initrd/gpg: address review comments for reprovision flow

Fix 6 instances of $? clobbered by intervening TRACE_FUNC/DEBUG
calls: capture rc=$? immediately after each DO_WITH_DEBUG gpg
pipeline, check $rc instead of $? after TRACE_FUNC/DEBUG.

Fix algo_code/bit_len extraction: add head -1 to prevent
multi-line values when multiple keys are present in the backup.

Fix STATUS_OK on public partition mount: only emit STATUS_OK
when mount-usb.sh succeeds, not unconditionally.

Fix gpg_reset_nk3_secret_app return code: propagate the actual
hotp_verification error code instead of returning generic 1.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Author: tlaurion

initrd/etc/gpg_functions.sh

@@ -166,7 +166,7 @@ gpg_reset_nk3_secret_app() {
 					whiptail_warning --msgbox "$DONGLE_BRAND requires physical presence: touch the dongle when requested" 0 80 --title "$DONGLE_BRAND secrets app reset attempt: $attempt/3"
 				else
 					DEBUG "NK3 Secrets app reset failed with error $error_code"
-					return 1
+					return $error_code
 				fi
 			fi
 		done
@@ -194,9 +194,10 @@ gpg_card_factory_reset() {
 	} | DO_WITH_DEBUG gpg --command-fd=0 --status-fd=1 --pinentry-mode=loopback \
 		--passphrase-file <(echo -n "$card_admin_pin") --card-edit \
 		>/tmp/gpg_card_edit_output 2>&1
+	rc=$?
 	TRACE_FUNC
 	DEBUG "GPG factory-reset output: $(cat /tmp/gpg_card_edit_output)"
-	if [ $? -ne 0 ]; then
+	if [ $rc -ne 0 ]; then
 		return 1
 	fi
 
@@ -218,9 +219,10 @@ gpg_card_factory_reset() {
 			echo "${card_admin_pin}"
 		} | DO_WITH_DEBUG gpg --command-fd=0 --status-fd=1 --pinentry-mode=loopback --card-edit \
 			>/tmp/gpg_card_edit_output 2>&1
+		rc=$?
 		TRACE_FUNC
 		DEBUG "GPG forcesig toggle output: $(cat /tmp/gpg_card_edit_output)"
-		if [ $? -ne 0 ]; then
+		if [ $rc -ne 0 ]; then
 			WARN "Could not enable forced signature PIN; continuing anyway"
 		else
 			STATUS_OK "Forced signature PIN enabled"
@@ -244,9 +246,10 @@ gpg_card_factory_reset() {
 			echo "${card_admin_pin}"
 		} | DO_WITH_DEBUG gpg --expert --command-fd=0 --status-fd=1 --pinentry-mode=loopback --card-edit \
 			>/tmp/gpg_card_edit_output 2>&1
+		rc=$?
 		TRACE_FUNC
 		DEBUG "GPG p256 key-attr output: $(cat /tmp/gpg_card_edit_output)"
-		if [ $? -ne 0 ]; then
+		if [ $rc -ne 0 ]; then
 			return 1
 		fi
 		STATUS_OK "NIST P-256 key attributes set"
@@ -266,9 +269,10 @@ gpg_card_factory_reset() {
 			echo "${card_admin_pin}"
 		} | DO_WITH_DEBUG gpg --command-fd=0 --status-fd=1 --pinentry-mode=loopback --card-edit \
 			>/tmp/gpg_card_edit_output 2>&1
+		rc=$?
 		TRACE_FUNC
 		DEBUG "GPG RSA key-attr output: $(cat /tmp/gpg_card_edit_output)"
-		if [ $? -ne 0 ]; then
+		if [ $rc -ne 0 ]; then
 			return 1
 		fi
 		STATUS_OK "RSA ${rsa_key_length}-bit key attributes set"
@@ -365,9 +369,10 @@ gpg_card_change_pin() {
 		echo q
 	} | DO_WITH_DEBUG gpg --command-fd=0 --status-fd=2 --pinentry-mode=loopback --card-edit \
 		>/tmp/gpg_card_edit_output 2>&1
+	rc=$?
 	TRACE_FUNC
 	DEBUG "GPG PIN change output: $(cat /tmp/gpg_card_edit_output)"
-	if [ $? -ne 0 ]; then
+	if [ $rc -ne 0 ]; then
 		return 1
 	fi
 	TRACE_FUNC
@@ -416,9 +421,10 @@ gpg_keytocard_subkeys() {
 	} | DO_WITH_DEBUG gpg --expert --command-fd=0 --status-fd=1 --pinentry-mode=loopback \
 		--edit-key "$key_id" \
 		>/tmp/gpg_card_edit_output 2>&1
+	rc=$?
 	TRACE_FUNC
 	DEBUG "GPG keytocard output: $(cat /tmp/gpg_card_edit_output)"
-	if [ $? -ne 0 ]; then
+	if [ $rc -ne 0 ]; then
 		DEBUG "keytocard failed"
 		return 1
 	fi
@@ -521,8 +527,8 @@ reprovision_smartcard_from_backup() {
 	# gpg --with-colons field layout:
 	#   pub: ... :<bit_len>:<algo>:<key_id>: ...
 	#   uid: ... :<escaped_uid>: ...
-	algo_code="$(gpg --with-colons --list-keys 2>/dev/null | grep '^pub:' | cut -d: -f4)"
-	bit_len="$(gpg --with-colons --list-keys 2>/dev/null | grep '^pub:' | cut -d: -f3)"
+	algo_code="$(gpg --with-colons --list-keys 2>/dev/null | grep '^pub:' | cut -d: -f4 | head -1)"
+	bit_len="$(gpg --with-colons --list-keys 2>/dev/null | grep '^pub:' | cut -d: -f3 | head -1)"
 	uid_line="$(gpg --with-colons --list-keys 2>/dev/null | grep '^uid:' | head -1 | cut -d: -f10)"
 
 	case "$algo_code" in
@@ -743,12 +749,16 @@ reprovision_smartcard_from_backup() {
 		DEBUG "Mounting public partition via explicit device: $pub_partition"
 		if ! mount-usb.sh --device "$pub_partition" --mode ro --mountpoint /media; then
 			DEBUG "Could not mount public partition at $pub_partition"
+		else
+			STATUS_OK "Public partition mounted"
 		fi
-		STATUS_OK "Public partition mounted"
 	else
 		DEBUG "No explicit public device; falling back to auto-detection"
-		mount-usb.sh --mode ro --mountpoint /media 2>/dev/null ||
+		if mount-usb.sh --mode ro --mountpoint /media 2>/dev/null; then
+			STATUS_OK "Public partition mounted"
+		else
 			DEBUG "Could not auto-detect public partition"
+		fi
 	fi
 
 	STATUS "Importing public key from backup"