Linux: rewrite mount.veracrypt in POSIX sh (#1895)

Use POSIX sh and collect VeraCrypt arguments as quoted positional
parameters. Preserve whitespace in option values and keep wildcard
characters literal.

Handle calls without an option list and skip flags supplied between
the mountpoint and -o.

Collect system, nokernelcrypto, headerbak, and timestamp into one
--mount-options argument. Previously, only system had a mapping to
that argument; the remaining options went to the filesystem options.

Reject the obsolete truecrypt option before invoking VeraCrypt.

Validation: 32 cases passed under both Bash and dash using a stub
executable, with comparisons against the original helper.

Signed-off-by: Ville Takio <ville+git@takio.fi>

src/Setup/Linux/mount.veracrypt

@@ -1,23 +1,42 @@
-#!/bin/bash
+#!/bin/sh
-DEV="$1"
+# mount.veracrypt <device> <mountpoint> [flags] [-o comma-options]
-MNTPT="$2"
+DEV=$1
-VCOPTIONS=""
+MNTPT=$2
-OPTIONS=""
+MOUNTOPTS=
+OPTIONS=
 
-shift 3
+shift 2
-IFS=','
+while [ "$#" -gt 0 ] && [ "$1" != "-o" ]; do shift; done
-for arg in $*; do
+[ "$#" -gt 0 ] && shift
-  case "$arg" in
+
-    truecrypt)        VCOPTIONS=(${VCOPTIONS[*]} --truecrypt);;
+OLDIFS=$IFS
-    system)           VCOPTIONS=(${VCOPTIONS[*]} --mount-options=system);;
+IFS=,
-    fs=*)             VCOPTIONS=(${VCOPTIONS[*]} --filesystem=${arg#*=});;
+set -f
-    keyfiles=*)       VCOPTIONS=(${VCOPTIONS[*]} --keyfiles=${arg#*=});;
+OPTSTR="$*"
-    password=*)       VCOPTIONS=(${VCOPTIONS[*]} --password=${arg#*=});;
+# Collect veracrypt arguments as positional parameters so values with spaces
-    pim=*)            VCOPTIONS=(${VCOPTIONS[*]} --pim=${arg#*=});;
+# (e.g. keyfile paths) stay single arguments.
-    protect-hidden=*) VCOPTIONS=(${VCOPTIONS[*]} --protect-hidden=${arg#*=});;
+set --
-    slot=*)           VCOPTIONS=(${VCOPTIONS[*]} --slot=${arg#*=});;
+for arg in $OPTSTR; do
+	case $arg in
+		system|nokernelcrypto|headerbak|timestamp)
+		                  MOUNTOPTS="${MOUNTOPTS:+$MOUNTOPTS,}$arg" ;;
+		truecrypt)
+			echo "mount.veracrypt: TrueCrypt mode is no longer supported" >&2
+			exit 1 ;;
+		fs=*)             set -- "$@" "--filesystem=${arg#*=}" ;;
+		keyfiles=*)       set -- "$@" "--keyfiles=${arg#*=}" ;;
+		password=*)       set -- "$@" "--password=${arg#*=}" ;;
+		pim=*)            set -- "$@" "--pim=${arg#*=}" ;;
+		protect-hidden=*) set -- "$@" "--protect-hidden=${arg#*=}" ;;
+		slot=*)           set -- "$@" "--slot=${arg#*=}" ;;
 		*)                OPTIONS="${OPTIONS}${arg}," ;;
 	esac
 done
+IFS=$OLDIFS
+set +f
 
-/usr/bin/veracrypt --text --non-interactive ${VCOPTIONS[*]} --fs-options="${OPTIONS%,*}" ${DEV} ${MNTPT}
+# veracrypt reads a single --mount-options value, so pass one comma list.
+[ -n "$MOUNTOPTS" ] && set -- "$@" "--mount-options=$MOUNTOPTS"
+
+exec /usr/bin/veracrypt --text --non-interactive "$@" \
+	--fs-options="${OPTIONS%,}" "$DEV" "$MNTPT"