penguins-eggs 25.10.23 → 25.10.24

package/dist/classes/ovary.d/luks-home-support.d.ts

@@ -0,0 +1,12 @@
+/**
+ * ./src/classes/ovary.d/luks-home-support.ts
+ * penguins-eggs v.25.10.x / ecmascript 2020
+ * author: Piero Proietti
+ * email: piero.proietti@gmail.com
+ * license: MIT
+ */
+import Ovary from '../ovary.js';
+/**
+ * Installa i file necessari per sbloccare home.img LUKS durante il boot
+ */
+export declare function installHomecryptSupport(this: Ovary, squashfsRoot: string, homeImgPath: string): void;

package/dist/classes/ovary.d/luks-home-support.js

@@ -0,0 +1,75 @@
+/**
+ * ./src/classes/ovary.d/luks-home-support.ts
+ * penguins-eggs v.25.10.x / ecmascript 2020
+ * author: Piero Proietti
+ * email: piero.proietti@gmail.com
+ * license: MIT
+ */
+// packages
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { dirname } from 'path';
+import Utils from '../utils.js';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+/**
+ * Installa i file necessari per sbloccare home.img LUKS durante il boot
+ */
+export function installHomecryptSupport(squashfsRoot, homeImgPath) {
+    Utils.warning('installing encrypted home support...');
+    // console.log("squashfsRoot:", squashfsRoot)
+    // console.log("homeImgPath:", homeImgPath)
+    // Leggi il template bash
+    const templatePath = path.join(__dirname, '../../../scripts/mount-encrypted-home.sh');
+    let bashScript = fs.readFileSync(templatePath, 'utf8');
+    // Sostituisci il placeholder con il path reale
+    bashScript = bashScript.replace('__HOME_IMG_PATH__', homeImgPath);
+    // Systemd service
+    const systemdService = `[Unit]
+Description=Unlock and mount encrypted home.img
+DefaultDependencies=no
+After=systemd-udev-settle.service local-fs-pre.target
+Before=local-fs.target display-manager.service
+ConditionPathExists=${homeImgPath}
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+StandardInput=tty
+StandardOutput=journal+console
+StandardError=journal+console
+TTYPath=/dev/console
+TTYReset=yes
+TTYVHangup=yes
+ExecStart=/usr/local/bin/mount-encrypted-home.sh
+ExecStop=/bin/bash -c 'umount /home && cryptsetup close live-home'
+
+[Install]
+WantedBy=local-fs.target
+`;
+    // Percorsi di destinazione
+    const scriptPath = path.join(squashfsRoot, 'usr/local/bin/mount-encrypted-home.sh');
+    const servicePath = path.join(squashfsRoot, 'etc/systemd/system/mount-encrypted-home.service');
+    const symlinkDir = path.join(squashfsRoot, 'etc/systemd/system/local-fs.target.wants');
+    const symlinkPath = path.join(symlinkDir, 'mount-encrypted-home.service');
+    // Crea le directory necessarie
+    fs.mkdirSync(path.dirname(scriptPath), { recursive: true });
+    fs.mkdirSync(path.dirname(servicePath), { recursive: true });
+    fs.mkdirSync(symlinkDir, { recursive: true });
+    // Scrivi lo script
+    fs.writeFileSync(scriptPath, bashScript);
+    fs.chmodSync(scriptPath, 0o755);
+    // console.log(`✓ Created: ${scriptPath}`)
+    // Scrivi il service
+    fs.writeFileSync(servicePath, systemdService);
+    // console.log(`✓ Created: ${servicePath}`)
+    // Crea il symlink per abilitare il service
+    if (fs.existsSync(symlinkPath)) {
+        fs.unlinkSync(symlinkPath);
+    }
+    fs.symlinkSync('../mount-encrypted-home.service', symlinkPath);
+    // console.log(`✓ Enabled: mount-encrypted-home.service`)
+    // console.log('Encrypted home support installed successfully')
+    // console.log('Logs will be available at: /var/log/mount-encrypted-home.log')
+}

