archinstall 2.5.2__tar.gz → 2.5.3__tar.gz

{archinstall-2.5.2 → archinstall-2.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: archinstall
-Version: 2.5.2
+Version: 2.5.3
 Summary: Arch Linux installer - guided, templates etc.
 Keywords: linux,arch,archinstall,installer
 Author-email: Anton Hvornum <anton@hvornum.se>

{archinstall-2.5.2 → archinstall-2.5.3}/archinstall/__init__.py

@@ -37,21 +37,17 @@ from .lib.menu import Menu
 from .lib.menu.list_manager import ListManager
 from .lib.menu.text_input import TextInput
 from .lib.menu.global_menu import GlobalMenu
-from .lib.menu.selection_menu import (
+from .lib.menu.abstract_menu import (
 	Selector,
-	GeneralMenu
+	AbstractMenu
 )
 from .lib.translationhandler import TranslationHandler, DeferredTranslation
 from .lib.plugins import plugins, load_plugin # This initiates the plugin loading ceremony
 from .lib.configuration import *
 from .lib.udev import udevadm_info
-from .lib.hsm import (
-	get_fido2_devices,
-	fido2_enroll
-)
 parser = ArgumentParser()
 
-__version__ = "2.5.2"
+__version__ = "2.5.3"
 storage['__version__'] = __version__
 
 # add the custome _ as a builtin, it can now be used anywhere in the

{archinstall-2.5.2 → archinstall-2.5.3/archinstall}/examples/guided.py

@@ -54,12 +54,8 @@ def ask_user_questions():
 
 	global_menu.enable('disk_layouts')
 
-	# Get disk encryption password (or skip if blank)
-	global_menu.enable('!encryption-password')
-
-	if archinstall.arguments.get('advanced', False) or archinstall.arguments.get('HSM', None):
-		# Enables the use of HSM
-		global_menu.enable('HSM')
+	# Specify disk encryption options
+	global_menu.enable('disk_encryption')
 
 	# Ask which boot-loader to use (will only ask if we're in UEFI mode, otherwise will default to GRUB)
 	global_menu.enable('bootloader')
@@ -150,14 +146,6 @@ def perform_installation(mountpoint):
 				if partition.size < 0.19: # ~200 MiB in GiB
 					raise archinstall.DiskError(f"The selected /boot partition in use is not large enough to properly install a boot loader. Please resize it to at least 200MiB and re-run the installation.")
 
-		# if len(mirrors):
-		# Certain services might be running that affects the system during installation.
-		# Currently, only one such service is "reflector.service" which updates /etc/pacman.d/mirrorlist
-		# We need to wait for it before we continue since we opted in to use a custom mirror/region.
-		installation.log('Waiting for automatic mirror selection (reflector) to complete.', level=logging.INFO)
-		while archinstall.service_state('reflector') not in ('dead', 'failed'):
-			time.sleep(1)
-
 		# If we've activated NTP, make sure it's active in the ISO too and
 		# make sure at least one time-sync finishes before we continue with the installation
 		if archinstall.arguments.get('ntp', False):
@@ -179,6 +167,22 @@ def perform_installation(mountpoint):
 					installation.log(f"Waiting for timedatectl timesync-status to report a timesync against a server", level=logging.INFO)
 					logged = True
 				time.sleep(1)
+		
+		# if len(mirrors):
+		# Certain services might be running that affects the system during installation.
+		# Currently, only one such service is "reflector.service" which updates /etc/pacman.d/mirrorlist
+		# We need to wait for it before we continue since we opted in to use a custom mirror/region.
+		installation.log('Waiting for automatic mirror selection (reflector) to complete.', level=logging.INFO)
+		while archinstall.service_state('reflector') not in ('dead', 'failed', 'exited'):
+			time.sleep(1)
+
+		installation.log('Waiting pacman-init.service to complete.', level=logging.INFO)
+		while archinstall.service_state('pacman-init') not in ('dead', 'failed', 'exited'):
+			time.sleep(1)
+
+		installation.log('Waiting Arch Linux keyring sync (archlinux-keyring-wkd-sync) to complete.', level=logging.INFO)
+		while archinstall.service_state('archlinux-keyring-wkd-sync') not in ('dead', 'failed', 'exited'):
+			time.sleep(1)
 
