The integrity check is read-only for every filesystem: no repairing fallback, no stdin for a fix question, errors to the FORCE gate

The optional check offered before encryption is called read-only, and for
f2fs it was not: fsck.f2fs --dry-run || fsck.f2fs -a. A fsck.f2fs without
--dry-run, or one that found errors, went on to -a, a repairing mode. -a
also exits 0 when it finds nothing it was told to fix, so on the real tools
(f2fs-tools 1.16) a damaged image that --dry-run reported with exit 4 came
back from the check as PASSED, every time - the FORCE gate never saw the
errors.

Audited, every filesystem's check:
  - ext2/3/4 e2fsck -f -n, btrfs check --readonly, xfs_repair -n, vfat
    fsck.fat -n: read-only already; unchanged but for stdin.
  - f2fs: fsck.f2fs --dry-run alone. Whether it has --dry-run is read from
    its usage first (a bare fsck.f2fs touches no device); without it the
    check is skipped with a warning saying why. No -a, ever.
  - ntfs: ntfsfix --no-action alone. ntfsfix || ntfsresize --info let
    ntfsresize overrule an ntfsfix that refused the volume; both are
    read-only, but the refusal was an error the FORCE gate never saw. Same
    usage probe; without --no-action, a skip.
  - every checker now runs with stdin from /dev/null. On damaged metadata
    fsck.f2fs --dry-run asks "restore lost files? [Y/N]"; answered y, f2fs-
    tools 1.16 segfaults; with stdin closed it exits 255, an error.
  - a missing tool, or a filesystem with no read-only checker, is a skip,
    reported as one - before, "cannot check" (exit 2) was shown as errors.

The verdict goes to a new integrity_check: clean, PASSED; skipped, a loud
warning that nothing was checked or repaired; errors, "Nothing was
repaired", the FORCE gate as before - and, before FORCE, what the shrink
that follows will do if you go on: ext2/3/4 run e2fsck -f -p then -y, f2fs
fsck.f2fs -f, both repairing, unless an earlier run already shrank it.
That shrink-phase fsck is unchanged; it is now stated, not implied.

Each check was run against the real tools on clean and damaged image files
first: none writes a byte (sha256 before and after), and the exit codes
used here are theirs - e2fsck 0/4, fsck.fat 0/1, ntfsfix 0/1, fsck.f2fs
--dry-run 0/4/255, xfs_repair and btrfs check 0.

Tests, uki-fixture-test.sh section 12 (no root): fs_check_ro against fake
checkers that record every call and whether stdin reached them - a
fsck.f2fs that rejects --dry-run must lead to a skip and no -a, no checker
may run anything but its read-only mode or be handed stdin, ntfsresize may
never decide; integrity_check's skip, pass, errors-to-FORCE and its warning
about the shrink; and fs_check_ro against the real tools on image files,
damaged ones included: every image byte-identical, the verdict the
checker's own. Against 1.6.6 it reports 15 failures, among them the -a call
and both damaged f2fs images passed. CI installs the filesystem tools in
the uki-fixtures job; no job is renamed.

docs/FILESYSTEMS.md gains the check's table and what each outcome does,
and its shrink cells say their fsck repairs; INSTALL and SECURITY match.

uki 145/0 (1 skip) on the M2 Max, and again with every Asahi signal hidden
in a user namespace; cmdline 71/0; bash -n and shellcheck -S warning clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: doug445

.github/workflows/lint.yml

@@ -63,8 +63,12 @@ jobs:
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v7
-      - name: install binutils (objcopy, for .cmdline extraction)
-        run: sudo apt-get update -q && sudo apt-get install -y -q binutils
+      # binutils: objcopy, for .cmdline extraction. The filesystem tools: the
+      # integrity check runs against real checkers on small image files.
+      - name: install binutils + filesystem tools
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -y -q binutils e2fsprogs f2fs-tools ntfs-3g dosfstools btrfs-progs xfsprogs
       - name: UKI fixture test
         run: bash tests/uki-fixture-test.sh
 

