fix: quote ISO kernel args for GRUB

Use GRUB quoting function to the kernel args passed to Talos.

This fixes passing `${variable}` to `talos.config=` kernel argument.

Also fix a problem with `ONBUILD` being exected for `imager` image.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
(cherry picked from commit 2c55550)

Dockerfile

@@ -662,7 +662,7 @@ FROM install-artifacts-${INSTALLER_ARCH} AS install-artifacts
 COPY --from=pkg-grub / /
 COPY --from=unicode-pf2 /usr/share/grub/unicode.pf2 /usr/share/grub/unicode.pf2
 
-FROM alpine:3.17.2 AS installer
+FROM alpine:3.17.2 AS installer-image
 RUN apk add --no-cache --update --no-scripts \
     bash \
     cpio \
@@ -686,6 +686,8 @@ ENV VERSION ${TAG}
 LABEL "alpha.talos.dev/version"="${VERSION}"
 LABEL org.opencontainers.image.source https://github.com/siderolabs/talos
 ENTRYPOINT ["/bin/installer"]
+
+FROM installer-image AS installer
 ONBUILD RUN apk add --no-cache --update \
     cpio \
     squashfs-tools \
@@ -706,7 +708,7 @@ ONBUILD RUN find /rootfs \
     && rm -rf /initramfs
 ONBUILD WORKDIR /
 
-FROM installer AS imager
+FROM installer-image AS imager
 
 # The test target performs tests on the source code.
 

cmd/installer/cmd/grub.iso.cfg

@@ -9,13 +9,13 @@ terminal_output console
 menuentry "Talos ISO" {
 	set gfxmode=auto
 	set gfxpayload=text
-	linux /boot/vmlinuz {{ .Cmdline }}
+	linux /boot/vmlinuz {{ quote .Cmdline }}
 	initrd /boot/initramfs.xz
 }
 
 menuentry "Reset Talos installation" {
 	set gfxmode=auto
 	set gfxpayload=text
-	linux /boot/vmlinuz {{ .Cmdline }} talos.experimental.wipe=system
+	linux /boot/vmlinuz {{ quote .Cmdline }} talos.experimental.wipe=system
 	initrd /boot/initramfs.xz
 }

cmd/installer/cmd/iso.go

@@ -20,6 +20,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/siderolabs/talos/cmd/installer/pkg"
+	"github.com/siderolabs/talos/internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub"
 	"github.com/siderolabs/talos/internal/app/machined/pkg/runtime/v1alpha1/platform/metal"
 	"github.com/siderolabs/talos/pkg/machinery/constants"
 	"github.com/siderolabs/talos/pkg/machinery/kernel"
@@ -111,7 +112,11 @@ func runISOCmd() error {
 
 	var grubCfg bytes.Buffer
 
-	tmpl, err := template.New("grub.cfg").Parse(string(isoGrubCfg))
+	tmpl, err := template.New("grub.cfg").
+		Funcs(template.FuncMap{
+			"quote": grub.Quote,
+		}).
+		Parse(string(isoGrubCfg))
 	if err != nil {
 		return err
 	}

internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/decode.go

@@ -122,7 +122,7 @@ func parseEntries(conf []byte) (map[BootLabel]MenuEntry, error) {
 }
 
 func parseConfBlock(block []byte) (linux, cmdline, initrd string, err error) {
-	block = []byte(unquote(string(block)))
+	block = []byte(Unquote(string(block)))
 
 	linuxMatches := linuxRegex.FindAllSubmatch(block, -1)
 	if len(linuxMatches) != 1 {

internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/encode.go

@@ -68,7 +68,7 @@ func (c *Config) Encode(wr io.Writer) error {
 	}
 
 	t := template.Must(template.New("grub").Funcs(template.FuncMap{
-		"quote": quote,
+		"quote": Quote,
 	}).Parse(confTemplate))
 
 	return t.Execute(wr, c)

internal/app/machined/pkg/runtime/v1alpha1/bootloader/grub/quote.go

@@ -8,19 +8,19 @@ import (
 	"strings"
 )
 
-// quote according to (incomplete) GRUB quoting rules.
+// Quote according to (incomplete) GRUB quoting rules.
 //
 // See https://www.gnu.org/software/grub/manual/grub/html_node/Shell_002dlike-scripting.html
-func quote(s string) string {
+func Quote(s string) string {
 	for _, c := range `\{}&$|;<>"` {
 		s = strings.ReplaceAll(s, string(c), `\`+string(c))
 	}
 
 	return s
 }
 
-// unquote according to (incomplete) GRUB quoting rules.
-func unquote(s string) string {
+// Unquote according to (incomplete) GRUB quoting rules.
+func Unquote(s string) string {
 	for _, c := range `{}&$|;<>\"` {
 		s = strings.ReplaceAll(s, `\`+string(c), string(c))
 	}