-/d' /etc/fstab
echo "/dev/mapper/luks-${REAL_UUID} / ext4 defaults 0 1" >> /etc/fstab
echo "/dev/vda3 none swap sw,x-systemd.makefs,x-systemd.device-timeout=5 0 0" >> /etc/fstab
echo "RESUME=none" > /etc/initramfs-tools/conf.d/resume

D. Write out the verified initramfs copy hook file using the correct $DESTDIR

mkdir -p /etc/initramfs-tools/hooks
cat << 'EOF' > /etc/initramfs-tools/hooks/embed_keyfile
#!/bin/sh
if [ "$1" = "prereqs" ]; then exit 0; fi
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
EOF
chmod +x /etc/initramfs-tools/hooks/embed_keyfile

@tabletseeker

tabletseeker commented Jul 11, 2026

Copy link
Copy Markdown
Author

#!/bin/bash
set -e

A. Migrate the key file to the standard initramfs folder layout

mkdir -p /etc/cryptsetup-initramfs
mv /crypto_keyfile.bin /etc/cryptsetup-initramfs/boot.key 2>/dev/null || true
chmod 400 /etc/cryptsetup-initramfs/boot.key

B. Grab the real runtime UUID and write a clean single-prompt crypttab

REAL_UUID=$(blkid -o value -s UUID /dev/vda2)
echo "luks-${REAL_UUID} UUID=${REAL_UUID} /etc/cryptsetup-initramfs/boot.key luks,initramfs,keyslot=0" > /etc/crypttab
echo "KEYFILE_PATTERN="/etc/cryptsetup-initramfs/boot.key"" > /etc/cryptsetup-initramfs/conf-hook
echo "UMASK=0077" >> /etc/cryptsetup-initramfs/conf-hook

C. Rewrite fstab to route swap to the physical device with zero-timeout overrides

sed -i '/swap/d; /luks-/d' /etc/fstab
echo "/dev/mapper/luks-${REAL_UUID} / ext4 defaults 0 1" >> /etc/fstab
echo "/dev/vda3 none swap sw,x-systemd.makefs,x-systemd.device-timeout=5 0 0" >> /etc/fstab
echo "RESUME=none" > /etc/initramfs-tools/conf.d/resume

D. Write out the verified initramfs copy hook file using the correct $DESTDIR

mkdir -p /etc/initramfs-tools/hooks
cat << 'EOF' > /etc/initramfs-tools/hooks/embed_keyfile
#!/bin/sh
if [ "$1" = "prereqs" ]; then exit 0; fi
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
EOF
chmod +x /etc/initramfs-tools/hooks/embed_keyfile

@tabletseeker

tabletseeker commented Jul 11, 2026

Copy link
Copy Markdown
Author 
#!/bin/bash
set -e

# A. Migrate the key file to the standard initramfs folder layout
mkdir -p /etc/cryptsetup-initramfs
mv /crypto_keyfile.bin /etc/cryptsetup-initramfs/boot.key 2>/dev/null || true
chmod 400 /etc/cryptsetup-initramfs/boot.key

# B. Grab the real runtime UUID and write a clean single-prompt crypttab
REAL_UUID=$(blkid -o value -s UUID /dev/vda2)
echo "luks-${REAL_UUID} UUID=${REAL_UUID} /etc/cryptsetup-initramfs/boot.key luks,initramfs,keyslot=0" > /etc/crypttab
echo "KEYFILE_PATTERN=\"/etc/cryptsetup-initramfs/boot.key\"" > /etc/cryptsetup-initramfs/conf-hook
echo "UMASK=0077" >> /etc/cryptsetup-initramfs/conf-hook

# C. Rewrite fstab to route swap to the physical device with zero-timeout overrides
sed -i '/swap/d; /luks-/d' /etc/fstab
echo "/dev/mapper/luks-${REAL_UUID} / ext4 defaults 0 1" >> /etc/fstab
echo "/dev/vda3 none swap sw,x-systemd.makefs,x-systemd.device-timeout=5 0 0" >> /etc/fstab
echo "RESUME=none" > /etc/initramfs-tools/conf.d/resume