SECURITY.md

@@ -162,7 +162,8 @@ interesting surface:
   redaction failing to apply when it was not disabled with `--no-redact`.
 * **A read-only tool that writes.** `luks-tune.sh` must never create or destroy
   a keyslot, change a passphrase, or touch data; `--dry-run` anywhere must reach
-  no point of no return and write nothing to the target;
+  no point of no return and write nothing to the target; the integrity check
+  offered before encryption must write nothing and repair nothing;
   `extras/luks-fetch-cache` must read public header
   metadata and nothing else, and its cache at `/var/cache/luks-fetch.txt` is
   world-readable by design, so anything resembling key material appearing in it

bin/luks-deploy.sh

@@ -779,21 +779,93 @@ fs_bytes() {
     esac
 }
 
-# fs_check_ro <dev> <fstype> — read-only integrity check. Returns the checker's
-# exit status; returns 2 (distinct "cannot check") when no checker exists.
+# fs_check_ro <dev> <fstype> — the optional pre-encryption check, read-only for
+# every filesystem: e2fsck -f -n, btrfs check --readonly, xfs_repair -n,
+# fsck.f2fs --dry-run, ntfsfix --no-action, fsck.fat -n — each writes nothing,
+# clean or damaged. Each runs with stdin from /dev/null, so none can put a fix
+# question to you (fsck.f2fs asks one on damaged metadata; answered, it can
+# crash). Returns the checker's status: 0 clean, anything else errors found.
+#
+# Nothing here repairs, and nothing falls back to a mode that does — until
+# 1.6.7 a refused or failed fsck.f2fs --dry-run went on to fsck.f2fs -a, a
+# repairing mode that also turned "errors found" into a pass, and ntfsfix's
+# refusal was overruled by ntfsresize --info. Where this machine has no
+# read-only checker for <fstype> (a fsck.f2fs without --dry-run, an ntfsfix
+# without --no-action, a missing tool), FS_CHECK_SKIP says why and it returns
+# 0 having checked nothing; integrity_check reports that as a skip.
+FS_CHECK_SKIP=""
 fs_check_ro() {
-    local dev="$1" fstype="$2"
+    local dev="$1" fstype="$2" usage
+    FS_CHECK_SKIP=""
     case "$fstype" in
-        ext2|ext3|ext4) e2fsck -f -n "$dev" ;;
-        btrfs)          btrfs check --readonly "$dev" 2>&1 | tail -3 ;;
-        xfs)            xfs_repair -n "$dev" ;;
-        ntfs)           ntfsfix --no-action "$dev" 2>&1 || ntfsresize --info --force "$dev" >/dev/null ;;
-        f2fs)           fsck.f2fs --dry-run "$dev" 2>&1 || fsck.f2fs -a "$dev" ;;
-        vfat)           fsck.fat -n "$dev" ;;
-        *)              return 2 ;;
+        ext2|ext3|ext4)
+            command -v e2fsck >/dev/null 2>&1 || { FS_CHECK_SKIP="e2fsck is not installed"; return 0; }
+            e2fsck -f -n "$dev" </dev/null ;;
+        btrfs)
+            command -v btrfs >/dev/null 2>&1 || { FS_CHECK_SKIP="btrfs-progs is not installed"; return 0; }
+            btrfs check --readonly "$dev" </dev/null 2>&1 | tail -3 ;;
+        xfs)
+            command -v xfs_repair >/dev/null 2>&1 || { FS_CHECK_SKIP="xfs_repair is not installed"; return 0; }
+            xfs_repair -n "$dev" </dev/null ;;
+        ntfs)
+            command -v ntfsfix >/dev/null 2>&1 || { FS_CHECK_SKIP="ntfsfix is not installed"; return 0; }
+            usage=$(ntfsfix --help </dev/null 2>&1 || true)
+            case "$usage" in
+                *--no-action*) ntfsfix --no-action "$dev" </dev/null 2>&1 ;;
+                *) FS_CHECK_SKIP="this ntfsfix has no --no-action mode, so it cannot check without writing"; return 0 ;;
+            esac ;;
+        f2fs)
+            command -v fsck.f2fs >/dev/null 2>&1 || { FS_CHECK_SKIP="fsck.f2fs is not installed"; return 0; }
+            # A bare fsck.f2fs prints its usage and touches no device.
+            usage=$(fsck.f2fs </dev/null 2>&1 || true)
+            case "$usage" in
+                *--dry-run*) fsck.f2fs --dry-run "$dev" </dev/null 2>&1 ;;
+                *) FS_CHECK_SKIP="this fsck.f2fs has no --dry-run mode, so it cannot check without repairing"; return 0 ;;
+            esac ;;
+        vfat)
+            command -v fsck.fat >/dev/null 2>&1 || { FS_CHECK_SKIP="fsck.fat is not installed"; return 0; }
+            fsck.fat -n "$dev" </dev/null ;;
+        *)
+            FS_CHECK_SKIP="there is no read-only checker for $fstype"; return 0 ;;
     esac
 }
 
