Skip to content
This repository has been archived by the owner on Sep 12, 2023. It is now read-only.

Commit

Permalink
Browse files Browse the repository at this point in the history
Write bash variables to lower case
  • Loading branch information
@duxsco
duxsco committed May 7, 2022
1 parent cb220be commit 7b86017
Show file tree
Hide file tree
Showing 5 changed files with 233 additions and 233 deletions.
12 changes: 6 additions & 6 deletions bin/btrfs-scrub.sh
View file
Expand Up @@ -2,15 +2,15 @@

# Credits: https://github.com/kdave/btrfsmaintenance

while read -r MOUNTPOINT; do
while read -r mountpoint; do

if mountpoint --quiet "${MOUNTPOINT}" && \
! grep -q -i "^status:[[:space:]]*running$" < <(btrfs scrub status "${MOUNTPOINT}") && \
if mountpoint --quiet "${mountpoint}" && \
! grep -q -i "^status:[[:space:]]*running$" < <(btrfs scrub status "${mountpoint}") && \
{
! grep -q -i "^scrub started:" < <(btrfs scrub status "${MOUNTPOINT}") || \
[[ $(date -u -d "$(TZ=UTC btrfs scrub status "${MOUNTPOINT}" | grep -Poi "^scrub started:[[:space:]]*\K.*")" "+%s") -lt $(date -u -d "-28 days" "+%s") ]]
! grep -q -i "^scrub started:" < <(btrfs scrub status "${mountpoint}") || \
[[ $(date -u -d "$(TZ=UTC btrfs scrub status "${mountpoint}" | grep -Poi "^scrub started:[[:space:]]*\K.*")" "+%s") -lt $(date -u -d "-28 days" "+%s") ]]
}
then
btrfs scrub start -c3 "${MOUNTPOINT}"
btrfs scrub start -c3 "${mountpoint}"
fi
done < <(sort -u -k1,1 /etc/fstab | awk '$1 ~ /^UUID=/ && $3 == "btrfs" && $4 !~ /noauto/ {print $2}')
178 changes: 89 additions & 89 deletions bin/disk.sh
View file
Expand Up @@ -2,7 +2,7 @@

# Prevent tainting variables via environment
# See: https://gist.github.com/duxsco/fad211d5828e09d0391f018834f955c9
unset ALPHABET BOOT_PARTITION BOOT_PASSWORD BTRFS_RAID DISK DISKS INDEX KEYFILE MASTER_PASSWORD PARTITION PBKDF RAID RESCUE_PARTITION RESCUE_PASSWORD SWAP_PARTITION SWAP_SIZE SYSTEM_SIZE
unset alphabet boot_partition boot_password btrfs_raid disk disks index keyfile master_password partition pbkdf raid rescue_partition rescue_password swap_partition swap_size system_size

function help() {
cat <<EOF
Expand All @@ -27,160 +27,160 @@ EOF
}

function getPartitions() {
for DISK in "${DISKS[@]}"; do
ls "${DISK}"*"$1"
for disk in "${disks[@]}"; do
ls "${disk}"*"$1"
done | xargs
}

function getMapperPartitions() {
for DISK in "${DISKS[@]}"; do
ls "${DISK/\/dev\//\/dev\/mapper\/}"*"$1"
for disk in "${disks[@]}"; do
ls "${disk/\/dev\//\/dev\/mapper\/}"*"$1"
done | xargs
}

function setRaid() {
if [[ -z ${RAID} ]]; then
RAID="$1"
if [[ -z ${raid} ]]; then
raid="$1"
else
help
exit 1
fi
}

EFI_SYSTEM_PARTITION_SIZE="260"
BOOT_PARTITION_SIZE="512"
RESCUE_PARTITION_SIZE="2048"
efi_system_partition_size="260"
boot_partition_size="512"
rescue_partition_size="2048"

