#!/bin/sh
# finish-install of partman-scubed3 (the target is installed, apt works):
# 1. scubed3 in the installed system: the package scubed3 if apt can find
#    it, otherwise the programs and initramfs-tools scripts of the installer
#    (in /usr/local/sbin and /etc/initramfs-tools)
# 2. /etc/scubed3.conf (the salt, the iterations, the paranoia level)
# 3. root on scubed3 (the partition root): cryptsetup and
#    cryptsetup-initramfs (CRYPTSETUP=y, and its askpass: the boot
#    passphrase is asked as for an encrypted disk), the key store
#    /etc/scubed3.keys, /etc/scubed3/initramfs.conf (BASE, OPTIONS),
#    update-initramfs; the other file systems on scubed3 (/home, ...) are
#    partitions of the boot passphrase, the initramfs opens their LUKS
#    volumes, /etc/fstab mounts them
# 4. the blocks lent to a partition are given back: the partition gets its
#    own size again, the garbage collector removes the extra blocks while
#    the installed system writes (scubed3ctl p shows "shrinking")
# 5. a note: keep a copy of /etc/scubed3.conf, the options and the key
#    store

. /usr/share/debconf/confmodule

STATE=/var/lib/partman/scubed3
SHARE=/usr/share/scubed3

[ -f $STATE/base ] || exit 0
[ -S /run/scubed3/control ] || exit 0

ctl () {
	log-output -t scubed3-finish scubed3ctl -q -YYY -C $STATE/scubed3.conf "$@"
}

failed () {
	db_subst partman-scubed3/install_failed WHAT "$1"
	db_fset partman-scubed3/install_failed seen false
	db_input critical partman-scubed3/install_failed
	db_go || true
}

# the stable name of the base device
stable_name () {
	local real l
	real=$(readlink -f "$1")
	for l in /dev/disk/by-partuuid/* /dev/disk/by-id/* /dev/disk/by-path/*; do
		[ -e "$l" ] || continue
		if [ "$(readlink -f $l)" = "$real" ]; then
			echo $l
			return 0
		fi
	done
	echo "$1"
}

root=
prefix=scubed3-
grep -q '^luks_prefix=' $STATE/scubed3.conf && prefix=$(sed -n 's/^luks_prefix=//p' $STATE/scubed3.conf | head -n 1)
grep -q "^/dev/mapper/${prefix}root /target " /proc/mounts && root=root

# 1. scubed3
if ! apt-install scubed3; then
	logger -t scubed3-finish "no package scubed3, the programs of the installer are copied"
	mkdir -p /target/usr/local/sbin /target/etc/initramfs-tools/hooks \
		/target/etc/initramfs-tools/scripts/local-top
	cp /usr/sbin/scubed3 /usr/sbin/scubed3ctl /usr/sbin/keystorectl \
		/target/usr/local/sbin/
	cp $SHARE/initramfs-tools/hooks/scubed3 /target/etc/initramfs-tools/hooks/
	cp $SHARE/initramfs-tools/scripts/local-top/scubed3 \
		/target/etc/initramfs-tools/scripts/local-top/
	chmod 755 /target/usr/local/sbin/scubed3 /target/usr/local/sbin/scubed3ctl \
		/target/usr/local/sbin/keystorectl \
		/target/etc/initramfs-tools/hooks/scubed3 \
		/target/etc/initramfs-tools/scripts/local-top/scubed3
	# the libraries of the programs (libgcrypt is in every system)
	apt-install fuse3 || failed fuse3
fi

# 2. the configuration, the key store (random data without its
# passphrases)
cp $STATE/scubed3.conf /target/etc/scubed3.conf
chmod 644 /target/etc/scubed3.conf
if [ -f $STATE/scubed3.keys ]; then
	cp $STATE/scubed3.keys /target/etc/scubed3.keys
	chmod 600 /target/etc/scubed3.keys
fi

# 3. root on scubed3
if [ "$root" ]; then
	apt-install cryptsetup cryptsetup-initramfs || failed cryptsetup-initramfs
	# cryptsetup in the initramfs, also without an entry in /etc/crypttab
	hook=/target/etc/cryptsetup-initramfs/conf-hook
	mkdir -p ${hook%/*}
	if grep -q "^CRYPTSETUP=" $hook 2>/dev/null; then
		sed -i 's/^CRYPTSETUP=.*/CRYPTSETUP=y/' $hook
	else
		echo "CRYPTSETUP=y" >> $hook
	fi

	mkdir -p /target/etc/scubed3
	{
		echo "# /etc/scubed3/initramfs.conf: root on a scubed3 partition, made by"
		echo "# the debian-installer (see /usr/share/doc/scubed3 or the README of"
		echo "# contrib/initramfs-tools); KEEP OPTIONS THE SAME FOREVER; root is"
		echo "# the partition root of the key store /etc/scubed3.keys"
		echo "BASE=$(stable_name $(cat $STATE/base))"
		echo "OPTIONS=\"$(cat $STATE/options)\""
		echo "# the name in the question at boot, \"Please unlock disk NAME:\""
		echo "# (default: as the installer names an encrypted partition)"
		echo "#CRYPTTAB_NAME=$(basename $(readlink -f $(cat $STATE/base)))_crypt"
		echo "# passphrases without root before the boot goes on without it"
		echo "#TRIES=3"
	} > /target/etc/scubed3/initramfs.conf

	if ! log-output -t scubed3-finish in-target update-initramfs -u -k all; then
		failed update-initramfs
	fi
fi

# 4. give the lent blocks back
for p in $STATE/parts/*; do
	[ -f "$p/lent" ] || continue
	read n r < $p/lent
	if ctl -c "resize-internal ${p##*/} $n $r"; then
		rm -f $p/lent
	else
		failed "resize-internal ${p##*/} $n $r"
	fi
done

# 5. the note
db_subst partman-scubed3/final_note SALT "$(sed -n 's/^salt=//p' $STATE/scubed3.conf)"
db_subst partman-scubed3/final_note OPTIONS "$(cat $STATE/options)"
db_fset partman-scubed3/final_note seen false
db_input critical partman-scubed3/final_note || true
db_go || true

# what is written now is on disk (the file systems flush it again when
# they are unmounted)
sync
exit 0