Update bootloader config

add-calamares-desktop-icon

@@ -0,0 +1,25 @@
+#!/bin/sh
+# Creates an "Install Debian" icon on the live session tested with:
+# Xfce, LXDE, LXqt, Gnome, KDE, Mate, Cinnamon
+
+
+# Create ~/Desktop just in case this runs before the xdg folder
+# creation script.
+mkdir -p ~/Desktop
+
+
+# Among the Debian desktop environments, LXDE is the only one
+# that behaves completely different.
+if [ -f /usr/bin/lxsession ]; then
+    echo "[Desktop Entry]" > ~/Desktop/install-debian.desktop
+    echo "Type=Link" >> ~/Desktop/install-debian.desktop
+    echo "Name=Install Debian" >> ~/Desktop/install-debian.desktop
+    echo "Icon=install-debian" >> ~/Desktop/install-debian.desktop
+    echo "URL=/usr/share/applications/install-debian.desktop" \
+          >> ~/Desktop/install-debian.desktop
+else
+    cp /usr/share/applications/install-debian.desktop ~/Desktop
+    # Xfce needs this executable otherwise it complains, everything
+    # else doesn't seem to care either way.
+    chmod +x ~/Desktop/install-debian.desktop
+fi

calamares/branding/debian/branding.desc

@@ -4,15 +4,15 @@ welcomeStyleCalamares: true
 
 strings:
     productName:         Debian GNU/Linux
-    shortProductName:    Debian GNU/Linux
-    version:             10
+    shortProductName:    Debian
+    version:             10 (buster)
     shortVersion:        10
-    versionedName:       Debian GNU/Linux
-    shortVersionedName:  Debian GNU/Linux 10
-    bootloaderEntryName: Debian GNU/Linux
+    versionedName:       Debian 10 (buster)
+    shortVersionedName:  Debian 10
+    bootloaderEntryName: Debian
     productUrl:          https://debian.org
     supportUrl:          https://www.debian.org/support
-    releaseNotesUrl:     https://www.debian.org/releases/stretch/releasenotes
+    releaseNotesUrl:     https://www.debian.org/releases/buster/releasenotes
 
 images:
     productLogo:         "debian-logo.png"

calamares/modules/bootloader.conf

@@ -0,0 +1,54 @@
+# Bootloader configuration. The bootloader is installed to allow
+# the system to start (and pick one of the installed operating
+# systems to run).
+---
+# Define which bootloader you want to use for EFI installations
+# Possible options are 'grub', 'sb-shim' and 'systemd-boot'.
+efiBootLoader: "grub"
+
+# systemd-boot configuration files settings, set kernel and initramfs file names
+# and amount of time before default selection boots
+kernel: "/vmlinuz-linux"
+img: "/initramfs-linux.img"
+fallback: "/initramfs-linux-fallback.img"
+timeout: "10"
+
+# Optionally set the menu entry name and kernel name to use in systemd-boot.
+# If not specified here, these settings will be taken from branding.desc.
+#
+# bootloaderEntryName: "Generic GNU/Linux"
+# kernelLine: ", with Stable-Kernel"
+# fallbackKernelLine:  ", with Stable-Kernel (fallback initramfs)"
+
+# GRUB 2 binary names and boot directory
+# Some distributions (e.g. Fedora) use grub2-* (resp. /boot/grub2/) names.
+# These names are also used when using sb-shim, since that needs some
+# GRUB functionality (notably grub-probe) to work. As needed, you may use
+# complete paths like `/usr/bin/efibootmgr` for the executables.
+#
+grubInstall: "grub-install"
+grubMkconfig: "grub-mkconfig"
+grubCfg: "/boot/grub/grub.cfg"
+grubProbe: "grub-probe"
+efiBootMgr: "efibootmgr"
+
+# Optionally set the bootloader ID to use for EFI. This is passed to
+# grub-install --bootloader-id.
+#
+# If not set here, the value from bootloaderEntryName from branding.desc
+# is used, with problematic characters (space and slash) replaced.
+#
+# The ID is also used as a directory name within the EFI environment,
+# and the bootloader is copied from /boot/efi/EFI/<dirname>/ . When
+# setting the option here, keep in mind that the name is sanitized
+# (problematic characters, see above, are replaced).
+#
+# efiBootloaderId: "dirname"
+
+# Optionally install a copy of the GRUB EFI bootloader as the EFI
+# fallback loader (either bootia32.efi or bootx64.efi depending on
+# the system). This may be needed on certain systems (Intel DH87MC
+# seems to be the only one). If you set this to false, take care
+# to add another module to optionally install the fallback on those
+# boards that need it.
+installEFIFallback: false

