install

#!/usr/bin/zsh
# vim: set ft=sh ts=4 sw=4 et:

# 安装系统所用的硬盘
disk='/dev/sda'
# 默认用户名称
user='administrator'
# 默认用户密码
pass='1145141919810'

if ! sha512sum -c sha512sums; then
    curl -so /dev/null https://ping.archlinux.org || iwctl
    {
        systemctl restart reflector
        pacman -Sy --needed --noconfirm git
    }&
    if [ ! -f id_ed25519 ]; then
        # 写死IP地址，对抗DNS污染
        for ip in 185.199.{108..111}.133; do
            curl --connect-timeout 1 \
                --resolve raw.githubusercontent.com:443:$ip \
                -sO https://raw.githubusercontent.com/n0tr00teuorg/dotfiles/main/id_ed25519 && break
        done
        chmod -v 0600 id_ed25519
    fi
    # 写死GitHub的指纹，用于初次免验证，且更安全
    echo 'github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl' >~/.ssh/known_hosts
    wait
    # 使用SSH协议更容易通过墙
    GIT_SSH_COMMAND="ssh -i $(pwd)/id_ed25519" \
        git clone git@github.com:n0tr00teuorg/dotfiles --depth 1
    cd "$(dirname $0)"
    [ -d dotfiles ] && cd dotfiles
    ./install 2>&1 | tee install.log

    # 允许15秒内终止脚本执行进行debug
    sleep 15
    mv -v install.log /mnt/boot
    [ -f /mnt/var/swap ] && swapoff -v /mnt/var/swap
    umount -Rv /mnt
    cryptsetup -v close root
    reboot
fi

# 当前进程可用处理器数
nproc="$(nproc)"
# 临时目录
tmp="$(mktemp)"

UEFI=([ -d /sys/firmware/efi/efivars ])
if ! $UEFI; then
    echo '\033[31mError: This script does not support legacy BIOS mode.\033[0m'
    exit 1
fi

keys=(07C1003E46490054A20D3A8E250A4BA6630FD7F1	# selinux（我自签的selinux镜像，即使使用github镜像，也不用担心被篡改）
      882DCFE48E2051D48E2562ABF3B607488DB35A47	# cachyos
      A3873AB27021C5DD39E0501AFBA220DFC880C036	# chaotic-aur
      CCED9BE21E1173C61DC1C9407931B6D628C8D3BA	# arch4edu
      F9A6E68A711354D84A9B91637533BAFE69A25079)	# blackarch

keyrings=('arch4edu-keyring'
          'archlinuxcn-keyring'
          'blackarch-keyring'
          'cachyos-keyring'
          'chaotic-keyring')

mirrorlists=('archlinuxcn-mirrorlist-git'
             'blackarch-mirrorlist'
             'cachyos-mirrorlist'
             'chaotic-mirrorlist'
             'mirrorlist.arch4edu'
             'selinux-mirrorlist'
             'xyne-mirrorlist')

# 软件源测速排序需要 rankmirrors
pacman -Sy --needed --noconfirm pacman-contrib

# 密钥环初始化 & 准备镜像列表
cp -vfr mnt/etc/pacman.d/* /etc/pacman.d/
cp -vfb {mnt,}/etc/pacman.conf
mv -vf /etc/pacman.d/{mirrorlist,archlinux}
v=$(/usr/lib/ld-linux-x86-64.so.2 --help | grep -Po '(?<=x86-64-v).(?= \(supported)')
if [[ $v =~ 4 ]]; then
    mirrorlists+='cachyos-v4-mirrorlist'
    cat mnt/etc/pacman_v4.conf   >> /etc/pacman.conf
fi
if [[ $v =~ 3 ]]; then
    keys+=0D4D2FDAF45468F3DDF59BEDE3D0D2CD3952E298
    keyrings+='alhp-keyring'
    mirrorlists+=('alhp-mirrorlist' 'cachyos-v3-mirrorlist')
    cat mnt/etc/pacman_v3.conf   >> /etc/pacman.conf
fi
cat mnt/etc/pacman_baseline.conf >> /etc/pacman.conf
tr ' ' '\n' <<< "$mirrorlists" | mnt/etc/pacman.d/hooks/rankmirrors
pacman-key --verbose --init
pacman-key --verbose --import .
pacman-key --verbose --lsign-key $keys
pacman-key --verbose --populate
pacman -Sy --needed  --noconfirm --overwrite "*" $keyrings

# 分区
sfdisk --delete "$disk"
shred -zvs 251M "$disk"
parted -sa  opt "$disk"             \
    mklabel gpt                     \
    mkpart  EFI     fat32   1M 150M \
    mkpart  primary btrfs 150M 100% \
    set     1       esp     on      \
    set     2       root    on
mkfs.fat -vF 32 "$disk"1

