Last active
July 12, 2026 11:50
-
-
Save tabletseeker/29eaf62d24be327f15bc27c534ea3d1d to your computer and use it in GitHub Desktop.
calamares
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: no | |
| # SPDX-License-Identifier: CC0-1.0 | |
| # /etc/calamares/modules/shellprocess/shellprocess@luksfix.conf | |
| --- | |
| id: luksfix | |
| dontChroot: false | |
| timeout: 90 | |
| name: "Configuring single-passphrase boot bypass..." | |
| script: | |
| # 1. Write the clean, standalone script file using a literal text block | |
| - | | |
| cat << 'EOF' > /tmp/luks-bypass.sh | |
| #!/bin/bash | |
| set -x | |
| set -e | |
| mkdir -p /boot/cryptsetup-keys.d | |
| dd bs=512 count=8 if=/dev/urandom of=/boot/cryptsetup-keys.d/root.key iflag=fullblock | |
| chmod 400 /boot/cryptsetup-keys.d/root.key | |
| echo "# Automatically generated by Mobian FDE Fix" > /etc/crypttab | |
| ls /dev/mapper/luks-* 2>/dev/null | while read -r mapper_path; do | |
| MAP_NAME=$(basename "$mapper_path") | |
| UUID_HEX=$(cryptsetup luksUUID "$mapper_path" 2>/dev/null || echo "") | |
| if [ -n "$UUID_HEX" ]; then | |
| PHYS_PART=$(blkid -U "$UUID_HEX" 2>/dev/null || echo "") | |
| if [ -n "$PHYS_PART" ]; then | |
| echo "Enrolling keyfile into LUKS slot for: $PHYS_PART" | |
| echo -n "$PASSPHRASE_TOKEN" | cryptsetup luksAddKey "$PHYS_PART" /boot/cryptsetup-keys.d/root.key | |
| echo "${MAP_NAME} UUID=${UUID_HEX} /boot/cryptsetup-keys.d/root.key luks,initramfs" >> /etc/crypttab | |
| fi | |
| fi | |
| done | |
| mkdir -p /etc/cryptsetup-initramfs | |
| echo 'KEYFILE_PATTERN="/boot/cryptsetup-keys.d/*.key"' >> /etc/cryptsetup-initramfs/conf-hook | |
| EOF | |
| # 2. Make the script executable | |
| - "chmod +x /tmp/luks-bypass.sh" | |
| # 3. Execute the script while safely injecting the Calamares password variable from the host | |
| - "PASSPHRASE_TOKEN=${PASSWORD} /tmp/luks-bypass.sh" | |
| # 4. Clean up the temporary script file | |
| - "rm -f /tmp/luks-bypass.sh" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # /etc/calamares/modules/shellprocess@cryptfix.conf | |
| --- | |
| dontChroot: true # Keep this TRUE so the script can map the host's real disk layout | |
| timeout: 30 | |
| script: | |
| - description: "Dynamically mapping host LUKS parameters to the target configuration..." | |
| command: | | |
| # 1. Locate where Calamares has currently mounted the target root image on the live host | |
| TARGET_MOUNT=$(mount | grep 'calamares-root' | grep 'on /tmp/' | head -n 1 | awk '{print $3}') | |
| # Validate that a mount target was actually discovered before continuing | |
| if [ -z "$TARGET_MOUNT" ]; then | |
| echo "ERROR: Calamares target mount point could not be detected!" | |
| exit 1 | |
| fi | |
| # 2. Extract the underlying mapper device node handling the filesystem | |
| TARGET_DEV=$(mount | grep "on ${TARGET_MOUNT}" | awk '{print $1}') | |
| # 3. Retrieve the matching true physical LUKS disk partition UUID | |
| REAL_UUID=$(blkid -o value -s UUID ${TARGET_DEV}) | |
| if [ -z "$REAL_UUID" ]; then | |
| echo "ERROR: Failed to resolve the underlying LUKS container UUID!" | |
| exit 1 | |
| fi | |
| # 4. Mount target is on the host, so write directly to its absolute path offset | |
| echo "cryptroot UUID=${REAL_UUID} none luks,initramfs" > "${TARGET_MOUNT}/etc/crypttab" | |
| # Output confirmation directly to Calamares logs for clean debugging | |
| echo "SUCCESS: Wrote cryptroot entry with UUID=${REAL_UUID} directly to ${TARGET_MOUNT}/etc/crypttab" |
tabletseeker
commented
Jul 12, 2026
Author
Author
#!/usr/bin/env bash
set -e
# Dynamically pull the exact UUIDs from your real disk layout
REAL_ROOT_UUID=$(blkid -s UUID -o value /dev/vda2)
REAL_SWAP_UUID=$(blkid -s UUID -o value /dev/vda3)
REAL_EFI_UUID=$(blkid -s UUID -o value /dev/vda1)
TARGET="/mnt/target_clean"
MAP_NAME="luks-${REAL_ROOT_UUID}"
echo "======================================================="
echo " EXECUTION PASS: ALIGNING SCHEMATICS TO REAL HARDWARE "
echo "======================================================="
echo "Found Active Root UUID: ${REAL_ROOT_UUID}"
echo "Found Active Swap UUID: ${REAL_SWAP_UUID}"
echo "--> 1. Freeing active partition locks..."