# shellcheck disable=SC2207
while getopts 56b:d:e:f:i:m:r:s:th opt; do
case $opt in
5) setRaid 5;;
6) setRaid 6;;
b) BOOT_PASSWORD="$OPTARG";;
d) DISKS=( $(xargs <<<"$OPTARG" | tr ' ' '\n' | sort | xargs) );;
e) EFI_SYSTEM_PARTITION_SIZE="$OPTARG";;
f) BOOT_PARTITION_SIZE="$OPTARG";;
i) RESCUE_PARTITION_SIZE="$OPTARG";;
m) MASTER_PASSWORD="$OPTARG";;
r) RESCUE_PASSWORD="$OPTARG";;
s) SWAP_SIZE="$((OPTARG * 1024))";;
b) boot_password="$OPTARG";;
d) disks=( $(xargs <<<"$OPTARG" | tr ' ' '\n' | sort | xargs) );;
e) efi_system_partition_size="$OPTARG";;
f) boot_partition_size="$OPTARG";;
i) rescue_partition_size="$OPTARG";;
m) master_password="$OPTARG";;
r) rescue_password="$OPTARG";;
s) swap_size="$((OPTARG * 1024))";;
t) setRaid 10;;
h) help; exit 0;;
?) help; exit 1;;
esac
done

# shellcheck disable=SC2068
if { [[ -n ${RAID} ]] && [[ ${RAID} -eq 5 ]] && [[ ${#DISKS[@]} -lt 3 ]]; } || \
{ [[ -n ${RAID} ]] && [[ ${RAID} -eq 6 ]] && [[ ${#DISKS[@]} -lt 4 ]]; } || \
{ [[ -n ${RAID} ]] && [[ ${RAID} -eq 10 ]] && [[ ${#DISKS[@]} -lt 4 ]]; } || \
{ [[ -n ${RAID} ]] && [[ ${RAID} -eq 10 ]] && [[ $((${#DISKS[@]}%2)) -ne 0 ]]; } || \
[[ -z ${BOOT_PASSWORD} ]] || [[ ${#DISKS[@]} -eq 0 ]] || [[ -z ${MASTER_PASSWORD} ]] || \
[[ -z ${RESCUE_PASSWORD} ]] || [[ -z ${SWAP_SIZE} ]] || ! ls ${DISKS[@]} >/dev/null 2>&1; then
if { [[ -n ${raid} ]] && [[ ${raid} -eq 5 ]] && [[ ${#disks[@]} -lt 3 ]]; } || \
{ [[ -n ${raid} ]] && [[ ${raid} -eq 6 ]] && [[ ${#disks[@]} -lt 4 ]]; } || \
{ [[ -n ${raid} ]] && [[ ${raid} -eq 10 ]] && [[ ${#disks[@]} -lt 4 ]]; } || \
{ [[ -n ${raid} ]] && [[ ${raid} -eq 10 ]] && [[ $((${#disks[@]}%2)) -ne 0 ]]; } || \
[[ -z ${boot_password} ]] || [[ ${#disks[@]} -eq 0 ]] || [[ -z ${master_password} ]] || \
[[ -z ${rescue_password} ]] || [[ -z ${swap_size} ]] || ! ls ${disks[@]} >/dev/null 2>&1; then
help
exit 1
fi

case ${#DISKS[@]} in
1) BTRFS_RAID="single";;
2) BTRFS_RAID="raid1";;
3) BTRFS_RAID="raid1c3";;
*) BTRFS_RAID="raid1c4";;
case ${#disks[@]} in
1) btrfs_raid="single";;
2) btrfs_raid="raid1";;
3) btrfs_raid="raid1c3";;
*) btrfs_raid="raid1c4";;
esac

# create keyfile
KEYFILE="$(umask 0377 && mktemp)"
dd bs=512 count=16384 iflag=fullblock if=/dev/random of="${KEYFILE}"
keyfile="$(umask 0377 && mktemp)"
dd bs=512 count=16384 iflag=fullblock if=/dev/random of="${keyfile}"