+# --- integrity_check ---
+# integrity_check <dev> <fstype> — run fs_check_ro and act on what it found.
+# Clean: say so. No read-only checker here: say so, loudly, and go on without
+# a check — never a repairing fallback. Errors: report them, say what the
+# shrink that follows would do about them, and stop unless FORCE is typed.
+# Nothing in this step repairs anything.
+integrity_check() {
+    local dev="$1" fstype="$2" fsck_override=""
+    log "  Running read-only $fstype check (this may take a while)..."
+    if fs_check_ro "$dev" "$fstype"; then
+        if [ -n "$FS_CHECK_SKIP" ]; then
+            warn "  Filesystem check SKIPPED — $FS_CHECK_SKIP."
+            warn "  Nothing was checked, and nothing was repaired. If you can, check $dev"
+            warn "  with a read-only tool yourself before going on."
+        else
+            log "  Filesystem check: PASSED"
+        fi
+        return 0
+    fi
+    err "  Filesystem check found errors! Nothing was repaired."
+    if [ "${DEPLOY_MODE:-encrypt}" = "encrypt" ]; then
+        case "$fstype" in
+            ext2|ext3|ext4)
+                warn "  If you go on, the shrink before encryption (unless an earlier run already"
+                warn "  shrank it) runs e2fsck -f -p, then e2fsck -f -y: it repairs what it finds,"
+                warn "  answering yes to every fix." ;;
+            f2fs)
+                warn "  If you go on, the shrink before encryption (unless an earlier run already"
+                warn "  shrank it) runs fsck.f2fs -f, which repairs what it finds." ;;
+        esac
+    fi
+    ask fsck_override LUKS_FSCK_FORCE "  Continue despite filesystem errors? (Type 'FORCE' to override): "
+    [ "$fsck_override" = "FORCE" ] || fatal "Fix filesystem errors before encrypting."
+}
+# --- end integrity_check ---
+
 # fs_shrink <dev> <fstype> — shrink the filesystem by SHRINK_MB so the LUKS2
 # header fits. Fatal on failure (nothing has been encrypted yet; aborting is
 # free). Caller has already verified the device is unmounted.
@@ -2464,15 +2536,7 @@ else
 fi
 case "$DO_CHECK" in [Nn]|[Nn][Oo]) DO_CHECK=n ;; esac
 if [ "$DO_CHECK" != "n" ]; then
-    log "  Running read-only $ORIG_FSTYPE check (this may take a while)..."
-    if fs_check_ro "$CHECK_DEV" "$ORIG_FSTYPE"; then
-        log "  Filesystem check: PASSED"
-    else
-        err "  Filesystem check found errors!"
-        fsck_override=""
-        ask fsck_override LUKS_FSCK_FORCE "  Continue despite filesystem errors? (Type 'FORCE' to override): "
-        [ "$fsck_override" = "FORCE" ] || fatal "Fix filesystem errors before encrypting."
-    fi
+    integrity_check "$CHECK_DEV" "$ORIG_FSTYPE"
 else
     warn "  Skipping filesystem check."
 fi

docs/FILESYSTEMS.md

@@ -9,16 +9,43 @@ Everything gnome-disks can format is classified below.
 