package/dist/classes/ovary.d/luks-home.d.ts

@@ -0,0 +1,15 @@
+/**
+ * ./src/classes/ovary.d/luks-home.ts
+ * penguins-eggs v.25.10.x / ecmascript 2020
+ * author: Piero Proietti
+ * email: piero.proietti@gmail.com
+ * license: MIT
+ */
+import Ovary from '../ovary.js';
+/**
+ * luksHome()
+ *
+ * create a container LUKS with the entire
+ * filesystem.squashfs
+ */
+export declare function luksHome(this: Ovary, clone?: boolean, homecrypt?: boolean): Promise<void>;

package/dist/classes/ovary.d/luks-home.js

@@ -0,0 +1,152 @@
+/**
+ * ./src/classes/ovary.d/luks-home.ts
+ * penguins-eggs v.25.10.x / ecmascript 2020
+ * author: Piero Proietti
+ * email: piero.proietti@gmail.com
+ * license: MIT
+ */
+// packages
+import fs from 'fs';
+import { spawn } from 'node:child_process';
+import Utils from '../utils.js';
+import { exec } from '../../lib/utils.js';
+const noop = () => { };
+/**
+ * luksHome()
+ *
+ * create a container LUKS with the entire
+ * filesystem.squashfs
+ */
+export async function luksHome(clone = false, homecrypt = false) {
+    const loggers = {
+        log: this.hidden ? noop : console.log,
+        warning: this.hidden ? noop : Utils.warning,
+        success: this.hidden ? noop : Utils.success,
+        info: this.hidden ? noop : Utils.info,
+    };
+    const { log, warning, success, info } = loggers;
+    try {
+        /**
+         * this.luksMappedName = 'home.img';
+         * this.luksFile = `/tmp/${luksMappedName}`
+         * this.luksDevice = `/dev/mapper/${luksMappedName}`
+         * this.luksMountpoint = `/tmp/mnt/${luksMappedName}`
+         * this.luksPassword = '0'
+         */
+        if (this.hidden) {
+            Utils.warning("intentionally blank. System is working, please wait");
+        }
+        log();
+        log('====================================');
+        log(` Creating ${this.luksMappedName}`);
+        log('====================================');
+        // Utils.warning('1. Calculation of space requirements...')
+        let sizeString = (await exec('du -sb --exclude=/home/eggs /home', { capture: true })).data.trim().split(/\s+/)[0];
+        let size = Number.parseInt(sizeString, 10);
+        const luksSize = Math.ceil(size * 2);
+        /**
+         * E' più precisa ma equivalente grazie
+         * al truncate
+         */
+        // const fsOverhead = Math.max(size * 0.1, 100 * 1024 * 1024)
+        // const luksSize = size * 1.25 + fsOverhead // +25% 
+        warning(`homes size: ${bytesToGB(size)}`);
+        warning(`partition LUKS ${this.luksFile} size: ${bytesToGB(luksSize)}`);
+        warning(`creating partition LUKS: ${this.luksFile}`);
+        await executeCommand('truncate', ['--size', `${luksSize}`, this.luksFile]);
+        warning(`formatting ${this.luksFile} as a LUKS volume...`);
+        await executeCommand('cryptsetup', ['--batch-mode', 'luksFormat', this.luksFile], `${this.luksPassword}\n`);
+        warning(`opening the LUKS volume. It will be mapped to ${this.luksDevice}`);
+        await executeCommand('cryptsetup', ['luksOpen', this.luksFile, this.luksMappedName], `${this.luksPassword}\n`);
+        warning(`formatting c ext4 `);
+        await exec(`mkfs.ext4 -L live-home ${this.luksDevice}`, this.echo);
+        warning(`mounting ${this.luksDevice} on ${this.luksMountpoint}`);
+        if (fs.existsSync(this.luksMountpoint)) {
+            if (!Utils.isMountpoint(this.luksMountpoint)) {
+                await exec(`rm -rf ${this.luksMountpoint}`, this.echo);
+            }
+            else {
+                throw new Error(`${this.luksMountpoint} is already mounted, process will abort!`);
+            }
+        }
+        await exec(`mkdir -p ${this.luksMountpoint}`, this.echo);
