Migrate the platform to Alpine for root volume immutability

[bgshacklett]

No description provided.

[bgshacklett]

@cubic-dev-ai review this pull request

[cubic-dev-ai]

@cubic-dev-ai review this pull request

@bgshacklett I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

12 issues found across 20 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="etc/unattended.sh">

<violation number="1" location="etc/unattended.sh:22">
P2: The `*.disabled` case is unreachable dead code because `find` already filters to only `*.sh` files. If the intent is to skip disabled scripts (e.g., `01-setup.sh.disabled`), the `find` pattern needs to be broadened so those files enter the pipeline in the first place.</violation>

<violation number="2" location="etc/unattended.sh:48">
P2: No guard for an empty `$BOOT`. If the boot media isn't found, `$BOOT` will be empty and `. "$BOOT/unattended.lib.sh"` will attempt to source `/unattended.lib.sh`, failing with a misleading "No such file" error. Add a check after the discovery block.</violation>
</file>

<file name="etc/pre-network.d/10-setup-wifi.qemu.sh">

<violation number="1" location="etc/pre-network.d/10-setup-wifi.qemu.sh:107">
P2: Use `$IP` instead of bare `ip` here for consistency with the rest of the script. The `IP=/sbin/ip` variable was defined to ensure the correct binary is used; this line bypasses that.</violation>
</file>

<file name="extras/wpa_supplicant.conf.example">

<violation number="1" location="extras/wpa_supplicant.conf.example:1">
P2: Country code should be uppercase `US` per ISO 3166-1 alpha-2 convention. Lowercase may not be recognized correctly by the kernel's wireless regulatory domain subsystem on some platforms.</violation>
</file>

<file name="extras/answers.txt.example">

<violation number="1" location="extras/answers.txt.example:23">
P2: Comment says "Set timezone to local time" but the value is UTC. Either update the comment to reflect that UTC is intentional, or change the value to an actual local timezone placeholder (e.g., `${TIMEZONE}`).</violation>
</file>

<file name="etc/unattended.exec.d/90-cleanup.any.sh">

<violation number="1" location="etc/unattended.exec.d/90-cleanup.any.sh:7">
P1: `shred` is not available in BusyBox/Alpine by default (requires `coreutils` package). Because the error is suppressed with `2>/dev/null || true`, the WiFi credentials file will silently remain on disk undeleted. Add a fallback `rm` to ensure the file is at least removed when `shred` isn't available.</violation>
</file>

<file name="etc/unattended.exec.d/99-commit.any.sh">

<violation number="1" location="etc/unattended.exec.d/99-commit.any.sh:16">
P2: Reset `OPTIND=1` before the `getopts` loop. Without this, if `lbu_commit` is invoked more than once in the same shell process (or the script is sourced after another `getopts` user), argument parsing silently skips all options.</violation>
</file>

<file name=".gitignore">

<violation number="1" location=".gitignore:11">
P2: `!**/README.md` will not un-ignore `etc/unattended.conf.d/README.md` because its parent directory is excluded by `etc/*`. Git does not traverse into ignored directories to apply negation patterns. You need to explicitly un-ignore the parent directory first, then re-ignore its contents.</violation>
</file>

<file name="scripts/alpine-rpi.sh">

<violation number="1" location="scripts/alpine-rpi.sh:49">
P2: When `EXTRA_FILES` is empty (the common case), `${EXTRA_FILES[@]:-()}` evaluates to the literal string `"()"`, making `EXTRA_FILES` a one-element array containing `"()"` rather than remaining empty. Use the `${arr[@]+...}` pattern to safely handle unset/empty arrays under `set -u`.</violation>

<violation number="2" location="scripts/alpine-rpi.sh:108">
P2: The `umount` in the trap is missing `sudo`. Since `mount` is called with `sudo` on line 102, the cleanup trap will fail to unmount unless the script is already running as root.</violation>

<violation number="3" location="scripts/alpine-rpi.sh:315">
P1: Bug: `extra_files=("$@")` captures all positional parameters including the first 8 named ones. This causes spurious "not a file" warnings and means the `${#extra_files[@]} -gt 0` check is always true. Use `("${@:9}")` to capture only arguments beyond the 8th.</violation>
</file>

<file name="etc/unattended.exec.d/70-setup-diskless.any.sh">

<violation number="1" location="etc/unattended.exec.d/70-setup-diskless.any.sh:107">
P1: `INTERFACESOPTS_SSID` and `INTERFACESOPTS_PSK` are never exported, so `envsubst` in `setup_alpine()` will substitute them with empty strings. Unlike `LBUOPTS` (which is explicitly exported), these remain local shell variables invisible to `envsubst`.</violation>
</file>

_{Tip: instead of fixing issues one by one fix them all with cubic
Re-trigger cubic}

[cubic-dev-ai]

