live-build/helpers/lh_binary_encryption

#!/bin/sh

# lh_binary_encryption(1) - encrypts rootfs
# Copyright (C) 2006-2008 Daniel Baumann <daniel@debian.org>
#
# live-helper comes with ABSOLUTELY NO WARRANTY; for details see COPYING.
# This is free software, and you are welcome to redistribute it
# under certain conditions; see COPYING for details.

set -e

# Including common functions
LH_BASE="${LH_BASE:-/usr/share/live-helper}"

for FUNCTION in "${LH_BASE}"/functions/*.sh
do
	. "${FUNCTION}"
done

# Setting static variables
DESCRIPTION="encrypts rootfs"
HELP=""
USAGE="${PROGRAM} [--force]"

Arguments "${@}"

# Reading configuration files
Read_conffile config/common
Read_conffile config/bootstrap
Read_conffile config/chroot
Read_conffile config/binary
Read_conffile config/source
Read_conffile "${LH_CONFIG}"
Set_defaults

if [ -z "${LH_ENCRYPTION}" ]
then
	exit 0
fi

Echo_message "Begin encrypting root filesystem image..."

# Requiring stage file
Require_stagefile .stage/bootstrap
Require_stagefile .stage/binary_rootfs

# Checking stage file
Check_stagefile .stage/binary_encryption

# Checking lock file
Check_lockfile .lock

# Creating lock file
Create_lockfile .lock

case "${LH_INITRAMFS}" in
	casper)
		INITFS="casper"
		;;

	live-initramfs)
		INITFS="live"
		;;
esac

case "${LH_CHROOT_FILESYSTEM}" in
	ext2)
		ROOTFS="ext2"
		;;

	jffs2)
		Echo_warning "encryption not yet supported on jffs2 filesystem."
		exit 0
		;;

	plain)
		Echo_warning "encryption not supported on plain filesystem."
		exit 0
		;;

	squashfs)
		ROOTFS="squashfs"
		;;
esac

# Checking depends
Check_package chroot/usr/bin/aespipe aespipe

# Restoring cache
Restore_cache cache/packages_binary

# Installing depends
Install_package

Echo_message "Encrypting binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM} with ${LH_ENCRYPTION}..."

if [ "${LH_CHROOT_BUILD}" = "enabled" ]
then
	# Moving image
	mv binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM} chroot
fi

while true
do
	echo
	echo " **************************************"
	echo " ** Configuring encrypted filesystem **"
	echo " **************************************"
	echo " (Passwords must be at least 20 characters long)"
	echo

	case "${LH_CHROOT_BUILD}" in
		enabled)
			if Chroot aespipe -e ${LH_ENCRYPTION} -T \
				< chroot/filesystem.${LH_CHROOT_FILESYSTEM} \
				> chroot/filesystem.${LH_CHROOT_FILESYSTEM}.tmp
			then
				mv chroot/filesystem.${LH_CHROOT_FILESYSTEM}.tmp binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM}
				break
			fi
			;;
		disabled)
			if aespipe -e ${LH_ENCRYPTION} -T \
				< binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM} \
				> binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM}.tmp
			then
				mv binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM}.tmp binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM}
				break
			fi
			;;
	esac

	printf "\nThere was an error configuring encryption ... Retry? [Y/n] "
	read ANSWER

	if [ "$(echo "${ANSWER}" | cut -b1 | tr A-Z a-z)" = "n" ]
	then
		unset ANSWER
		break
	fi
done
	
# Cleanup temporary filesystems
rm -f chroot/filesystem.${LH_CHROOT_FILESYSTEM}
rm -f chroot/filesystem.${LH_CHROOT_FILESYSTEM}.tmp
rm -f binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM}.tmp

# Saving cache
Save_cache cache/packages_binary

# Removing depends
Remove_package

# Creating stage file
Create_stagefile .stage/binary_encryption