sudo swapoff -a 2>/dev/null || true
if mountpoint -q "$TARGET"; then
sudo umount -R "$TARGET" 2>/dev/null || true
fi
echo "--> 2. Ensuring the real system device mapping is mounted..."
# If Calamares already opened it under the real name, this safely uses it
if [ ! -b "/dev/mapper/${MAP_NAME}" ]; then
sudo cryptsetup open /dev/vda2 "$MAP_NAME"
fi
echo "--> 3. Structuring clean target virtual environments..."
sudo mkdir -p "$TARGET"
sudo mount "/dev/mapper/${MAP_NAME}" "$TARGET"
sudo mkdir -p "$TARGET/boot/efi"
sudo mount /dev/vda1 "$TARGET/boot/efi"
# Bind pseudo-filesystems for chroot commands
for dir in dev proc sys dev/pts; do
sudo mkdir -p "$TARGET/$dir"
sudo mount --bind "/$dir" "$TARGET/$dir"
done
echo "--> 4. Depositing high-entropy keyfile..."
sudo mkdir -p "$TARGET/etc/cryptsetup-initramfs"
sudo dd bs=512 count=4 if=/dev/urandom of="$TARGET/etc/cryptsetup-initramfs/boot.key" status=none
sudo chmod 400 "$TARGET/etc/cryptsetup-initramfs/boot.key"
echo "--> 5. Enrolling key into LUKS keyslot..."
# This will prompt you for your master user passphrase once
sudo cryptsetup luksAddKey --key-slot 3 /dev/vda2 "$TARGET/etc/cryptsetup-initramfs/boot.key"
echo "--> 6. Generating systemic file tables using dynamic identifiers..."
sudo tee "$TARGET/etc/crypttab" << EOF
${MAP_NAME} UUID=${REAL_ROOT_UUID} /etc/cryptsetup-initramfs/boot.key luks,initramfs,keyslot=3
cryptswap UUID=${REAL_SWAP_UUID} /dev/urandom swap,cipher=aes-xts-plain64,size=256,noauto
EOF
sudo tee "$TARGET/etc/fstab" << EOF
UUID=${REAL_EFI_UUID} /boot/efi vfat defaults 0 2
/dev/mapper/${MAP_NAME} / ext4 defaults 0 1
/dev/mapper/cryptswap none swap sw,x-systemd.makefs 0 0
EOF
echo "--> 7. Structuring fixed initramfs hook variables..."
sudo tee "$TARGET/etc/cryptsetup-initramfs/conf-hook" << EOF
KEYFILE_PATTERN="/etc/cryptsetup-initramfs/boot.key"
UMASK=0077
EOF
sudo mkdir -p "$TARGET/etc/initramfs-tools/hooks"
sudo tee "$TARGET/etc/initramfs-tools/hooks/embed_keyfile" << 'EOF'
#!/bin/sh
PREREQ=""
prereqs() { echo "$PREREQ"; }
case $1 in prereqs) prereqs; exit 0;; esac
. /usr/share/initramfs-tools/hook-functions
if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
EOF
sudo chmod +x "$TARGET/etc/initramfs-tools/hooks/embed_keyfile"
echo "--> 8. Compiling new initial ramdisk..."
sudo chroot "$TARGET" sh -c "echo 'RESUME=none' > /etc/initramfs-tools/conf.d/resume && update-initramfs -u -k all && update-grub"
echo "--> 9. VERIFYING PAYLOAD INTEGRITY..."
if sudo chroot "$TARGET" sh -c "lsinitramfs /boot/initrd.img-* | grep -q 'boot.key'"; then
echo " [SUCCESS] Verified: boot.key mapped perfectly inside the boot RAM disk image!"
else
echo " [CRITICAL FAIL] key asset dropped out of initrd compile path."
exit 1
fi
echo "--> 10. Cleanly unlocking system devices..."
sudo umount -R "$TARGET"
# We leave the device mapping as-is since the live environment is tracking it.
echo "======================================================="
echo " VICTORY: Script fully reconciled against device pins! "
echo "======================================================="
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment