Skip to content

Commit 1608b7d

Browse files
Copilot0xrinegade
Copilot
and
0xrinegade
committed
Implement critical security and robustness improvements per code review
Co-authored-by: 0xrinegade <[email protected]>
1 parent ea346d2 commit 1608b7d

File tree

7 files changed

+257
-36
lines changed

7 files changed

+257
-36
lines changed

‎bin/osvmarchi-install‎

Lines changed: 147 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,48 @@
55

66
set -euo pipefail
77

8+
# Cleanup function for signals and errors
9+
cleanup() {
10+
local exit_code=$?
11+
12+
# Unmount partitions if they exist
13+
if [[ -d "/mnt" ]]; then
14+
if mountpoint -q "/mnt/boot" 2>/dev/null; then
15+
log_warning "Unmounting /mnt/boot..."
16+
umount "/mnt/boot" 2>/dev/null || true
17+
fi
18+
if mountpoint -q "/mnt" 2>/dev/null; then
19+
log_warning "Unmounting /mnt..."
20+
umount "/mnt" 2>/dev/null || true
21+
fi
22+
fi
23+
24+
# Clean up temporary files
25+
if [[ -f "oswmarchi-boot.sh" ]]; then
26+
rm -f "oswmarchi-boot.sh"
27+
fi
28+
29+
# Clean up secure config directory if empty
30+
if [[ -d "$INSTALL_CONFIG_DIR" ]]; then
31+
rmdir "$INSTALL_CONFIG_DIR" 2>/dev/null || true
32+
fi
33+
34+
# Sync filesystem changes
35+
sync
36+
37+
exit $exit_code
38+
}
39+
40+
# Set up signal traps
41+
trap cleanup EXIT ERR SIGINT SIGTERM
42+
43+
# Source shared utilities first (logging functions)
44+
if [[ -f /home/runner/work/osvmarchi/osvmarchi/bin/osvmarchi-utils ]]; then
45+
source /home/runner/work/osvmarchi/osvmarchi/bin/osvmarchi-utils
46+
elif [[ -f ~/.local/share/osvmarchi/bin/osvmarchi-utils ]]; then
47+
source ~/.local/share/osvmarchi/bin/osvmarchi-utils
48+
fi
49+
850
# Configuration file for installation state - secure location
951
INSTALL_CONFIG_DIR="/run/user/$(id -u)/osvmarchi"
1052
INSTALL_CONFIG_FILE="${INSTALL_CONFIG_DIR}/install.conf"
@@ -65,28 +107,68 @@ cleanup_install_state() {
65107
[[ -d "$INSTALL_CONFIG_DIR" ]] && rmdir "$INSTALL_CONFIG_DIR" 2>/dev/null || true
66108
}
67109

68-
# Colors for output
110+
# Colors for output (fallback if utils not loaded)
69111
RED='\033[0;31m'
70-
GREEN='\033[0;32m'
112+
GREEN='\033[0;32m'
71113
BLUE='\033[0;34m'
72114
YELLOW='\033[1;33m'
73115
NC='\033[0m' # No Color
74116

75-
# Logging functions
76-
log_info() {
77-
echo -e "${BLUE}[INFO]${NC} $1"
78-
}
79-
80-
log_success() {
81-
echo -e "${GREEN}[SUCCESS]${NC} $1"
82-
}
117+
# Fallback logging functions if utils not loaded
118+
if ! declare -f log_info >/dev/null 2>&1; then
119+
log_info() {
120+
echo -e "${BLUE}[INFO]${NC} $1"
121+
}
122+
123+
log_success() {
124+
echo -e "${GREEN}[SUCCESS]${NC} $1"
125+
}
126+
127+
log_warning() {
128+
echo -e "${YELLOW}[WARNING]${NC} $1"
129+
}
130+
131+
log_error() {
132+
echo -e "${RED}[ERROR]${NC} $1"
133+
}
134+
fi
83135

84-
log_warning() {
85-
echo -e "${YELLOW}[WARNING]${NC} $1"
136+
# Install packages with failure tracking
137+
install_packages_with_tracking() {
138+
local package_script="$1"
139+
local failed_packages=()
140+
141+
log_info "Installing packages from $package_script..."
142+
143+
# Source the package script but capture failures
144+
if source "$package_script"; then
145+
log_success "Package installation completed successfully"
146+
return 0
147+
else
148+
# Installation had some failures, but continue
149+
log_warning "Some package installations may have failed"
150+
failed_packages+=("$package_script")
151+
return 1
152+
fi
86153
}
87154

88-
log_error() {
89-
echo -e "${RED}[ERROR]${NC} $1"
155+
# Report installation summary
156+
report_installation_summary() {
157+
local failed_installers=("$@")
158+
159+
if [[ ${#failed_installers[@]} -eq 0 ]]; then
160+
log_success "All package installations completed successfully"
161+
else
162+
echo
163+
log_warning "Installation Summary:"
164+
log_warning "The following package installers had some failures:"
165+
for installer in "${failed_installers[@]}"; do
166+
log_warning " - $installer"
167+
done
168+
log_info "The system should still be functional, but some packages may be missing"
169+
log_info "You can manually install missing packages later using 'pacman -S <package>'"
170+
echo
171+
fi
90172
}
91173