# partition
for DISK in "${DISKS[@]}"; do
for disk in "${disks[@]}"; do

if [ $((512*$(<"/sys/class/block/${DISK##*\/}/size"))) -gt 536870912000 ]; then
SYSTEM_SIZE="-5119"
if [ $((512*$(<"/sys/class/block/${disk##*\/}/size"))) -gt 536870912000 ]; then
system_size="-5119"
else
SYSTEM_SIZE="99%"
system_size="99%"
fi

parted --align optimal --script "${DISK}" \
parted --align optimal --script "${disk}" \
mklabel gpt \
unit MiB \
"mkpart 'esp3141592653part' 1 $((1 + EFI_SYSTEM_PARTITION_SIZE))" \
mkpart boot3141592653part $((1 + EFI_SYSTEM_PARTITION_SIZE)) $((1 + EFI_SYSTEM_PARTITION_SIZE + BOOT_PARTITION_SIZE)) \
mkpart rescue3141592653part $((1 + EFI_SYSTEM_PARTITION_SIZE + BOOT_PARTITION_SIZE)) $((1 + EFI_SYSTEM_PARTITION_SIZE + BOOT_PARTITION_SIZE + RESCUE_PARTITION_SIZE)) \
mkpart swap3141592653part $((1 + EFI_SYSTEM_PARTITION_SIZE + BOOT_PARTITION_SIZE + RESCUE_PARTITION_SIZE)) $((1 + EFI_SYSTEM_PARTITION_SIZE + BOOT_PARTITION_SIZE + RESCUE_PARTITION_SIZE + SWAP_SIZE)) \
"mkpart system3141592653part $((1 + EFI_SYSTEM_PARTITION_SIZE + BOOT_PARTITION_SIZE + RESCUE_PARTITION_SIZE + SWAP_SIZE)) ${SYSTEM_SIZE}" \
"mkpart 'esp3141592653part' 1 $((1 + efi_system_partition_size))" \
mkpart boot3141592653part $((1 + efi_system_partition_size)) $((1 + efi_system_partition_size + boot_partition_size)) \
mkpart rescue3141592653part $((1 + efi_system_partition_size + boot_partition_size)) $((1 + efi_system_partition_size + boot_partition_size + rescue_partition_size)) \
mkpart swap3141592653part $((1 + efi_system_partition_size + boot_partition_size + rescue_partition_size)) $((1 + efi_system_partition_size + boot_partition_size + rescue_partition_size + swap_size)) \
"mkpart system3141592653part $((1 + efi_system_partition_size + boot_partition_size + rescue_partition_size + swap_size)) ${system_size}" \
set 1 esp on
done

# boot partition
if [[ ${#DISKS[@]} -eq 1 ]]; then
BOOT_PARTITION="$(getPartitions 2)"
if [[ ${#disks[@]} -eq 1 ]]; then
boot_partition="$(getPartitions 2)"
else
BOOT_PARTITION="/dev/md0"
boot_partition="/dev/md0"
# shellcheck disable=SC2046
mdadm --create "${BOOT_PARTITION}" --name boot3141592653md --level=1 --raid-devices=${#DISKS[@]} --metadata=default $(getPartitions 2)
mdadm --create "${boot_partition}" --name boot3141592653md --level=1 --raid-devices=${#disks[@]} --metadata=default $(getPartitions 2)
fi

# rescue partition
if [[ ${#DISKS[@]} -eq 1 ]]; then
RESCUE_PARTITION="$(getPartitions 3)"
if [[ ${#disks[@]} -eq 1 ]]; then
rescue_partition="$(getPartitions 3)"
else
RESCUE_PARTITION="/dev/md1"
rescue_partition="/dev/md1"
# shellcheck disable=SC2046
mdadm --create "${RESCUE_PARTITION}" --name rescue3141592653md --level=1 --raid-devices=${#DISKS[@]} --metadata=default $(getPartitions 3)
mdadm --create "${rescue_partition}" --name rescue3141592653md --level=1 --raid-devices=${#disks[@]} --metadata=default $(getPartitions 3)
fi