# D. Write out the verified initramfs copy hook file using the correct $DESTDIR
mkdir -p /etc/initramfs-tools/hooks
cat << 'EOF' > /etc/initramfs-tools/hooks/embed_keyfile
#!/bin/sh
if [ "$1" = "prereqs" ]; then exit 0; fi
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
    mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
    cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
EOF
chmod +x /etc/initramfs-tools/hooks/embed_keyfile

@tabletseeker

tabletseeker commented Jul 11, 2026

Copy link
Copy Markdown
Author 
echo "--> 1. Terminating any background partition locks and unmounting nodes..." && \
sudo swapoff -a 2>/dev/null || true && \
sudo umount -R /mnt/target_clean 2>/dev/null || true && \
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44 2>/dev/null || true && \
\
echo "--> 2. Re-opening storage container cleanly using the true tracking name..." && \
sudo cryptsetup open /dev/vda2 luks-0c349def-f79f-4dc7-934c-4fc12238ae44 && \
\
echo "--> 3. Remounting core system directory sectors cleanly..." && \
sudo mkdir -p /mnt/target_clean && \
sudo mount /dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 /mnt/target_clean && \
sudo mount /dev/vda1 /mnt/target_clean/boot/efi && \
sudo mount --bind /dev /mnt/target_clean/dev && \
sudo mount --bind /proc /mnt/target_clean/proc && \
sudo mount --bind /sys /mnt/target_clean/sys && \
\
echo "--> 4. Regenerating a high-entropy valid passkey asset file..." && \
sudo mkdir -p /mnt/target_clean/etc/cryptsetup-initramfs && \
sudo dd bs=512 count=4 if=/dev/urandom of=/mnt/target_clean/etc/cryptsetup-initramfs/boot.key status=none && \
sudo chmod 400 /mnt/target_clean/etc/cryptsetup-initramfs/boot.key && \
\
echo "--> 5. Enrolling the fresh valid key file into your drive header..." && \
sudo cryptsetup luksAddKey /dev/vda2 /mnt/target_clean/etc/cryptsetup-initramfs/boot.key && \
\
echo "--> 6. Synchronizing internal system tables with true boot parameters..." && \
sudo tee /mnt/target_clean/etc/crypttab << 'EOF'
luks-0c349def-f79f-4dc7-934c-4fc12238ae44  UUID=0c349def-f79f-4dc7-934c-4fc12238ae44  /etc/cryptsetup-initramfs/boot.key  luks,initramfs,keyslot=1
cryptswap                                  /dev/vda3                                  /dev/urandom                        swap,cipher=aes-xts-plain64,size=256,noauto
EOF
\
sudo tee /mnt/target_clean/etc/cryptsetup-initramfs/crypttab << 'EOF'
luks-0c349def-f79f-4dc7-934c-4fc12238ae44  UUID=0c349def-f79f-4dc7-934c-4fc12238ae44  /etc/cryptsetup-initramfs/boot.key  luks,initramfs,keyslot=1
EOF
\
echo "--> 7. FIX 1: Overwriting fstab to load the hardware swap node directly (No Timeout Delay)..." && \
sudo tee /mnt/target_clean/etc/fstab << 'EOF'
UUID=8CFE-32E0                            /boot/efi      vfat    defaults   0 2
/dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 /              ext4    defaults   0 1
/dev/vda3                                 none           swap    sw,x-systemd.makefs,x-systemd.device-timeout=5 0 0
EOF
\
echo "--> 8. Populating the initramfs ramdisk file-copy script hook pattern templates..." && \
sudo tee /mnt/target_clean/etc/cryptsetup-initramfs/conf-hook << 'EOF'
KEYFILE_PATTERN="/etc/cryptsetup-initramfs/boot.key"
UMASK=0077
EOF
\
echo "--> 9. FIX 2: Overwriting the initramfs hook with the correct DESTDIR variable..." && \
sudo mkdir -p /mnt/target_clean/etc/initramfs-tools/hooks && \
sudo tee /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile << 'EOF'
#!/bin/sh
PREREQ=""
prereqs() { echo "$PREREQ"; }
case $1 in prereqs) prereqs; exit 0;; esac
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
    mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
    cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
EOF
sudo chmod +x /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile && \
\
echo "--> 10. Forcing the clean initramfs image compilation pass and updating GRUB lines..." && \
sudo chroot /mnt/target_clean sh -c "echo 'RESUME=none' > /etc/initramfs-tools/conf.d/resume && update-initramfs -u -k all && update-grub" && \
\
echo "--> 11. VERIFYING SUCCESS: Confirming key footprint inside the image..." && \
sudo chroot /mnt/target_clean sh -c "lsinitramfs /boot/initrd.img-* | grep boot.key" && \
\
echo "--> 12. Safely unmounting and locking all device descriptors..." && \
sudo umount -R /mnt/target_clean && \
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44 && \
echo "=======================================================" && \
echo " VICTORY: Single-passphrase boot is officially active! " && \
echo "======================================================="

