h

R-Larocque · R-Larocque · commit 76b22b5afad5 · 2026-05-02T00:31:34.000-04:00
diff --git a/renovate.json b/renovate.json
@@ -0,0 +1,32 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "schedule": ["every weekend"],
+  "packageRules": [
+    {
+      "matchUpdateTypes": ["patch"],
+      "automerge": true,
+      "automergeType": "pr"
+    },
+    {
+      "matchUpdateTypes": ["major"],
+      "dependencyDashboardApproval": true,
+      "labels": ["dependencies", "major-update"]
+    },
+    {
+      "matchUpdateTypes": ["minor"],
+      "groupName": "minor dependencies",
+      "labels": ["dependencies"]
+    },
+    {
+      "matchDepTypes": ["action"],
+      "groupName": "GitHub Actions",
+      "pinDigests": true
+    }
+  ],
+  "labels": ["dependencies"],
+  "prCreation": "not-pending",
+  "rebaseWhen": "behind-base-branch"
+}
diff --git a/src/lufus/drives/formatting.py b/src/lufus/drives/formatting.py
@@ -60,14 +60,17 @@ def unmount(drive: str = None) -> bool:
     log.info("Unmounting %s...", drive)
     for target in targets:
         try:
-            result = subprocess.run(["umount", "-l", target])
-            # exit 32 = "not mounted" on Linux — acceptable when clearing a drive
-            if result.returncode not in (0, 32):
-                log.error("umount -l %s exited with code %d", target, result.returncode)
-                unmount_fail()
-                return False
+            subprocess.run(["umount", "-l", target], check=True)
             time.sleep(0.5)
             log.info("Unmounted %s successfully.", target)
+        except subprocess.CalledProcessError as e:
+            # exit 32 = "not mounted" on Linux — acceptable when clearing a drive
+            if e.returncode == 32:
+                log.info("Unmounted %s (was already unmounted).", target)
+                continue
+            log.error("umount -l %s exited with code %d", target, e.returncode)
+            unmount_fail()
+            return False
         except Exception as e:
             log.error("(UMNTFUNC) Unexpected error type: %s — %s", type(e).__name__, e)
             log_unexpected_error()
diff --git a/src/lufus/gui/gui.py b/src/lufus/gui/gui.py
@@ -1687,9 +1687,7 @@ def get_latest_release(self):
                 if is_newer:
                     self.log_message(f"New version found: {tag_name} > {current_version}", level="DEBUG")
                 else:
-                    self.log_message(
-                        f"Running latest release build: {tag_name} <= {current_version}", level="INFO"
-                    )
+                    self.log_message(f"Running latest release build: {tag_name} <= {current_version}", level="INFO")
                     return
             else:
                 self.log_message(f"Couldn't get latest release, response: {req.status}", level="WARNING")
diff --git a/src/lufus/writing/flash_usb.py b/src/lufus/writing/flash_usb.py
@@ -4,7 +4,7 @@
 import subprocess
 from lufus.utils import strip_partition_suffix
 from lufus.writing.check_file_sig import check_iso_signature
-from lufus.writing.windows.detect import detect_iso_type, IsoType
+from lufus.writing.windows.detect import detect_iso_type, IsoType, is_windows_iso
 from lufus.writing.windows.flash import flash_windows
 from lufus.lufus_logging import get_logger
 from lufus.writing.partition_scheme import PartitionScheme
@@ -33,18 +33,21 @@ def _status(msg: str) -> None:
 
     _status(f"flash_usb called: iso={iso_path}, device={device}")
 
-    # Validate device path before any operation — prevents accidental writes to
-    # system disks if a bad options file or UI bug passes a wrong path.
-    if not re.match(r"^/dev/(sd[a-z]+|nvme[0-9]+n[0-9]+|mmcblk[0-9]+)$", device):
-        log.error("flash_usb: invalid device path %r — aborting", device)
-        _status(f"Flash aborted: invalid device path {device!r}")
-        return False
-
+    # Strip any partition suffix first (e.g. /dev/nvme0n1p1 -> /dev/nvme0n1,
+    # /dev/sdb1 -> /dev/sdb) so that validation operates on the whole-disk path.
     original_device = device
     device = strip_partition_suffix(device)
     if device != original_device:
         _status(f"Stripped partition suffix: {original_device} -> {device}")
 