# encrypting boot, swap and system partitions
PBKDF="--pbkdf pbkdf2"
INDEX=0
pbkdf="--pbkdf pbkdf2"
index=0
# shellcheck disable=SC2046
while read -r PARTITION; do
if [[ ${INDEX} -eq 2 ]]; then
unset PBKDF
while read -r partition; do
if [[ ${index} -eq 2 ]]; then
unset pbkdf
fi
# shellcheck disable=SC2086
cryptsetup --batch-mode luksFormat --hash sha512 --cipher aes-xts-plain64 --key-size 512 --key-file "${KEYFILE}" --use-random ${PBKDF:---pbkdf argon2id} "${PARTITION}"
if [[ ${INDEX} -eq 1 ]]; then
cryptsetup --batch-mode luksFormat --hash sha512 --cipher aes-xts-plain64 --key-size 512 --key-file "${keyfile}" --use-random ${pbkdf:---pbkdf argon2id} "${partition}"
if [[ ${index} -eq 1 ]]; then
# shellcheck disable=SC2086
echo -n "${RESCUE_PASSWORD}" | cryptsetup luksAddKey --hash sha512 --key-file "${KEYFILE}" ${PBKDF:---pbkdf argon2id} "${PARTITION}" -
echo -n "${rescue_password}" | cryptsetup luksAddKey --hash sha512 --key-file "${keyfile}" ${pbkdf:---pbkdf argon2id} "${partition}" -
else
# shellcheck disable=SC2086
echo -n "${MASTER_PASSWORD}" | cryptsetup luksAddKey --hash sha512 --key-file "${KEYFILE}" ${PBKDF:---pbkdf argon2id} "${PARTITION}" -
echo -n "${master_password}" | cryptsetup luksAddKey --hash sha512 --key-file "${keyfile}" ${pbkdf:---pbkdf argon2id} "${partition}" -
# shellcheck disable=SC2086
echo -n "${BOOT_PASSWORD}" | cryptsetup luksAddKey --hash sha512 --key-file "${KEYFILE}" ${PBKDF:---pbkdf argon2id} "${PARTITION}" -
echo -n "${boot_password}" | cryptsetup luksAddKey --hash sha512 --key-file "${keyfile}" ${pbkdf:---pbkdf argon2id} "${partition}" -
fi
cryptsetup luksOpen --key-file "${KEYFILE}" "${PARTITION}" "${PARTITION##*\/}"
INDEX=$((INDEX+1))
done < <(find "${BOOT_PARTITION}" "${RESCUE_PARTITION}" $(getPartitions 4) $(getPartitions 5))
cryptsetup luksOpen --key-file "${keyfile}" "${partition}" "${partition##*\/}"
index=$((index+1))
done < <(find "${boot_partition}" "${rescue_partition}" $(getPartitions 4) $(getPartitions 5))

# EFI system partition
ALPHABET=({A..Z})
alphabet=({A..Z})
tmpCount=0
# shellcheck disable=SC2046
while read -r PARTITION; do
mkfs.vfat -n "EFI${ALPHABET[tmpCount++]}" -F 32 "${PARTITION}"
while read -r partition; do
mkfs.vfat -n "EFI${alphabet[tmpCount++]}" -F 32 "${partition}"
done < <(find $(getPartitions 1))

# boot partition
mkfs.btrfs --checksum blake2 --label boot3141592653fs "/dev/mapper/${BOOT_PARTITION##*\/}"
mkfs.btrfs --checksum blake2 --label boot3141592653fs "/dev/mapper/${boot_partition##*\/}"

# rescue partition
mkfs.btrfs --checksum blake2 --label rescue3141592653fs "/dev/mapper/${RESCUE_PARTITION##*\/}"
mkfs.btrfs --checksum blake2 --label rescue3141592653fs "/dev/mapper/${rescue_partition##*\/}"

# swap partition
# shellcheck disable=SC2046
if [ ${#DISKS[@]} -eq 1 ]; then
SWAP_PARTITION="$(getMapperPartitions 4)"
if [ ${#disks[@]} -eq 1 ]; then
swap_partition="$(getMapperPartitions 4)"
else
SWAP_PARTITION="/dev/md2"
mdadm --create "${SWAP_PARTITION}" --name swap3141592653md --level="${RAID:-1}" --raid-devices=${#DISKS[@]} --metadata=default $(getMapperPartitions 4)
swap_partition="/dev/md2"
mdadm --create "${swap_partition}" --name swap3141592653md --level="${raid:-1}" --raid-devices=${#disks[@]} --metadata=default $(getMapperPartitions 4)
fi
mkswap --label swap3141592653fs "${SWAP_PARTITION}"
swapon "${SWAP_PARTITION}"
mkswap --label swap3141592653fs "${swap_partition}"
swapon "${swap_partition}"

