fix: ENABLE_CRYPTFS -> UBOOT, SPLITFS, EXPANDROOT - cleanupHEADmaster

24 files changed, 430 insertions, 180 deletions

diff --git a/README.md b/README.md
index 1f91c88..f02d286 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@
 ## Build dependencies
 The following list of Debian packages must be installed on the build system because they are essentially required for the bootstrapping process. The script will check if all required packages are installed and missing packages will be installed automatically if confirmed by the user.
 
-  ```debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git-core```
+  ```debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git```
 
 ## Command-line parameters
 The script accepts certain command-line parameters to enable or disable specific OS features, services and configuration settings. These parameters are passed to the `rpi2-gen-image.sh` script via (simple) shell-variables. Unlike environment shell-variables (simple) shell-variables are defined at the beginning of the command-line call of the `rpi2-gen-image.sh` script.
@@ -226,7 +226,7 @@ Remove all `locale` translation files.
 #### Encrypted root partition:
 
 ##### `ENABLE_CRYPTFS`=false
-Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. `ENABLE_UBOOT`, `ENABLE_SPLITFS`, `EXPANDROOT` and SSH-to-initramfs are currently not supported but will be soon - feel free to help.
+Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. SSH-to-initramfs is currently not supported but will be soon - feel free to help.
 
 ##### `CRYPTFS_PASSWORD`=""
 Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true.
@@ -266,6 +266,7 @@ All the required configuration files that will be copied to the generated OS ima
 | `boot` | Boot and RPi2 configuration files |
 | `dpkg` | Package Manager configuration |
 | `firstboot` | Scripts that get executed on first boot  |
+| `initramfs` | Initramfs scripts |
 | `iptables` | Firewall configuration files |
 | `locales` | Locales configuration |
 | `modules` | Kernel Modules configuration |
diff --git a/bootstrap.d/10-bootstrap.sh b/bootstrap.d/10-bootstrap.sh
index f55c3e3..2dfddff 100644
--- a/bootstrap.d/10-bootstrap.sh
+++ b/bootstrap.d/10-bootstrap.sh
@@ -7,22 +7,22 @@
 
 # Base debootstrap (unpack only)
 if [ "$ENABLE_MINBASE" = true ] ; then
-  http_proxy=${APT_PROXY} debootstrap --arch="${RELEASE_ARCH}" --foreign --variant=minbase --include="${APT_INCLUDES}" "${RELEASE}" "$R" "http://${APT_SERVER}/debian"
+  http_proxy=${APT_PROXY} debootstrap --arch="${RELEASE_ARCH}" --foreign --variant=minbase --include="${APT_INCLUDES}" "${RELEASE}" "${R}" "http://${APT_SERVER}/debian"
 else
-  http_proxy=${APT_PROXY} debootstrap --arch="${RELEASE_ARCH}" --foreign --include="${APT_INCLUDES}" "${RELEASE}" "$R" "http://${APT_SERVER}/debian"
+  http_proxy=${APT_PROXY} debootstrap --arch="${RELEASE_ARCH}" --foreign --include="${APT_INCLUDES}" "${RELEASE}" "${R}" "http://${APT_SERVER}/debian"
 fi
 
 # Copy qemu emulator binary to chroot
 install_exec "${QEMU_BINARY}" "${R}${QEMU_BINARY}"
 
 # Copy debian-archive-keyring.pgp
-mkdir -p "$R/usr/share/keyrings"
-install_readonly /usr/share/keyrings/debian-archive-keyring.gpg "$R/usr/share/keyrings/debian-archive-keyring.gpg"
+mkdir -p "${R}/usr/share/keyrings"
+install_readonly /usr/share/keyrings/debian-archive-keyring.gpg "${R}/usr/share/keyrings/debian-archive-keyring.gpg"
 
 # Complete the bootstrapping process
 chroot_exec /debootstrap/debootstrap --second-stage
 
 # Mount required filesystems
-mount -t proc none "$R/proc"
-mount -t sysfs none "$R/sys"
-mount --bind /dev/pts "$R/dev/pts"
+mount -t proc none "${R}/proc"
+mount -t sysfs none "${R}/sys"
+mount --bind /dev/pts "${R}/dev/pts"
diff --git a/bootstrap.d/11-apt.sh b/bootstrap.d/11-apt.sh
index 554aaf5..1d32051 100644
--- a/bootstrap.d/11-apt.sh
+++ b/bootstrap.d/11-apt.sh
@@ -7,28 +7,28 @@
 
 # Install and setup APT proxy configuration
 if [ -z "$APT_PROXY" ] ; then
-  install_readonly files/apt/10proxy "$R/etc/apt/apt.conf.d/10proxy"
-  sed -i "s/\"\"/\"${APT_PROXY}\"/" "$R/etc/apt/apt.conf.d/10proxy"
+  install_readonly files/apt/10proxy "${ETCDIR}/apt/apt.conf.d/10proxy"
+  sed -i "s/\"\"/\"${APT_PROXY}\"/" "${ETCDIR}/apt/apt.conf.d/10proxy"
 fi
 
 if [ "$BUILD_KERNEL" = false ] ; then
   # Install APT pinning configuration for flash-kernel package
-  install_readonly files/apt/flash-kernel "$R/etc/apt/preferences.d/flash-kernel"
+  install_readonly files/apt/flash-kernel "${ETCDIR}/apt/preferences.d/flash-kernel"
 
   # Install APT sources.list
-  install_readonly files/apt/sources.list "$R/etc/apt/sources.list"
-  echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >> "$R/etc/apt/sources.list"
+  install_readonly files/apt/sources.list "${ETCDIR}/apt/sources.list"
+  echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >> "${ETCDIR}/apt/sources.list"
 
   # Upgrade collabora package index and install collabora keyring
   chroot_exec apt-get -qq -y update
   chroot_exec apt-get -qq -y --force-yes install collabora-obs-archive-keyring
 else # BUILD_KERNEL=true
   # Install APT sources.list
-  install_readonly files/apt/sources.list "$R/etc/apt/sources.list"
+  install_readonly files/apt/sources.list "${ETCDIR}/apt/sources.list"
 
   # Use specified APT server and release
-  sed -i "s/\/ftp.debian.org\//\/${APT_SERVER}\//" "$R/etc/apt/sources.list"
-  sed -i "s/ jessie/ ${RELEASE}/" "$R/etc/apt/sources.list"
+  sed -i "s/\/ftp.debian.org\//\/${APT_SERVER}\//" "${ETCDIR}/apt/sources.list"
+  sed -i "s/ jessie/ ${RELEASE}/" "${ETCDIR}/apt/sources.list"
 fi
 
 # Upgrade package index and update all installed packages and changed dependencies
diff --git a/bootstrap.d/12-locale.sh b/bootstrap.d/12-locale.sh
index d82f212..bd1edf4 100644
--- a/bootstrap.d/12-locale.sh
+++ b/bootstrap.d/12-locale.sh
@@ -6,7 +6,7 @@
 . ./functions.sh
 
 # Install and setup timezone
-echo ${TIMEZONE} > "$R/etc/timezone"
+echo ${TIMEZONE} > "${ETCDIR}/timezone"
 chroot_exec dpkg-reconfigure -f noninteractive tzdata
 
 # Install and setup default locale and keyboard configuration
@@ -19,40 +19,40 @@ if [ "$ENABLE_MINBASE" = false ] ; then
   else
     # en_US.UTF-8 should be available anyway : https://www.debian.org/doc/manuals/debian-reference/ch08.en.html#_the_reconfiguration_of_the_locale
     chroot_exec echo "locales locales/locales_to_be_generated multiselect en_US.UTF-8 UTF-8, ${DEFLOCAL} UTF-8" | debconf-set-selections
-    sed -i "/en_US.UTF-8/s/^#//" "$R/etc/locale.gen"
+    sed -i "/en_US.UTF-8/s/^#//" "${ETCDIR}/locale.gen"
   fi
 
-  sed -i "/${DEFLOCAL}/s/^#//" "$R/etc/locale.gen"
+  sed -i "/${DEFLOCAL}/s/^#//" "${ETCDIR}/locale.gen"
   chroot_exec echo "locales locales/default_environment_locale select ${DEFLOCAL}" | debconf-set-selections
   chroot_exec locale-gen
   chroot_exec update-locale LANG="${DEFLOCAL}"
 
