Add security.debian.org to sources.list (except for unstable/sid). [Closes: issue967]

[grml-debootstrap.git] / chroot-script

diff --git a/chroot-script b/chroot-script
index 75c6990..470a111 100755 (executable)
--- a/chroot-script
+++ b/chroot-script
@@ -20,7 +20,7 @@ if [ -x /usr/bin/aptitude ] ; then
    APTINSTALL="aptitude -y --without-recommends install $DPKG_OPTIONS"
    APTUPDATE='aptitude update'
 else
-   APTINSTALL="apt-get --force-yes -y install $DPKG_OPTIONS"
+   APTINSTALL="apt-get --force-yes -y --no-install-recommends install $DPKG_OPTIONS"
    APTUPDATE='apt-get update'
 fi
 
@@ -42,6 +42,15 @@ stage() {
   echo "   Executing stage ${1}"
   return 0
 }
+
+askpass() {
+  # read -s emulation for dash. result is in $resp.
+  set -o noglob
+  stty -echo
+  read resp
+  stty echo
+  set +o noglob
+}
 # }}}
 
 # define chroot mirror {{{
@@ -52,9 +61,23 @@ chrootmirror() {
   if [ -n "$ISO" ] ; then
      echo "deb $ISO $RELEASE $COMPONENTS" > /etc/apt/sources.list
      [ -n "$MIRROR" ] && echo "deb $MIRROR $RELEASE $COMPONENTS" >> /etc/apt/sources.list || true
+     # add security.debian.org:
+     case "$RELEASE" in
+       unstable|sid) ;;  # no security pool available
+       *)
+         echo "deb http://security.debian.org ${RELEASE}/updates $COMPONENTS" >> /etc/apt/sources.list
+         ;;
+     esac
   else
     if [ -n "$MIRROR" ] ; then
        echo "deb $MIRROR $RELEASE $COMPONENTS" > /etc/apt/sources.list
+       # add security.debian.org:
+       case "$RELEASE" in
+         unstable|sid) ;;  # no security pool available
+         *)
+           echo "deb http://security.debian.org ${RELEASE}/updates $COMPONENTS" >> /etc/apt/sources.list
+           ;;
+       esac
     fi
   fi
 }
@@ -64,8 +87,8 @@ chrootmirror() {
 grmlrepos() {
   if [ -n "$GRMLREPOS" ] ; then
      # user might have provided their own apt sources.list
-     if ! grep -q grml /etc/apt/sources.list 2>/dev/null ; then
-        cat >> /etc/apt/sources.list << EOF
+     if ! grep -q grml /etc/apt/sources.list.d/grml.list 2>/dev/null ; then
+        cat >> /etc/apt/sources.list.d/grml.list << EOF
 
 # grml: stable repository:
   deb     http://deb.grml.org/ grml-stable  main
@@ -78,10 +101,15 @@ grmlrepos() {
 EOF
      fi
 
-     # make sure we have the keys available for aptitude
-     gpg --keyserver subkeys.pgp.net --recv-keys F61E2E7CECDEA787
-     gpg --export F61E2E7CECDEA787 | apt-key add - || true # not yet sure
-     # why it's necessary, sometimes we get an error even though it works [mika]
+     if apt-get update ; then
+       apt-get -y --allow-unauthenticated install grml-debian-keyring
+       apt-get update
+     else
+       # make sure we have the keys available for aptitude
+       gpg --keyserver subkeys.pgp.net --recv-keys F61E2E7CECDEA787
+       gpg --export F61E2E7CECDEA787 | apt-key add - || true # not yet sure
+       # why it's necessary, sometimes we get an error even though it works [mika]
+     fi
 
      # make sure we install packages from grml's pool only if not available
      # from Debian!
@@ -131,7 +159,12 @@ EOF
 
 # remove now useless apt cache {{{
 remove_apt_cache() {
-    find /var/cache/apt/archives -name '*.deb' -exec rm -f '{}' \;
+  if [ "$RM_APTCACHE" = 'yes' ] ; then
+    echo "Cleaning apt cache."
+    apt-get clean
+  else
+    echo "Not cleaning apt cache as \$RM_APTCACHE is unset."
+  fi
 }
 # }}}
 
