calamares

gistfile1.txt

# SPDX-FileCopyrightText: no
# SPDX-License-Identifier: CC0-1.0
# /etc/calamares/modules/shellprocess/shellprocess@luksfix.conf
---
id: luksfix
dontChroot: false
timeout: 90
name: "Configuring single-passphrase boot bypass..."

script:
  # 1. Write the clean, standalone script file using a literal text block
  - |
    cat << 'EOF' > /tmp/luks-bypass.sh
    #!/bin/bash
    set -x
    set -e
    
    mkdir -p /boot/cryptsetup-keys.d
    dd bs=512 count=8 if=/dev/urandom of=/boot/cryptsetup-keys.d/root.key iflag=fullblock
    chmod 400 /boot/cryptsetup-keys.d/root.key
    echo "# Automatically generated by Mobian FDE Fix" > /etc/crypttab

    ls /dev/mapper/luks-* 2>/dev/null | while read -r mapper_path; do
        MAP_NAME=$(basename "$mapper_path")
        UUID_HEX=$(cryptsetup luksUUID "$mapper_path" 2>/dev/null || echo "")
        if [ -n "$UUID_HEX" ]; then
            PHYS_PART=$(blkid -U "$UUID_HEX" 2>/dev/null || echo "")
            if [ -n "$PHYS_PART" ]; then
                echo "Enrolling keyfile into LUKS slot for: $PHYS_PART"
                echo -n "$PASSPHRASE_TOKEN" | cryptsetup luksAddKey "$PHYS_PART" /boot/cryptsetup-keys.d/root.key
                echo "${MAP_NAME} UUID=${UUID_HEX} /boot/cryptsetup-keys.d/root.key luks,initramfs" >> /etc/crypttab
            fi
        fi
    done
    
    mkdir -p /etc/cryptsetup-initramfs
    echo 'KEYFILE_PATTERN="/boot/cryptsetup-keys.d/*.key"' >> /etc/cryptsetup-initramfs/conf-hook
    EOF

  # 2. Make the script executable
  - "chmod +x /tmp/luks-bypass.sh"

  # 3. Execute the script while safely injecting the Calamares password variable from the host
  - "PASSPHRASE_TOKEN=${PASSWORD} /tmp/luks-bypass.sh"

  # 4. Clean up the temporary script file
  - "rm -f /tmp/luks-bypass.sh"

gistfile2.txt

# /etc/calamares/modules/shellprocess@cryptfix.conf
---
dontChroot: true   # Keep this TRUE so the script can map the host's real disk layout
timeout: 30
script:
  - description: "Dynamically mapping host LUKS parameters to the target configuration..."
    command: |
      # 1. Locate where Calamares has currently mounted the target root image on the live host
      TARGET_MOUNT=$(mount | grep 'calamares-root' | grep 'on /tmp/' | head -n 1 | awk '{print $3}')
      
      # Validate that a mount target was actually discovered before continuing
      if [ -z "$TARGET_MOUNT" ]; then
          echo "ERROR: Calamares target mount point could not be detected!"
          exit 1
      fi

      # 2. Extract the underlying mapper device node handling the filesystem
      TARGET_DEV=$(mount | grep "on ${TARGET_MOUNT}" | awk '{print $1}')

      # 3. Retrieve the matching true physical LUKS disk partition UUID
      REAL_UUID=$(blkid -o value -s UUID ${TARGET_DEV})
      
      if [ -z "$REAL_UUID" ]; then
          echo "ERROR: Failed to resolve the underlying LUKS container UUID!"
          exit 1
      fi

      # 4. Mount target is on the host, so write directly to its absolute path offset
      echo "cryptroot UUID=${REAL_UUID} none luks,initramfs" > "${TARGET_MOUNT}/etc/crypttab"
      
      # Output confirmation directly to Calamares logs for clean debugging
      echo "SUCCESS: Wrote cryptroot entry with UUID=${REAL_UUID} directly to ${TARGET_MOUNT}/etc/crypttab"

#!/usr/bin/env bash
set -e

# Dynamically pull the exact UUIDs from your real disk layout
REAL_ROOT_UUID=$(blkid -s UUID -o value /dev/vda2)
REAL_SWAP_UUID=$(blkid -s UUID -o value /dev/vda3)
REAL_EFI_UUID=$(blkid -s UUID -o value /dev/vda1)