   # Install and setup default keyboard configuration
   if [ "$XKB_MODEL" != "" ] ; then
-    sed -i "s/^XKBMODEL.*/XKBMODEL=\"${XKB_MODEL}\"/" "$R/etc/default/keyboard"
+    sed -i "s/^XKBMODEL.*/XKBMODEL=\"${XKB_MODEL}\"/" "${ETCDIR}/default/keyboard"
   fi
   if [ "$XKB_LAYOUT" != "" ] ; then
-    sed -i "s/^XKBLAYOUT.*/XKBLAYOUT=\"${XKB_LAYOUT}\"/" "$R/etc/default/keyboard"
+    sed -i "s/^XKBLAYOUT.*/XKBLAYOUT=\"${XKB_LAYOUT}\"/" "${ETCDIR}/default/keyboard"
   fi
   if [ "$XKB_VARIANT" != "" ] ; then
-    sed -i "s/^XKBVARIANT.*/XKBVARIANT=\"${XKB_VARIANT}\"/" "$R/etc/default/keyboard"
+    sed -i "s/^XKBVARIANT.*/XKBVARIANT=\"${XKB_VARIANT}\"/" "${ETCDIR}/default/keyboard"
   fi
   if [ "$XKB_OPTIONS" != "" ] ; then
-    sed -i "s/^XKBOPTIONS.*/XKBOPTIONS=\"${XKB_OPTIONS}\"/" "$R/etc/default/keyboard"
+    sed -i "s/^XKBOPTIONS.*/XKBOPTIONS=\"${XKB_OPTIONS}\"/" "${ETCDIR}/default/keyboard"
   fi
   chroot_exec dpkg-reconfigure -f noninteractive keyboard-configuration
 
   # Install and setup font console
   case "${DEFLOCAL}" in
     *UTF-8)
-      sed -i 's/^CHARMAP.*/CHARMAP="UTF-8"/' "$R/etc/default/console-setup"
+      sed -i 's/^CHARMAP.*/CHARMAP="UTF-8"/' "${ETCDIR}/default/console-setup"
       ;;
     *)
-      sed -i 's/^CHARMAP.*/CHARMAP="guess"/' "$R/etc/default/console-setup"
+      sed -i 's/^CHARMAP.*/CHARMAP="guess"/' "${ETCDIR}/default/console-setup"
       ;;
   esac
   chroot_exec dpkg-reconfigure -f noninteractive console-setup
 else # ENABLE_MINBASE=true
   # Install POSIX default locale
-  install_readonly files/locales/locale "$R/etc/default/locale"
+  install_readonly files/locales/locale "${ETCDIR}/default/locale"
 fi
diff --git a/bootstrap.d/13-kernel.sh b/bootstrap.d/13-kernel.sh
index cc4828d..2652142 100644
--- a/bootstrap.d/13-kernel.sh
+++ b/bootstrap.d/13-kernel.sh
@@ -8,7 +8,7 @@
 # Fetch and build latest raspberry kernel
 if [ "$BUILD_KERNEL" = true ] ; then
   # Setup source directory
-  mkdir -p "$R/usr/src"
+  mkdir -p "${R}/usr/src"
 
   # Copy existing kernel sources into chroot directory
   if [ -n "$KERNELSRC_DIR" ] && [ -d "$KERNELSRC_DIR" ] ; then
@@ -17,11 +17,11 @@ if [ "$BUILD_KERNEL" = true ] ; then
 
     # Clean the kernel sources
     if [ "$KERNELSRC_CLEAN" = true ] && [ "$KERNELSRC_PREBUILT" = false ] ; then
-      make -C "$R/usr/src/linux" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" mrproper
+      make -C "${KERNELDIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" mrproper
     fi
   else # KERNELSRC_DIR=""
     # Fetch current raspberrypi kernel sources
-    git -C "$R/usr/src" clone --depth=1 https://github.com/raspberrypi/linux
+    git -C "${R}/usr/src" clone --depth=1 https://github.com/raspberrypi/linux
   fi
 
   # Calculate optimal number of kernel building threads
@@ -33,7 +33,7 @@ if [ "$BUILD_KERNEL" = true ] ; then
   if [ "$KERNELSRC_PREBUILT" = false ] ; then
     # Remove device, network and filesystem drivers from kernel configuration
     if [ "$KERNEL_REDUCE" = true ] ; then
-      make -C "$R/usr/src/linux" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
+      make -C "${KERNELDIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
       sed -i\
       -e "s/\(^CONFIG_SND.*\=\).*/\1n/"\
       -e "s/\(^CONFIG_SOUND.*\=\).*/\1n/"\
@@ -64,25 +64,25 @@ if [ "$BUILD_KERNEL" = true ] ; then
       -e "s/\(^CONFIG_TOUCHSCREEN.*\=\).*/\1n/"\
       -e "s/\(^CONFIG_USB_GSPCA_.*\=\).*/\1n/"\
       -e "s/\(^CONFIG_DRM.*\=\).*/\1n/"\
-      "$R/usr/src/linux/.config"
+      "${KERNELDIR}/.config"
     fi
 
     if [ "$KERNELSRC_CONFIG" = true ] ; then
       # Load default raspberry kernel configuration
-      make -C "$R/usr/src/linux" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
+      make -C "${KERNELDIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
 
       # Start menu-driven kernel configuration (interactive)
       if [ "$KERNEL_MENUCONFIG" = true ] ; then
-        make -C "$R/usr/src/linux" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" menuconfig
+        make -C "${KERNELDIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" menuconfig
       fi
     fi
 
     # Cross compile kernel and modules
-    make -C "$R/usr/src/linux" -j${KERNEL_THREADS} ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" zImage modules dtbs
+    make -C "${KERNELDIR}" -j${KERNEL_THREADS} ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" zImage modules dtbs
   fi
 
   # Check if kernel compilation was successful
-  if [ ! -r "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/zImage" ] ; then
+  if [ ! -r "${KERNELDIR}/arch/${KERNEL_ARCH}/boot/zImage" ] ; then
     echo "error: kernel compilation failed! (zImage not found)"
     cleanup
     exit 1
@@ -90,50 +90,55 @@ if [ "$BUILD_KERNEL" = true ] ; then
 
   # Install kernel modules
   if [ "$ENABLE_REDUCE" = true ] ; then
-    make -C "$R/usr/src/linux" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=../../.. modules_install
+    make -C "${KERNELDIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=../../.. modules_install
   else
-    make -C "$R/usr/src/linux" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_PATH=../../.. modules_install
+    make -C "${KERNELDIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_PATH=../../.. modules_install
 
     # Install kernel firmware
-    make -C "$R/usr/src/linux" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_FW_PATH=../../../lib firmware_install
+    make -C "${KERNELDIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_FW_PATH=../../../lib firmware_install
   fi
 
   # Install kernel headers
   if [ "$KERNEL_HEADERS" = true ] && [ "$KERNEL_REDUCE" = false ] ; then
-    make -C "$R/usr/src/linux" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_HDR_PATH=../.. headers_install
+    make -C "${KERNELDIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_HDR_PATH=../.. headers_install
   fi
 
   # Prepare boot (firmware) directory
-  mkdir "$R/boot/firmware/"
+  mkdir "${BOOTDIR}"
 
   # Get kernel release version
-  KERNEL_VERSION=`cat "$R/usr/src/linux/include/config/kernel.release"`
+  KERNEL_VERSION=`cat "${KERNELDIR}/include/config/kernel.release"`
 
   # Copy kernel configuration file to the boot directory
-  install_readonly "$R/usr/src/linux/.config" "$R/boot/config-${KERNEL_VERSION}"
+  install_readonly "${KERNELDIR}/.config" "${R}/boot/config-${KERNEL_VERSION}"
 
