c86fcf3580
Split the mkinitcpio-only remote-LUKS-unlock path into an InitramfsBackend ABC with a get_backend() dispatch, and add the initramfs-tools backend for Debian / Raspberry Pi OS. - base.py: six-step backend contract; encryption.py becomes a thin, distro-neutral sequencer (get_backend by distribution). - initramfs_tools.py: crypttab `none luks,initramfs`, cmdline rewritten to root=/dev/mapper + ip=::::host:eth0:dhcp, dropbear-initramfs authorized_keys, update-initramfs -k all (no build-host uname leak). - shipped hooks (configuration/initramfs-tools/*): single-hop non-anonymous onion, libnss DNS baking, sed-not-source DHCP, kill-tor-before-pivot. - shared offline onion keygen in keygen.py; tor.py removed (logic moved to mkinitcpio.py). - raspios added to the apt distro family (session.py, raspberry.py). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
20 lines
611 B
Bash
20 lines
611 B
Bash
#!/bin/sh
|
|
# initramfs-tools cleanup hook: stop Tor before the pivot to the real root.
|
|
# Installed to /etc/initramfs-tools/scripts/init-bottom/tor by lim.
|
|
# Nothing from the initramfs may keep running once run-init replaces it.
|
|
PREREQ=""
|
|
prereqs() { echo "$PREREQ"; }
|
|
case "$1" in
|
|
prereqs) prereqs; exit 0 ;;
|
|
esac
|
|
|
|
# pidof/killall may be absent; scan /proc for the tor binary (no extra tools).
|
|
for pid in $(ls /proc 2>/dev/null); do
|
|
case "$pid" in
|
|
*[!0-9]*) continue ;;
|
|
esac
|
|
[ "$(readlink "/proc/$pid/exe" 2>/dev/null)" = "/usr/bin/tor" ] \
|
|
&& kill "$pid" 2>/dev/null
|
|
done
|
|
exit 0
|