92174
# Check if running on Arch Linux live environment
@@ -359,6 +441,9 @@ automatic_partition() {
359441
wipefs -a "$disk"
360442
sgdisk --zap-all "$disk"
361443

444+
# Sync to ensure disk changes are written
445+
sync
446+
362447
# Create GPT partition table and partitions
363448
log_info "Creating partition table..."
364449
sgdisk --clear \
@@ -370,6 +455,9 @@ automatic_partition() {
370455
partprobe "$disk"
371456
sleep 2
372457

458+
# Sync partition table changes
459+
sync
460+
373461
# Determine partition names (handle nvme vs sda naming)
374462
local boot_part root_part
375463
if [[ $disk =~ nvme ]]; then
@@ -387,6 +475,9 @@ automatic_partition() {
387475
log_info "Formatting root partition..."
388476
mkfs.ext4 -L "OSVMarchi" "$root_part"
389477

478+
# Sync filesystem changes
479+
sync
480+
390481
# Save partition information to config file
391482
save_install_state "OSVMARCHI_BOOT_PART" "$boot_part"
392483
save_install_state "OSVMARCHI_ROOT_PART" "$root_part"
@@ -504,6 +595,7 @@ manual_partition() {
504595
if gum confirm "Format $boot_part as FAT32?"; then
505596
log_info "Formatting EFI partition as FAT32..."
506597
mkfs.fat -F 32 -n "EFI" "$boot_part"
598+
sync # Ensure filesystem changes are written
507599
else
508600
log_error "EFI partition must be FAT32 for UEFI boot"
509601
exit 1
@@ -521,6 +613,7 @@ manual_partition() {
521613
log_warning "EFI partition does not have ESP (EF00) type code"
522614
if gum confirm "Set ESP type code on $boot_part?"; then
523615
sgdisk -t "${part_num}:EF00" "$disk_path"
616+
sync # Ensure partition table changes are written
524617
log_success "ESP type code set"
525618
else
526619
log_warning "Continuing without ESP type code (may cause boot issues)"
@@ -562,10 +655,12 @@ manual_partition() {
562655
"ext4")
563656
log_info "Formatting root partition as ext4..."
564657
mkfs.ext4 -L "OSVMarchi" "$root_part"
658+
sync # Ensure filesystem changes are written
565659
;;
566660
"btrfs")
567661
log_info "Formatting root partition as btrfs..."
568662
mkfs.btrfs -L "OSVMarchi" "$root_part"
663+
sync # Ensure filesystem changes are written
569664
;;
570665
esac
571666
elif [[ "$root_fstype" != "ext4" && "$root_fstype" != "btrfs" && "$root_fstype" != "xfs" ]]; then
@@ -692,9 +787,9 @@ console-mode max
692787
editor no
693788
EOL
694789
695-
# Generate a secure random password
790+
# Generate a secure random password (hex-based for maximum entropy)
696791
generate_secure_password() {
697-
openssl rand -base64 12 | tr -d "=+/" | cut -c1-16
792+
openssl rand -hex 12 # 24-character hex password
698793
}
699794
700795
# Create user
@@ -715,8 +810,8 @@ chmod 0440 /etc/sudoers.d/wheel
715810
# Force password change on first login for user
716811
chage -d 0 user
717812
718-
# Generate secure random password
719-
TEMP_PASSWORD=\$(openssl rand -base64 12 | tr -d "=+/" | cut -c1-16)
813+
# Generate secure random password (hex-based for maximum entropy)
814+
TEMP_PASSWORD=\$(openssl rand -hex 12) # 24-character hex password
720815
721816
# Set the random password
722817
echo "user:\$TEMP_PASSWORD" | chpasswd
@@ -788,7 +883,7 @@ log_error() {
788883
789884
log_info "Downloading OSVMarchi installer..."
790885
791-
# Download the installer script with retry logic
886+
# Download the installer script with retry logic and enhanced verification
792887
local download_attempts=0
793888
local max_download_attempts=3
794889
local download_success=false
@@ -797,14 +892,38 @@ while [[ $download_attempts -lt $max_download_attempts ]] && [[ "$download_succe
797892
download_attempts=$((download_attempts + 1))
798893
log_info "Download attempt $download_attempts of $max_download_attempts..."
799894
800-
if curl -fsSL -o osvmarchi-boot.sh https://raw.githubusercontent.com/openSVM/osvmarchi/master/boot.sh; then
801-
download_success=true
802-
log_success "OSVMarchi installer downloaded successfully"
803-
break
895+
# Download both script and SHA256 hash if available
896+
if curl -fsSL -o osvmarchi-boot.sh https://raw.githubusercontent.com/openSVM/osvmarchi/master/boot.sh && \
897+
curl -fsSL -o boot.sh.sha256 https://raw.githubusercontent.com/openSVM/osvmarchi/master/boot.sh.sha256 2>/dev/null; then
898+
899+
# Verify SHA256 if available
900+
if [[ -f boot.sh.sha256 ]]; then
901+
log_info "Verifying script integrity with SHA256..."
902+
if sha256sum -c boot.sh.sha256 &>/dev/null; then
903+
log_success "Script integrity verified with SHA256"
904+
download_success=true
905+
break
906+
else
907+
log_warning "SHA256 verification failed, falling back to basic verification"
908+
rm -f boot.sh.sha256
909+
fi
910+
fi
911+
912+
# Fall back to basic verification if SHA256 not available or failed
913+
if [[ -s osvmarchi-boot.sh ]] && \
914+
head -1 osvmarchi-boot.sh | grep -q "^#!/bin/bash" && \
915+
grep -q "OSVMarchi" osvmarchi-boot.sh; then
916+
log_success "OSVMarchi installer downloaded and verified"
917+
download_success=true
918+
break
919+
else
920+
log_error "Downloaded script failed basic verification"
921+
rm -f osvmarchi-boot.sh boot.sh.sha256
922+
fi
804923
else
805924
if [[ $download_attempts -lt $max_download_attempts ]]; then
806925
log_warning "Download attempt $download_attempts failed, retrying in 5 seconds..."
807-
rm -f osvmarchi-boot.sh 2>/dev/null || true
926+
rm -f osvmarchi-boot.sh boot.sh.sha256 2>/dev/null || true
808927
sleep 5
809928
else
810929
log_error "Failed to download OSVMarchi installer after $max_download_attempts attempts"
@@ -814,15 +933,9 @@ while [[ $download_attempts -lt $max_download_attempts ]] && [[ "$download_succe
814933
fi
815934
done
816935
817-
# Verify the downloaded script is not empty and contains expected content
936+
# Verify the downloaded script is ready for execution
818937
if [[ ! -s osvmarchi-boot.sh ]]; then
819-
log_error "Downloaded installer is empty"
820-
exit 1
821-
fi
822-
823-
# Basic verification - check for expected OSVMarchi signatures
824-
if ! grep -q "OSVMarchi" osvmarchi-boot.sh || ! grep -q "#!/bin/bash" osvmarchi-boot.sh; then
825-
log_error "Downloaded installer does not appear to be a valid OSVMarchi script"
938+
log_error "Downloaded installer is empty or missing"
826939
exit 1
827940
fi
828941
@@ -832,8 +945,8 @@ log_info "Downloaded installer verified, executing..."
832945
chmod +x osvmarchi-boot.sh
833946
./osvmarchi-boot.sh
834947
835-
# Clean up downloaded script
836-
rm -f osvmarchi-boot.sh
948+
# Clean up downloaded script and hash
949+
rm -f osvmarchi-boot.sh boot.sh.sha256
837950
838951
USEREOF
839952

