Update bootloader config

add-calamares-desktop-icon

@@ -0,0 +1,25 @@
+#!/bin/sh
+# Creates an "Install Debian" icon on the live session tested with:
+# Xfce, LXDE, LXqt, Gnome, KDE, Mate, Cinnamon
+
+
+# Create ~/Desktop just in case this runs before the xdg folder
+# creation script.
+mkdir -p ~/Desktop
+
+
+# Among the Debian desktop environments, LXDE is the only one
+# that behaves completely different.
+if [ -f /usr/bin/lxsession ]; then
+    echo "[Desktop Entry]" > ~/Desktop/install-debian.desktop
+    echo "Type=Link" >> ~/Desktop/install-debian.desktop
+    echo "Name=Install Debian" >> ~/Desktop/install-debian.desktop
+    echo "Icon=install-debian" >> ~/Desktop/install-debian.desktop
+    echo "URL=/usr/share/applications/install-debian.desktop" \
+          >> ~/Desktop/install-debian.desktop
+else
+    cp /usr/share/applications/install-debian.desktop ~/Desktop
+    # Xfce needs this executable otherwise it complains, everything
+    # else doesn't seem to care either way.
+    chmod +x ~/Desktop/install-debian.desktop
+fi

conf/calamares-desktop-icon.desktop

@@ -0,0 +1,9 @@
+[Desktop Entry]
+Type=Application
+Name=Add Calamares Desktop Icon
+Exec=add-calamares-desktop-icon
+StartupNotify=false
+NoDisplay=true
+
+X-GNOME-Autostart-Phase=Initialization
+X-KDE-autostart-phase=1

debian/.gitignore

@@ -0,0 +1,5 @@
+.debhelper/
+calamares-settings-debian.substvars
+calamares-settings-debian/
+debhelper-build-stamp
+files

debian/changelog

@@ -1,3 +1,33 @@
+calamares-settings-debian (10.0.25-1) unstable; urgency=medium
+
+  * New upstream release
+    - Refine fix for initramfs permissions, only apply
+      when encryption is enabled
+
+ -- Jonathan Carter <jcc@debian.org>  Fri, 05 Jul 2019 17:37:33 +0200
+
+calamares-settings-debian (10.0.24-1) unstable; urgency=medium
+
+  * New upstream release
+    - Fix path in previous CVE bug fix
+
+ -- Jonathan Carter <jcc@debian.org>  Wed, 03 Jul 2019 13:29:07 +0000
+
+calamares-settings-debian (10.0.23-1) unstable; urgency=medium
+
+  * New upstream release
+    -  Fixes permissions for initramfs image (CVE-2019-13179)
+       (Closes: #931373)
+
+ -- Jonathan Carter <jcc@debian.org>  Wed, 03 Jul 2019 13:05:47 +0000
+
+calamares-settings-debian (10.0.20-1) unstable; urgency=medium
+
+  * New upstream release
+    - Configure Desktop icon for calamares
+
+ -- Jonathan Carter <jcc@debian.org>  Thu, 18 Apr 2019 08:18:37 +0000
+
 calamares-settings-debian (10.0.19-1) unstable; urgency=medium
 
   * New upstream release

debian/install

@@ -5,3 +5,5 @@ scripts/* usr/sbin
 install-debian usr/bin
 artwork/install-debian.png usr/share/pixmaps
 conf/96_calamares-settings-debian.gschema.override usr/share/glib-2.0/schemas
+conf/calamares-desktop-icon.desktop etc/xdg/autostart
+add-calamares-desktop-icon usr/bin

scripts/bootloader-config

@@ -2,6 +2,14 @@
 
 CHROOT=$(mount | grep proc | grep calamares | awk '{print $3}' | sed -e "s#/proc##g")
 
+# Set secure permissions for the initramfs if we're configuring
+# full-disk-encryption. The initramfs is re-generated later in the
+# installation process so we only set the permissions snippet without
+# regenerating the initramfs right now:
+if [ "$(mount | grep $CHROOT" " | cut -c -16)" = "/dev/mapper/luks" ]; then
+    echo "UMASK=0077" > $CHROOT/etc/initramfs-tools/conf.d/initramfs-permissions
+fi
+
 echo "Running bootloader-config..."
 
 if [ -d /sys/firmware/efi/efivars ]; then