+        await exec(`mount /dev/mapper/${this.luksMappedName} ${this.luksMountpoint}`, this.echo);
+        warning(`copying /home on  ${this.luksMountpoint}`);
+        await exec(`rsync -ah --exclude='eggs' /home/ ${this.luksMountpoint}`, this.echo);
+        warning(`saving user accounts info...`);
+        // Crea directory per backup system files
+        await exec(`mkdir -p ${this.luksMountpoint}/.system-backup`, this.echo);
+        // Filtra solo utenti con UID >= 1000
+        await exec(`awk -F: '$3 >= 1000 {print}' /etc/passwd > ${this.luksMountpoint}/.system-backup/passwd`, this.echo);
+        await exec(`awk -F: '$3 >= 1000 {print}' /etc/shadow > ${this.luksMountpoint}/.system-backup/shadow`, this.echo);
+        // Per i gruppi: salva TUTTI (non filtrare per GID)
+        // Gli utenti possono appartenere a gruppi di sistema (sudo, audio, video, etc.)
+        await exec(`cp /etc/group ${this.luksMountpoint}/.system-backup/group`, this.echo);
+        await exec(`cp /etc/gshadow ${this.luksMountpoint}/.system-backup/gshadow`, this.echo);
+        warning(`unmount ${this.luksDevice}`);
+        await exec(`umount ${this.luksMountpoint}`, this.echo);
+        warning(`closing LUKS volume ${this.luksMappedName}.`);
+        await executeCommand('cryptsetup', ['close', this.luksMappedName]);
+        warning(`moving ${this.luksMappedName}  to (ISO)/live/.`);
+        await exec(`mv ${this.luksFile} ${this.settings.iso_work}/live`, this.echo);
+        warning('encryption process successfully completed!');
+        /**
+         * YOU MUST! unlink the key on production
+         */
+        // fs.unlinkSync(`${this.settings.iso_work}/live/home.key`)
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            Utils.error(`ERROR: ${error.message}`);
+        }
+        else {
+            Utils.error(`An unknown error has occurred.`);
+        }
+        Utils.warning('Cleaning performed following the error...');
+        if (fs.existsSync(this.luksMountpoint)) {
+            await exec(`umount -lf ${this.luksMountpoint}`).catch(() => { });
+        }
+        if (fs.existsSync(this.luksDevice)) {
+            await executeCommand('cryptsetup', ['close', this.luksMappedName]).catch(() => { });
+        }
+        await Utils.pressKeyToExit();
+        process.exit(1);
+    }
+}
+/**
+ * Funzione helper per eseguire comandi esterni in modo asincrono,
+ * gestendo lo standard input per passare le password.
+ * Restituisce una Promise che si risolve al successo o si rigetta in caso di errore.
+ */
+function executeCommand(command, args, stdinData) {
+    return new Promise((resolve, reject) => {
+        // Se passiamo dati a stdin, dobbiamo usare 'pipe'. Altrimenti, 'inherit'.
+        const stdioConfig = stdinData ? ['pipe', 'inherit', 'inherit'] : 'inherit';
+        const process = spawn(command, args, { stdio: stdioConfig });
+        // Se fornito, scriviamo i dati (es. la password) nello stdin del processo.
+        if (stdinData && process.stdin) {
+            process.stdin.write(stdinData);
+            process.stdin.end();
+        }
+        process.on('error', (err) => {
+            reject(new Error(`Error starting command "${command}": ${err.message}`));
+        });
+        process.on('close', (code) => {
+            if (code === 0) {
+                resolve(); // Success
+            }
+            else {
+                reject(new Error(`Command "${command} ${args.join(' ')}" ended with error code ${code}`));
+            }
+        });
+    });
+}
+/**
+ * Converte bytes in gigabytes per la visualizzazione.
+ */
+function bytesToGB(bytes) {
+    if (bytes === 0)
+        return '0.00 GB';
+    const gigabytes = bytes / (1024 * 1024 * 1024);
+    return gigabytes.toFixed(2) + ' GB';
+}