calamares/modules/luksopenswaphookcfg.conf

@@ -0,0 +1,4 @@
+# Writes an openswap configuration with LUKS settings to the given path
+---
+# Path of the configuration file to write (in the target system)
+configFilePath: /etc/openswap.conf

calamares/modules/machineid.conf

@@ -0,0 +1,8 @@
+---
+# Whether to create /etc/machine-id for systemd.
+systemd: true
+# Whether to create /var/lib/dbus/machine-id for D-Bus.
+dbus: true
+# Whether /var/lib/dbus/machine-id should be a symlink to /etc/machine-id
+# (ignored if dbus is false, or if there is no /etc/machine-id to point to).
+symlink: true

calamares/modules/mount.conf

@@ -0,0 +1,36 @@
+# Mount filesystems in the target (generally, before treating the
+# target as a usable chroot / "live" system). Filesystems are
+# automatically mounted from the partitioning module. Filesystems
+# listed here are **extra**. The filesystems listed in *extraMounts*
+# are mounted in all target systems. The filesystems listed in
+# *extraMountsEfi* are mounted in the target system **only** if
+# the host machine uses UEFI.
+---
+# Extra filesystems to mount. The key's value is a list of entries; each
+# entry has four keys:
+#   - device    The device node to mount
+#   - fs        The filesystem type to use
+#   - mountPoint Where to mount the filesystem
+#   - options (optional) Extra options to pass to mount(8)
+#
+extraMounts:
+    - device: proc
+      fs: proc
+      mountPoint: /proc
+    - device: sys
+      fs: sysfs
+      mountPoint: /sys
+    - device: /dev
+      mountPoint: /dev
+      options: bind
+    - device: tmpfs
+      fs: tmpfs
+      mountPoint: /run
+    - device: /run/udev
+      mountPoint: /run/udev
+      options: bind
+
+extraMountsEfi:
+    - device: efivarfs
+      fs: efivarfs
+      mountPoint: /sys/firmware/efi/efivars

calamares/modules/packages.conf

@@ -11,3 +11,4 @@ operations:
       - 'live-tools'
       - 'live-task-localisation'
       - 'live-task-recommended'
+      - 'calamares-settings-debian'

calamares/modules/unpackfs.conf

@@ -1,5 +1,5 @@
 ---
 unpack:
-    -   source: "/lib/live/mount/medium/live/filesystem.squashfs"
+    -   source: "/run/live/medium/live/filesystem.squashfs"
         sourcefs: "squashfs"
         destination: ""

calamares/modules/welcome.conf

@@ -10,7 +10,6 @@ requirements:
         - storage
         - ram
         - power
-        - internet
         - root
     required:
         - storage