   # Copy dts and dtb device tree sources and binaries
-  mkdir "$R/boot/firmware/overlays/"
-  install_readonly "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/"*.dtb "$R/boot/firmware/"
-  install_readonly "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtb* "$R/boot/firmware/overlays/"
-  install_readonly "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "$R/boot/firmware/overlays/README"
-
-  # Convert and copy zImage kernel to the boot directory
-  "$R/usr/src/linux/scripts/mkknlimg" "$R/usr/src/linux/arch/arm/boot/zImage" "$R/boot/firmware/kernel7.img"
+  mkdir "${BOOTDIR}/overlays"
+  install_readonly "${KERNELDIR}/arch/${KERNEL_ARCH}/boot/dts/"*.dtb "${BOOTDIR}/"
+  install_readonly "${KERNELDIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtb* "${BOOTDIR}/overlays/"
+  install_readonly "${KERNELDIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "${BOOTDIR}/overlays/README"
+
+  if [ "$ENABLE_UBOOT" = false ] ; then
+    # Convert and copy zImage kernel to the boot directory
+    "${KERNELDIR}/scripts/mkknlimg" "${KERNELDIR}/arch/${KERNEL_ARCH}/boot/zImage" "${BOOTDIR}/${KERNEL_IMAGE}"
+  else
+    # Copy zImage kernel to the boot directory
+    install_readonly "${KERNELDIR}/arch/${KERNEL_ARCH}/boot/zImage" "${BOOTDIR}/${KERNEL_IMAGE}"
+  fi
 
   # Remove kernel sources
   if [ "$KERNEL_REMOVESRC" = true ] ; then
-    rm -fr "$R/usr/src/linux"
+    rm -fr "${KERNELDIR}"
   fi
 
   # Install latest boot binaries from raspberry/firmware github
-  wget -q -O "$R/boot/firmware/bootcode.bin" https://github.com/raspberrypi/firmware/raw/master/boot/bootcode.bin
-  wget -q -O "$R/boot/firmware/fixup.dat" https://github.com/raspberrypi/firmware/raw/master/boot/fixup.dat
-  wget -q -O "$R/boot/firmware/fixup_cd.dat" https://github.com/raspberrypi/firmware/raw/master/boot/fixup_cd.dat
-  wget -q -O "$R/boot/firmware/fixup_x.dat" https://github.com/raspberrypi/firmware/raw/master/boot/fixup_x.dat
-  wget -q -O "$R/boot/firmware/start.elf" https://github.com/raspberrypi/firmware/raw/master/boot/start.elf
-  wget -q -O "$R/boot/firmware/start_cd.elf" https://github.com/raspberrypi/firmware/raw/master/boot/start_cd.elf
-  wget -q -O "$R/boot/firmware/start_x.elf" https://github.com/raspberrypi/firmware/raw/master/boot/start_x.elf
+  wget -q -O "${BOOTDIR}/bootcode.bin" https://github.com/raspberrypi/firmware/raw/master/boot/bootcode.bin
+  wget -q -O "${BOOTDIR}/fixup.dat" https://github.com/raspberrypi/firmware/raw/master/boot/fixup.dat
+  wget -q -O "${BOOTDIR}/fixup_cd.dat" https://github.com/raspberrypi/firmware/raw/master/boot/fixup_cd.dat
+  wget -q -O "${BOOTDIR}/fixup_x.dat" https://github.com/raspberrypi/firmware/raw/master/boot/fixup_x.dat
+  wget -q -O "${BOOTDIR}/start.elf" https://github.com/raspberrypi/firmware/raw/master/boot/start.elf
+  wget -q -O "${BOOTDIR}/start_cd.elf" https://github.com/raspberrypi/firmware/raw/master/boot/start_cd.elf
+  wget -q -O "${BOOTDIR}/start_x.elf" https://github.com/raspberrypi/firmware/raw/master/boot/start_x.elf
 
 else # BUILD_KERNEL=false
   # Kernel installation
@@ -143,14 +148,14 @@ else # BUILD_KERNEL=false
   chroot_exec apt-get -qq -y install flash-kernel
 
   # Check if kernel installation was successful
-  VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)"
+  VMLINUZ="$(ls -1 ${R}/boot/vmlinuz-* | sort | tail -n 1)"
   if [ -z "$VMLINUZ" ] ; then
     echo "error: kernel installation failed! (/boot/vmlinuz-* not found)"
     cleanup
     exit 1
   fi
   # Copy vmlinuz kernel to the boot directory
-  install_readonly "$VMLINUZ" "$R/boot/firmware/kernel7.img"
+  install_readonly "${VMLINUZ}" "${BOOTDIR}/${KERNEL_IMAGE}"
 fi
 
 # Setup firmware boot cmdline
@@ -160,6 +165,15 @@ else
   CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1 ${CMDLINE}"
 fi
 
+# Add encrypted root partition to cmdline.txt
+if [ "$ENABLE_CRYPTFS" = true ] ; then
+  if [ "$ENABLE_SPLITFS" = true ] ; then
+    CMDLINE=$(echo ${CMDLINE} | sed "s/sda1/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/sda1:${CRYPTFS_MAPPING}/")
+  else
+    CMDLINE=$(echo ${CMDLINE} | sed "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/mmcblk0p2:${CRYPTFS_MAPPING}/")
+  fi
+fi
+
 # Add serial console support
 if [ "$ENABLE_CONSOLE" = true ] ; then
   CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"
@@ -171,69 +185,79 @@ if [ "$ENABLE_IPV6" = false ] ; then
 fi
 
 # Install firmware boot cmdline
-echo "${CMDLINE}" > "$R/boot/firmware/cmdline.txt"
-
-# Add encrypted root partition to cmdline.txt
-if [ "$ENABLE_CRYPTFS" = true ] ; then
-    sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/mmcblk0p2:${CRYPTFS_MAPPING}/" "$R/boot/firmware/cmdline.txt"
-fi
+echo "${CMDLINE}" > "${BOOTDIR}/cmdline.txt"
 
 # Install firmware config
-install_readonly files/boot/config.txt "$R/boot/firmware/config.txt"
+install_readonly files/boot/config.txt "${BOOTDIR}/config.txt"
 
 # Setup minimal GPU memory allocation size: 16MB (no X)
 if [ "$ENABLE_MINGPU" = true ] ; then
-  echo "gpu_mem=16" >> "$R/boot/firmware/config.txt"
+  echo "gpu_mem=16" >> "${BOOTDIR}/config.txt"
 fi
 
 # Setup boot with initramfs
 if [ "$ENABLE_INITRAMFS" = true ] ; then
-  echo "initramfs initramfs-${KERNEL_VERSION} followkernel" >> "$R/boot/firmware/config.txt"
+  echo "initramfs initramfs-${KERNEL_VERSION} followkernel" >> "${BOOTDIR}/config.txt"
 fi
 
 # Create firmware configuration and cmdline symlinks
-ln -sf firmware/config.txt "$R/boot/config.txt"
-ln -sf firmware/cmdline.txt "$R/boot/cmdline.txt"
+ln -sf firmware/config.txt "${R}/boot/config.txt"
+ln -sf firmware/cmdline.txt "${R}/boot/cmdline.txt"
 
 # Install and setup kernel modules to load at boot
-mkdir -p "$R/lib/modules-load.d/"
-install_readonly files/modules/rpi2.conf "$R/lib/modules-load.d/rpi2.conf"
+mkdir -p "${R}/lib/modules-load.d/"
+install_readonly files/modules/rpi2.conf "${R}/lib/modules-load.d/rpi2.conf"
 
 # Load hardware random module at boot
-if [ "$ENABLE_HWRANDOM" = true ] ; then
-  sed -i "s/^# bcm2708_rng/bcm2708_rng/" "$R/lib/modules-load.d/rpi2.conf"
+if [ "$ENABLE_HWRANDOM" = true ] && [ "$BUILD_KERNEL" = false ] ; then
+  sed -i "s/^# bcm2708_rng/bcm2708_rng/" "${R}/lib/modules-load.d/rpi2.conf"
 fi
 
 # Load sound module at boot
 if [ "$ENABLE_SOUND" = true ] ; then
-  sed -i "s/^# snd_bcm2835/snd_bcm2835/" "$R/lib/modules-load.d/rpi2.conf"
+  sed -i "s/^# snd_bcm2835/snd_bcm2835/" "${R}/lib/modules-load.d/rpi2.conf"
 fi
 
 # Install kernel modules blacklist
-mkdir -p "$R/etc/modprobe.d/"
-install_readonly files/modules/raspi-blacklist.conf "$R/etc/modprobe.d/raspi-blacklist.conf"
+mkdir -p "${ETCDIR}/modprobe.d/"
+install_readonly files/modules/raspi-blacklist.conf "${ETCDIR}/modprobe.d/raspi-blacklist.conf"
 
 # Install and setup fstab
-install_readonly files/mount/fstab "$R/etc/fstab"
+install_readonly files/mount/fstab "${ETCDIR}/fstab"
 
