v1.8.2 — fix silent stage-6 abort on Asahi Remix

Bug fix release. Recommended for anyone deploying onto Fedora Asahi Remix.

Fixed

luks-deploy.sh aborted silently in stage 6 on Fedora Asahi Remix (#2)

The script read the existing kernel command line with a grep "^GRUB_CMDLINE_LINUX=" inside a command substitution. Under set -euo pipefail, a /etc/default/grub with no such line makes grep exit 1, which killed the script — with no error message, because nothing had printed one yet. The run stopped after Updating /etc/default/grub... and went straight to the cleanup trap.

Stock Fedora Asahi Remix ships GRUB_CMDLINE_LINUX_DEFAULT and no GRUB_CMDLINE_LINUX line at all, so every such install was affected. The bug has been present since the initial commit and only fires on targets that use the _DEFAULT name.

A second failure was hidden behind it: the sed -i that added the unlock arguments silently matched nothing when the line was absent, so even a run that survived could have dropped rd.luks.uuid / rd.luks.name without a word.

Stage 6c now updates GRUB_CMDLINE_LINUX and GRUB_CMDLINE_LINUX_DEFAULT — whichever exist, both if both do — appends GRUB_CMDLINE_LINUX when the file defines neither, creates the file if it is missing, and refuses to leave the stage unless rd.luks.uuid is actually on disk. Rewrites go through awk so a stray & or | in an existing command line cannot corrupt the replacement, and the file is written in place so its inode, mode, owner and SELinux label survive.

post-encryption-setup.sh reported a splash restore that never happened

Its splash-restore sed only matched GRUB_CMDLINE_LINUX=", so on Asahi it changed nothing and still printed [ok] — sed exits 0 when it matches nothing. It now matches either variable and verifies the tokens landed before reporting success.

Recovering an interrupted run

If a deployment stopped at this point, no data is at risk: the root partition is already encrypted and /etc/crypttab and /etc/fstab are already correct. Re-run luks-deploy.sh on the same target — it detects the existing LUKS container and offers config-only mode, which redoes every configuration step idempotently without touching the data.

Testing

Stage 6c was tested against 10 shapes of /etc/default/grub: Asahi _DEFAULT-only, plain Fedora, both variables, neither, single-quoted, unquoted, values containing sed metacharacters, commented-out lines, a missing file, and duplicate definitions — plus an idempotent second run.

Thanks to @Larsvanzijl for the report and a diagnostic bundle complete enough to find this from.