X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=fai%2Fconfig%2Fhooks%2Finstsoft.DEFAULT;h=5c7be4e777a920f327931cab7d82a57050eeb2dd;hb=137ffae7de84a51c4b438ccf2fb50f5571f522a6;hp=ab6e213617f02f65094b554d2f41e4a8da3b2c11;hpb=ce5290b5a6eee95cc59b5c1651d73a224c3d5bbd;p=automated-distro-installer

diff --git a/fai/config/hooks/instsoft.DEFAULT b/fai/config/hooks/instsoft.DEFAULT
index ab6e213..5c7be4e 100755
--- a/fai/config/hooks/instsoft.DEFAULT
+++ b/fai/config/hooks/instsoft.DEFAULT
@@ -1,8 +1,14 @@
 #!/bin/bash
 
-# exit for any vm which is not our test vm
-if ifclass VM && ! ifclass demohost; then
-    exit 0
+# These are things we can do before package_config packages get installed.
+
+# exit for any vm except demohost, or if we are doing a dirinstall
+if ifclass VM && ! ifclass demohost || ifclass VOL_BULLSEYE_BOOTSTRAP || [[ ! $FAI_ACTION || $FAI_ACTION = dirinstall ]]; then
+  exit 0
+fi
+
+if ifclass FSF; then
+  exit 0
 fi
 
 keyfile=/var/lib/fai/config/distro-install-common/luks/host-$HOSTNAME
@@ -13,33 +19,39 @@ cat <<'EOF'
 $(cat $keyfile)
 EOF
 EOFOUTER
-chmod +x $f
-
-
-crypt_dev=(/dev/mapper/crypt_dev_?da3)
-crypt_dev=${crypt_dev[0]}
-crypt_name=${crypt_dev##/dev/mapper/}
-dev=(/dev/?da3)
-dev=${dev[0]}
+chmod 700 $f
 
-dd if=$keyfile of=$crypt_dev
 
-f=$target/root/keyscript-manual
-cat >$f  <<'EOF'
-#!/bin/sh
-if ! [ -e /tmp/key ]; then
-    stty -echo
-    read pass
-    printf '%s' "$pass" > /tmp/key
+# for hosts which don't have these data volumes, copy the specific
+# files we need.
+if ifclass demohost; then
+  files=(/var/lib/fai/config/distro-install-common/luks/host-demohost)
+elif ifclass tp; then
+  files=(/var/lib/fai/config/distro-install-common/luks/host-tp)
+fi
+if [[ ${files[0]}  ]]; then
+  d=$target/q/root/luks
+  mkdir -p $d
+  chmod 700 $d
+  cp -p ${files[@]} $d
 fi
-cat /tmp/key
-EOF
-chmod +x $f
 
 
-if ifclass tp; then
-    d=$target/root/shadow
-    mkdir -p $d
-    ls -la /var/lib/fai/config/distro-install-common
-    cp /var/lib/fai/config/distro-install-common/traci{,-simple} $d
+#### This bit is duplicated in rootsshsync, except we skip
+#### update-initramfs and add $target
+####
+# We generally shouldn't need this, because we don't ssh in on the 1st
+# reboot since we initially embed the luks key, and with distro-begin,
+# we run rootsshsync around the same time as we remove it. However, it
+# could be helpful in case of problems.
+
+auth_dir=$target/etc/dropbear/initramfs/
+candidate=$(apt-cache policy dropbear-initramfs | awk '$1 == "Candidate:" { print $2 }' | head -n1 ||:)
+if [[ $candidate ]] && dpkg --compare-versions "$candidate" lt 2020.81-4; then
+  auth_dir=$target/etc/dropbear-initramfs
+fi
+auth_file=$auth_dir/authorized_keys
+mkdir -p $auth_dir
+if [[ ! -e $auth_file ]] || ! diff -q /root/.ssh/authorized_keys $auth_file; then
+  cp -p /root/.ssh/authorized_keys $auth_file
 fi