 # Add usb/sda disk root partition to fstab
-if [ "$ENABLE_SPLITFS" = true ] ; then
-  sed -i "s/mmcblk0p2/sda1/" "$R/etc/fstab"
+if [ "$ENABLE_SPLITFS" = true ] && [ "$ENABLE_CRYPTFS" = false ] ; then
+  sed -i "s/mmcblk0p2/sda1/" "${ETCDIR}/fstab"
 fi
 
 # Add encrypted root partition to fstab and crypttab
 if [ "$ENABLE_CRYPTFS" = true ] ; then
   # Replace fstab root partition with encrypted partition mapping
-  sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING}/" "$R/etc/fstab"
+  sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING}/" "${ETCDIR}/fstab"
 
   # Add encrypted partition to crypttab and fstab
-  install_readonly files/mount/crypttab "$R/etc/crypttab"
-  echo "${CRYPTFS_MAPPING} /dev/mmcblk0p2 none luks" >> "$R/etc/crypttab"
+  install_readonly files/mount/crypttab "${ETCDIR}/crypttab"
+  echo "${CRYPTFS_MAPPING} /dev/mmcblk0p2 none luks" >> "${ETCDIR}/crypttab"
+
+  if [ "$ENABLE_SPLITFS" = true ] ; then
+    # Add usb/sda disk to crypttab
+    sed -i "s/mmcblk0p2/sda1/" "${ETCDIR}/crypttab"
+  fi
 fi
 
 # Generate initramfs file
 if [ "$ENABLE_INITRAMFS" = true ] ; then
   if [ "$ENABLE_CRYPTFS" = true ] ; then
+    # Include initramfs scripts to auto expand encrypted root partition
+    if [ "$EXPANDROOT" = true ] ; then
+      install_exec files/initramfs/expand_encrypted_rootfs "${ETCDIR}/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs"
+      install_exec files/initramfs/expand-premount "${ETCDIR}/initramfs-tools/scripts/local-premount/expand-premount"
+      install_exec files/initramfs/expand-tools "${ETCDIR}/initramfs-tools/hooks/expand-tools"
+    fi
+
+    # Disable SSHD inside initramfs
+    printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=n\n" >> "${ETCDIR}/initramfs-tools/initramfs.conf"
+
     # Dummy mapping required by mkinitramfs
     echo "0 1 crypt $(echo ${CRYPTFS_CIPHER} | cut -d ':' -f 1) ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 0 7:0 4096" | chroot_exec dmsetup create "${CRYPTFS_MAPPING}"
 
@@ -249,4 +273,4 @@ if [ "$ENABLE_INITRAMFS" = true ] ; then
 fi
 
 # Install sysctl.d configuration files
-install_readonly files/sysctl.d/81-rpi-vm.conf "$R/etc/sysctl.d/81-rpi-vm.conf"
+install_readonly files/sysctl.d/81-rpi-vm.conf "${ETCDIR}/sysctl.d/81-rpi-vm.conf"
diff --git a/bootstrap.d/20-networking.sh b/bootstrap.d/20-networking.sh
index bd6e8db..16e06f2 100644
--- a/bootstrap.d/20-networking.sh
+++ b/bootstrap.d/20-networking.sh
@@ -6,37 +6,37 @@
 . ./functions.sh
 
 # Install and setup hostname
-install_readonly files/network/hostname "$R/etc/hostname"
-sed -i "s/^rpi2-jessie/${HOSTNAME}/" "$R/etc/hostname"
+install_readonly files/network/hostname "${ETCDIR}/hostname"
+sed -i "s/^rpi2-jessie/${HOSTNAME}/" "${ETCDIR}/hostname"
 
 # Install and setup hosts
-install_readonly files/network/hosts "$R/etc/hosts"
-sed -i "s/rpi2-jessie/${HOSTNAME}/" "$R/etc/hosts"
+install_readonly files/network/hosts "${ETCDIR}/hosts"
+sed -i "s/rpi2-jessie/${HOSTNAME}/" "${ETCDIR}/hosts"
 
 # Setup hostname entry with static IP
 if [ "$NET_ADDRESS" != "" ] ; then
   NET_IP=$(echo "${NET_ADDRESS}" | cut -f 1 -d'/')
-  sed -i "s/^127.0.1.1/${NET_IP}/" "$R/etc/hosts"
+  sed -i "s/^127.0.1.1/${NET_IP}/" "${ETCDIR}/hosts"
 fi
 
 # Remove IPv6 hosts
 if [ "$ENABLE_IPV6" = false ] ; then
-  sed -i -e "/::[1-9]/d" -e "/^$/d" "$R/etc/hosts"
+  sed -i -e "/::[1-9]/d" -e "/^$/d" "${ETCDIR}/hosts"
 fi
 
 # Install hint about network configuration
-install_readonly files/network/interfaces "$R/etc/network/interfaces"
+install_readonly files/network/interfaces "${ETCDIR}/network/interfaces"
 
 # Install configuration for interface eth0
-install_readonly files/network/eth.network "$R/etc/systemd/network/eth.network"
+install_readonly files/network/eth.network "${ETCDIR}/systemd/network/eth.network"
 
 if [ "$ENABLE_DHCP" = true ] ; then
   # Enable DHCP configuration for interface eth0
-  sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "$R/etc/systemd/network/eth.network"
+  sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETCDIR}/systemd/network/eth.network"
 
   # Set DHCP configuration to IPv4 only
   if [ "$ENABLE_IPV6" = false ] ; then
-    sed -i "s/DHCP=.*/DHCP=v4/" "$R/etc/systemd/network/eth.network"
+    sed -i "s/DHCP=.*/DHCP=v4/" "${ETCDIR}/systemd/network/eth.network"
   fi
 
 else # ENABLE_DHCP=false
@@ -50,23 +50,23 @@ else # ENABLE_DHCP=false
   -e "s|Domains=\$|Domains=${NET_DNS_DOMAINS}|"\
   -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_1}|"\
   -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_2}|"\
-  "$R/etc/systemd/network/eth.network"
+  "${ETCDIR}/systemd/network/eth.network"
 fi
 
 # Remove empty settings from network configuration
-sed -i "/.*=\$/d" "$R/etc/systemd/network/eth.network"
+sed -i "/.*=\$/d" "${ETCDIR}/systemd/network/eth.network"
 
 # Enable systemd-networkd service
 chroot_exec systemctl enable systemd-networkd
 
 # Install host.conf resolver configuration
-install_readonly files/network/host.conf "$R/etc/host.conf"
+install_readonly files/network/host.conf "${ETCDIR}/host.conf"
 
 # Enable network stack hardening
 if [ "$ENABLE_HARDNET" = true ] ; then
   # Install sysctl.d configuration files
-  install_readonly files/sysctl.d/82-rpi-net-hardening.conf "$R/etc/sysctl.d/82-rpi-net-hardening.conf"
+  install_readonly files/sysctl.d/82-rpi-net-hardening.conf "${ETCDIR}/sysctl.d/82-rpi-net-hardening.conf"
 
   # Setup resolver warnings about spoofed addresses
-  sed -i "s/^# spoof warn/spoof warn/" "$R/etc/host.conf"
+  sed -i "s/^# spoof warn/spoof warn/" "${ETCDIR}/host.conf"
 fi
diff --git a/bootstrap.d/21-firewall.sh b/bootstrap.d/21-firewall.sh
index 247325e..7583d04 100644
--- a/bootstrap.d/21-firewall.sh
+++ b/bootstrap.d/21-firewall.sh
@@ -7,16 +7,16 @@
 
 if [ "$ENABLE_IPTABLES" = true ] ; then
   # Create iptables configuration directory
-  mkdir -p "$R/etc/iptables"
+  mkdir -p "${ETCDIR}/iptables"
 
   # Install iptables systemd service
-  install_readonly files/iptables/iptables.service "$R/etc/systemd/system/iptables.service"
+  install_readonly files/iptables/iptables.service "${ETCDIR}/systemd/system/iptables.service"
 
   # Install flush-table script called by iptables service
-  install_exec files/iptables/flush-iptables.sh "$R/etc/iptables/flush-iptables.sh"
+  install_exec files/iptables/flush-iptables.sh "${ETCDIR}/iptables/flush-iptables.sh"
 
   # Install iptables rule file
-  install_readonly files/iptables/iptables.rules "$R/etc/iptables/iptables.rules"
+  install_readonly files/iptables/iptables.rules "${ETCDIR}/iptables/iptables.rules"
 