calamares/settings.conf

@@ -29,7 +29,7 @@ sequence:
   - partition
   - mount
   - unpackfs
-  - sources-media 
+  - sources-media
   - machineid
   - fstab
   - locale
@@ -38,13 +38,13 @@ sequence:
   - users
   - networkcfg
   - hwclock
-  - services
+  - services-systemd
   - bootloader-config
   - grubcfg
   - bootloader
   - packages
   - luksbootkeyfile
-  - luksopenswaphookcfg
+  - plymouthcfg
   - initramfscfg
   - initramfs
   - sources-media-unmount
@@ -67,3 +67,25 @@ sequence:
 # specified here, Calamares then takes care of finding it and
 # loading the contents.
 branding: debian
+
+# If this is set to true, Calamares will show an "Are you sure?" prompt right
+# before each execution phase, i.e. at points of no return. If this is set to
+# false, no prompt is shown. Default is false.
+#
+# YAML: boolean.
+prompt-install: false
+
+# If this is set to true, Calamares will execute all target environment
+# commands in the current environment, without chroot. This setting should
+# only be used when setting up Calamares as a post-install configuration tool,
+# as opposed to a full operating system installer.
+#
+# Some official Calamares modules are not expected to function with this
+# setting. (e.g. partitioning seems like a bad idea, since that is expected to
+# have been done already)
+#
+# Default is false (for a normal installer).
+#
+# YAML: boolean.
+dont-chroot: false
+

conf/96_calamares-settings-debian.gschema.override

@@ -0,0 +1,10 @@
+# Launcher icons
+[org.gnome.shell]
+favorite-apps=['install-debian.desktop', 'firefox-esr.desktop', 'org.gnome.Evolution.desktop', 'rhythmbox.desktop', 'libreoffice-writer.desktop', 'org.gnome.Nautilus.desktop', 'org.gnome.Software.desktop', 'yelp.desktop']
+
+# We don't want the screensaver to enable on the live media while installing
+[org.gnome.desktop.lockdown]
+disable-lock-screen=true
+
+[org.gnome.desktop.session]
+idle-delay=0

conf/calamares-desktop-icon.desktop

@@ -0,0 +1,9 @@
+[Desktop Entry]
+Type=Application
+Name=Add Calamares Desktop Icon
+Exec=add-calamares-desktop-icon
+StartupNotify=false
+NoDisplay=true
+
+X-GNOME-Autostart-Phase=Initialization
+X-KDE-autostart-phase=1

debian/.gitignore

@@ -0,0 +1,5 @@
+.debhelper/
+calamares-settings-debian.substvars
+calamares-settings-debian/
+debhelper-build-stamp
+files