# system partition
# shellcheck disable=SC2046
mkfs.btrfs --data "${BTRFS_RAID}" --metadata "${BTRFS_RAID}" --checksum blake2 --label system3141592653fs $(getMapperPartitions 5)
mkfs.btrfs --data "${btrfs_raid}" --metadata "${btrfs_raid}" --checksum blake2 --label system3141592653fs $(getMapperPartitions 5)

if [ ! -d /mnt/gentoo ]; then
mkdir /mnt/gentoo
Expand All @@ -197,38 +197,38 @@ umount /mnt/gentoo
# shellcheck disable=SC2046
mount -o noatime,subvol=@root $(getMapperPartitions 5 | awk '{print $1}') /mnt/gentoo
mkdir -p /mnt/gentoo/etc/gentoo-installation/keyfile/mnt/key
rsync -a "${KEYFILE}" /mnt/gentoo/etc/gentoo-installation/keyfile/mnt/key/key
rsync -a "${keyfile}" /mnt/gentoo/etc/gentoo-installation/keyfile/mnt/key/key
sync
cmp "${KEYFILE}" /mnt/gentoo/etc/gentoo-installation/keyfile/mnt/key/key
rm -f "${KEYFILE}"
cmp "${keyfile}" /mnt/gentoo/etc/gentoo-installation/keyfile/mnt/key/key
rm -f "${keyfile}"

useradd -m -s /bin/bash meh
chown meh: /mnt/gentoo /tmp/fetch_files.sh
chmod u+x /tmp/fetch_files.sh
su -l meh -c /tmp/fetch_files.sh
chown -R root: /mnt/gentoo

ALPHABET=({a..z})
ln -s "/dev/mapper/${BOOT_PARTITION##*\/}" /mnt/gentoo/mapperBoot
ln -s "/dev/mapper/${RESCUE_PARTITION##*\/}" /mnt/gentoo/mapperRescue
ln -s "${SWAP_PARTITION}" /mnt/gentoo/mapperSwap
alphabet=({a..z})
ln -s "/dev/mapper/${boot_partition##*\/}" /mnt/gentoo/mapperBoot
ln -s "/dev/mapper/${rescue_partition##*\/}" /mnt/gentoo/mapperRescue
ln -s "${swap_partition}" /mnt/gentoo/mapperSwap
ln -s "$(getMapperPartitions 5 | awk '{print $1}')" /mnt/gentoo/mapperSystem
tmpCount=0
# shellcheck disable=SC2046
while read -r PARTITION; do
ln -s "${PARTITION}" "/mnt/gentoo/devEfi${ALPHABET[tmpCount++]}"
while read -r partition; do
ln -s "${partition}" "/mnt/gentoo/devEfi${alphabet[tmpCount++]}"
done < <(find $(getPartitions 1))
ln -s "$(awk '{print $1}' <<<"${BOOT_PARTITION}")" "/mnt/gentoo/devBoot"
ln -s "$(awk '{print $1}' <<<"${RESCUE_PARTITION}")" "/mnt/gentoo/devRescue"
ln -s "$(awk '{print $1}' <<<"${boot_partition}")" "/mnt/gentoo/devBoot"
ln -s "$(awk '{print $1}' <<<"${rescue_partition}")" "/mnt/gentoo/devRescue"
tmpCount=0
# shellcheck disable=SC2046
while read -r PARTITION; do
ln -s "${PARTITION}" "/mnt/gentoo/devSwap${ALPHABET[tmpCount++]}"
while read -r partition; do
ln -s "${partition}" "/mnt/gentoo/devSwap${alphabet[tmpCount++]}"
done < <(find $(getPartitions 4))
tmpCount=0
# shellcheck disable=SC2046
while read -r PARTITION; do
ln -s "${PARTITION}" "/mnt/gentoo/devSystem${ALPHABET[tmpCount++]}"
while read -r partition; do
ln -s "${partition}" "/mnt/gentoo/devSystem${alphabet[tmpCount++]}"
done < <(find $(getPartitions 5))

echo $?
18 changes: 9 additions & 9 deletions bin/fetch_files.sh
View file
Expand Up @@ -2,11 +2,11 @@

