initrd/gpg: address PR #2158 review comments

- Fix 6 instances of $? clobbered by intervening TRACE_FUNC/DEBUG
  calls: capture rc=$? immediately after each DO_WITH_DEBUG gpg
  pipeline, check $rc (adds local rc declarations).
- Replace --passphrase-file with --passphrase-fd 3 3< <(...) to
  avoid leaking the PIN value through /proc/<pid>/cmdline of the
  child echo process (3 sites: factory reset, card identity, import).
- Fix algo_code/bit_len extraction: add head -1 to prevent multi-line
  values when multiple keys are present in the backup.
- Fix STATUS_OK on public partition mount: only emit on success.
- Fix gpg_reset_nk3_secret_app: return actual hotp_verification
  error code, add local error_code, explicit return 0 for non-NK3.
- Remove incorrect || [ $? -eq 2 ] pattern: gpg --import exit code 2
  is a fatal error, not "unchanged".
- Fix pubkey.asc import: check success properly, fall back to keyring
  export on failure.
- Fix partition derivation for NVMe/MMC: use [0-9]+$ without (p?)
  capture that was removing the p separator.
- Add _luks_cleanup helper called on every error return path to
  close LUKS mappings (removed broken EXIT trap).
- Re-run NK3 Secrets app reset with custom PIN when factory reset
  is retried from default to custom PIN.
- Add chmod 600 on /tmp/secret/gpg_pin to match existing convention.
- Fix recovery-shell.md: gpg_auth also guards USB/external boot entry
  via media-scan.sh.
- Write backup passphrase to /tmp/secret/backup_pass, call mount-usb.sh
  with --pass-file instead of --pass to avoid argv leak.
- Add --pass-file option to mount-usb.sh (reads passphrase from file).
- Fix doc/qemu.md: clarify ./qemu_img/ vs ~/Qemu_img/ roles.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Author: tlaurion

doc/qemu.md

@@ -158,13 +158,22 @@ cp -alf ~/Qemu_img/usb_fd.img \
 
 ### Daily development cycle
 
-After OS install + USB provisioned, reference both from `./qemu_img/`:
+After OS install + USB provisioned, reference the root disk from `./qemu_img/`
+(inside the repo clone — Docker visibility) and USB backups from `~/Qemu_img/`
+(outside the repo — survives clean builds via hardlinks):
 
-    ./docker_repro.sh make BOARD=qemu-coreboot-fbwhiptail-tpm1-hotp \
-      PUBKEY_ASC=pubkey.asc \
-      USB_TOKEN=Nitrokey3NFC \
-      ROOT_DISK_IMG=./qemu_img/root.qcow2 \
-      inject_gpg run
+```bash
+./docker_repro.sh make BOARD=qemu-coreboot-fbwhiptail-tpm1-hotp \
+  PUBKEY_ASC=pubkey.asc \
+  USB_TOKEN=Nitrokey3NFC \
+  ROOT_DISK_IMG=./qemu_img/root.qcow2 \
+  inject_gpg run
+```
+
+Root disk images live at `./qemu_img/` because `ROOT_DISK_IMG` is passed to
+`make` inside the Docker container, which only sees `$(pwd)`.  USB backup
+images live at `~/Qemu_img/` and are bridged into the build directory via
+hardlinks (`cp -alf`).
 
 
 ### Testing GPG key reprovision from a backup drive

doc/recovery-shell.md

@@ -27,7 +27,8 @@ with the in-memory backup path, or by running the reprovision flow from the GPG
 Management Menu), the recovery shell requires GPG smartcard authentication before
 the bash prompt opens.
 
-**Scope:** This ONLY guards recovery shell entry.  USB boot, TPM operations,
+**Scope:** This guards recovery shell and external media/USB boot entry
+(`media-scan.sh` also calls `gpg_auth` before scanning USB).  TPM operations,
 flash/update, GPG management, and all other GUI menu functions are NOT gated
 by this check — they remain accessible from the main menu.
 

initrd/bin/mount-usb.sh

@@ -25,7 +25,7 @@ DEVICE=""
 MOUNTPOINT="/media"
 PASS=""
 
-#Only assign --mode, --device, --mountpoint and --pass parameters only if variables following them are not empty
+#Only assign --mode, --device, --mountpoint, --pass and --pass-file parameters
 while [ $# -gt 0 ]; do
 	case "$1" in
 	--mode)
@@ -56,6 +56,13 @@ while [ $# -gt 0 ]; do
 			shift
 		fi
 		;;
+	--pass-file)
+		if [ -n "$2" ] && [ -r "$2" ]; then
+			PASS="$(cat "$2")"
+			shift
+			shift
+		fi
+		;;
 	*)
 		usage
 		exit 1