package/dist/classes/ovary.d/luks-root-initrd.d.ts

@@ -0,0 +1,17 @@
+/**
+ * ./src/classes/ovary.d/initrd-luks.ts
+ * penguins-eggs v.25.7.x / ecmascript 2020
+ * author: Piero Proietti
+ * email: piero.proietti@gmail.com
+ * license: MIT
+ */
+import Ovary from '../ovary.js';
+/**
+ * Creates a streamlined initrd image for Debian/Ubuntu with LUKS support using mkinitramfs within a temporary chroot.
+ * Copies the necessary unlock script, ensures losetup is included via a hook, and wraps /scripts/live for debugging.
+ * Assumes live-boot and cryptsetup packages are installed in the chroot.
+ * No cleanup of /etc modifications is performed as the chroot is temporary.
+ * @param this - Ovary instance context
+ * @param verbose - Whether to show verbose output
+ */
+export declare function luksRootInitrd(this: Ovary, verbose?: boolean): Promise<void>;

package/dist/classes/ovary.d/luks-root-initrd.js

@@ -0,0 +1,213 @@
+/**
+ * ./src/classes/ovary.d/initrd-luks.ts
+ * penguins-eggs v.25.7.x / ecmascript 2020
+ * author: Piero Proietti
+ * email: piero.proietti@gmail.com
+ * license: MIT
+ */
+// packages
+import fs from 'fs';
+import path from 'node:path';
+// classes
+import { exec } from '../../lib/utils.js';
+import Utils from '../utils.js';
+// _dirname
+const __dirname = path.dirname(new URL(import.meta.url).pathname);
+const noop = () => { };
+/**
+ * Creates a streamlined initrd image for Debian/Ubuntu with LUKS support using mkinitramfs within a temporary chroot.
+ * Copies the necessary unlock script, ensures losetup is included via a hook, and wraps /scripts/live for debugging.
+ * Assumes live-boot and cryptsetup packages are installed in the chroot.
+ * No cleanup of /etc modifications is performed as the chroot is temporary.
+ * @param this - Ovary instance context
+ * @param verbose - Whether to show verbose output
+ */
+export async function luksRootInitrd(verbose = false) {
+    const loggers = {
+        log: this.hidden ? noop : console.log,
+        warning: this.hidden ? noop : Utils.warning,
+        success: this.hidden ? noop : Utils.success,
+        info: this.hidden ? noop : Utils.info,
+    };
+    const { log, warning, success, info } = loggers;
+    if (this.hidden) {
+        Utils.warning("intentionally blank. System is working, please wait");
+    }
+    log();
+    log('===========================================================================');
+    log(`Creating ${this.initrd} for LUKS using mkinitramfs`);
+    log('===========================================================================');
+    // --- Core Paths & Config ---
+    const chrootPath = path.join(this.dotMnt, 'filesystem.squashfs');
+    const kernelVersion = this.kernel;
+    const initrdBaseName = path.basename(this.initrd);
+    const logBaseName = `${this.settings.config.snapshot_prefix}mkinitramfs.log.txt`;
+    const finalInitrdDestPath = path.join(this.settings.iso_work, 'live', initrdBaseName); // Define final destination early for logging
+    try {
+        // --- 2. Prepare Chroot Environment ---
+        warning("Preparing chroot environment...");
+        // --- 2.1 Copy boot-encrypted-root.sh
+        {
+            const bootEncryptedRootName = 'boot-encrypted-root.sh'; // Corrected to lowercase zz-
+            const srcbootEncryptedRootPath = path.join(__dirname, '../../../scripts', bootEncryptedRootName);
+            const chrootbootEncryptedRootDir = '/etc/initramfs-tools/scripts/live-premount';
+            const chrootbootEncryptedRootPath = path.join(chrootbootEncryptedRootDir, bootEncryptedRootName);