@@ -183,7 +216,7 @@ kernel() {
   if [ -n "$KERNEL" ] ; then
      $APTUPDATE
      # note: install busybox to be able to debug initramfs
-     KERNELPACKAGES="linux-image-$KERNEL linux-headers-$KERNEL busybox"
+     KERNELPACKAGES="linux-image-$KERNEL linux-headers-$KERNEL busybox firmware-linux"
      DEBIAN_FRONTEND=$DEBIAN_FRONTEND $APTINSTALL $KERNELPACKAGES
   fi
 }
@@ -222,10 +255,14 @@ passwords()
      echo "Setting password for user root:"
      while [ "$a" != "$b" ] ; do
        echo -n "Enter new UNIX password for user root: "
-       read -s a
+       askpass
+       a="$resp"
+       unset resp
        echo
        echo -n "Retype new UNIX password for user root: "
-       read -s b
+       askpass
+       b="$resp"
+       unset resp
        echo
        if [ "$a" != "$b" ] ; then
          echo "Sorry, passwords do not match. Retry."
@@ -371,22 +408,42 @@ initrd() {
 # }}}
 
 # grub configuration/installation {{{
-grub_config() {
+grub_install() {
+
   if [ -z "$GRUB" ] ; then
-     echo "Warning: \$GRUB is not defined, will not adjust grub configuration therefore."
+     echo "Notice: \$GRUB not defined, will not install grub therefore."
+     return 0
+  fi
+
+  if ! [ -x "$(which grub-install)" ] ; then
+     echo "Error: grub-install not available. (Error while installing grub package?)" >&2
+     return 1
+  fi
+
+  if [ -n "$SELECTED_PARTITIONS" ] ; then # using sw-raid
+     for device in $SELECTED_PARTITIONS ; do
+        GRUB="${device%%[0-9]}"
+        echo "Installing grub on ${GRUB}:"
+        grub-install --no-floppy "$GRUB"
+     done
   else
-     echo "Adjusting grub configuration for use on ${GRUB}."
+     echo "Installing grub on ${GRUB}:"
+     grub-install --no-floppy "$GRUB"
+  fi
 
-     # finally install grub
-     if [ -x /usr/sbin/update-grub ] ; then
-        UPDATEGRUB='/usr/sbin/update-grub'
-     else
-        UPDATEGRUB='/sbin/update-grub'
-     fi
+  echo "Adjusting grub configuration for use on ${GRUB}."
 
-     # grub2:
-     $UPDATEGRUB
+  # finally install grub
+  if [ -x /usr/sbin/update-grub ] ; then
+     UPDATEGRUB='/usr/sbin/update-grub'
+  elif [ -x /sbin/update-grub ] ; then
+     UPDATEGRUB='/sbin/update-grub'
+  else
+    echo "Error: update-grub not available, can not execute it." >&2
+    return 1
   fi
+
+  $UPDATEGRUB
 }
 # }}}
 
@@ -411,15 +468,14 @@ services() {
 }
 # }}}
 
-# unmount all filesystems in chroot, make sure nothing is left {{{
+# unmount /proc and make sure nothing is left {{{
 finalize() {
   # make sure we don't leave any sensible data
   rm -f /etc/debootstrap/variables
+
   [ -n "$POLICYRCD" ] && rm -f /usr/sbin/policy-rc.d
-  umount -a    1>/dev/null 2>/dev/null || true
-  umount /proc 1>/dev/null 2>/dev/null || true
-  umount /proc 1>/dev/null 2>/dev/null || true
-  umount -a    1>/dev/null 2>/dev/null || true
+
+  umount /proc >/dev/null 2>/dev/null || true
 }
 # }}}
 
@@ -441,9 +497,9 @@ trap signal_handler HUP INT QUIT TERM
  install_policy_rcd
 
  for i in chrootmirror grmlrepos kernelimg_conf \
-     remove_apt_cache kernel packages extrapackages reconfigure hosts interfaces   \
-     timezone fstab hostname initrd grub_config passwords custom_scripts   \
-     services ; do
+     kernel packages extrapackages  reconfigure hosts interfaces \
+     timezone fstab hostname initrd grub_install passwords        \
+     custom_scripts remove_apt_cache services ; do
      if stage $i ; then
        $i && stage $i done || exit 1
      fi