 		# Set mirrors used by pacstrap (outside of installation)
 		if archinstall.arguments.get('mirror-region', None):

{archinstall-2.5.2 → archinstall-2.5.3/archinstall}/examples/only_hd.py

@@ -12,7 +12,7 @@ class OnlyHDMenu(archinstall.GlobalMenu):
 		super()._setup_selection_menu_options()
 		options_list = []
 		mandatory_list = []
-		options_list = ['harddrives', 'disk_layouts', '!encryption-password','swap']
+		options_list = ['harddrives', 'disk_layouts', 'disk_encryption','swap']
 		mandatory_list = ['harddrives']
 		options_list.extend(['save_config','install','abort'])
 

{archinstall-2.5.2 → archinstall-2.5.3/archinstall}/examples/swiss.py

@@ -153,7 +153,7 @@ def select_installed_locale(mode):
 	_menus
 """
 
-class SetupMenu(archinstall.GeneralMenu):
+class SetupMenu(archinstall.AbstractMenu):
 	def __init__(self,storage_area):
 		super().__init__(data_store=storage_area)
 
@@ -230,14 +230,14 @@ class MyMenu(archinstall.GlobalMenu):
 		mandatory_list = []
 		if self._execution_mode in ('full','lineal'):
 			options_list = ['keyboard-layout', 'mirror-region', 'harddrives', 'disk_layouts',
-					'!encryption-password','swap', 'bootloader', 'hostname', '!root-password',
+					'disk_encryption','swap', 'bootloader', 'hostname', '!root-password',
 					'!users', 'profile', 'audio', 'kernels', 'packages','additional-repositories','nic',
 					'timezone', 'ntp']
 			if archinstall.arguments.get('advanced',False):
 				options_list.extend(['sys-language','sys-encoding'])
 			mandatory_list = ['harddrives','bootloader','hostname']
 		elif self._execution_mode == 'only_hd':
-			options_list = ['harddrives', 'disk_layouts', '!encryption-password','swap']
+			options_list = ['harddrives', 'disk_layouts', 'disk_encryption','swap']
 			mandatory_list = ['harddrives']
 		elif self._execution_mode == 'only_os':
 			options_list = ['keyboard-layout', 'mirror-region','bootloader', 'hostname',

{archinstall-2.5.2 → archinstall-2.5.3}/archinstall/lib/configuration.py

@@ -5,15 +5,18 @@ import logging
 import pathlib
 from typing import Optional, Dict
 
+from .hsm.fido import Fido2
+from .models.disk_encryption import DiskEncryption
 from .storage import storage
 from .general import JSON, UNSAFE_JSON
 from .output import log
 from .exceptions import RequirementError
-from .hsm import get_fido2_devices
+
 
 def configuration_sanity_check():
-	if storage['arguments'].get('HSM'):
-		if not get_fido2_devices():
+	disk_encryption: DiskEncryption = storage['arguments'].get('disk_encryption')
+	if disk_encryption is not None and disk_encryption.hsm_device:
+		if not Fido2.get_fido2_devices():
 			raise RequirementError(
 				f"In order to use HSM to pair with the disk encryption,"
 				+ f" one needs to be accessible through /dev/hidraw* and support"
@@ -21,6 +24,7 @@ def configuration_sanity_check():
 				+ f" 'systemd-cryptenroll --fido2-device=list'."
 			)
 
+
 class ConfigurationOutput:
 	def __init__(self, config: Dict):
 		"""
@@ -39,8 +43,8 @@ class ConfigurationOutput:
 		self._user_creds_file = "user_credentials.json"
 		self._disk_layout_file = "user_disk_layout.json"
 
-		self._sensitive = ['!users', '!encryption-password']
-		self._ignore = ['abort', 'install', 'config', 'creds', 'dry_run']
+		self._sensitive = ['!users']
+		self._ignore = ['abort', 'install', 'config', 'creds', 'dry_run', 'disk_encryption']
 
 		self._process_config()
 

