43 lines
1.6 KiB
Python
43 lines
1.6 KiB
Python
|
"""The initramfs backend interface.
|
||
|
|
|
||
|
|
Encrypted remote-unlock images differ by init system: Arch/Manjaro use
|
||
|
|
mkinitcpio, Debian/Raspberry Pi OS use initramfs-tools. Each backend owns the
|
||
|
|
distro-specific bits (package set, crypttab syntax, initramfs generation,
|
||
|
|
bootloader cmdline, and how the Tor hook is baked in); the encryption flow
|
||
|
|
orchestrates them the same way for every distro.
|
||
|
|
"""
|
||
|
|
|
||
|
|
from abc import ABC, abstractmethod
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
from lim.image.plan import ImagePlan
|
||
|
|
from lim.image.session import ImageSession
|
||
|
|
|
||
|
|
|
||
|
|
class InitramfsBackend(ABC):
|
||
|
|
"""Distro-specific steps to build an encrypted, remote-unlockable image."""
|
||
|
|
|
||
|
|
@abstractmethod
|
||
|
|
def luks_package_collection(self) -> str:
|
||
|
|
"""Name of the package collection providing the LUKS/unlock stack."""
|
||
|
|
|
||
|
|
@abstractmethod
|
||
|
|
def install_authorized_key(self, root: Path, authorized_keys: Path) -> None:
|
||
|
|
"""Place the SSH public key where the initramfs dropbear reads it."""
|
||
|
|
|
||
|
|
@abstractmethod
|
||
|
|
def install_tor_unlock(self, plan: ImagePlan, root: Path) -> str:
|
||
|
|
"""Bake the Tor onion service into the initramfs; return the address."""
|
||
|
|
|
||
|
|
@abstractmethod
|
||
|
|
def register_encrypted_root(self, plan: ImagePlan, session: ImageSession, root: Path) -> None:
|
||
|
|
"""Write fstab and crypttab in the distro's syntax."""
|
||
|
|
|
||
|
|
@abstractmethod
|
||
|
|
def configure_initramfs(self, plan: ImagePlan, root: Path) -> None:
|
||
|
|
"""Configure the initramfs modules/hooks and (re)generate it."""
|
||
|
|
|
||
|
|
@abstractmethod
|
||
|
|
def configure_bootloader(self, plan: ImagePlan, session: ImageSession, root: Path) -> None:
|
||
|
|
"""Point the bootloader at the encrypted root with early networking."""
|