   # Reload systemd configuration and enable iptables service
   chroot_exec systemctl daemon-reload
@@ -24,12 +24,12 @@ if [ "$ENABLE_IPTABLES" = true ] ; then
 
   if [ "$ENABLE_IPV6" = true ] ; then
     # Install ip6tables systemd service
-    install_readonly files/iptables/ip6tables.service "$R/etc/systemd/system/ip6tables.service"
+    install_readonly files/iptables/ip6tables.service "${ETCDIR}/systemd/system/ip6tables.service"
 
     # Install ip6tables file
-    install_exec files/iptables/flush-ip6tables.sh "$R/etc/iptables/flush-ip6tables.sh"
+    install_exec files/iptables/flush-ip6tables.sh "${ETCDIR}/iptables/flush-ip6tables.sh"
 
-    install_readonly files/iptables/ip6tables.rules "$R/etc/iptables/ip6tables.rules"
+    install_readonly files/iptables/ip6tables.rules "${ETCDIR}/iptables/ip6tables.rules"
 
     # Reload systemd configuration and enable iptables service
     chroot_exec systemctl daemon-reload
@@ -39,6 +39,6 @@ fi
 
 if [ "$ENABLE_SSHD" = false ] ; then
  # Remove SSHD related iptables rules
- sed -i "/^#/! {/SSH/ s/^/# /}" "$R/etc/iptables/iptables.rules" 2> /dev/null
- sed -i "/^#/! {/SSH/ s/^/# /}" "$R/etc/iptables/ip6tables.rules" 2> /dev/null
+ sed -i "/^#/! {/SSH/ s/^/# /}" "${ETCDIR}/iptables/iptables.rules" 2> /dev/null
+ sed -i "/^#/! {/SSH/ s/^/# /}" "${ETCDIR}/iptables/ip6tables.rules" 2> /dev/null
 fi
diff --git a/bootstrap.d/30-security.sh b/bootstrap.d/30-security.sh
index a07719d..a5b558b 100644
--- a/bootstrap.d/30-security.sh
+++ b/bootstrap.d/30-security.sh
@@ -19,7 +19,7 @@ if [ "$ENABLE_ROOT" = true ] ; then
   chroot_exec usermod -p "${ENCRYPTED_PASSWORD}" root
 
   if [ "$ENABLE_ROOT_SSH" = true ] ; then
-    sed -i "s|[#]*PermitRootLogin.*|PermitRootLogin yes|g" "$R/etc/ssh/sshd_config"
+    sed -i "s|[#]*PermitRootLogin.*|PermitRootLogin yes|g" "${ETCDIR}/ssh/sshd_config"
   fi
 else
   # Set no root password to disable root login
diff --git a/bootstrap.d/31-logging.sh b/bootstrap.d/31-logging.sh
index 00a9f86..149ab68 100644
--- a/bootstrap.d/31-logging.sh
+++ b/bootstrap.d/31-logging.sh
@@ -7,7 +7,7 @@
 
 # Disable rsyslog
 if [ "$ENABLE_RSYSLOG" = false ] ; then
-  sed -i "s|[#]*ForwardToSyslog=yes|ForwardToSyslog=no|g" "$R/etc/systemd/journald.conf"
+  sed -i "s|[#]*ForwardToSyslog=yes|ForwardToSyslog=no|g" "${ETCDIR}/systemd/journald.conf"
   chroot_exec systemctl disable rsyslog
   chroot_exec apt-get -qq -y --force-yes purge rsyslog
 fi
diff --git a/bootstrap.d/41-uboot.sh b/bootstrap.d/41-uboot.sh
index 8f59f26..19ad084 100644
--- a/bootstrap.d/41-uboot.sh
+++ b/bootstrap.d/41-uboot.sh
@@ -7,25 +7,61 @@
 
 # Install gcc/c++ build environment inside the chroot
 if [ "$ENABLE_UBOOT" = true ] || [ "$ENABLE_FBTURBO" = true ] ; then
-  chroot_exec apt-get -q -y --force-yes --no-install-recommends install linux-compiler-gcc-4.9-arm g++ make bc
+  chroot_exec apt-get -q -y --force-yes --no-install-recommends install linux-compiler-gcc-4.8-arm g++ make bc
 fi
 
 # Fetch and build U-Boot bootloader
 if [ "$ENABLE_UBOOT" = true ] ; then
   # Fetch U-Boot bootloader sources
-  git -C "$R/tmp" clone git://git.denx.de/u-boot.git
+  git -C "${R}/tmp" clone git://git.denx.de/u-boot.git
 
   # Build and install U-Boot inside chroot
-  chroot_exec make -C /tmp/u-boot/ rpi_2_defconfig all
+  chroot_exec make -C /tmp/u-boot/ ${UBOOT_CONFIG} all
 
   # Copy compiled bootloader binary and set config.txt to load it
-  install_readonly "$R/tmp/u-boot/u-boot.bin" "$R/boot/firmware/u-boot.bin"
-  printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> "$R/boot/firmware/config.txt"
+  install_exec "${R}/tmp/u-boot/tools/mkimage" "${R}/usr/sbin/mkimage"
+  install_readonly "${R}/tmp/u-boot/u-boot.bin" "${BOOTDIR}/u-boot.bin"
+  printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> "${BOOTDIR}/config.txt"
 
   # Install and setup U-Boot command file
-  install_readonly files/boot/uboot.mkimage "$R/boot/firmware/uboot.mkimage"
-  printf "# Set the kernel boot command line\nsetenv bootargs \"earlyprintk ${CMDLINE}\"\n\n$(cat $R/boot/firmware/uboot.mkimage)" > "$R/boot/firmware/uboot.mkimage"
+  install_readonly files/boot/uboot.mkimage "${BOOTDIR}/uboot.mkimage"
+  printf "# Set the kernel boot command line\nsetenv bootargs \"earlyprintk ${CMDLINE}\"\n\n$(cat ${BOOTDIR}/uboot.mkimage)" > "${BOOTDIR}/uboot.mkimage"
+
+  if [ "$ENABLE_INITRAMFS" = true ] ; then
+    # Convert generated initramfs for U-Boot using mkimage
+    chroot_exec /usr/sbin/mkimage -A "${KERNEL_ARCH}" -T ramdisk -C none -n "initramfs-${KERNEL_VERSION}" -d "/boot/firmware/initramfs-${KERNEL_VERSION}" "/boot/firmware/initramfs-${KERNEL_VERSION}.uboot"
+
+    # Remove original initramfs file
+    rm -f "${BOOTDIR}/initramfs-${KERNEL_VERSION}"
+
+    # Configure U-Boot to load generated initramfs
+    printf "# Set initramfs file\nsetenv initramfs initramfs-${KERNEL_VERSION}.uboot\n\n$(cat ${BOOTDIR}/uboot.mkimage)" > "${BOOTDIR}/uboot.mkimage"
+    printf "\nbootz \${kernel_addr_r} \${ramdisk_addr_r} \${fdt_addr_r}" >> "${BOOTDIR}/uboot.mkimage"
+  else # ENABLE_INITRAMFS=false
+    # Remove initramfs from U-Boot mkfile
+    sed -i '/.*initramfs.*/d' "${BOOTDIR}/uboot.mkimage"
+
+    if [ "$BUILD_KERNEL" = false ] ; then
+      # Remove dtbfile from U-Boot mkfile
+      sed -i '/.*dtbfile.*/d' "${BOOTDIR}/uboot.mkimage"
+      printf "\nbootz \${kernel_addr_r}" >> "${BOOTDIR}/uboot.mkimage"
+    else
+      printf "\nbootz \${kernel_addr_r} - \${fdt_addr_r}" >> "${BOOTDIR}/uboot.mkimage"
+    fi
+  fi
+
+  # Set mkfile to use dtb file
+  sed -i "s/^\(setenv dtbfile \).*/\1${DTB_FILE}/" "${BOOTDIR}/uboot.mkimage"
+
+  # Set mkfile to use kernel image
+  sed -i "s/^\(fatload mmc 0:1 \${kernel_addr_r} \).*/\1${KERNEL_IMAGE}/" "${BOOTDIR}/uboot.mkimage"
+
+  # Remove all leading blank lines
+  sed -i "/./,\$!d" "${BOOTDIR}/uboot.mkimage"
 