@tabletseeker

tabletseeker commented Jul 11, 2026

Copy link
Copy Markdown
Author 
echo "--> 1. Updating your system fstab table to load the hardware swap node directly..." && \
sudo sed -i '/cryptswap/d' /etc/fstab && \
echo "/dev/vda3    none    swap    sw,x-systemd.makefs,x-systemd.device-timeout=5    0    0" | sudo tee -a /etc/fstab && \
\
echo "--> 2. Reloading the systemd manager profile tracking caches..." && \
sudo systemctl daemon-reload && \
\
echo "=================================================================" && \
echo " SUCCESS: Swap timeout erased! Future boots will be instant.     " && \
echo "=================================================================" && \
echo "--> 1. Re-opening storage container cleanly..." && \
sudo cryptsetup open /dev/vda2 luks-0c349def-f79f-4dc7-934c-4fc12238ae44 && \
\
echo "--> 2. Remounting core system directory sectors cleanly..." && \
sudo mount /dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 /mnt/target_clean && \
sudo mount /dev/vda1 /mnt/target_clean/boot/efi && \
sudo mount --bind /dev /mnt/target_clean/dev && \
sudo mount --bind /proc /mnt/target_clean/proc && \
sudo mount --bind /sys /mnt/target_clean/sys && \
\
echo "--> 3. Overwriting the initramfs hook with the correct DESTDIR variable..." && \
sudo mkdir -p /mnt/target_clean/etc/initramfs-tools/hooks && \
sudo tee /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile << 'EOF'
#!/bin/sh
PREREQ=""
prereqs() { echo "$PREREQ"; }
case $1 in prereqs) prereqs; exit 0;; esac
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
    mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
    cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
EOF
sudo chmod +x /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile && \
\
echo "--> 4. Compiling the final, verified boot image..." && \
sudo chroot /mnt/target_clean sh -c "update-initramfs -u -k all && update-grub" && \
\
echo "--> 5. VERIFYING SUCCESS: Confirming key footprint inside the image..." && \
sudo chroot /mnt/target_clean sh -c "lsinitramfs /boot/initrd.img-* | grep boot.key" && \
\
echo "--> 6. Safely unmounting and locking all device descriptors..." && \
sudo umount -R /mnt/target_clean && \
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44 && \
echo "=======================================================" && \
echo " VICTORY: Single-passphrase boot is officially active! " && \
echo "======================================================="

@tabletseeker

tabletseeker commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Diagnostics 12/07/10AM

echo "================================================================="
echo "        CALAMARES CRYPTOGRAPHIC SYSTEM AUDIT INTERFACE           "
echo "================================================================="
echo ""

echo "[1/5] SCANNING RAW VIRTUAL DISK CHANNELS..."
lsblk -o NAME,FSTYPE,SIZE,UUID,MOUNTPOINTS /dev/vda
echo ""

echo "[2/5] AUDITING ACTIVE KERNEL MAPPER PROFILES..."
sudo cryptsetup status luks-0c349def-f79f-4dc7-934c-4fc12238ae44 2>/dev/null || echo "Mapper luks-0c349def is currently closed."
sudo cryptsetup status target_repair_node 2>/dev/null || echo "Mapper target_repair_node is currently closed."
echo ""

echo "[3/5] LOCATING EMBEDDED KEYFILE ASSETS ON ACTIVE MOUNTS..."
echo "Checking live host mount tree locations:"
find /mnt /tmp -name "boot.key" -o -name "crypto_keyfile.bin" 2>/dev/null || echo "No key assets found on live host paths."
echo ""