+    # Validate the (already-stripped) device path before any operation —
+    # prevents accidental writes to system disks if a bad options file or
+    # UI bug passes a wrong path.
+    if not re.match(r"^/dev/(sd[a-z]+|nvme[0-9]+n[0-9]+|mmcblk[0-9]+)$", device):
+        log.error("flash_usb: invalid device path %r — aborting", device)
+        _status(f"Flash aborted: invalid device path {device!r}")
+        return False
+
     try:
         iso_size = os.path.getsize(iso_path)
         _status(f"File size: {iso_size:,} bytes ({iso_size / (1024**3):.2f} GiB)")
@@ -60,8 +63,7 @@ def _status(msg: str) -> None:
             _status(f"Not an ISO file ({os.path.basename(iso_path)}), skipping ISO signature check")
 
         _status("Checking if image contains installation markers...")
-        iso_type = detect_iso_type(iso_path)
-        if iso_type == IsoType.WINDOWS:
+        if is_windows_iso(iso_path):
             _status("Windows Installation media detected, routing to flash_windows (ISO mode)")
             return flash_windows(
                 device,
@@ -70,7 +72,9 @@ def _status(msg: str) -> None:
                 progress_cb=progress_cb,
                 status_cb=status_cb,
             )
-        elif iso_type == IsoType.LINUX:
+
+        iso_type = detect_iso_type(iso_path)
+        if iso_type == IsoType.LINUX:
             _status("Linux Installation media detected, will use dd for flashing")
         else:
             _status("Generic or unknown image, will use dd for flashing")
diff --git a/src/lufus/writing/install_ventoy.py b/src/lufus/writing/install_ventoy.py
@@ -56,12 +56,16 @@ def download_wimboot(dest_path: str) -> bool:
         if _WIMBOOT_SHA256:
             if not _verify_sha256(dest_path, _WIMBOOT_SHA256):
                 os.unlink(dest_path)
-                print("ERROR: wimboot SHA-256 verification failed — file deleted. "
-                      "Check the download source or update _WIMBOOT_SHA256.")
+                print(
+                    "ERROR: wimboot SHA-256 verification failed — file deleted. "
+                    "Check the download source or update _WIMBOOT_SHA256."
+                )
                 return False
         else:
-            print("WARNING: wimboot downloaded without hash verification. "
-                  "Set _WIMBOOT_SHA256 before shipping to production.")
+            print(
+                "WARNING: wimboot downloaded without hash verification. "
+                "Set _WIMBOOT_SHA256 before shipping to production."
+            )
 
         print("wimboot downloaded successfully.")
         return True
@@ -129,15 +133,20 @@ def install_grub(target_device: str) -> bool:
     for partition in glob.glob(f"{target_device}*"):
         subprocess.run(["umount", partition], check=False)
 
+    # Partition separator: NVMe and MMC block devices use 'p' between the
+    # disk name and the partition number (e.g. /dev/nvme0n1p1, /dev/mmcblk0p1).
+    # Standard SCSI/SATA/USB drives use no separator (e.g. /dev/sdb1).
+    sep = "p" if re.search(r"(nvme\d+n\d+|mmcblk\d+)$", target_device) else ""
+
     # Partitioning Definition
     sfdisk_input = f"""
 label: gpt
 device: {target_device}
 unit: sectors
 
-{target_device}1 : start=2048, size=2048, type=21686148-6449-6E6F-7444-6961676F6E61
-{target_device}2 : start=4096, size=204800, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B
-{target_device}3 : start=208896, type=EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
+{target_device}{sep}1 : start=2048, size=2048, type=21686148-6449-6E6F-7444-6961676F6E61
+{target_device}{sep}2 : start=4096, size=204800, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B
+{target_device}{sep}3 : start=208896, type=EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
     """
 
     # Use unique temp dirs instead of hardcoded /tmp paths to avoid stale-mount collisions.
@@ -156,8 +165,8 @@ def install_grub(target_device: str) -> bool:
         subprocess.run(["sync"], check=True)
 
         # Wait for device nodes to be created by udev
-        efi_part = f"{target_device}2"
-        data_part = f"{target_device}3"
+        efi_part = f"{target_device}{sep}2"
+        data_part = f"{target_device}{sep}3"
         for _ in range(10):
             if os.path.exists(data_part):
                 break
diff --git a/src/lufus/writing/windows/detect.py b/src/lufus/writing/windows/detect.py
@@ -27,10 +27,11 @@
 # IsoType enum
 # ---------------------------------------------------------------------------
 