‎boot.sh.sha256‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
5dfbe669d44591487f5f1c581103a2d81144597a2f227e83e02c84b3ecce9bd5 boot.sh
2+
hanges
3+
# Generate with: sha256sum boot.sh > boot.sh.sha256

‎install/packages-base.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
# Base system packages
3+
sudo pacman -S --noconfirm --needed \
4+
bash-completion \
5+
curl \
6+
git \
7+
gum \
8+
sudo \
9+
wget \
10+
which

‎install/packages-desktop.sh‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/bin/bash
2+
# Desktop environment packages
3+
sudo pacman -S --noconfirm --needed \
4+
alacritty \
5+
avahi \
6+
blueberry \
7+
brightnessctl \
8+
cups \
9+
cups-browsed \
10+
cups-filters \
11+
cups-pdf \
12+
evince \
13+
firefox \
14+
flatpak \
15+
gnome-calculator \
16+
gnome-keyring \
17+
gnome-themes-extra \
18+
gvfs-mtp \
19+
hyprland \
20+
hyprpaper \
21+
mako \
22+
networkmanager \
23+
papirus-icon-theme \
24+
pavucontrol \
25+
pipewire \
26+
pipewire-alsa \
27+
pipewire-pulse \
28+
sddm \
29+
waybar \
30+
wl-clipboard \
31+
wofi \
32+
xdg-desktop-portal-hyprland \
33+
xdg-user-dirs

‎install/packages-development.sh‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash
2+
# Development packages
3+
sudo pacman -S --noconfirm --needed \
4+
bcc-tools \
5+
clang \
6+
cmake \
7+
docker \
8+
docker-buildx \
9+
docker-compose \
10+
gcc14 \
11+
git-delta \
12+
github-cli \
13+
just \
14+
meson \
15+
neovim \
16+
nodejs \
17+
npm \
18+
perf \
19+
protobuf \
20+
rust \
21+
rust-analyzer \
22+
tokei \
23+
tree-sitter \
24+
vscode

‎install/packages-optional.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/bash
2+
# Optional packages
3+
sudo pacman -S --noconfirm --needed \
4+
1password-beta \
5+
1password-cli \
6+
clickhouse \
7+
distrobox \
8+
kubectl \
9+
kubernetes \
10+
lynx \
11+
msedit \
12+
onnxruntime \
13+
podman \
14+
python-transformers \
15+
rocksdb \
16+
tesseract \
17+
virt-manager \
18+
zellij

0 commit comments

Comments
 (0)