From e9f82d19c75ac8602f5840794d6bd62e30576c30 Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Fri, 14 Aug 2026 11:51:27 -0500 Subject: fix(install): refuse out-of-range passphrases before the disk is wiped The unattended path only checked that a passphrase was non-empty, while zpool create enforces 8-512 characters, so a short passphrase failed after partitioning had already destroyed the old pool. The velox reinstall hit exactly that: its profile shipped a 7-char placeholder, and run 1 died post-wipe. validate_encryption_passphrase now takes min/max bounds. ZFS gets 8-512 pre-flight, and LUKS gets the same 8 minimum the interactive prompt enforces. Two adjacent gaps close with it: SWAP_SIZE now rejects zero sizes, which previously passed validation and died at sgdisk after the wipe. validate_config warns when the swap partition lands next to an encrypted root, since a hibernate image is a full RAM dump with keys included. The tracked example profiles' 7-char placeholders are now 8 characters. --- installer/velox-btrfs.conf.example | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'installer/velox-btrfs.conf.example') diff --git a/installer/velox-btrfs.conf.example b/installer/velox-btrfs.conf.example index af7c0c0..08581f1 100644 --- a/installer/velox-btrfs.conf.example +++ b/installer/velox-btrfs.conf.example @@ -10,6 +10,6 @@ KEYMAP=us DISKS=/dev/nvme0n1 RAID_LEVEL= -LUKS_PASSPHRASE=welcome -ROOT_PASSWORD=welcome +LUKS_PASSPHRASE=changeme +ROOT_PASSWORD=changeme ENABLE_SSH=yes -- cgit v1.2.3