archinstall-2.5.3/archinstall/lib/disk/encryption.py

@@ -0,0 +1,162 @@
+from typing import Dict, Optional, Any, TYPE_CHECKING, List
+
+from ..menu.abstract_menu import Selector, AbstractSubMenu
+from ..menu.menu import MenuSelectionType
+from ..menu.table_selection_menu import TableMenu
+from ..models.disk_encryption import EncryptionType, DiskEncryption
+from ..user_interaction.partitioning_conf import current_partition_layout
+from ..user_interaction.utils import get_password
+from ..menu import Menu
+from ..general import secret
+from ..hsm.fido import Fido2Device, Fido2
+
+if TYPE_CHECKING:
+	_: Any
+
+
+class DiskEncryptionMenu(AbstractSubMenu):
+	def __init__(self, data_store: Dict[str, Any], preset: Optional[DiskEncryption], disk_layouts: Dict[str, Any]):
+		if preset:
+			self._preset = preset
+		else:
+			self._preset = DiskEncryption()
+
+		self._disk_layouts = disk_layouts
+		super().__init__(data_store=data_store)
+
+	def _setup_selection_menu_options(self):
+		self._menu_options['encryption_password'] = \
+			Selector(
+				_('Encryption password'),
+				lambda x: select_encrypted_password(),
+				display_func=lambda x: secret(x) if x else '',
+				default=self._preset.encryption_password,
+				enabled=True
+			)
+		self._menu_options['encryption_type'] = \
+			Selector(
+				_('Encryption type'),
+				func=lambda preset: select_encryption_type(preset),
+				display_func=lambda x: EncryptionType.type_to_text(x) if x else None,
+				dependencies=['encryption_password'],
+				default=self._preset.encryption_type,
+				enabled=True
+			)
+		self._menu_options['partitions'] = \
+			Selector(
+				_('Partitions'),
+				func=lambda preset: select_partitions_to_encrypt(self._disk_layouts, preset),
+				display_func=lambda x: f'{len(x)} {_("Partitions")}' if x else None,
+				dependencies=['encryption_password'],
+				default=self._preset.partitions,
+				preview_func=self._prev_disk_layouts,
+				enabled=True
+			)
+		self._menu_options['HSM'] = \
+			Selector(
+				description=_('Use HSM to unlock encrypted drive'),
+				func=lambda preset: select_hsm(preset),
+				display_func=lambda x: self._display_hsm(x),
+				dependencies=['encryption_password'],
+				default=self._preset.hsm_device,
+				enabled=True
+			)
+
+	def run(self, allow_reset: bool = True) -> Optional[DiskEncryption]:
+		super().run(allow_reset=allow_reset)
+
+		if self._data_store.get('encryption_password', None):
+			return DiskEncryption(
+				encryption_password=self._data_store.get('encryption_password', None),
+				encryption_type=self._data_store['encryption_type'],
+				partitions=self._data_store.get('partitions', None),
+				hsm_device=self._data_store.get('HSM', None)
+			)
+
+		return None
+
+	def _display_hsm(self, device: Optional[Fido2Device]) -> Optional[str]:
+		if device:
+			return device.manufacturer
+
+		if not Fido2.get_fido2_devices():
+			return str(_('No HSM devices available'))
+		return None
+
+	def _prev_disk_layouts(self) -> Optional[str]:
+		selector = self._menu_options['partitions']
+		if selector.has_selection():
+			partitions: List[Any] = selector.current_selection
+			output = str(_('Partitions to be encrypted')) + '\n'
+			output += current_partition_layout(partitions, with_title=False)
+			return output.rstrip()
+		return None
+
+
+def select_encryption_type(preset: EncryptionType) -> Optional[EncryptionType]:
+	title = str(_('Select disk encryption option'))
+	options = [
+		# _type_to_text(EncryptionType.FullDiskEncryption),
+		EncryptionType.type_to_text(EncryptionType.Partition)
+	]
+
+	preset_value = EncryptionType.type_to_text(preset)
+	choice = Menu(title, options, preset_values=preset_value).run()
+
+	match choice.type_:
+		case MenuSelectionType.Reset: return None
+		case MenuSelectionType.Skip: return preset
+		case MenuSelectionType.Selection: return EncryptionType.text_to_type(choice.value)  # type: ignore
+
+
+def select_encrypted_password() -> Optional[str]:
+	if passwd := get_password(prompt=str(_('Enter disk encryption password (leave blank for no encryption): '))):
+		return passwd
+	return None
+
+
+def select_hsm(preset: Optional[Fido2Device] = None) -> Optional[Fido2Device]:
+	title = _('Select a FIDO2 device to use for HSM')
+	fido_devices = Fido2.get_fido2_devices()
+
+	if fido_devices:
+		choice = TableMenu(title, data=fido_devices).run()
+		match choice.type_:
+			case MenuSelectionType.Reset:
+				return None
+			case MenuSelectionType.Skip:
+				return preset
+			case MenuSelectionType.Selection:
+				return choice.value  # type: ignore
+
+	return None
+
+
+def select_partitions_to_encrypt(disk_layouts: Dict[str, Any], preset: List[Any]) -> List[Any]:
+	# If no partitions was marked as encrypted, but a password was supplied and we have some disks to format..
+	# Then we need to identify which partitions to encrypt. This will default to / (root).
+	all_partitions = []
+	for blockdevice in disk_layouts.values():
+		if partitions := blockdevice.get('partitions'):
+			partitions = [p for p in partitions if p['mountpoint'] != '/boot']
+			all_partitions += partitions
+
+	if all_partitions:
+		title = str(_('Select which partitions to encrypt'))
+		partition_table = current_partition_layout(all_partitions, with_title=False).strip()
+
+		choice = TableMenu(
+			title,
+			table_data=(all_partitions, partition_table),
+			multi=True
+		).run()
+
+		match choice.type_:
+			case MenuSelectionType.Reset:
+				return []
+			case MenuSelectionType.Skip:
+				return preset
+			case MenuSelectionType.Selection:
+				return choice.value  # type: ignore
+
+	return []

