From b3ed4cda81923a143c8cd63545e58a9b00b1a16c Mon Sep 17 00:00:00 2001 From: cproudlock Date: Mon, 5 Oct 2026 12:24:29 -0400 Subject: [PATCH] blancco-init: give Blancco /run/initramfs from config.img on UEFI On a native boot config.img is an initrd and archiso leaves its files in /run/initramfs, where /opt/scripts/inc/1_reportKey, 2_certificate, 1_config and 2_flexible_container install report.key, ca.pem, hybrid.ids and the flexible container. The Ubuntu-kernel UEFI path never created /run/initramfs, so 1_reportKey wrote an empty /albus/report.key and the rest were skipped (true since 7.15). Fetch config.img, unpack it on a tmpfs mounted at the new root's /run (systemd keeps an existing /run), and fail loudly if report.key is missing. First real 7.20 run (Dell Pro 5 14, Panther Lake, 7.0 kernel) licensed and erased, but did not start the cloud workflow on its own or save the report without a click; the missing report key is the leading suspect. --- playbook/blancco-init.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/playbook/blancco-init.sh b/playbook/blancco-init.sh index 70fae8e..662986f 100644 --- a/playbook/blancco-init.sh +++ b/playbook/blancco-init.sh @@ -192,6 +192,24 @@ if ! wget -q -T 30 -O /run/newroot/albus/config.xml "http://$SERVER/blancco/conf exec /bin/sh fi +# On a native boot config.img is an initrd, its files land in the +# initramfs root and archiso keeps them in /run/initramfs, where Blancco's +# /opt/scripts/inc/* pick up report.key (report signing), certificate.ca, +# hybrid.ids and flexible_container. This path never had them, so +# 1_reportKey wrote an empty /albus/report.key. Recreate the layout on a +# tmpfs at the new root's /run; systemd leaves an existing /run mounted. +mount -t tmpfs -o mode=0755,nosuid,nodev tmpfs /run/newroot/run +mkdir -p /run/newroot/run/initramfs +if wget -q -T 30 -O /tmp/config.img "http://$SERVER/blancco/config.img" && + (cd /run/newroot/run/initramfs && cpio -id < /tmp/config.img 2>/dev/null) && + [ -s /run/newroot/run/initramfs/report.key ]; then + dbg ls -la /run/newroot/run/initramfs +else + echo "ERROR: config.img (report key, certificate) download or unpack failed." + exec /bin/sh +fi +rm -f /tmp/config.img + mkdir -p /run/newroot/etc/X11/xorg.conf.d # Don't pin a single Xorg driver - hardware varies per site (Intel iGPU, # NVIDIA GK208, AMD, etc). Let Xorg auto-pick. With nomodeset + KMS