#!/bin/sh
# runthis.sh - one-shot verification of the fixed LUKS probe + bind order.
# Run in the debian-installer shell (Alt-F2), from /tmp:
#   sh runthis.sh 2>&1 | tee /tmp/verify.log
# Read-only except: writes /target/tmp/verify-key (shredded after) and, on
# success, enrolls ONE TPM keyslot on the current (already-failed) install.
# Nothing reboots. Upload /tmp/verify.log afterwards.
set -u
LUKS_PASSPHRASE='633776703f0b71fac3e13fa344a7587879d23cc60fd7b73b'
LUKS_DEV=""
echo "=== 1. blkid probe (host) ==="
if command -v blkid >/dev/null 2>&1; then
	LUKS_DEV="$(blkid -t TYPE=crypto_LUKS -o device 2>/dev/null | head -n 1 || true)"
	echo "blkid -> [$LUKS_DEV]"
else
	echo "blkid missing on installer"
fi
echo "=== 2. list-devices (host) ==="
if command -v list-devices >/dev/null 2>&1; then
	echo "partitions: $(list-devices partition 2>/dev/null || echo none)"
else
	echo "list-devices missing on installer"
fi
if [ -z "$LUKS_DEV" ]; then
	echo "PROBE FAILED, aborting before bind"
	exit 1
fi
echo "=== 3. keyslots before ==="
chroot /target cryptsetup luksDump "$LUKS_DEV" | grep -E "^ +[0-9]+: " || true
echo "=== 4. bind, FIXED order (-k before positionals) ==="
echo "(no timeout on this box: if it sits at a password prompt or stalls"
echo " for >2 min, press Ctrl+C and report where it stopped)"
printf '%s' "$LUKS_PASSPHRASE" > /target/tmp/verify-key
chmod 600 /target/tmp/verify-key
chroot /target clevis luks bind -d "$LUKS_DEV" -k /tmp/verify-key tpm2 '{}'
echo "bind-exit:$?"
echo "=== 5. clevis list after ==="
chroot /target clevis luks list -d "$LUKS_DEV"
echo "list-exit:$?"
shred -u /target/tmp/verify-key 2>/dev/null || rm -f /target/tmp/verify-key || true
echo "=== done (key shredded) ==="