+
 class IsoType(str, Enum):
     WINDOWS = "windows"
-    LINUX   = "linux"
-    OTHER   = "other"
+    LINUX = "linux"
+    OTHER = "other"
 
 
 # ---------------------------------------------------------------------------
@@ -40,11 +41,11 @@ class IsoType(str, Enum):
 # ISO 9660: sector 16 = byte 32768.  Within the PVD:
 #   byte  1– 5 : Standard Identifier "CD001"
 #   byte 40–71 : Volume Identifier (32 a-characters)
-_PVD_OFFSET        = 16 * 2048        # 32768
-_PVD_MAGIC_OFFSET  = _PVD_OFFSET + 1  # where "CD001" lives
-_PVD_MAGIC         = b"CD001"
-_PVD_LABEL_OFFSET  = _PVD_OFFSET + 40
-_PVD_LABEL_SIZE    = 32
+_PVD_OFFSET = 16 * 2048  # 32768
+_PVD_MAGIC_OFFSET = _PVD_OFFSET + 1  # where "CD001" lives
+_PVD_MAGIC = b"CD001"
+_PVD_LABEL_OFFSET = _PVD_OFFSET + 40
+_PVD_LABEL_SIZE = 32
 
 
 def _read_pvd_label(iso_path: str) -> str:
@@ -63,16 +64,49 @@ def _read_pvd_label(iso_path: str) -> str:
         return ""
 
 
+def _read_iso_label(iso_path: str) -> str:
+    """Read the ISO 9660 volume label at the fixed sector-16 offset.
+
+    Unlike _read_pvd_label this does not check the CD001 magic, making it
+    useful for unit tests that write a minimal label-only fixture.  Returns
+    an empty string on OSError (e.g. missing file) or when the file is too
+    small to contain a label.
+    """
+    try:
+        with open(iso_path, "rb") as f:
+            f.seek(_PVD_LABEL_OFFSET)
+            raw = f.read(_PVD_LABEL_SIZE)
+        if len(raw) < _PVD_LABEL_SIZE:
+            return ""
+        return raw.decode("ascii", errors="replace").strip()
+    except OSError as e:
+        log.error("detect: cannot read label from %s: %s", iso_path, e)
+        return ""
+
+
+def _label_is_windows(label: str) -> bool:
+    """Return True if *label* matches a known Windows ISO volume identifier.
+
+    Uses the pre-compiled _WIN_LABEL_RE regex.  Any label beginning with
+    "WIN" already covers all "WINDOWS…" variants, so no redundant prefix
+    check is needed.
+    """
+    return bool(_WIN_LABEL_RE.match(label))
+
+
 # ---------------------------------------------------------------------------
 # File-listing helpers — 7z first, isoinfo as fallback
 # ---------------------------------------------------------------------------
 
+
 def _list_with_7z(iso_path: str) -> "str | None":
     """Return the lowercased 7z file listing, or None on failure / not installed."""
     try:
         r = subprocess.run(
             ["7z", "l", iso_path],
-            capture_output=True, text=True, timeout=30,
+            capture_output=True,
+            text=True,
+            timeout=30,
         )
         if r.returncode == 0:
             return r.stdout.lower()
@@ -98,13 +132,15 @@ def _list_with_isoinfo(iso_path: str) -> "str | None":
         # If the ISO has no RR, isoinfo falls back to ISO 9660 names gracefully.
         r = subprocess.run(
             ["isoinfo", "-f", "-R", "-i", iso_path],
-            capture_output=True, text=True, timeout=30,
+            capture_output=True,
+            text=True,
+            timeout=30,
         )
         if r.returncode == 0:
             lines = []
             for line in r.stdout.splitlines():
                 line = line.strip().lstrip("/").lower()
-                line = re.sub(r";[0-9]+$", "", line)   # strip ;1 version suffix
+                line = re.sub(r";[0-9]+$", "", line)  # strip ;1 version suffix
                 lines.append(line)
             return "\n".join(lines)
         log.warning("detect: isoinfo exited %d", r.returncode)
@@ -139,10 +175,10 @@ def _get_file_listing(iso_path: str) -> "str | None":
 # Files that exist ONLY in Windows installation media.
 # NOTE: EFI directories are deliberately absent — Windows ISOs also have efi/boot/.
 _WIN_FILE_MARKERS = [
-    "sources/install.wim",   # Windows setup image (retail / OEM)
-    "sources/install.esd",   # Windows setup image (ESD download)
-    "sources/install.swm",   # Split setup image (multi-disc)
-    "sources/boot.wim",      # Windows PE boot image
+    "sources/install.wim",  # Windows setup image (retail / OEM)
+    "sources/install.esd",  # Windows setup image (ESD download)
+    "sources/install.swm",  # Split setup image (multi-disc)
+    "sources/boot.wim",  # Windows PE boot image
 ]
 