echo "[4/5] MOUNTING CORE ENCRYPTED TREE TO CHECK TARGET FILES..."
# Safely peek inside using a neutral temporary name to avoid resource locks
sudo mkdir -p /tmp/diag_peeker
if sudo cryptsetup open /dev/vda2 diag_peeker --readonly; then
    sudo mount -o ro /dev/mapper/diag_peeker /tmp/diag_peeker
    
    echo "--- TARGET CRYPTTAB ---"
    cat /tmp/diag_peeker/etc/crypttab || echo "ERROR: crypttab missing"
    echo ""
    
    echo "--- TARGET FSTAB ---"
    cat /tmp/diag_peeker/etc/fstab || echo "ERROR: fstab missing"
    echo ""
    
    echo "--- TARGET HOOK CONFIGURATIONS ---"
    cat /tmp/diag_peeker/etc/cryptsetup-initramfs/conf-hook 2>/dev/null || echo "conf-hook missing"
    echo ""
    
    echo "--- TARGET EMBED HOOK CONTENT ---"
    cat /tmp/diag_peeker/etc/initramfs-tools/hooks/embed_keyfile 2>/dev/null || echo "embed_keyfile hook missing"
    echo ""

    echo "--- INTERNAL HARDWARE KEYS RECORDED IN DRIVE HEADER ---"
    sudo cryptsetup luksDump /dev/vda2 | grep -A 4 "Key Slot"
    echo ""

    sudo umount /tmp/diag_peeker
    sudo cryptsetup close diag_peeker
else
    echo "CRITICAL: Could not unlock /dev/vda2 for file auditing."
fi
echo ""

echo "[5/5] CHECKING LIVE STORAGE FILE ALLOCATIONS..."
df -h
echo "================================================================="
=================================================================
        CALAMARES CRYPTOGRAPHIC SYSTEM AUDIT INTERFACE           
=================================================================

[1/5] SCANNING RAW VIRTUAL DISK CHANNELS...
NAME                                          FSTYPE       SIZE UUID                                 MOUNTPOINTS
vda                                                         20G                                      
├─vda1                                        vfat         300M A477-ACD9                            
├─vda2                                        crypto_LUKS 15.5G 85e64c1f-170c-4a22-835c-fa1cc9ec7c13 
│ └─luks-85e64c1f-170c-4a22-835c-fa1cc9ec7c13 ext4        15.5G 7e24cb36-8225-48b8-b543-bf1c3e5a92cc 
└─vda3                                        crypto_LUKS  4.2G 3caf8d4f-1b77-46f1-9b8e-52977c7a1b4d 
  └─luks-3caf8d4f-1b77-46f1-9b8e-52977c7a1b4d swap         4.2G 87017c1e-7373-4744-89a7-f1928fd483fd 

[2/5] AUDITING ACTIVE KERNEL MAPPER PROFILES...
[sudo] password for mobian: 
/dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 is inactive.
Mapper luks-0c349def is currently closed.
/dev/mapper/target_repair_node is inactive.
Mapper target_repair_node is currently closed.

[3/5] LOCATING EMBEDDED KEYFILE ASSETS ON ACTIVE MOUNTS...
Checking live host mount tree locations:
/mnt/target_clean/etc/cryptsetup-initramfs/boot.key
No key assets found on live host paths.

[4/5] MOUNTING CORE ENCRYPTED TREE TO CHECK TARGET FILES...
Enter passphrase for /dev/vda2: 
Cannot use device /dev/vda2 which is in use (already mapped or mounted).
CRITICAL: Could not unlock /dev/vda2 for file auditing.