+            const hostDestbootEncryptedRootDir = path.join(chrootPath, chrootbootEncryptedRootDir);
+            const hostDestbootEncryptedRootPath = path.join(chrootPath, chrootbootEncryptedRootPath);
+            if (!fs.existsSync(srcbootEncryptedRootPath)) {
+                throw new Error(`Unlock script source not found: ${srcbootEncryptedRootPath}`);
+            }
+            await exec(`mkdir -p "${hostDestbootEncryptedRootDir}"`);
+            await exec(`cp "${srcbootEncryptedRootPath}" "${hostDestbootEncryptedRootPath}"`);
+            await exec(`chmod +x "${hostDestbootEncryptedRootPath}"`);
+            success(`Copied ${bootEncryptedRootName} script to ${hostDestbootEncryptedRootDir}`);
+        }
+        // --- 2.2 Create dummy /etc/crypttab if needed ---
+        {
+            const chrootCrypttabPath = '/etc/crypttab';
+            const hostCrypttabPath = path.join(chrootPath, chrootCrypttabPath);
+            if (!fs.existsSync(hostCrypttabPath)) {
+                const crypttabContent = "# Dummy entry to ensure cryptsetup is included\ncryptroot UUID=none none luks\n";
+                fs.writeFileSync(hostCrypttabPath, crypttabContent, 'utf-8');
+                success(`Created crypttab on ${path.dirname(hostCrypttabPath)}`);
+            }
+            else {
+                info(`${hostCrypttabPath} already exists.`);
+            }
+        }
+        // --- 2.3 Add hook ---
+        // Utils.warning(`Generating required hook scripts`)
+        await addHook('/usr/sbin/losetup', chrootPath, loggers);
+        await addHook('/usr/bin/rsync', chrootPath, loggers);
+        // --- 2.4 Add modules ---
+        // addModules('overlay', chrootPath)
+        // --- 3. Execute mkinitramfs INSIDE Chroot ---
+        {
+            warning(`Running mkinitramfs for kernel ${kernelVersion} inside chroot...`);
+            const chrootTmpInitrdPath = `/tmp/${initrdBaseName}`;
+            let logFilePath = path.join(this.settings.iso_work, logBaseName);
+            if (this.hidden) {
+                logFilePath = '/dev/null';
+            }
+            const mkinitramfsCmd = `mkinitramfs -v -o "${chrootTmpInitrdPath}" ${kernelVersion}`;
+            const chrootCmd = `chroot "${chrootPath}" /bin/bash -c "${mkinitramfsCmd}" > "${logFilePath}" 2>&1`;
+            await exec(chrootCmd, this.echo);
+            success(`mkinitramfs completed. Log: ${logFilePath}`);
+        }
+        // --- 4. Move Result ---
+        {
+            const chrootTmpInitrdPath = `/tmp/${initrdBaseName}`; // Re-declare for scope
+            const hostTmpInitrdPath = path.join(chrootPath, chrootTmpInitrdPath);
+            if (fs.existsSync(hostTmpInitrdPath)) {
+                info(`Moving generated initrd to ${finalInitrdDestPath}`);
+                await exec(`mv "${hostTmpInitrdPath}" "${finalInitrdDestPath}"`);
+                success(`Initrd moved successfully.`);
+            }
+            else {
+                Utils.error(`Generated initrd not found at ${hostTmpInitrdPath}. Build failed!`);
+                throw new Error("mkinitramfs did not produce the expected output file.");
+            }
+            // process.exit()
+        }
+    }
+    catch (error) {
+        Utils.error(`Error during LUKS initrd generation: ${error}`);
+        const logFilePath = path.join(this.settings.iso_work, logBaseName); // Re-declare for scope
+        if (error instanceof Error && error.message.includes('mkinitramfs inside chroot failed')) {
+            Utils.warning(`Check mkinitramfs log: ${logFilePath}`);
+        }
+        throw error; // Re-throw error
+    }
