ca66b7ef78
Support distributions that ship a full .img (Raspberry Pi OS, moode, RetroPie, Manjaro ARM) rather than a rootfs tarball, by loop-mounting the image and copying its boot + root partitions into a fresh LUKS container. - distributions.yml/catalog.py/choosers.py: raspios catalog (lite64/desktop64/ lite32 via the stable _latest redirects) + choose_raspios. - plan.py: source_url override so a _latest redirect downloads under an .img.xz name that decompress_command recognises. - transfer.py: transfer_disk_image (loop-mount -> repartition -> LUKS -> rsync copy with progress, cp fallback -> fix boot fstab); transfer_image gains interactive= and routes encrypted non-arch images here; download_image gains force_prompt. - loopimg.py: losetup attach/detach/partition helper. - fsutil.drop_fstab_mount + register_encrypted_root: replace a stock image's existing / fstab line instead of colliding with it. - encryption.configure_encryption returns the onion address. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
1.5 KiB
Python
43 lines
1.5 KiB
Python
"""Remote-unlockable LUKS boot configuration.
|
|
|
|
Distro-agnostic orchestration; the init-system-specific steps live in the
|
|
initramfs backends (mkinitcpio for Arch/Manjaro, initramfs-tools for
|
|
Debian/Raspberry Pi OS). See lim/image/initramfs/.
|
|
"""
|
|
|
|
from pathlib import Path
|
|
|
|
from lim import packages, ui
|
|
from lim.image.initramfs import get_backend
|
|
from lim.image.plan import ImagePlan
|
|
from lim.image.session import ImageSession, install_packages
|
|
|
|
|
|
def configure_encryption(
|
|
plan: ImagePlan, session: ImageSession, authorized_keys: Path
|
|
) -> str | None:
|
|
"""Configure the remote-unlock LUKS stack; return the onion address, if any."""
|
|
root = session.root_mount_path
|
|
backend = get_backend(plan.distribution)
|
|
ui.info("Setup encryption...")
|
|
ui.info("Installing neccessary software...")
|
|
install_packages(
|
|
plan.distribution,
|
|
root,
|
|
" ".join(packages.get_packages(backend.luks_package_collection())),
|
|
)
|
|
|
|
backend.install_authorized_key(root, authorized_keys)
|
|
|
|
onion_address = None
|
|
if plan.tor_unlock:
|
|
# Hook files and onion keys must exist before the initramfs is baked.
|
|
onion_address = backend.install_tor_unlock(plan, root)
|
|
|
|
# crypttab must be written before the initramfs is (re)generated so the
|
|
# Debian cryptsetup hook can bake the mapping in.
|
|
backend.register_encrypted_root(plan, session, root)
|
|
backend.configure_initramfs(plan, root)
|
|
backend.configure_bootloader(plan, session, root)
|
|
return onion_address
|