initrd/gpg: fix additional review issues from PR #2158

- Remove incorrect || [ $? -eq 2 ] pattern: exit code 2 from
  gpg --import is a fatal error, not "unchanged" as previously documented
- Fix pubkey.asc import: check success/failure properly, fall back to
  keyring export on failure instead of silently continuing with stale PUBKEY
- Fix gpg_reset_nk3_secret_app: add local error_code to prevent global
  scope leak, implicit return 0 for non-NK3 devices (non-zero fall-through
  broke OEM reset on NK3-incompatible hardware)
- Fix partition derivation for NVMe/MMC: sed pattern (p?)[0-9]+$ was
  removing the p separator from nvme0n1p1 -> nvme0n1, producing
  nvme0n12 instead of nvme0n1p2. Use [0-9]+$ without p? capture.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Author: tlaurion

initrd/etc/gpg_functions.sh

@@ -7,7 +7,7 @@ gpg_flash_rom() {
 		[ -e /.gnupg/trustdb.gpg ] && rm /.gnupg/trustdb.gpg
 	fi
 
-	cat "$PUBKEY" | gpg --import || [ $? -eq 2 ]
+	cat "$PUBKEY" | gpg --import
 	gpg --list-keys --fingerprint --with-colons | sed -E -n -e 's/^fpr:::::::::([0-9A-F]+):$/\1:6:/p' | gpg --import-ownertrust
 	gpg --update-trust
 
@@ -154,6 +154,7 @@ gpg_replace_key_reflash() {
 gpg_reset_nk3_secret_app() {
 	TRACE_FUNC
 	local admin_pin="$1"
+	local error_code
 	if [ "$DONGLE_BRAND" = "Nitrokey 3" ] && [ -x /bin/hotp_verification ]; then
 		STATUS "Resetting Nitrokey 3 Secrets app (physical touch will be required)"
 		for attempt in 1 2 3; do
@@ -781,7 +782,7 @@ reprovision_smartcard_from_backup() {
 		# and derive parent disk (e.g. /dev/sdb) + public partition (/dev/sdb2).
 		local part_name
 		part_name="$(basename "$mapper_dev" | sed 's/^usb_mount_//')"
-		parent_disk="$(echo "/dev/$part_name" | sed -E 's/(p?)[0-9]+$//')"
+		parent_disk="$(echo "/dev/$part_name" | sed -E 's/[0-9]+$//')"
 		pub_partition="${parent_disk}2"
 		DEBUG "mapper_dev=$mapper_dev part_name=$part_name parent_disk=$parent_disk pub_partition=${pub_partition:-none}"
 		cryptsetup close "$(basename "$mapper_dev")" 2>/dev/null || true
@@ -791,8 +792,6 @@ reprovision_smartcard_from_backup() {
 	fi
 
 	# Phase 9: mount the public partition and import pubkey.asc.
-	# Validate against the key already in ~/.gnupg; re-import is idempotent
-	# so exit code 2 (unchanged) is a normal result.
 	enable_usb
 	enable_usb_storage
 	STATUS "Mounting GPG key backup (public partition)"
@@ -814,10 +813,18 @@ reprovision_smartcard_from_backup() {
 
 	STATUS "Importing public key from backup"
 	if [ -f /media/pubkey.asc ]; then
-		gpg --import </media/pubkey.asc || [ $? -eq 2 ]
-		PUBKEY=/media/pubkey.asc
-		DEBUG "pubkey.asc found on public partition at /media/pubkey.asc"
-		STATUS_OK "Public key imported"
+		if gpg --import </media/pubkey.asc 2>/dev/null; then
+			PUBKEY=/media/pubkey.asc
+			DEBUG "pubkey.asc found on public partition at /media/pubkey.asc"
+			STATUS_OK "Public key imported"
+		else
+			DEBUG "pubkey.asc import failed; exporting from imported keyring"
+			gpg --export --armor "$key_id" >/tmp/reprovision_pubkey.asc 2>/dev/null || {
+				umount /media 2>/dev/null || true
+				DIE "Failed to export public key for ROM flash"
+			}
+			PUBKEY=/tmp/reprovision_pubkey.asc
+		fi
 	else
 		# Fallback: export from the keyring (public key is already there
 		# from the privkey.sec import)