+    success(`Finished creating LUKS initrd: ${finalInitrdDestPath}`);
+}
+/**
+ * Genera e installa uno script hook di initramfs-tools nel chroot.
+ * Copia il comando specificato nella sua directory di destinazione
+ * standard (/bin o /sbin) all'interno dell'initramfs.
+ * @param cmdPath Path assoluto del comando da copiare *nel chroot* (es. '/usr/sbin/losetup')
+ * @param chrootPath Path assoluto alla radice del chroot
+ */
+async function addHook(cmdPath, chrootPath, loggers) {
+    const { log, warning, success, info } = loggers;
+    const chrootHooksDirPath = '/etc/initramfs-tools/hooks';
+    const hostHooksDirPath = path.join(chrootPath, chrootHooksDirPath);
+    const cmd = path.basename(cmdPath); // es. 'losetup'
+    const hookScriptName = `add-${cmd}-hook.sh`; // es. 'add-losetup-hook.sh'
+    const hostHookPath = path.join(hostHooksDirPath, hookScriptName);
+    if (!fs.existsSync(cmdPath)) {
+        Utils.error(`Dont' exists ${cmdPath}`);
+        process.exit();
+    }
+    let destDir = "/sbin"; // Default a /sbin per i comandi di amministrazione
+    // Determina la destinazione corretta
+    if (cmdPath.includes('/usr/bin') || cmdPath.includes('/bin')) {
+        destDir = "/bin"; // Comandi utente
+    }
+    else if (cmdPath.includes('/usr/sbin') || cmdPath.includes('/sbin')) {
+        destDir = "/sbin"; // Comandi amministrativi
+    }
+    // Crea la riga di comando per l'hook
+    const copyLine = `copy_exec ${cmdPath} ${destDir} || echo "WARNING: Failed to copy ${cmdPath} to ${destDir}" >&2`;
+    // Crea il contenuto boilerplate dello script hook
+    const hookContent = `#!/bin/sh
+# Hook: ${hookScriptName}
+# Generato automaticamente da penguins-eggs
+# Copia ${cmdPath} in ${destDir}
+
+PREREQ=""
+case $1 in prereqs) echo "\${PREREQ}"; exit 0;; esac
+
+. /usr/share/initramfs-tools/hook-functions
+
+echo "EGGS-HOOK: Esecuzione hook ${hookScriptName}..."
+${copyLine}
+
+exit 0
+`;
+    try {
+        await exec(`mkdir -p "${hostHooksDirPath}"`);
+        // Scrive il file e lo rende eseguibile (mode 0o755)
+        fs.writeFileSync(hostHookPath, hookContent, { mode: 0o755, encoding: 'utf-8' });
+        // console.log(hookContent)
+        success(`Generated and set executable hook: ${hookScriptName}`);
+    }
+    catch (err) {
+        Utils.error(`Failed to write hook script ${hostHookPath}: ${err.message}`);
+        process.exit(1);
+        throw err; // Lancia l'errore per fermare il processo
+    }
+}
+/**
+ *
+ * @param module
+ * @param chrootPath
+ */
+function addModules(module, chrootPath, loggers) {
+    const { log, warning, success, info } = loggers;
+    const chrootModulesFilePath = '/etc/initramfs-tools/modules'; // Relative inside chroot
+    const hostModulesFilePath = path.join(chrootPath, chrootModulesFilePath); // Absolute on host fs
+    let modulesContent = '';
+    let needsUpdate = false;
+    if (fs.existsSync(hostModulesFilePath)) {
+        modulesContent = fs.readFileSync(hostModulesFilePath, 'utf-8');
+    }
+    else {
+        // inizializzazione modules
+        modulesContent = '\n';
+    }
+    if (modulesContent.includes(`\n${module}\n`)) {
+        info(`'${module}' module already present.`);
+    }
+    else {
+        info(`Added '${module}' module on ${hostModulesFilePath}`);
+        if (!modulesContent.endsWith('\n')) {
+            modulesContent += '\n';
+        }
+        modulesContent += `${module}\n`;
+        needsUpdate = true;
+    }
+    if (needsUpdate) {
+        fs.writeFileSync(hostModulesFilePath, modulesContent, 'utf-8');
+        success(`Updated ${hostModulesFilePath} with 'overlay'.`);
+    }
+}