 
@@ -177,34 +213,27 @@ def _get_file_listing(iso_path: str) -> "str | None":
     "isolinux/isolinux.cfg",
     "syslinux/syslinux.cfg",
     "syslinux/ldlinux.c32",
-
     # ---- GRUB config files — Linux-only for optical/USB media ----
     # Windows uses BCD / bootmgr; it never ships grub.cfg on install media.
     "boot/grub/grub.cfg",
     "boot/grub/i386-pc/",
     "grub/grub.cfg",
-
     # ---- Ubuntu / Kubuntu / Xubuntu / Mint (Casper live system) ----
     "casper/filesystem.squashfs",
     "casper/filesystem.manifest",
     "casper/vmlinuz",
-
     # ---- Debian / Kali / Tails / Parrot (live-boot) ----
     "live/filesystem.squashfs",
     "live/filesystem.manifest",
     "live/vmlinuz",
-
     # ---- Ubuntu / Debian installer marker ----
     ".disk/info",
-
     # ---- Arch Linux (specific sub-paths, not the broad "arch/" directory) ----
     "arch/pkglist.x86_64.txt",
     "arch/boot/x86_64/vmlinuz-linux",
-
     # ---- Fedora / RHEL / CentOS installer (Anaconda) ----
     "images/pxeboot/vmlinuz",
     ".discinfo",
-
     # ---- Generic kernel presence under known Linux-only directories ----
     "boot/vmlinuz",
     "boot/bzimage",
@@ -215,6 +244,7 @@ def _get_file_listing(iso_path: str) -> "str | None":
 # Main detection entry point
 # ---------------------------------------------------------------------------
 
+
 def detect_iso_type(iso_path: str) -> IsoType:
     """Detect the OS family of an ISO image.
 
@@ -274,6 +304,7 @@ def detect_iso_type(iso_path: str) -> IsoType:
 # Backward-compatible wrappers
 # ---------------------------------------------------------------------------
 
+
 def is_windows_iso(iso_path: str) -> bool:
     """Return True if iso_path is a Windows installation image."""
     return detect_iso_type(iso_path) == IsoType.WINDOWS
diff --git a/src/lufus/writing/windows/flash.py b/src/lufus/writing/windows/flash.py
@@ -550,6 +550,7 @@ def _get_disk_size_sectors(drive: str) -> int:
 def _verify_sha256(path: str, expected: str) -> bool:
     """Return True if the SHA-256 of *path* matches *expected* (hex, case-insensitive)."""
     import hashlib
+
     h = hashlib.sha256()
     with open(path, "rb") as f:
         for chunk in iter(lambda: f.read(65536), b""):
@@ -570,8 +571,7 @@ def find_uefi_ntfs_img(status_cb=None) -> str:
         if _UEFI_NTFS_SHA256:
             if not _verify_sha256(candidate, _UEFI_NTFS_SHA256):
                 raise FileNotFoundError(
-                    f"uefi-ntfs.img failed SHA-256 verification. "
-                    f"Re-bundle the file and update _UEFI_NTFS_SHA256."
+                    f"uefi-ntfs.img failed SHA-256 verification. Re-bundle the file and update _UEFI_NTFS_SHA256."
                 )
         return candidate
 
@@ -580,12 +580,12 @@ def find_uefi_ntfs_img(status_cb=None) -> str:
 
     if not _UEFI_NTFS_SHA256:
         log.warning(
-            "Downloading uefi-ntfs.img without a pinned hash — "
-            "set _UEFI_NTFS_SHA256 before shipping to production."
+            "Downloading uefi-ntfs.img without a pinned hash — set _UEFI_NTFS_SHA256 before shipping to production."
         )
 
     try:
         import urllib.request
+
         urllib.request.urlretrieve(UEFI_NTFS_URL, candidate)
         if status_cb:
             status_cb(f"Downloaded uefi-ntfs.img to {candidate}")