# 磁盘加密
dd bs=512 count=4 if=/dev/random of=root.key iflag=fullblock
cryptsetup -vq luksFormat "$disk"2    root.key
cryptsetup -v  open       "$disk"2 -d root{.key,}

# Btrfs 配置，子卷管理和分区挂载
mkfs.btrfs -vfn 32k    /dev/mapper/root
mount -vo compress=lzo /dev/mapper/root /mnt
echo -n ,etc,home,opt,usr,var | xargs -P$nproc -i -d, btrfs -v subvolume create /mnt/@{}
umount -v /mnt
mount  -vo noatime,nodiratime,compress=lzo,subvol=@ /dev/mapper/root /mnt
mkdir  -v /mnt/{boot,etc,home,opt,usr,var}
mount  -vo noatime,nodiratime "$disk"1 /mnt/boot &
echo -n  etc,home,opt,usr,var | xargs -P$nproc -i -d, \
    mount -vo noatime,nodiratime,compress=lzo,subvol=@{} /dev/mapper/root /mnt/{}
chattr +C /mnt/var

# 自动计算交换文件所需要的大小
size=$(($(grep 'MemTotal' /proc/meminfo | awk '{print $2}') >> 19))
if (( $size < 32 )); then
    (( $size > 8 )) && size=8
    avail=$(df -BG --output=avail /dev/mapper/root | tail -n1)
    if (( $((size << 3)) < ${avail%G*} )); then
        # 创建交换文件
        truncate -s 0 /mnt/var/swap
        fallocate -vl "$size"G /mnt/var/swap
        chmod -v 0600 /mnt/var/swap
        mkswap        /mnt/var/swap
        swapon        /mnt/var/swap
    fi
fi

cp -rvf  mnt/.  /mnt
rm -rvf /mnt/etc/pacman*
install -Dm600 root.key "/mnt/etc/cryptsetup-keys.d/root.key"
chmod -v 0700           "/mnt/etc/cryptsetup-keys.d"

# 创建分区表
genfstab /mnt | grep -E '/(etc|usr)' \
              | sed 's#\t/#\t/sysroot/#'  >>/mnt/etc/fstab.initramfs    &
genfstab /mnt | sed -E  '/^(#.*)?$/d'     >>/mnt/etc/fstab              &
echo -n "root $disk"2                     >>/mnt/etc/crypttab.initramfs &
wait

# 安装汐统
cp -v {/usr/bin,$tmp}/pacstrap
sed -i 's#/mirrorlist#/*#g' $tmp/pacstrap  # 添加支持复制第三方镜像列表
$tmp/pacstrap -P /mnt $keyrings $mirrorlists $(<pkgs.txt)
rm -vf /mnt/etc/**/*.pacnew &

# 将系统时钟设置到硬件时钟
hwclock --systohc --adjfile /mnt/etc/adjtime &

# 新建用户
useradd -mg wheel -G lp,seat -s /usr/bin/zsh "$user" -P /mnt
echo -n "$user:$pass" | arch-chroot /mnt chpasswd -c YESCRYPT
echo -n "$user localhost = (ALL) ALL" \
    > "/mnt/etc/sudoers.d/$user"
echo -n "ExecStart=-/usr/bin/agetty -o '-p -f -H -- \\\\\\\u' -a $user - \$TERM" \
    >> '/mnt/etc/systemd/system/getty@tty1.service.d/override.conf'
cp    -rv home/.      "/mnt/home/$user"
chmod -Rv g-rwx,o-rwx "/mnt/home/$user" "/mnt/boot"
chown -Rvh 1000:998   "/mnt/home/$user"

# 配置引导
efibootmgr | grep  -Po '(?<=Boot)....(?=\*? Boot with standard options)' \
           | xargs -P$nproc -i efibootmgr -Bb {}
efibootmgr -cd "$disk" -L 'Boot with standard options' -l linux-zen.efi -u
efibootmgr -ab  $(efibootmgr | grep -Pom 1 '(?<=Boot)....(?=\*? Boot with standard options)')

# 本地化
cp -v {/usr/bin,$tmp}/locale-gen
sed -i -E 's#(LOCALE.{,3}=)#\1/mnt#g'                   $tmp/locale-gen
sed -i -E 's#(/usr/lib/locale/locale-archive)#/mnt\1#'  $tmp/locale-gen
sed -i -E 's#(localedef)#\1 --prefix=/mnt#'             $tmp/locale-gen
sed -i -E 's#(/usr/share/locale/locale.alias)#/mnt\1#'  $tmp/locale-gen
$tmp/locale-gen
wait