package/dist/classes/ovary.d/luks-root.d.ts

@@ -0,0 +1,15 @@
+/**
+ * ./src/classes/ovary.d/encrypt-live-fs.ts
+ * penguins-eggs v.25.10.x / ecmascript 2020
+ * author: Piero Proietti
+ * email: piero.proietti@gmail.com
+ * license: MIT
+ */
+import Ovary from '../ovary.js';
+/**
+ * luksRoot()
+ *
+ * create a container LUKS with the entire
+ * filesystem.squashfs
+ */
+export declare function luksRoot(this: Ovary): Promise<void>;

package/dist/classes/ovary.d/luks-root.js

@@ -0,0 +1,151 @@
+/**
+ * ./src/classes/ovary.d/encrypt-live-fs.ts
+ * penguins-eggs v.25.10.x / ecmascript 2020
+ * author: Piero Proietti
+ * email: piero.proietti@gmail.com
+ * license: MIT
+ */
+// packages
+import fs from 'fs';
+import { spawn } from 'node:child_process';
+import Utils from '../utils.js';
+import { exec } from '../../lib/utils.js';
+const noop = () => { };
+/**
+ * luksRoot()
+ *
+ * create a container LUKS with the entire
+ * filesystem.squashfs
+ */
+export async function luksRoot() {
+    const loggers = {
+        log: this.hidden ? noop : console.log,
+        warning: this.hidden ? noop : Utils.warning,
+        success: this.hidden ? noop : Utils.success,
+        info: this.hidden ? noop : Utils.info,
+    };
+    const { log, warning, success, info } = loggers;
+    // filesystem.squashfs
+    const live_fs = `${this.settings.iso_work}live/filesystem.squashfs`;
+    try {
+        /**
+         * this.luksMappedName = 'luks.img';
+         * this.luksFile = `/tmp/${luksMappedName}`
+         * this.luksDevice = `/dev/mapper/${luksMappedName}`
+         * this.luksMountpoint = `/tmp/mnt/${luksMappedName}`
+         * this.luksPassword = '0'
+         */
+        if (this.hidden) {
+            Utils.warning("intentionally blank. System is working, please wait");
+        }
+        log();
+        log('====================================');
+        log(` Creating ${this.luksMappedName}`);
+        log('====================================');
+        if (!fs.existsSync(live_fs)) {
+            throw new Error(`filesystem.squashfs not found at: ${live_fs}`);
+        }
+        const stats = fs.statSync(live_fs);
+        let size = stats.size; // Dimensione REALE del file in Byte
+        // Add overhead * 1.25 per più sicurezza con file grandi
+        const luksSize = Math.ceil(size * 1.25);
+        warning(`filesystem.squashfs size: ${bytesToGB(size)}`);
+        warning(`partition LUKS ${this.luksFile} size: ${bytesToGB(luksSize)}`);
+        warning(`creating partition LUKS: ${this.luksFile}`);
+        await executeCommand('truncate', ['--size', `${luksSize}`, this.luksFile]);
+        warning(`formatting ${this.luksFile} as a LUKS volume...`);
+        await executeCommand('cryptsetup', ['--batch-mode', 'luksFormat', this.luksFile], `${this.luksPassword}\n`);
+        warning(`opening the LUKS volume. It will be mapped to ${this.luksDevice}`);
+        await executeCommand('cryptsetup', ['luksOpen', this.luksFile, this.luksMappedName], `${this.luksPassword}\n`);
+        warning(`formatting ext4 (without journal)...`);
+        await exec(`mkfs.ext4 -O ^has_journal -L live-root ${this.luksDevice}`, this.echo);
+        warning(`mounting ${this.luksDevice} on ${this.luksMountpoint}`);
+        if (fs.existsSync(this.luksMountpoint)) {
+            if (!Utils.isMountpoint(this.luksMountpoint)) {
+                await exec(`rm -rf ${this.luksMountpoint}`, this.echo);
+            }
+            else {
+                throw new Error(`${this.luksMountpoint} is already mounted, process will abort!`);
+            }
+        }
+        await exec(`mkdir -p ${this.luksMountpoint}`, this.echo);
+        await exec(`mount /dev/mapper/${this.luksMappedName} ${this.luksMountpoint}`, this.echo);
+        warning(`moving ${live_fs} ${this.luksMountpoint}/filesystem.squashfs`);
