fix(install): refuse out-of-range passphrases before the disk is wiped

The unattended path only checked that a passphrase was non-empty, while zpool create enforces 8-512 characters, so a short passphrase failed after partitioning had already destroyed the old pool. The velox reinstall hit exactly that: its profile shipped a 7-char placeholder, and run 1 died post-wipe. validate_encryption_passphrase now takes min/max bounds. ZFS gets 8-512 pre-flight, and LUKS gets the same 8 minimum the interactive prompt enforces.

Two adjacent gaps close with it: SWAP_SIZE now rejects zero sizes, which previously passed validation and died at sgdisk after the wipe. validate_config warns when the swap partition lands next to an encrypted root, since a hibernate image is a full RAM dump with keys included. The tracked example profiles' 7-char placeholders are now 8 characters.

1 files changed, 27 insertions, 6 deletions

diff --git a/installer/lib/config.sh b/installer/lib/config.sh
index dea65a0..8dedc96 100644
--- a/installer/lib/config.sh
+++ b/installer/lib/config.sh
@@ -146,10 +146,12 @@ validate_config() {
         ((++errors))
     fi
 
-    # SWAP_SIZE: sgdisk size syntax (digits + K/M/G/T), single disk only —
-    # a per-disk swap on a RAID layout has no defined resume device.
+    # SWAP_SIZE: sgdisk size syntax (nonzero digits + K/M/G/T), single
+    # disk only — a per-disk swap on a RAID layout has no defined resume
+    # device. A zero size would pass here and die at sgdisk, after the
+    # wipe, so the leading digit must be 1-9.
     if [[ -n "$SWAP_SIZE" ]]; then
-        if [[ ! "$SWAP_SIZE" =~ ^[0-9]+[KMGT]$ ]]; then
+        if [[ ! "$SWAP_SIZE" =~ ^[1-9][0-9]*[KMGT]$ ]]; then
             warn "Invalid SWAP_SIZE '$SWAP_SIZE' (expected e.g. 100G)"
             ((++errors))
         fi
@@ -157,6 +159,12 @@ validate_config() {
             warn "SWAP_SIZE is only supported on single-disk installs"
             ((++errors))
         fi
+        # Advisory only: the installer creates the partition but doesn't
+        # encrypt it, and a hibernate image is a full RAM dump — keys
+        # included. The velox recipe LUKS-encrypts it post-install.
+        if [[ "$NO_ENCRYPT" != "yes" ]]; then
+            warn "SWAP_SIZE partition is created unencrypted — encrypt it before hibernating (root is encrypted, swap won't be)"
+        fi
     fi
 
     if [[ $errors -gt 0 ]]; then
@@ -176,13 +184,26 @@ validate_filesystem() {
 
 # Ensure an encryption passphrase variable is set when encryption is
 # on. Takes the variable name (ZFS_PASSPHRASE or LUKS_PASSPHRASE) and
-# errors out if NO_ENCRYPT is not "yes" and the named variable is
-# empty. Indirect expansion (${!var_name}) lets one helper handle both
+# an optional minimum length, and errors out if NO_ENCRYPT is not "yes"
+# and the named variable is empty or shorter than the minimum. ZFS
+# enforces an 8-char minimum at pool creation, which lands AFTER
+# partitioning has destroyed the disk — checking here refuses before the
+# wipe. Indirect expansion (${!var_name}) lets one helper handle both
 # ZFS and Btrfs passphrase fields without duplicating the conditional
 # in gather_input's filesystem dispatch.
 validate_encryption_passphrase() {
     local var_name="$1"
-    if [[ "$NO_ENCRYPT" != "yes" && -z "${!var_name}" ]]; then
+    local min_len="${2:-0}"
+    local max_len="${3:-0}"
+    local value="${!var_name}"
+    [[ "$NO_ENCRYPT" == "yes" ]] && return 0
+    if [[ -z "$value" ]]; then
         error "Config missing required: ${var_name} (or set NO_ENCRYPT=yes)"
     fi
+    if [[ ${#value} -lt $min_len ]]; then
+        error "${var_name} must be at least ${min_len} characters"
+    fi
+    if [[ $max_len -gt 0 && ${#value} -gt $max_len ]]; then
+        error "${var_name} must be at most ${max_len} characters"
+    fi
 }