{archinstall-2.5.2 → archinstall-2.5.3}/archinstall/lib/disk/filesystem.py

@@ -5,6 +5,8 @@ import json
 import pathlib
 from typing import Optional, Dict, Any, TYPE_CHECKING
 # https://stackoverflow.com/a/39757388/929999
+from ..models.disk_encryption import DiskEncryption
+
 if TYPE_CHECKING:
 	from .blockdevice import BlockDevice
 	_: Any
@@ -107,33 +109,22 @@ class Filesystem:
 				continue
 
 			if partition.get('filesystem', {}).get('format', False):
-
 				# needed for backward compatibility with the introduction of the new "format_options"
 				format_options = partition.get('options',[]) + partition.get('filesystem',{}).get('format_options',[])
-				if partition.get('encrypted', False):
+				disk_encryption: DiskEncryption = storage['arguments'].get('disk_encryption')
+
+				if disk_encryption and partition in disk_encryption.partitions:
 					if not partition['device_instance']:
 						raise DiskError(f"Internal error caused us to loose the partition. Please report this issue upstream!")
 
-					if not partition.get('!password'):
-						if not storage['arguments'].get('!encryption-password'):
-							if storage['arguments'] == 'silent':
-								raise ValueError(f"Missing encryption password for {partition['device_instance']}")
-
-							from ..user_interaction import get_password
-
-							prompt = str(_('Enter a encryption password for {}').format(partition['device_instance']))
-							storage['arguments']['!encryption-password'] = get_password(prompt)
-
-						partition['!password'] = storage['arguments']['!encryption-password']
-
 					if partition.get('mountpoint',None):
 						loopdev = f"{storage.get('ENC_IDENTIFIER', 'ai')}{pathlib.Path(partition['mountpoint']).name}loop"
 					else:
 						loopdev = f"{storage.get('ENC_IDENTIFIER', 'ai')}{pathlib.Path(partition['device_instance'].path).name}"
 
-					partition['device_instance'].encrypt(password=partition['!password'])
+					partition['device_instance'].encrypt(password=disk_encryption.encryption_password)
 					# Immediately unlock the encrypted device to format the inner volume
-					with luks2(partition['device_instance'], loopdev, partition['!password'], auto_unmount=True) as unlocked_device:
+					with luks2(partition['device_instance'], loopdev, disk_encryption.encryption_password, auto_unmount=True) as unlocked_device:
 						if not partition.get('wipe'):
 							if storage['arguments'] == 'silent':
 								raise ValueError(f"Missing fs-type to format on newly created encrypted partition {partition['device_instance']}")

{archinstall-2.5.2 → archinstall-2.5.3}/archinstall/lib/disk/helpers.py

@@ -212,6 +212,47 @@ def all_disks() -> List[BlockDevice]:
 	log(f"[Deprecated] archinstall.all_disks() is deprecated. Use archinstall.all_blockdevices() with the appropriate filters instead.", level=logging.WARNING, fg="yellow")
 	return all_blockdevices(partitions=False, mappers=False)
 
+def get_blockdevice_info(device_path, exclude_iso_dev :bool = True) -> Dict[str, Any]:
+	for retry_attempt in range(storage['DISK_RETRY_ATTEMPTS']):
+		partprobe(device_path)
+		time.sleep(max(0.1, storage['DISK_TIMEOUTS'] * retry_attempt))
+		
+		try:
+			if exclude_iso_dev:
+				# exclude all devices associated with the iso boot locations
+				iso_devs = ['/run/archiso/airootfs', '/run/archiso/bootmnt']
+
+				try:
+					lsblk_info = get_lsblk_info(device_path)
+				except DiskError:
+					continue
+
+				if any([dev in lsblk_info.mountpoints for dev in iso_devs]):
+					continue
+
+			information = blkid(f'blkid -p -o export {device_path}')
+			return enrich_blockdevice_information(information)
+		except SysCallError as ex:
+			if ex.exit_code in (512, 2):
+				# Assume that it's a loop device, and try to get info on it
+				try:
+					resolved_device_name = device_path.readlink().name
+				except OSError:
+					resolved_device_name = device_path.name
+
+				try:
+					information = get_loop_info(device_path)
+					if not information:
+						raise SysCallError(f"Could not get loop information for {resolved_device_name}", exit_code=1)
+					return enrich_blockdevice_information(information)
+
+				except SysCallError:
+					information = get_blockdevice_uevent(resolved_device_name)
+					return enrich_blockdevice_information(information)
+			else:
+				# We could not reliably get any information, perhaps the disk is clean of information?
+				if retry_attempt == storage['DISK_RETRY_ATTEMPTS'] - 1:
+					raise ex
 