TARGET="/mnt/target_clean"
MAP_NAME="luks-${REAL_ROOT_UUID}"

echo "======================================================="
echo " EXECUTION PASS: ALIGNING SCHEMATICS TO REAL HARDWARE  "
echo "======================================================="
echo "Found Active Root UUID: ${REAL_ROOT_UUID}"
echo "Found Active Swap UUID: ${REAL_SWAP_UUID}"

echo "--> 1. Freeing active partition locks..."
sudo swapoff -a 2>/dev/null || true
if mountpoint -q "$TARGET"; then
    sudo umount -R "$TARGET" 2>/dev/null || true
fi

echo "--> 2. Ensuring the real system device mapping is mounted..."
# If Calamares already opened it under the real name, this safely uses it
if [ ! -b "/dev/mapper/${MAP_NAME}" ]; then
    sudo cryptsetup open /dev/vda2 "$MAP_NAME"
fi

echo "--> 3. Structuring clean target virtual environments..."
sudo mkdir -p "$TARGET"
sudo mount "/dev/mapper/${MAP_NAME}" "$TARGET"
sudo mkdir -p "$TARGET/boot/efi"
sudo mount /dev/vda1 "$TARGET/boot/efi"

# Bind pseudo-filesystems for chroot commands
for dir in dev proc sys dev/pts; do
    sudo mkdir -p "$TARGET/$dir"
    sudo mount --bind "/$dir" "$TARGET/$dir"
done

echo "--> 4. Depositing high-entropy keyfile..."
sudo mkdir -p "$TARGET/etc/cryptsetup-initramfs"
sudo dd bs=512 count=4 if=/dev/urandom of="$TARGET/etc/cryptsetup-initramfs/boot.key" status=none
sudo chmod 400 "$TARGET/etc/cryptsetup-initramfs/boot.key"

echo "--> 5. Enrolling key into LUKS keyslot..."
# This will prompt you for your master user passphrase once
sudo cryptsetup luksAddKey --key-slot 3 /dev/vda2 "$TARGET/etc/cryptsetup-initramfs/boot.key"

echo "--> 6. Generating systemic file tables using dynamic identifiers..."
sudo tee "$TARGET/etc/crypttab" << EOF
${MAP_NAME}  UUID=${REAL_ROOT_UUID}  /etc/cryptsetup-initramfs/boot.key  luks,initramfs,keyslot=3
cryptswap         UUID=${REAL_SWAP_UUID}  /dev/urandom                        swap,cipher=aes-xts-plain64,size=256,noauto
EOF

sudo tee "$TARGET/etc/fstab" << EOF
UUID=${REAL_EFI_UUID}                            /boot/efi      vfat    defaults   0 2
/dev/mapper/${MAP_NAME} /              ext4    defaults   0 1
/dev/mapper/cryptswap                      none           swap    sw,x-systemd.makefs 0 0
EOF

echo "--> 7. Structuring fixed initramfs hook variables..."
sudo tee "$TARGET/etc/cryptsetup-initramfs/conf-hook" << EOF
KEYFILE_PATTERN="/etc/cryptsetup-initramfs/boot.key"
UMASK=0077
EOF

sudo mkdir -p "$TARGET/etc/initramfs-tools/hooks"
sudo tee "$TARGET/etc/initramfs-tools/hooks/embed_keyfile" << 'EOF'
#!/bin/sh
PREREQ=""
prereqs() { echo "$PREREQ"; }
case $1 in prereqs) prereqs; exit 0;; esac

. /usr/share/initramfs-tools/hook-functions

if [ -f /etc/cryptsetup-initramfs/boot.key ]; then
    mkdir -p "$DESTDIR/etc/cryptsetup-initramfs"
    cp -p /etc/cryptsetup-initramfs/boot.key "$DESTDIR/etc/cryptsetup-initramfs/boot.key"
fi
EOF
sudo chmod +x "$TARGET/etc/initramfs-tools/hooks/embed_keyfile"

echo "--> 8. Compiling new initial ramdisk..."
sudo chroot "$TARGET" sh -c "echo 'RESUME=none' > /etc/initramfs-tools/conf.d/resume && update-initramfs -u -k all && update-grub"

echo "--> 9. VERIFYING PAYLOAD INTEGRITY..."
if sudo chroot "$TARGET" sh -c "lsinitramfs /boot/initrd.img-* | grep -q 'boot.key'"; then
    echo "   [SUCCESS] Verified: boot.key mapped perfectly inside the boot RAM disk image!"
else
    echo "   [CRITICAL FAIL] key asset dropped out of initrd compile path."
    exit 1
fi

echo "--> 10. Cleanly unlocking system devices..."
sudo umount -R "$TARGET"
# We leave the device mapping as-is since the live environment is tracking it.

echo "======================================================="
echo " VICTORY: Script fully reconciled against device pins!  "
echo "======================================================="