[5/5] CHECKING LIVE STORAGE FILE ALLOCATIONS...
Filesystem      Size  Used Avail Use% Mounted on
udev            612M     0  612M   0% /dev
tmpfs           197M  944K  196M   1% /run
/dev/sda3       6.8G  4.7G  1.8G  73% /
tmpfs           985M   96K  985M   1% /dev/shm
efivarfs        256K  7.5K  244K   3% /sys/firmware/efi/efivars
none            1.0M     0  1.0M   0% /run/credentials/systemd-journald.service
tmpfs           985M  3.7M  981M   1% /tmp
/dev/sda2       488M  111M  342M  25% /boot
/dev/sda1       510M  168K  510M   1% /boot/efi
tmpfs           197M   44K  197M   1% /run/user/1000
tmpfs           197M   20K  197M   1% /run/user/0
=================================================================

@tabletseeker

tabletseeker commented Jul 12, 2026

Copy link
Copy Markdown
Author 
echo "--> 1. Terminating background storage mapping blocks..."
sudo swapoff -a 2>/dev/null || true
sudo umount -R /mnt/target_clean 2>/dev/null || true
sudo cryptsetup close luks-9e7e1b0a-6ffd-4b61-ab64-8ad2da9bbd16 2>/dev/null || true
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44 2>/dev/null || true

echo "--> 2. Re-opening storage container using the exact name crypttab checks for..."
sudo cryptsetup open /dev/vda2 luks-0c349def-f79f-4dc7-934c-4fc12238ae44

echo "--> 3. Remounting core system directory sectors cleanly..."
sudo mkdir -p /mnt/target_clean
sudo mount /dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 /mnt/target_clean
sudo mount /dev/vda1 /mnt/target_clean/boot/efi
sudo mount --bind /dev /mnt/target_clean/dev
sudo mount --bind /proc /mnt/target_clean/proc
sudo mount --bind /sys /mnt/target_clean/sys

echo "--> 4. Writing a clean, high-entropy keyfile asset to the target root..."
sudo mkdir -p /mnt/target_clean/etc/cryptsetup-initramfs
sudo dd bs=512 count=4 if=/dev/urandom of=/mnt/target_clean/etc/cryptsetup-initramfs/boot.key status=none
sudo chmod 400 /mnt/target_clean/etc/cryptsetup-initramfs/boot.key

echo "--> 5. Enrolling the valid key into hardware Key Slot 3..."
sudo cryptsetup luksAddKey /dev/vda2 /mnt/target_clean/etc/cryptsetup-initramfs/boot.key

echo "--> 6. Aligning the target system tables to eliminate swap locks..."
sudo tee /mnt/target_clean/etc/crypttab << 'EOF'
luks-0c349def-f79f-4dc7-934c-4fc12238ae44  UUID=0c349def-f79f-4dc7-934c-4fc12238ae44  /etc/cryptsetup-initramfs/boot.key  luks,initramfs,keyslot=3
cryptswap                                  /dev/vda3                                  /dev/urandom                        swap,cipher=aes-xts-plain64,size=256,noauto
EOF

sudo tee /mnt/target_clean/etc/fstab << 'EOF'
UUID=8CFE-32E0                            /boot/efi      vfat    defaults   0 2
/dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 /              ext4    defaults   0 1
/dev/mapper/cryptswap                      none           swap    sw,x-systemd.makefs 0 0
EOF

echo "--> 7. Populating the initramfs ramdisk file-copy script hook..."
sudo tee /mnt/target_clean/etc/cryptsetup-initramfs/conf-hook << 'EOF'
KEYFILE_PATTERN="/etc/cryptsetup-initramfs/boot.key"
UMASK=0077
EOF

sudo mkdir -p /mnt/target_clean/etc/initramfs-tools/hooks
sudo tee /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile << 'EOF'
#!/bin/sh
if [ "$1" = "prereqs" ]; then exit 0; fi
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
    mkdir -p "$2/etc/cryptsetup-initramfs"
    cp -p /etc/cryptsetup-initramfs/boot.key "$2/etc/cryptsetup-initramfs/boot.key"
fi
EOF
sudo chmod +x /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile

echo "--> 8. Triggering pristine ramdisk and bootloader compilation..."
sudo chroot /mnt/target_clean sh -c "echo 'RESUME=none' > /etc/initramfs-tools/conf.d/resume && update-initramfs -u -k all && update-grub"

echo "--> 9. VERIFYING SUCCESS: Scanning boot target for the keyfile payload..."
sudo chroot /mnt/target_clean sh -c "lsinitramfs /boot/initrd.img-* | grep boot.key"