 | Filesystem | In place? | Shrink tool | Size probe (idempotency guard) | Notes |
 |---|---|---|---|---|
-| ext4 / ext3 / ext2 | ✅ | `resize2fs` (offline, after forced `e2fsck`) | `dumpe2fs` block count × block size | grow-back via `resize2fs` with no size argument |
+| ext4 / ext3 / ext2 | ✅ | `resize2fs` (offline, after a repairing `e2fsck -f -p`, then `-y`) | `dumpe2fs` block count × block size | grow-back via `resize2fs` with no size argument |
 | btrfs | ✅ | `btrfs filesystem resize -32M` (mounted) | `dump-super total_bytes` | subvolume layouts (`root`, `@`, `@rootfs`, flat) auto-detected; grow via `resize max` |
 | xfs | ⚠️ slack only | **none — XFS cannot shrink** | `xfs_db` dblocks × blocksize | accepted only when ≥ 32 MiB of slack already exists between filesystem end and partition end; grow via `xfs_growfs` |
-| f2fs | ✅ | `resize.f2fs -t` (needs f2fs-tools ≥ 1.16) | none — the script asks on re-runs whether a previous shrink completed | common on SBC/flash installs |
+| f2fs | ✅ | `resize.f2fs -t` (needs f2fs-tools ≥ 1.16), after a repairing `fsck.f2fs -f` | none — the script asks on re-runs whether a previous shrink completed | common on SBC/flash installs |
 | ntfs | ✅ | `ntfsresize --size` | `ntfsresize --info` | data partitions; the resize marks the volume for a consistency check on the next Windows boot (normal) |
 | vfat | ✅ | `fatresize` | none — asks on re-runs | data partitions / firmware copies |
 | exfat | ❌ | no shrink tool exists | — | back up → `mkfs.exfat` on a LUKS container → restore |
 | udf | ❌ | no shrink tool exists | — | same workaround as exfat |
 | swap | ❌ (by design) | — | — | swap holds no data worth an in-place conversion; see below |
 
+## The integrity check
+
+Before anything is changed, a real run offers to check the target
+filesystem (`LUKS_FSCK=yes|no`; a dry run skips it). The check is read-only
+for every filesystem: no checker runs in a mode that can repair, and none is
+handed your keyboard — stdin is closed, so no fix question can be answered.
+
+| Filesystem | Check |
+|---|---|
+| ext4 / ext3 / ext2 | `e2fsck -f -n` |
+| btrfs | `btrfs check --readonly` |
+| xfs | `xfs_repair -n` |
+| f2fs | `fsck.f2fs --dry-run` |
+| ntfs | `ntfsfix --no-action` |
+| vfat | `fsck.fat -n` |
+
+- **Errors** are reported and nothing is repaired; the run stops unless you
+  type `FORCE` (`LUKS_FSCK_FORCE=FORCE`). If you go on, know that the shrink
+  that follows runs a repairing check of its own, because its tools need a
+  consistent filesystem — ext2/3/4 `e2fsck -f -p` and then `e2fsck -f -y`,
+  f2fs `fsck.f2fs -f` — unless an earlier run already shrank it. Both repair
+  what they find; the `FORCE` prompt says so.
+- **No read-only checker on this machine** — a `fsck.f2fs` without
+  `--dry-run`, an `ntfsfix` without `--no-action`, a missing tool — and the
+  check is skipped with a warning that says why. It never falls back to a
+  repairing mode, as f2fs's did until 1.6.7 (`fsck.f2fs -a`).
+
 ## System vs data partitions
 
 - A partition containing `/etc/fstab` is treated as an **installed system**:

docs/INSTALL.md

@@ -56,7 +56,10 @@ The deploy script then walks you through:
 - **Filesystem identification** — the filesystem's tools are auto-installed
   the moment the type is known (e.g. `e2fsprogs` for ext4, `ntfsprogs` for
   NTFS).
-- **Integrity check** — optional read-only fsck before anything changes.
+- **Integrity check** — optional, and read-only for every filesystem: errors
+  stop the run unless you type `FORCE`, and where this machine has no
+  read-only checker the check is skipped with a warning. Nothing is repaired
+  here; see [FILESYSTEMS.md](FILESYSTEMS.md#the-integrity-check).
 - **KDF profile** — aggressive / moderate / fast, with unlock-time estimates
   benchmarked on the machine in front of you.
 - **The `ENCRYPT` gate** — a typed confirmation. Immediately before