fix: grub2 hash validation and mkconfig fallback

[mhduiy]

修复 grub 编辑认证哈希校验与 update-grub 回退缺陷

改动

• grub2/edit_auth_ifc.go：新增包级 pbkdf2HashReg 正则，Enable() 写入前校验 PBKDF2 哈希格式，非法返回 invalid pbkdf2 hash format 错误，防止错误数据静默写入 /etc/grub.d/42_uos_menu_crypto 后被 grub 忽略（症状同原 bug：静默不校验）。新增 regexp import。
• grub2/modify_manger.go：runUpdateGrubWithUnit() 中 update-grub 不在 PATH 时的 fallback 改为 grub-mkconfig -o <grub.cfg>（原错误地仍 append update-grub，导致 grub-mkconfig 从未执行），并删除死赋值 path = grubMkconfigCmd。

关联

• Multica issue: https://agent-dev.uniontech.com/dde/issues/afa07fcb-a545-4913-b0d2-71dc1c5d27c3
• PMS: BUG-371591 (https://pms.uniontech.com/bug-view-371591.html)

审核 / 编译状态

• 代码审核：已通过（95 分 / 优秀）
• amd64 编译验证：已通过

Summary by Sourcery

Validate grub edit authentication hashes and correct the grub configuration fallback command.

Bug Fixes:

• Validate PBKDF2 hash format for grub edit authentication to prevent invalid hashes from being written and silently ignored.
• Fix fallback behavior to invoke grub-mkconfig with the correct arguments when update-grub is not available.

[deepin-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mhduiy

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR adds PBKDF2 hash format validation to the grub edit authentication path and fixes the fallback behavior when update-grub is not available by correctly invoking grub-mkconfig.

Sequence diagram for PBKDF2 hash validation in EditAuth.Enable

sequenceDiagram
    participant Caller
    participant EditAuth
    participant pbkdf2HashReg
    participant GrubConfig

    Caller->>EditAuth: Enable(sender, username, password)
    EditAuth->>EditAuth: isValidUsernameAndPassword(username, password)
    alt [username or password invalid]
        EditAuth-->>Caller: dbusutil.ToError("username or password invalid")
    else [username and password valid]
        EditAuth->>pbkdf2HashReg: MatchString(password)
        alt [invalid pbkdf2 hash format]
            EditAuth-->>Caller: dbusutil.ToError("invalid pbkdf2 hash format")
        else [valid pbkdf2 hash format]
            EditAuth->>GrubConfig: setGrubEditShellAuth(username, password)
            GrubConfig-->>EditAuth: error or nil
            EditAuth-->>Caller: dbusutil.ToError(err) or nil
        end
    end

Loading

Sequence diagram for update-grub to grub-mkconfig fallback

sequenceDiagram
    participant Manager as modifyManager
    participant Exec as exec
    participant Shell as shell

    Manager->>Manager: runUpdateGrubWithUnit()
    Manager->>Exec: LookPath(updateGrubCmd)
    alt [update-grub found]
        Exec-->>Manager: path
        Manager->>Shell: command = [path]
    else [update-grub not found]
        Exec-->>Manager: error
        Manager->>Shell: command = [grubMkconfigCmd, "-o", grubScriptFile]
    end
    Manager->>Shell: run(command)

Loading

File-Level Changes

Change	Details	Files
Validate PBKDF2 grub edit authentication hashes before writing configuration to avoid silently ignored invalid data.	Introduce a compiled regular expression that matches the expected PBKDF2 hash format used by grub. Import the regexp package to support hash format validation. Add a check in the Enable method to verify the password string matches the PBKDF2 format and return a DBus error on mismatch before calling setGrubEditShellAuth.	grub2/edit_auth_ifc.go
Correct the update-grub fallback to invoke grub-mkconfig directly when update-grub is not present in PATH.	Change the fallback command construction to use grub-mkconfig with -o <grub.cfg> instead of incorrectly appending update-grub. Remove the unused path assignment to grubMkconfigCmd in the fallback branch.	grub2/modify_manger.go

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[deepin-bot]

TAG Bot

New tag: 6.1.102
DISTRIBUTION: unstable
Suggest: synchronizing this PR through rebase #1207

[deepin-bot]

TAG Bot

New tag: 6.1.103
DISTRIBUTION: unstable
Suggest: synchronizing this PR through rebase #1217

[deepin-bot]

TAG Bot

New tag: 6.1.104
DISTRIBUTION: unstable
Suggest: synchronizing this PR through rebase #1218