   # Generate U-Boot bootloader image
-  chroot_exec /tmp/u-boot/tools/mkimage -A "${KERNEL_ARCH}" -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n RPi2 -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
+  chroot_exec /usr/sbin/mkimage -A "${KERNEL_ARCH}" -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n RPi2 -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
+
+  # Remove U-Boot sources
+  rm -fr "${R}/tmp/u-boot"
 fi
diff --git a/bootstrap.d/42-fbturbo.sh b/bootstrap.d/42-fbturbo.sh
index ca6b2fb..4e03f53 100644
--- a/bootstrap.d/42-fbturbo.sh
+++ b/bootstrap.d/42-fbturbo.sh
@@ -7,7 +7,7 @@
 
 if [ "$ENABLE_FBTURBO" = true ] ; then
   # Fetch fbturbo driver sources
-  git -C "$R/tmp" clone https://github.com/ssvb/xf86-video-fbturbo.git
+  git -C "${R}/tmp" clone https://github.com/ssvb/xf86-video-fbturbo.git
 
   # Install Xorg build dependencies
   chroot_exec apt-get -q -y --no-install-recommends install xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
@@ -22,7 +22,7 @@ make install
 EOF
 
   # Install fbturbo driver Xorg configuration
-  install_readonly files/xorg/99-fbturbo.conf "$R/usr/share/X11/xorg.conf.d/99-fbturbo.conf"
+  install_readonly files/xorg/99-fbturbo.conf "${R}/usr/share/X11/xorg.conf.d/99-fbturbo.conf"
 
   # Remove Xorg build dependencies
   chroot_exec apt-get -qq -y --auto-remove purge xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
@@ -30,5 +30,5 @@ fi
 
 # Remove gcc/c++ build environment from the chroot
 if [ "$ENABLE_UBOOT" = true ] || [ "$ENABLE_FBTURBO" = true ] ; then
-  chroot_exec apt-get -qq -y --auto-remove purge bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make
+  chroot_exec apt-get -qq -y --auto-remove purge bc binutils cpp cpp-4.8 cpp-4.9 g++ g++-4.8 g++-4.9 gcc gcc-4.8 gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.8-dev libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.8-arm linux-libc-dev make
 fi
diff --git a/bootstrap.d/50-firstboot.sh b/bootstrap.d/50-firstboot.sh
index 2ec9404..7e2e008 100644
--- a/bootstrap.d/50-firstboot.sh
+++ b/bootstrap.d/50-firstboot.sh
@@ -6,29 +6,34 @@
 . ./functions.sh
 
 # Prepare rc.firstboot script
-cat files/firstboot/10-begin.sh > "$R/etc/rc.firstboot"
+cat files/firstboot/10-begin.sh > "${ETCDIR}/rc.firstboot"
 
 # Ensure openssh server host keys are regenerated on first boot
 if [ "$ENABLE_SSHD" = true ] ; then
-  cat files/firstboot/21-generate-ssh-keys.sh >> "$R/etc/rc.firstboot"
+  cat files/firstboot/21-generate-ssh-keys.sh >> "${ETCDIR}/rc.firstboot"
 fi
 
 # Prepare filesystem auto expand
 if [ "$EXPANDROOT" = true ] ; then
-  cat files/firstboot/22-expandroot.sh >> "$R/etc/rc.firstboot"
+  if [ "$ENABLE_CRYPTFS" = false ] ; then
+    cat files/firstboot/22-expandroot.sh >> "${ETCDIR}/rc.firstboot"
+  else
+    # Regenerate initramfs to remove encrypted root partition auto expand
+    cat files/firstboot/23-regenerate-initramfs.sh >> "${ETCDIR}/rc.firstboot"
+  fi
 fi
 
 # Ensure that dbus machine-id exists
-cat files/firstboot/23-generate-machineid.sh >> "$R/etc/rc.firstboot"
+cat files/firstboot/24-generate-machineid.sh >> "${ETCDIR}/rc.firstboot"
 
 # Create /etc/resolv.conf symlink
-cat files/firstboot/24-create-resolv-symlink.sh >> "$R/etc/rc.firstboot"
+cat files/firstboot/25-create-resolv-symlink.sh >> "${ETCDIR}/rc.firstboot"
 
 # Finalize rc.firstboot script
-cat files/firstboot/99-finish.sh >> "$R/etc/rc.firstboot"
-chmod +x "$R/etc/rc.firstboot"
+cat files/firstboot/99-finish.sh >> "${ETCDIR}/rc.firstboot"
+chmod +x "${ETCDIR}/rc.firstboot"
 
 # Add rc.firstboot script to rc.local
-sed -i '/exit 0/d' "$R/etc/rc.local"
-echo /etc/rc.firstboot >> "$R/etc/rc.local"
-echo exit 0 >> "$R/etc/rc.local"
+sed -i '/exit 0/d' "${ETCDIR}/rc.local"
+echo /etc/rc.firstboot >> "${ETCDIR}/rc.local"
+echo exit 0 >> "${ETCDIR}/rc.local"
diff --git a/bootstrap.d/99-reduce.sh b/bootstrap.d/99-reduce.sh
index 99fbc9b..128e7a6 100644
--- a/bootstrap.d/99-reduce.sh
+++ b/bootstrap.d/99-reduce.sh
@@ -10,33 +10,33 @@ if [ "$ENABLE_REDUCE" = true ] ; then
   if [ "$REDUCE_APT" = true ] ; then
     # Install dpkg configuration file
     if [ "$REDUCE_DOC" = true ] || [ "$REDUCE_MAN" = true ] ; then
-      install_readonly files/dpkg/01nodoc "$R/etc/dpkg/dpkg.cfg.d/01nodoc"
+      install_readonly files/dpkg/01nodoc "${ETCDIR}/dpkg/dpkg.cfg.d/01nodoc"
     fi
 
     # Install APT configuration files
-    install_readonly files/apt/02nocache "$R/etc/apt/apt.conf.d/02nocache"
-    install_readonly files/apt/03compress "$R/etc/apt/apt.conf.d/03compress"
-    install_readonly files/apt/04norecommends "$R/etc/apt/apt.conf.d/04norecommends"
+    install_readonly files/apt/02nocache "${ETCDIR}/apt/apt.conf.d/02nocache"
+    install_readonly files/apt/03compress "${ETCDIR}/apt/apt.conf.d/03compress"
+    install_readonly files/apt/04norecommends "${ETCDIR}/apt/apt.conf.d/04norecommends"
 
     # Remove APT cache files
-    rm -fr "$R/var/cache/apt/pkgcache.bin"
-    rm -fr "$R/var/cache/apt/srcpkgcache.bin"
+    rm -fr "${R}/var/cache/apt/pkgcache.bin"
+    rm -fr "${R}/var/cache/apt/srcpkgcache.bin"
   fi
 
   # Remove all doc files
   if [ "$REDUCE_DOC" = true ] ; then
-    find "$R/usr/share/doc" -depth -type f ! -name copyright | xargs rm || true
-    find "$R/usr/share/doc" -empty | xargs rmdir || true
+    find "${R}/usr/share/doc" -depth -type f ! -name copyright | xargs rm || true
+    find "${R}/usr/share/doc" -empty | xargs rmdir || true
   fi
 
   # Remove all man pages and info files
   if [ "$REDUCE_MAN" = true ] ; then
-    rm -rf "$R/usr/share/man" "$R/usr/share/groff" "$R/usr/share/info" "$R/usr/share/lintian" "$R/usr/share/linda" "$R/var/cache/man"
+    rm -rf "${R}/usr/share/man" "${R}/usr/share/groff" "${R}/usr/share/info" "${R}/usr/share/lintian" "${R}/usr/share/linda" "${R}/var/cache/man"
   fi
 
   # Remove all locale translation files
   if [ "$REDUCE_LOCALE" = true ] ; then
-    find "$R/usr/share/locale" -mindepth 1 -maxdepth 1 ! -name 'en' | xargs rm -r
+    find "${R}/usr/share/locale" -mindepth 1 -maxdepth 1 ! -name 'en' | xargs rm -r
   fi
 