+        await exec(`mv ${live_fs} ${this.luksMountpoint}/filesystem.squashfs`, this.echo);
+        warning(`Syncing filesystem on ${this.luksMountpoint}...`);
+        await exec('sync', this.echo); // Forza scrittura dati su disco
+        warning(`Attempting unmount ${this.luksMountpoint}...`);
+        try {
+            await exec(`umount ${this.luksMountpoint}`, this.echo);
+            success(`Unmounted ${this.luksMountpoint} successfully.`);
+        }
+        catch (umountError) {
+            Utils.error(`Failed to unmount ${this.luksMountpoint}! Trying force unmount...`);
+            // Tenta un unmount forzato/lazy come ultima risorsa
+            await exec(`umount -lf ${this.luksMountpoint}`).catch((forceError) => {
+                Utils.error(`Force unmount also failed: ${forceError}`);
+                // Considera se lanciare un errore qui per fermare il processo
+            });
+            // Lancia comunque l'errore originale per segnalare il problema
+            throw umountError;
+        }
+        warning(`closing LUKS volume ${this.luksFile}.`);
+        await executeCommand('cryptsetup', ['close', this.luksMappedName]);
+        warning(`moving ${this.luksMappedName} on (ISO)/live.`);
+        await exec(`mv ${this.luksFile} ${this.settings.iso_work}/live`, this.echo);
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            Utils.error(`ERROR: ${error.message}`);
+        }
+        else {
+            Utils.error(`An unknown error has occurred.`);
+        }
+        Utils.warning('Cleaning performed following the error...');
+        if (fs.existsSync(this.luksMountpoint)) {
+            await exec(`umount -lf ${this.luksMountpoint}`).catch(() => { });
+        }
+        if (fs.existsSync(this.luksDevice)) {
+            await executeCommand('cryptsetup', ['close', this.luksMappedName]).catch(() => { });
+        }
+        await Utils.pressKeyToExit();
+        process.exit(1);
+    }
+}
+/**
+ * Funzione helper per eseguire comandi esterni in modo asincrono,
+ * gestendo lo standard input per passare le password.
+ * Restituisce una Promise che si risolve al successo o si rigetta in caso di errore.
+ */
+function executeCommand(command, args, stdinData) {
+    return new Promise((resolve, reject) => {
+        // Se passiamo dati a stdin, dobbiamo usare 'pipe'. Altrimenti, 'inherit'.
+        const stdioConfig = stdinData ? ['pipe', 'inherit', 'inherit'] : 'inherit';
+        const process = spawn(command, args, { stdio: stdioConfig });
+        // Se fornito, scriviamo i dati (es. la password) nello stdin del processo.
+        if (stdinData && process.stdin) {
+            process.stdin.write(stdinData);
+            process.stdin.end();
+        }
+        process.on('error', (err) => {
+            reject(new Error(`Error starting command "${command}": ${err.message}`));
+        });
+        process.on('close', (code) => {
+            if (code === 0) {
+                resolve(); // Success
+            }
+            else {
+                reject(new Error(`Command "${command} ${args.join(' ')}" ended with error code ${code}`));
+            }
+        });
+    });
+}
+/**
+ * Converte bytes in gigabytes per la visualizzazione.
+ */
+function bytesToGB(bytes) {
+    if (bytes === 0)
+        return '0.00 GB';
+    const gigabytes = bytes / (1024 * 1024 * 1024);
+    return gigabytes.toFixed(2) + ' GB';
+}

package/dist/classes/ovary.d/make-dot-disk.d.ts

@@ -0,0 +1,12 @@
+/**
+ * ./src/classes/ovary.d/produce.ts
+ * penguins-eggs v.25.7.x / ecmascript 2020
+ * author: Piero Proietti
+ * email: piero.proietti@gmail.com
+ * license: MIT
+ */
+import Ovary from './../ovary.js';
+/**
+   * makeDotDisk
+   */
+export declare function makeDotDisk(this: Ovary, info?: string, mksquashfs?: string, mkisofs?: string): void;