# Prevent tainting variables via environment
# See: https://gist.github.com/duxsco/fad211d5828e09d0391f018834f955c9
unset CURRENT_STAGE3 TEMP_GPG_HOMEDIR
unset current_stage3 temp_gpg_homedir

function gpg_verify() {
grep -q "^GOODSIG TRUST_ULTIMATE VALIDSIG$" < <(
gpg --homedir "${TEMP_GPG_HOMEDIR}" --status-fd 1 --verify "$1" "$2" 2>/dev/null | \
gpg --homedir "${temp_gpg_homedir}" --status-fd 1 --verify "$1" "$2" 2>/dev/null | \
grep -Po "^\[GNUPG:\][[:space:]]+\K(GOODSIG|VALIDSIG|TRUST_ULTIMATE)(?=[[:space:]])" | \
sort | \
paste -d " " -s -
Expand All @@ -15,22 +15,22 @@ function gpg_verify() {

pushd /mnt/gentoo || (echo 'Failed to move to directory "/mnt/gentoo"! Aborting...' >&2; exit 1)

TEMP_GPG_HOMEDIR="$(mktemp -d)"
temp_gpg_homedir="$(mktemp -d)"

# prepare gnupg
if gpg --homedir "${TEMP_GPG_HOMEDIR}" \
if gpg --homedir "${temp_gpg_homedir}" \
--auto-key-locate clear,hkps://keys.gentoo.org,wkd \
--locate-external-keys infrastructure@gentoo.org releng@gentoo.org >/dev/null 2>&1
then
echo -e "13EBBDBEDE7A12775DFDB1BABB572E0E2D182910:6:\nDCD05B71EAB94199527F44ACDB6B8C1F96D8BF6D:6:" | \
gpg --homedir "${TEMP_GPG_HOMEDIR}" --import-ownertrust --quiet
gpg --homedir "${temp_gpg_homedir}" --import-ownertrust --quiet
else
echo "Failed to fetch GnuPG public keys! Aborting..." >&2
exit 1
fi

# fetch tarballs
if ! CURRENT_STAGE3="$(
if ! current_stage3="$(
grep -Po "^[0-9]{8}T[0-9]{6}Z/[^[:space:]]+" < <(
curl \
--fail --silent --show-error --location \
Expand All @@ -45,21 +45,21 @@ elif ! curl \
--fail --silent --show-error --location \
--proto '=https' --tlsv1.3 \
--remote-name-all \
"https://mirror.leaseweb.com/gentoo/releases/amd64/autobuilds/${CURRENT_STAGE3}{,.asc}" \
"https://mirror.leaseweb.com/gentoo/releases/amd64/autobuilds/${current_stage3}{,.asc}" \
"https://mirror.leaseweb.com/gentoo/snapshots/portage-latest.tar.xz{,.gpgsig}"
then
echo "Failed to fetch files! Aborting..." >&2
exit 1
fi

# gnupg verify
if ! gpg_verify "${CURRENT_STAGE3##*/}.asc" "${CURRENT_STAGE3##*/}" || \
if ! gpg_verify "${current_stage3##*/}.asc" "${current_stage3##*/}" || \
! gpg_verify portage-latest.tar.xz.gpgsig portage-latest.tar.xz
then
echo "Failed to verify GnuPG signature! Aborting..." >&2
exit 1
fi

gpgconf --homedir "${TEMP_GPG_HOMEDIR}" --kill all
gpgconf --homedir "${temp_gpg_homedir}" --kill all

popd || (echo 'Failed to move out of directory "/mnt/gentoo"! Aborting...' >&2; exit 1)

0 comments on commit 7b86017

Please sign in to comment.