echo "--> 10. Safely locking down drive structures..."
sudo umount -R /mnt/target_clean
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44
echo "======================================================="
echo " FIXED: Verification pass complete. Ready to boot!     "
echo "======================================================="
--> 1. Terminating background storage mapping blocks...
--> 2. Re-opening storage container using the exact name crypttab checks for...
Enter passphrase for /dev/vda2: 
--> 3. Remounting core system directory sectors cleanly...
--> 4. Writing a clean, high-entropy keyfile asset to the target root...
--> 5. Enrolling the valid key into hardware Key Slot 3...
Enter any existing passphrase: 
--> 6. Aligning the target system tables to eliminate swap locks...
luks-0c349def-f79f-4dc7-934c-4fc12238ae44  UUID=0c349def-f79f-4dc7-934c-4fc12238ae44  /etc/cryptsetup-initramfs/boot.key  luks,initramfs,keyslot=3
cryptswap                                  /dev/vda3                                  /dev/urandom                        swap,cipher=aes-xts-plain64,size=256,noauto
UUID=8CFE-32E0                            /boot/efi      vfat    defaults   0 2
/dev/mapper/luks-0c349def-f79f-4dc7-934c-4fc12238ae44 /              ext4    defaults   0 1
/dev/mapper/cryptswap                      none           swap    sw,x-systemd.makefs 0 0
--> 7. Populating the initramfs ramdisk file-copy script hook...
KEYFILE_PATTERN="/etc/cryptsetup-initramfs/boot.key"
UMASK=0077
#!/bin/sh
if [ "$1" = "prereqs" ]; then exit 0; fi
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
    mkdir -p "$2/etc/cryptsetup-initramfs"
    cp -p /etc/cryptsetup-initramfs/boot.key "$2/etc/cryptsetup-initramfs/boot.key"
fi
--> 8. Triggering pristine ramdisk and bootloader compilation...
update-initramfs: Generating /boot/initrd.img-6.19.8-surface-3
cp: '/etc/cryptsetup-initramfs/boot.key' and '/etc/cryptsetup-initramfs/boot.key' are the same file
E: /etc/initramfs-tools/hooks/embed_keyfile failed with return 1.
update-initramfs: failed for /boot/initrd.img-6.19.8-surface-3 with 1.
--> 9. VERIFYING SUCCESS: Scanning boot target for the keyfile payload...
--> 10. Safely locking down drive structures...
=======================================================
 FIXED: Verification pass complete. Ready to boot!     
======================================================

echo "--> 1. Correcting the initramfs file hook with the proper destination variables..."
sudo tee /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile << 'EOF'
#!/bin/sh
PREREQ=""
prereqs() { echo "$PREREQ"; }
case $1 in prereqs) prereqs; exit 0;; esac
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
    mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
    cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
EOF
sudo chmod +x /mnt/target_clean/etc/initramfs-tools/hooks/embed_keyfile

echo "--> 2. Re-triggering the clean system image compilation pass..."
sudo chroot /mnt/target_clean sh -c "update-initramfs -u -k all && update-grub"

echo "--> 3. VERIFYING SUCCESS: Confirming key footprint inside the image..."
sudo chroot /mnt/target_clean sh -c "lsinitramfs /boot/initrd.img-* | grep boot.key"

echo "--> 4. Safely unmounting and locking all device descriptors..."
sudo umount -R /mnt/target_clean
sudo cryptsetup close luks-0c349def-f79f-4dc7-934c-4fc12238ae44
echo "======================================================="
echo " VICTORY: Single-passphrase boot is officially active! " && \
echo "======================================================="

@tabletseeker

tabletseeker commented Jul 12, 2026

Copy link
Copy Markdown
Author 
#!/usr/bin/env bash
set -e

# Dynamically pull the exact UUIDs from your real disk layout
REAL_ROOT_UUID=$(blkid -s UUID -o value /dev/vda2)
REAL_SWAP_UUID=$(blkid -s UUID -o value /dev/vda3)
REAL_EFI_UUID=$(blkid -s UUID -o value /dev/vda1)