debian/changelog

@@ -1,3 +1,105 @@
+calamares-settings-debian (10.0.25-1) unstable; urgency=medium
+
+  * New upstream release
+    - Refine fix for initramfs permissions, only apply
+      when encryption is enabled
+
+ -- Jonathan Carter <jcc@debian.org>  Fri, 05 Jul 2019 17:37:33 +0200
+
+calamares-settings-debian (10.0.24-1) unstable; urgency=medium
+
+  * New upstream release
+    - Fix path in previous CVE bug fix
+
+ -- Jonathan Carter <jcc@debian.org>  Wed, 03 Jul 2019 13:29:07 +0000
+
+calamares-settings-debian (10.0.23-1) unstable; urgency=medium
+
+  * New upstream release
+    -  Fixes permissions for initramfs image (CVE-2019-13179)
+       (Closes: #931373)
+
+ -- Jonathan Carter <jcc@debian.org>  Wed, 03 Jul 2019 13:05:47 +0000
+
+calamares-settings-debian (10.0.20-1) unstable; urgency=medium
+
+  * New upstream release
+    - Configure Desktop icon for calamares
+
+ -- Jonathan Carter <jcc@debian.org>  Thu, 18 Apr 2019 08:18:37 +0000
+
+calamares-settings-debian (10.0.19-1) unstable; urgency=medium
+
+  * New upstream release
+    - Don't install unnecessary efi file (Closes: #927102)
+    - Fix distribution description
+    - Fix release notes URL
+
+ -- Jonathan Carter <jcc@debian.org>  Mon, 15 Apr 2019 13:32:36 +0000
+
+calamares-settings-debian (10.0.18-1) unstable; urgency=medium
+
+  * New upstream releas
+    - fix efi install path to EFI/debian
+  * Update to debhelper-compat (=12)
+
+ -- Jonathan Carter <jcc@debian.org>  Fri, 15 Feb 2019 16:06:39 +0200
+
+calamares-settings-debian (10.0.17-1) unstable; urgency=medium
+
+  * New upstream release
+    - explicitly remove calamares-settings-debian from calamares packages
+      module
+
+ -- Jonathan Carter <jcc@debian.org>  Wed, 16 Jan 2019 19:14:36 +0200
+
+calamares-settings-debian (10.0.16-1) unstable; urgency=medium
+
+  * New upstream release
+  * Fix package description (Closes: #918222)
+
+ -- Jonathan Carter <jcc@debian.org>  Wed, 16 Jan 2019 12:15:28 +0200
+
+calamares-settings-debian (10.0.15-1) unstable; urgency=medium
+
+  * New upstream release
+  * Update standards version to 4.3.0
+
+ -- Jonathan Carter <jcc@debian.org>  Tue, 08 Jan 2019 10:48:47 +0200
+
+calamares-settings-debian (10.0.14-1) unstable; urgency=medium
+
+  * New upstream release
+
+ -- Jonathan Carter <jcc@debian.org>  Mon, 10 Dec 2018 15:32:26 +0200
+
+calamares-settings-debian (10.0.13-1) unstable; urgency=medium
+
+  * New upstream release
+  * Add libglib2.0-bin to build-depends
+
+ -- Jonathan Carter <jcc@debian.org>  Sat, 01 Dec 2018 11:40:55 +0200
+
+calamares-settings-debian (10.0.10-2) unstable; urgency=medium
+
+  * Fix diverts (Closes: #909492)
+
+ -- Jonathan Carter <jcc@debian.org>  Tue, 25 Sep 2018 14:32:01 +0200
+
+calamares-settings-debian (10.0.10-1) unstable; urgency=medium
+
+  * New upstream release
+
+ -- Jonathan Carter <jcc@debian.org>  Wed, 19 Sep 2018 10:58:27 +0200
+
+calamares-settings-debian (10.0.9-1) unstable; urgency=medium
+
+  * New usptream release
+  * Add divert to hide original Calamares icon
+  * Update standards version to 4.2.1
+
+ -- Jonathan Carter <jcc@debian.org>  Tue, 18 Sep 2018 20:17:54 +0200
+
 calamares-settings-debian (10.0.8-2) unstable; urgency=medium
 
   * Fix watch file

debian/compat

@@ -1 +0,0 @@
-11

debian/control

@@ -2,8 +2,8 @@ Source: calamares-settings-debian
 Section: utils
 Priority: optional
 Maintainer: Jonathan Carter <jcc@debian.org>
-Build-Depends: debhelper (>= 11)
-Standards-Version: 4.2.0
+Build-Depends: debhelper-compat (= 12), libglib2.0-bin
+Standards-Version: 4.3.0
 Homepage: https://salsa.debian.org/live-team/calamares-settings-debian
 Vcs-Git: https://salsa.debian.org/live-team/calamares-settings-debian-packaging.git
 Vcs-Browser: https://salsa.debian.org/live-team/calamares-settings-debian-packaging
@@ -18,7 +18,7 @@ Depends: calamares,
          ${misc:Depends}
 Provides: calamares-settings
 Description: Debian theme and settings for the Calamares Installer
- Calamares is a genereic installer framework for Linux distributions.
+ Calamares is a generic installer framework for Linux distributions.
  By default, it contains a set of boilerplate wording and images. This
  package provides the latest Debian artwork as well as scripts that
  supports EFI installations.

debian/install

@@ -2,4 +2,8 @@ calamares etc
 calamares-modules/* usr/lib/calamares/modules
 scripts/* usr/sbin
 *.desktop usr/share/applications
+install-debian usr/bin
 artwork/install-debian.png usr/share/pixmaps
+conf/96_calamares-settings-debian.gschema.override usr/share/glib-2.0/schemas
+conf/calamares-desktop-icon.desktop etc/xdg/autostart
+add-calamares-desktop-icon usr/bin

debian/lintian-overrides

@@ -1,5 +1,5 @@
 # Only meant to be run by calamares, so its scripts wouldn't have manpages
 calamares-settings-debian: binary-without-manpage
 