 def all_blockdevices(
 	mappers: bool = False,
@@ -230,40 +271,18 @@ def all_blockdevices(
 	# we'll iterate the /sys/class definitions and find the information
 	# from there.
 	for block_device in glob.glob("/sys/class/block/*"):
-		device_path = pathlib.Path(f"/dev/{pathlib.Path(block_device).readlink().name}")
+		try:
+			device_path = pathlib.Path(f"/dev/{pathlib.Path(block_device).readlink().name}")
+		except FileNotFoundError:
+			log(f"Unknown device found by '/sys/class/block/*', ignoring: {device_path}", level=logging.WARNING, fg="yellow")
 
 		if device_path.exists() is False:
 			log(f"Unknown device found by '/sys/class/block/*', ignoring: {device_path}", level=logging.WARNING, fg="yellow")
 			continue
 
-		try:
-			if exclude_iso_dev:
-				# exclude all devices associated with the iso boot locations
-				iso_devs = ['/run/archiso/airootfs', '/run/archiso/bootmnt']
-				lsblk_info = get_lsblk_info(device_path)
-				if any([dev in lsblk_info.mountpoints for dev in iso_devs]):
-					continue
-
-			information = blkid(f'blkid -p -o export {device_path}')
-		except SysCallError as ex:
-			if ex.exit_code in (512, 2):
-				# Assume that it's a loop device, and try to get info on it
-				try:
-					information = get_loop_info(device_path)
-					if not information:
-						print("Exit code for blkid -p -o export was:", ex.exit_code)
-						raise SysCallError("Could not get loop information", exit_code=1)
-
-				except SysCallError:
-					print("Not a loop device, trying uevent rules.")
-					information = get_blockdevice_uevent(pathlib.Path(block_device).readlink().name)
-			else:
-				# We could not reliably get any information, perhaps the disk is clean of information?
-				print("Raising ex because:", ex.exit_code)
-				raise ex
-				# return instances
-
-		information = enrich_blockdevice_information(information)
+		information = get_blockdevice_info(device_path)
+		if not information:
+			continue
 
 		for path, path_info in information.items():
 			if path_info.get('DMCRYPT_NAME'):
@@ -409,7 +428,6 @@ def get_partitions_in_use(mountpoint :str) -> Dict[str, Any]:
 		return {}
 
 	output = json.loads(output)
-	# print(output)
 
 	mounts = {}
 
@@ -421,11 +439,13 @@ def get_partitions_in_use(mountpoint :str) -> Dict[str, Any]:
 			continue
 
 		if isinstance(blockdev, Partition):
-			for blockdev_mountpoint in blockdev.mountpoints:
-				block_devices_mountpoints[blockdev_mountpoint] = blockdev
+			if blockdev.mountpoints:
+				for blockdev_mountpoint in blockdev.mountpoints:
+					block_devices_mountpoints[blockdev_mountpoint] = blockdev
 		else:
-			for blockdev_mountpoint in blockdev.mount_information:
-				block_devices_mountpoints[blockdev_mountpoint['target']] = blockdev
+			if blockdev.mount_information:
+				for blockdev_mountpoint in blockdev.mount_information:
+					block_devices_mountpoints[blockdev_mountpoint['target']] = blockdev
 
 	log(f'Filtering available mounts {block_devices_mountpoints} to those under {mountpoint}', level=logging.DEBUG)
 
@@ -469,12 +489,6 @@ def disk_layouts() -> Optional[Dict[str, Any]]:
 		return None
 
 
-def encrypted_partitions(blockdevices :Dict[str, Any]) -> bool:
-	for blockdevice in blockdevices.values():
-		for partition in blockdevice.get('partitions', []):
-			if partition.get('encrypted', False):
-				yield partition
-
 def find_partition_by_mountpoint(block_devices :List[BlockDevice], relative_mountpoint :str) -> Partition:
 	for device in block_devices:
 		for partition in block_devices[device]['partitions']: