From 699ed6a93572b6ee4abf4b562d281d343feb33b8 Mon Sep 17 00:00:00 2001
From: alvinlollo <alvin.vilaythong@gmail.com>
Date: Sun, 11 Oct 2026 17:41:38 +1100
Subject: [PATCH] fix(installer): Validate hostname, parse disk models, skip
 zram

- screen_hostname: reject names that break /etc/hostname and /etc/hosts.
- screen_disk: parse lsblk -P by regex so multi-word/empty MODELs show
  correctly, and never offer /dev/zram* (TYPE=disk) as a target.
- packages: add python-distro, the undeclared runtime dep of the shipped
  ssh-import-id (it always crashed and fell back to curl).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 airootfs/usr/local/bin/alvin-install | 20 ++++++++++++--------
 packages.x86_64                      |  1 +
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/airootfs/usr/local/bin/alvin-install b/airootfs/usr/local/bin/alvin-install
index d796ddf..bd040fb 100755
--- a/airootfs/usr/local/bin/alvin-install
+++ b/airootfs/usr/local/bin/alvin-install
@@ -336,15 +336,17 @@ screen_disk() {
         live_dev="/dev/${pk:-$(basename "$src")}"
     fi
 
-    local disks=()
+    # -P quotes every field (and escapes quotes inside), so multi-word or
+    # empty MODELs parse correctly - matched by regex, never eval'd.
+    local disks=() line name size model
+    local re='^NAME="([^"]*)" SIZE="([^"]*)" MODEL="([^"]*)" TYPE="disk"$'
     while IFS= read -r line; do
-        local name size model
-        name=$(echo "$line" | awk '{print $1}')
-        size=$(echo "$line" | awk '{print $2}')
-        model=$(echo "$line" | awk '{$1=$2=""; sub(/^[ \t]+/,""); print}')
+        [[ "$line" =~ $re ]] || continue
+        name=${BASH_REMATCH[1]} size=${BASH_REMATCH[2]} model=${BASH_REMATCH[3]}
         [[ "$name" == "$live_dev" ]] && continue
-        disks+=("${name}  ${size}  ${model}")
-    done < <(lsblk -dpno NAME,SIZE,MODEL,TYPE | awk '$NF=="disk" {print $1,$2,$3}')
+        [[ "$name" == /dev/zram* ]] && continue   # compressed RAM swap, TYPE=disk
+        disks+=("${name}  ${size}  ${model:-unknown model}")
+    done < <(lsblk -dpnP -o NAME,SIZE,MODEL,TYPE)
 
     (( ${#disks[@]} > 0 )) || die "No disks found."
 
@@ -456,9 +458,11 @@ screen_hostname() {
     clear
     header "Hostname"
     echo ""
-    HOSTNAME=$(gum input --placeholder "archlinux" --char-limit 64 --header "+ Hostname") \
+    HOSTNAME=$(gum input --placeholder "archlinux" --char-limit 63 --header "+ Hostname") \
         || die "No hostname entered."
     [[ -z "$HOSTNAME" ]] && HOSTNAME="archlinux"
+    [[ "$HOSTNAME" =~ ^[A-Za-z0-9]([A-Za-z0-9-]{0,62})$ && "$HOSTNAME" != *- ]] \
+        || die "Invalid hostname. Use letters, digits and '-' (max 63, no leading/trailing '-')."
     log "Hostname: $HOSTNAME"
 }
 
diff --git a/packages.x86_64 b/packages.x86_64
index 88e2dda..aa7b721 100644
--- a/packages.x86_64
+++ b/packages.x86_64
@@ -272,6 +272,7 @@ pptpclient
 pv
 pwgen
 python-aiohttp
+python-distro
 python-hatchling
 python-installer
 python-packaging