   # Remove hwdb PCI device classes (experimental)
@@ -60,19 +60,19 @@ if [ "$ENABLE_REDUCE" = true ] ; then
 
   # Remove GPU kernels
   if [ "$ENABLE_MINGPU" = true ] ; then
-    rm -f "$R/boot/firmware/start.elf"
-    rm -f "$R/boot/firmware/fixup.dat"
-    rm -f "$R/boot/firmware/start_x.elf"
-    rm -f "$R/boot/firmware/fixup_x.dat"
+    rm -f "${BOOTDIR}/start.elf"
+    rm -f "${BOOTDIR}/fixup.dat"
+    rm -f "${BOOTDIR}/start_x.elf"
+    rm -f "${BOOTDIR}/fixup_x.dat"
   fi
 
   # Remove kernel and initrd from /boot (already in /boot/firmware)
   if [ "$BUILD_KERNEL" = false ] ; then
-    rm -r "$R/boot/vmlinuz--*"
-    rm -r "$R/boot/initrd.img-*"
+    rm -f "${R}/boot/vmlinuz-*"
+    rm -f "${R}/boot/initrd.img-*"
   fi
 
   # Clean APT list of repositories
-  rm -fr "$R/var/lib/apt/lists/*"
+  rm -fr "${R}/var/lib/apt/lists/*"
   chroot_exec apt-get -qq -y update
 fi
diff --git a/files/boot/uboot.mkimage b/files/boot/uboot.mkimage
index cd71de6..8d02431 100644
--- a/files/boot/uboot.mkimage
+++ b/files/boot/uboot.mkimage
@@ -1,3 +1,6 @@
+# Set device tree fdtfile
+setenv dtbfile bcm2709-rpi-2-b.dtb
+
 # Tell Linux that it is booting on a Raspberry Pi2
 setenv machid 0x00000c42
 
@@ -6,6 +9,7 @@ saveenv
 
 # Load the existing Linux kernel into RAM
 fatload mmc 0:1 ${kernel_addr_r} kernel7.img
+fatload mmc 0:1 ${fdt_addr_r} ${dtbfile}
+fatload mmc 0:1 ${ramdisk_addr_r} ${initramfs}
 
 # Boot the kernel we have just loaded
-bootz ${kernel_addr_r}
diff --git a/files/firstboot/21-generate-ssh-keys.sh b/files/firstboot/21-generate-ssh-keys.sh
index 928ee2e..b3345b4 100644
--- a/files/firstboot/21-generate-ssh-keys.sh
+++ b/files/firstboot/21-generate-ssh-keys.sh
@@ -1,8 +1,11 @@
 logger -t "rc.firstboot" "Generating SSH host keys"
 
 if [ -d "/etc/ssh/" ] ; then
+  # Remove ssh host keys
   rm -f /etc/ssh/ssh_host_*
   systemctl stop sshd
+
+  # Regenerate ssh host keys
   ssh-keygen -q -t rsa -N "" -f /etc/ssh/ssh_host_rsa_key
   ssh-keygen -q -t dsa -N "" -f /etc/ssh/ssh_host_dsa_key
   ssh-keygen -q -t ecdsa -N "" -f /etc/ssh/ssh_host_ecdsa_key
@@ -11,8 +14,11 @@ if [ -d "/etc/ssh/" ] ; then
 fi
 
 if [ -d "/etc/dropbear/" ] ; then
+  # Remove ssh host keys
   rm -f /etc/dropbear/dropbear_*
   systemctl stop dropbear
+
+  # Regenerate ssh host keys
   dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key
   dropbearkey -t dss -f /etc/dropbear/dropbear_dss_host_key
   dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key
diff --git a/files/firstboot/22-expandroot.sh b/files/firstboot/22-expandroot.sh
index 03ec50d..235c411 100644
--- a/files/firstboot/22-expandroot.sh
+++ b/files/firstboot/22-expandroot.sh
@@ -1,10 +1,20 @@
-logger -t "rc.firstboot" "Expanding root"
+logger -t "rc.firstboot" "Expanding root partition"
+
+# Detect root partition device
 ROOT_PART=$(mount | sed -n 's|^/dev/\(.*\) on / .*|\1|p')
-PART_NUM=$(echo ${ROOT_PART} | grep -o '[1-9][0-9]*$')
+if [ -z "$ROOT_PART" ] ; then
+  log_warning_msg "unable to detect root partition device"
+  return 1
+fi
+
+# Extract root device name
 case "${ROOT_PART}" in
   mmcblk0*) ROOT_DEV=mmcblk0 ;;
   sda*)     ROOT_DEV=sda ;;
 esac
+
+# Check detected root partition name
+PART_NUM=$(echo ${ROOT_PART} | grep -o '[1-9][0-9]*$')
 if [ "$PART_NUM" = "$ROOT_PART" ] ; then
   logger -t "rc.firstboot" "$ROOT_PART is not an SD card. Don't know how to expand"
   return 0
@@ -16,6 +26,8 @@ if [ "$PART_NUM" -gt 2 ] ; then
   logger -t "rc.firstboot" "Your partition layout is not currently supported by this tool."
   return 0
 fi
+
+# Check if last partition number
 LAST_PART_NUM=$(parted /dev/${ROOT_DEV} -ms unit s p | tail -n 1 | cut -f 1 -d:)
 if [ $LAST_PART_NUM -ne $PART_NUM ]; then
   logger -t "rc.firstboot" "$ROOT_PART is not the last partition. Don't know how to expand"
@@ -53,4 +65,4 @@ EOF2
 # Reload the partition table, resize root filesystem then remove resizing code from this file
 partprobe &&
   resize2fs /dev/${ROOT_PART} &&
-  logger -t "rc.firstboot" "Root partition successfuly resized."
+  logger -t "rc.firstboot" "Root partition successfully resized."
diff --git a/files/firstboot/23-regenerate-initramfs.sh b/files/firstboot/23-regenerate-initramfs.sh
new file mode 100644
index 0000000..78e2922
--- /dev/null
+++ b/files/firstboot/23-regenerate-initramfs.sh
@@ -0,0 +1,31 @@
+logger -t "rc.firstboot" "Regenerating initramfs to remove encrypted root partition auto-expand"
+
+KERNEL_VERSION=$(uname -r)
+KERNEL_ARCH=$(uname -m)
+INITRAMFS="/boot/firmware/initramfs-${KERNEL_VERSION}"
+INITRAMFS_UBOOT="${INITRAMFS}.uboot"
+
+# Extract kernel arch
+case "${KERNEL_ARCH}" in
+  arm*) KERNEL_ARCH=arm ;;
+esac
+
+# Regenerate initramfs
+if [ -r "${INITRAMFS}" ] ; then
+  rm -f /etc/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs
+  rm -f /etc/initramfs-tools/scripts/local-premount/expand-premount
+  rm -f /etc/initramfs-tools/hooks/expand-tools
+  rm -f "${INITRAMFS}"
+  mkinitramfs -o "${INITRAMFS}" "${KERNEL_VERSION}"
+fi
+
+# Convert generated initramfs for U-Boot using mkimage
+if [ -r "${INITRAMFS_UBOOT}" ] ; then
+  rm -f /etc/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs
+  rm -f /etc/initramfs-tools/scripts/local-premount/expand-premount
+  rm -f /etc/initramfs-tools/hooks/expand-tools
+  rm -f "${INITRAMFS_UBOOT}"
+  mkinitramfs -o "${INITRAMFS}" "${KERNEL_VERSION}"
+  mkimage -A "${KERNEL_ARCH}" -T ramdisk -C none -n "initramfs-${KERNEL_VERSION}" -d "${INITRAMFS}" "${INITRAMFS_UBOOT}"
+  rm -f "${INITRAMFS}"
+fi
diff --git a/files/firstboot/23-generate-machineid.sh b/files/firstboot/24-generate-machineid.sh
index dca48b3..dca48b3 100644
--- a/files/firstboot/23-generate-machineid.sh
+++ b/files/firstboot/24-generate-machineid.sh
diff --git a/files/firstboot/24-create-resolv-symlink.sh b/files/firstboot/25-create-resolv-symlink.sh
index 8a3f00b..8a3f00b 100644
--- a/files/firstboot/24-create-resolv-symlink.sh
+++ b/files/firstboot/25-create-resolv-symlink.sh
diff --git a/files/initramfs/expand-premount b/files/initramfs/expand-premount
new file mode 100755
index 0000000..c0c5582
--- /dev/null
+++ b/files/initramfs/expand-premount
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set -e
+
+# Check for cryptdevice variable
+if [ -z "$cryptdevice" ] ; then
+  echo "unable to get cryptdevice variable (local-premount)"
+  exit 1
+fi
+
+if [ -n "$ROOT" ] ; then
+  # Resize encrypted root partition
+  cryptsetup resize "${ROOT}"
+  e2fsck -fp "${ROOT}"
+  resize2fs -f "${ROOT}"
+  e2fsck -fp "${ROOT}"
+fi
+
+exit 0
diff --git a/files/initramfs/expand-tools b/files/initramfs/expand-tools
new file mode 100755
index 0000000..ad5dea3
--- /dev/null
+++ b/files/initramfs/expand-tools
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set -e
+
+# Use initramfs utility functions
+. /usr/share/initramfs-tools/hook-functions
+
+# Add binaries required for resizing the filesystem
+copy_exec /bin/grep /bin
+copy_exec /usr/bin/awk /bin
+copy_exec /usr/bin/cut /bin
+copy_exec /usr/bin/tail /bin
+copy_exec /sbin/fdisk /sbin
+copy_exec /sbin/parted /sbin
+copy_exec /sbin/e2fsck /sbin
+copy_exec /sbin/resize2fs /sbin
+copy_exec /sbin/partprobe /sbin
+
+exit 0
diff --git a/files/initramfs/expand_encrypted_rootfs b/files/initramfs/expand_encrypted_rootfs
new file mode 100644
index 0000000..e6896ba
--- /dev/null
+++ b/files/initramfs/expand_encrypted_rootfs
@@ -0,0 +1,85 @@
+#!/bin/sh
+# expand_encrypted_rootfs initramfs-tools boot script
+
+# dependencies: grep awk cut tail fdisk parted e2fsck resize2fs
+
+set -e
+
+# Wait for USB devices to be ready
+sleep 5
+
+# Use initramfs utility functions
+if [ -r "/scripts/functions" ] ; then
+  . /scripts/functions
+fi
+
+# Check for cryptdevice variable
+if [ -z "$cryptdevice" ] ; then
+  echo "unable to get cryptdevice variable (init-premount)"
+  return 1
+fi
+
+# Detect root partition device
+ROOT_PART=$(echo $cryptdevice | awk -F"/|:" '{ print $3 }')
+if [ -z "$ROOT_PART" ] ; then
+  log_warning_msg "unable to detect encrypted root partition device (cryptdevice)"
+  return 1
+fi
+
+# Extract root device name
+case "${ROOT_PART}" in
+  mmcblk0*) ROOT_DEV=mmcblk0 ;;
+  sda*)     ROOT_DEV=sda ;;
+esac
+
+# Check detected root partition name
+PART_NUM=$(echo ${ROOT_PART} | grep -o '[1-9][0-9]*$')
+if [ "$PART_NUM" = "$ROOT_PART" ] ; then
+  log_warning_msg "$ROOT_PART is not an SD card. Don't know how to expand"
+  return 1
+fi
+
+# NOTE: the NOOBS partition layout confuses parted. For now, let's only
+# agree to work with a sufficiently simple partition layout
+if [ "$PART_NUM" -gt 2 ] ; then
+  log_warning_msg "Your partition layout is not currently supported by this tool."
+  return 1
+fi
+
+# Check if last partition number
+LAST_PART_NUM=$(parted /dev/${ROOT_DEV} -ms unit s p | tail -n 1 | cut -f 1 -d:)
+if [ $LAST_PART_NUM -ne $PART_NUM ]; then
+  log_warning_msg "$ROOT_PART is not the last partition. Don't know how to expand"
+  return 1
+fi
+
+# Get the starting offset of the root partition
+PART_START=$(parted /dev/${ROOT_DEV} -ms unit s p | grep "^${PART_NUM}" | cut -f 2 -d: | sed 's/[^0-9]//g')
+if [ -z "$PART_START" ] ; then
+  log_warning_msg "${ROOT_DEV} unable to get starting sector of the partition"
+  return 1
+fi
+
+# Get the possible last sector for the root partition
+PART_LAST=$(fdisk -l /dev/${ROOT_DEV} | grep '^Disk.*sectors' | awk '{ print $7 - 1 }')
+if [ -z "$PART_LAST" ] ; then
+  log_warning_msg "${ROOT_DEV} unable to get last sector of the partition"
+  return 1
+fi
+
+### Since rc.local is run with "sh -e", let's add "|| true" to prevent premature exit
+fdisk /dev/${ROOT_DEV} 2> /dev/null <<EOF2 || true
+p
+d
+$PART_NUM
+n
+p
+$PART_NUM
+$PART_START
+$PART_LAST
+p
+w
+EOF2
+
+partprobe
+log_success_msg "Root partition successfully resized."
diff --git a/functions.sh b/functions.sh
index ecf8a4c..f9627cd 100644
--- a/functions.sh
+++ b/functions.sh
@@ -6,9 +6,9 @@ cleanup (){
 