TARGET="/mnt/target_clean"
MAP_NAME="luks-${REAL_ROOT_UUID}"

echo "======================================================="
echo " EXECUTION PASS: ALIGNING SCHEMATICS TO REAL HARDWARE  "
echo "======================================================="
echo "Found Active Root UUID: ${REAL_ROOT_UUID}"
echo "Found Active Swap UUID: ${REAL_SWAP_UUID}"

echo "--> 1. Freeing active partition locks..."
sudo swapoff -a 2>/dev/null || true
if mountpoint -q "$TARGET"; then
    sudo umount -R "$TARGET" 2>/dev/null || true
fi

echo "--> 2. Ensuring the real system device mapping is mounted..."
# If Calamares already opened it under the real name, this safely uses it
if [ ! -b "/dev/mapper/${MAP_NAME}" ]; then
    sudo cryptsetup open /dev/vda2 "$MAP_NAME"
fi

echo "--> 3. Structuring clean target virtual environments..."
sudo mkdir -p "$TARGET"
sudo mount "/dev/mapper/${MAP_NAME}" "$TARGET"
sudo mkdir -p "$TARGET/boot/efi"
sudo mount /dev/vda1 "$TARGET/boot/efi"

# Bind pseudo-filesystems for chroot commands
for dir in dev proc sys dev/pts; do
    sudo mkdir -p "$TARGET/$dir"
    sudo mount --bind "/$dir" "$TARGET/$dir"
done

echo "--> 4. Depositing high-entropy keyfile..."
sudo mkdir -p "$TARGET/etc/cryptsetup-initramfs"
sudo dd bs=512 count=4 if=/dev/urandom of="$TARGET/etc/cryptsetup-initramfs/boot.key" status=none
sudo chmod 400 "$TARGET/etc/cryptsetup-initramfs/boot.key"

echo "--> 5. Enrolling key into LUKS keyslot..."
# This will prompt you for your master user passphrase once
sudo cryptsetup luksAddKey --key-slot 3 /dev/vda2 "$TARGET/etc/cryptsetup-initramfs/boot.key"

echo "--> 6. Generating systemic file tables using dynamic identifiers..."
sudo tee "$TARGET/etc/crypttab" << EOF
${MAP_NAME}  UUID=${REAL_ROOT_UUID}  /etc/cryptsetup-initramfs/boot.key  luks,initramfs,keyslot=3
cryptswap         UUID=${REAL_SWAP_UUID}  /dev/urandom                        swap,cipher=aes-xts-plain64,size=256,noauto
EOF

sudo tee "$TARGET/etc/fstab" << EOF
UUID=${REAL_EFI_UUID}                            /boot/efi      vfat    defaults   0 2
/dev/mapper/${MAP_NAME} /              ext4    defaults   0 1
/dev/mapper/cryptswap                      none           swap    sw,x-systemd.makefs 0 0
EOF

echo "--> 7. Structuring fixed initramfs hook variables..."
sudo tee "$TARGET/etc/cryptsetup-initramfs/conf-hook" << EOF
KEYFILE_PATTERN="/etc/cryptsetup-initramfs/boot.key"
UMASK=0077
EOF

sudo mkdir -p "$TARGET/etc/initramfs-tools/hooks"
sudo tee "$TARGET/etc/initramfs-tools/hooks/embed_keyfile" << 'EOF'
#!/bin/sh
PREREQ=""
prereqs() { echo "$PREREQ"; }
case $1 in prereqs) prereqs; exit 0;; esac

. /usr/share/initramfs-tools/hook-functions

if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
    mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
    cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
EOF
sudo chmod +x "$TARGET/etc/initramfs-tools/hooks/embed_keyfile"

echo "--> 8. Compiling new initial ramdisk..."
sudo chroot "$TARGET" sh -c "echo 'RESUME=none' > /etc/initramfs-tools/conf.d/resume && update-initramfs -u -k all && update-grub"

echo "--> 9. VERIFYING PAYLOAD INTEGRITY..."
if sudo chroot "$TARGET" sh -c "lsinitramfs /boot/initrd.img-* | grep -q 'boot.key'"; then
    echo "   [SUCCESS] Verified: boot.key mapped perfectly inside the boot RAM disk image!"
else
    echo "   [CRITICAL FAIL] key asset dropped out of initrd compile path."
    exit 1
fi

echo "--> 10. Cleanly unlocking system devices..."
sudo umount -R "$TARGET"
# We leave the device mapping as-is since the live environment is tracking it.

echo "======================================================="
echo " VICTORY: Script fully reconciled against device pins!  "
echo "======================================================="

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment