+ # parted will round up the disk size. Do -1 so we can have
+ # fully 1MiB unit partitions for easy resizing of the last partition.
+ # Otherwise we would pass in -0 for the end argument for the last partition.
+ #
+ # Note: parted print error output is expected. example:
+ # Error: /dev/vda: unrecognised disk label
+ disk_mib=$(( $(parted -m $dev unit MiB print | \
+ sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
+ root_end=$(( disk_mib - swap_mib - boot_mib / ${#boot_devs[@]} ))
+ swap_end=$(( root_end + swap_mib))
+
+ parted -s $dev mklabel gpt
+ # MiB because parted complains about alignment otherwise.
+ pcmd="parted -a optimal -s -- $dev"
+ $pcmd mkpart primary ext3 12MiB ${root_end}MiB
+ # without naming, systemd gives us misc errors like:
+ # dev-disk-by\x2dpartlabel-primary.device: Dev dev-disk-by\x2dpartlabel-primary.device appeared twice
+ $pcmd name $rootn root
+ # normally a swap is type "linux-swap", but this is encrypted swap. using that
+ # label will confuse systemd.
+ $pcmd mkpart primary "" ${root_end}MiB ${swap_end}MiB
+ $pcmd name $swapn swap
+ $pcmd mkpart primary "" ${swap_end}MiB ${disk_mib}MiB
+ $pcmd name $bootn boot
+ # i only need a few k, but googling min size,
+ # I found someone saying that gparted required
+ # required at least 8 because of their hard drive cylinder size.
+ # And 8 is still very tiny.
+ $pcmd mkpart primary "ext2" 4MiB 12MiB
+ $pcmd name $grub_extn grubext
+ # gpt ubuntu cloud image uses ~4 mb for this partition. fai uses 1 MiB.
+ # so, I use 3, whatever.
+ # note: parted manual saying cheap flash media
+ # should to start at 4.
+ $pcmd mkpart primary "" 1MiB 4MiB
+ $pcmd name $bios_grubn biosgrub
+ $pcmd set $bios_grubn bios_grub on
+ $pcmd set $bootn boot on # generally not needed on modern systems
+ # the mkfs failed before on a vm, which prompted me to add
+ # sleep .1
+ # then it failed again on a physical machine
+ # with:
+ # Device /dev/disk/by-id/foo doesn't exist or access denied,
+ # so I added a wait until it existed.
+ # Then I added the mkfs.ext2, which claimed to succeed,
+ # but then couldn't be found upon reboot. In that case we didn't
+ # wait at all. So I've added a 3 second minimum wait.
+ sleep 3
+ secs=0
+ while [[ ! -e $(rootdev) ]] && (( secs < 10 )); do
+ sleep 1
+ secs=$((secs +1))
+ done
+ # Holds just a single file, rarely written, so
+ # use ext2, like was often used for the /boot partition.
+ # This exists because grub can only persist data to a non-cow fs.
+ # And we use persisting a var in grub to do a one time boot.
+ # We could pass the data on the kernel command line and persist it
+ # to grubenv after booting, but that relies on the boot always succeeding.
+ # This is just a bit more robust, and it could work for booting
+ # into ipxe which can't persist data, if we ever got that working.
+ mkfs.ext2 $(grub_extdev)
+ # when we move to newer than trisquel 8, we can remove
+ # --type luks1. We can also check on cryptsetup --help | less /compil
+ # to see about the other settings. Default in debian 9 is luks2.
+ # You can convert from luks2 to luks 1 by adding a temporary key:
+ # cryptsetup luksAddKey --pbkdf pbkdf2
+ # then remove the new format keys with cryptsetup luksRemoveKey
+ # then cryptsetup convert DEV --type luks1, then readd old keys and remove temp.
+ yes YES | cryptsetup luksFormat $(rootdev) $luks_file \
+ --type luks1 -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]]
+ yes "$lukspw" | \
+ cryptsetup luksAddKey --key-file $luks_file \
+ $(rootdev) || [[ $? == 141 ]]
+ # background: Keyfile and password are treated just
+ # like 2 ways to input a passphrase, so we don't actually need to have
+ # different contents of keyfile and passphrase, but it makes some
+ # security sense to a really big randomly generated passphrase
+ # as much as possible, so we have both.
+ #
+ # This would remove the keyfile.