Update bootloader config

debian/changelog

@@ -1,3 +1,11 @@
+calamares-settings-debian (10.0.25-1) unstable; urgency=medium
+
+  * New upstream release
+    - Refine fix for initramfs permissions, only apply
+      when encryption is enabled
+
+ -- Jonathan Carter <jcc@debian.org>  Fri, 05 Jul 2019 17:37:33 +0200
+
 calamares-settings-debian (10.0.24-1) unstable; urgency=medium
 
   * New upstream release

scripts/bootloader-config

@@ -2,10 +2,13 @@
 
 CHROOT=$(mount | grep proc | grep calamares | awk '{print $3}' | sed -e "s#/proc##g")
 
-# Set secure permissions for the initramfs,
-# the initramfs is re-generated later in the installation process
-# so we only set the permissions without regenerating the initramfs now:
-echo "UMASK=0077" > $CHROOT/etc/initramfs-tools/conf.d/initramfs-permissions
+# Set secure permissions for the initramfs if we're configuring
+# full-disk-encryption. The initramfs is re-generated later in the
+# installation process so we only set the permissions snippet without
+# regenerating the initramfs right now:
+if [ "$(mount | grep $CHROOT" " | cut -c -16)" = "/dev/mapper/luks" ]; then
+    echo "UMASK=0077" > $CHROOT/etc/initramfs-tools/conf.d/initramfs-permissions
+fi
 
 echo "Running bootloader-config..."