-# sudo is from another package but validly so
-calamares-settings-debian: desktop-command-not-in-package
+# We don't provide this file on purpose
+calamares-settings-debian: diversion-for-unknown-file

debian/postrm

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    remove)
+        # Restore original Calamares icon 
+        dpkg-divert --quiet --rename --package calamares-settings-debian \
+                    --remove /usr/share/applications/calamares.desktop
+    ;;
+esac
+
+#DEBHELPER#

debian/preinst

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    install|upgrade)
+	# Hide upstream calamares icon when this package is installed
+        dpkg-divert --quiet --package calamares-settings-debian \
+                    --divert /usr/share/applications/calamares.desktop.orig \
+		    --rename /usr/share/applications/calamares.desktop
+    ;;
+esac
+
+#DEBHELPER#

install-debian

@@ -0,0 +1,15 @@
+#!/bin/sh
+###
+# Wrapper for running calamares on Debian live media
+###
+
+# Stale file left behind by live-build that messes with partitioning
+sudo mv /etc/fstab /etc/fstab.orig.calamares
+
+# Access control to run calamares as root for xwayland
+xhost +si:localuser:root
+pkexec calamares
+xhost -si:localuser:root
+
+# Restore stale fstab, for what it's worth
+sudo mv /etc/fstab.orig.calamares /etc/fstab

install-debian.desktop

@@ -3,9 +3,11 @@ Type=Application
 Version=1.0
 Name=Install Debian
 GenericName=Calamares Installer
-Exec=sudo /usr/bin/calamares
+Exec=install-debian
 Comment=Calamares — Installer for Debian Live
 Keywords=calamares;system;install;debian;installer
 Icon=install-debian
 Terminal=false
 Categories=Qt;System;
+StartupWMClass=calamares
+StartupNotify=True

scripts/bootloader-config

@@ -2,6 +2,14 @@
 
 CHROOT=$(mount | grep proc | grep calamares | awk '{print $3}' | sed -e "s#/proc##g")
 
+# Set secure permissions for the initramfs if we're configuring
+# full-disk-encryption. The initramfs is re-generated later in the
+# installation process so we only set the permissions snippet without
+# regenerating the initramfs right now:
+if [ "$(mount | grep $CHROOT" " | cut -c -16)" = "/dev/mapper/luks" ]; then
+    echo "UMASK=0077" > $CHROOT/etc/initramfs-tools/conf.d/initramfs-permissions
+fi
+
 echo "Running bootloader-config..."
 
 if [ -d /sys/firmware/efi/efivars ]; then

scripts/sources-media

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 CHROOT=$(mount | grep proc | grep calamares | awk '{print $3}' | sed -e "s#/proc##g")
-MEDIUM_PATH="/lib/live/mount/medium"
+MEDIUM_PATH="/run/live/medium"
 RELEASE="buster"
 
 if [ "$1" = "-u" ]; then
@@ -16,12 +16,10 @@ rm -f $CHROOT/etc/apt/sources.list.d/base.list
 
 mkdir -p $CHROOT/$MEDIUM_PATH
 mount --bind $MEDIUM_PATH $CHROOT/$MEDIUM_PATH
-echo "deb [trusted=yes] file:/lib/live/mount/medium $RELEASE main" > $CHROOT/etc/apt/sources.list.d/debian-live-media.list
+echo "deb [trusted=yes] file:$MEDIUM_PATH $RELEASE main" > $CHROOT/etc/apt/sources.list.d/debian-live-media.list
 chroot $CHROOT apt-get update
 # Attempt safest way to remove cruft
-rmdir $CHROOT/lib/live/mount/medium
-rmdir $CHROOT/lib/live/mount
-rmdir $CHROOT/lib/live
-rmdir $CHROOT/lib
+rmdir $CHROOT/run/live/medium
+rmdir $CHROOT/run/live
 
 exit 0