I've fixed all 12 review issues:

1. etc/pre-network.d/10-setup-wifi.qemu.sh:107 — Changed bare ip to $IP for consistency
2. etc/unattended.exec.d/70-setup-diskless.any.sh:107 — Added export for INTERFACESOPTS_SSID and INTERFACESOPTS_PSK so envsubst can see them
3. etc/unattended.exec.d/90-cleanup.any.sh:7 — Changed || true to || rm -f ... so the file is removed when shred isn't available
4. etc/unattended.exec.d/99-commit.any.sh:16 — Added OPTIND=1 before the getopts loop
5. etc/unattended.sh:22 — Removed unreachable *.disabled case (find already filters to *.sh)
6. etc/unattended.sh:48 — Added [ -z "$BOOT" ] guard with fatal error before sourcing the lib
7. extras/answers.txt.example:23 — Updated comment to match the actual UTC value
8. extras/wpa_supplicant.conf.example:1 — Changed country=us to country=US (ISO 3166-1 alpha-2)
9. .gitignore:11 — Un-ignored etc/unattended.conf.d directory, then re-ignored its contents except README.md
10. scripts/alpine-rpi.sh:49 — Fixed EXTRA_FILES to use ${arr[@]+...} pattern for safe empty-array handling
11. scripts/alpine-rpi.sh:108 — Added sudo to umount in the cleanup trap
12. scripts/alpine-rpi.sh:315 — Changed ("$@") to ("${@:9}") to capture only extra arguments beyond the 8 named parameters

✅ All shell scripts pass syntax checking (bash -n)

Pushed commits to alpine.

[cubic-dev-ai]

6 issues found across 23 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="etc/unattended.sh">

<violation number="1" location="etc/unattended.sh:20">
P1: The `find | sort | while read` pipeline runs the loop in a subshell where `set -e` error propagation is unreliable across shell implementations. If a step script fails, the script may silently continue and reboot with incomplete setup. Redirecting from a temporary file avoids the subshell issue and ensures `set -e` catches failures.</violation>
</file>

<file name="etc/unattended.exec.d/99-commit.any.sh">

<violation number="1" location="etc/unattended.exec.d/99-commit.any.sh:62">
P1: Password is leaked to stderr in the hint message. `$_fwd_opts` contains `-p PASSWORD` and is printed verbatim in this error output, potentially exposing the encryption password in logs.</violation>
</file>

<file name="etc/pre-network.d/10-setup-wifi.qemu.sh">

<violation number="1" location="etc/pre-network.d/10-setup-wifi.qemu.sh:32">
P2: APK repository is switched to HTTP to bootstrap CA certs but never reverted to HTTPS. Subsequent `apk add` calls (lines 72-73) download and install packages over plain HTTP, which is vulnerable to man-in-the-middle attacks. After `ca-certificates-bundle` is installed, switch back to HTTPS.</violation>
</file>

<file name="etc/unattended.exec.d/70-setup-diskless.any.sh">

<violation number="1" location="etc/unattended.exec.d/70-setup-diskless.any.sh:77">
P2: If no `.boot_repository` file is found, `xargs dirname` receives empty input and invokes `dirname` with no arguments, which fails under `set -e`. Add a guard or use `xargs -r` (BusyBox supports it) to avoid running `dirname` on empty input, and validate that `LBUOPTS` is non-empty before proceeding.</violation>
</file>

<file name="scripts/alpine-rpi.sh">

<violation number="1" location="scripts/alpine-rpi.sh:322">
P1: DTB path mismatch: `populate_boot_qemu` saves the DTB to `boot/qemu-rpi4.dtb`, but `_verify` and `_copy_launch_files` (called by `launch`) use the global `DTB_FILE` (e.g., `bcm2710-rpi-3-b-plus.dtb`). These commands will fail because the file doesn't exist at the expected path.

Consider using a consistent variable (e.g., `QEMU_DTB_PATH`) that `populate_boot_qemu` sets and that `verify`/`launch` reference, or change `populate_boot_qemu` to save the DTB at the board-derived `DTB_FILE` path.</violation>

<violation number="2" location="scripts/alpine-rpi.sh:540">
P1: `with_p1_qemu` relies on an EXIT trap for cleanup but never unmounts explicitly on return. In `launch()`, this causes compounding failures: `verify()` leaves the image mounted, then `with_p1_qemu` is called again (stacked mount on same path), and finally `exec` prevents the last trap from ever firing — leaving loop devices leaked and the image host-mounted while QEMU accesses it via `-drive`.

Consider adding explicit cleanup at the end of `with_p1_qemu` (unmount + loop_unmap after `"$@"` returns) and using the trap only as a safety net for abnormal exits.</violation>
</file>

_{Tip: instead of fixing issues one by one fix them all with cubic
Re-trigger cubic}