   # Identify and kill all processes still using files
   echo "killing processes using mount point ..."
-  fuser -k "$R"
+  fuser -k "${R}"
   sleep 3
-  fuser -9 -k -v "$R"
+  fuser -9 -k -v "${R}"
 
   # Clean up temporary .password file
   if [ -r ".password" ] ; then
@@ -17,9 +17,9 @@ cleanup (){
 
   # Clean up all temporary mount points
   echo "removing temporary mount points ..."
-  umount -l "$R/proc" 2> /dev/null
-  umount -l "$R/sys" 2> /dev/null
-  umount -l "$R/dev/pts" 2> /dev/null
+  umount -l "${R}/proc" 2> /dev/null
+  umount -l "${R}/sys" 2> /dev/null
+  umount -l "${R}/dev/pts" 2> /dev/null
   umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null
   umount "$BUILDDIR/mount" 2> /dev/null
   cryptsetup close "${CRYPTFS_MAPPING}" 2> /dev/null
@@ -30,7 +30,7 @@ cleanup (){
 
 chroot_exec() {
   # Exec command in chroot
-  LANG=C LC_ALL=C DEBIAN_FRONTEND=noninteractive chroot $R $*
+  LANG=C LC_ALL=C DEBIAN_FRONTEND=noninteractive chroot ${R} $*
 }
 
 install_readonly() {
diff --git a/rpi2-gen-image.sh b/rpi2-gen-image.sh
index 03c7359..a04c8e3 100755
--- a/rpi2-gen-image.sh
+++ b/rpi2-gen-image.sh
@@ -42,12 +42,20 @@ RELEASE_ARCH=${RELEASE_ARCH:=armhf}
 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabihf-}
 COLLABORA_KERNEL=${COLLABORA_KERNEL:=3.18.0-trunk-rpi2}
 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig}
+KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7.img}
+DTB_FILE=${DTB_FILE:=bcm2709-rpi-2-b.dtb}
+UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_2_defconfig}
 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static}
 
 # Build directories
 BASEDIR="$(pwd)/images/${RELEASE}"
 BUILDDIR="${BASEDIR}/build"
+
+# Chroot directories
 R="${BUILDDIR}/chroot"
+ETCDIR="${R}/etc"
+BOOTDIR="${R}/boot/firmware"
+KERNELDIR="${R}/usr/src/linux"
 
 # General settings
 HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}}
@@ -239,7 +247,7 @@ if [ -e "$BUILDDIR" ] ; then
 fi
 
 # Setup chroot directory
-mkdir -p "$R"
+mkdir -p "${R}"
 
 # Check if build directory has enough of free disk space >512MB
 if [ "$(df --output=avail ${BUILDDIR} | sed "1d")" -le "524288" ] ; then
@@ -354,7 +362,7 @@ for SCRIPT in /chroot_scripts/* ; do
   fi
 done
 EOF
-  rm -rf "$R/chroot_scripts"
+  rm -rf "${R}/chroot_scripts"
 fi
 
 # Remove apt-utils
@@ -362,8 +370,8 @@ chroot_exec apt-get purge -qq -y --force-yes apt-utils
 
 # Generate required machine-id
 MACHINE_ID=$(dbus-uuidgen)
-echo -n "${MACHINE_ID}" > "$R/var/lib/dbus/machine-id"
-echo -n "${MACHINE_ID}" > "$R/etc/machine-id"
+echo -n "${MACHINE_ID}" > "${R}/var/lib/dbus/machine-id"
+echo -n "${MACHINE_ID}" > "${ETCDIR}/machine-id"
 
 # APT Cleanup
 chroot_exec apt-get -y clean
@@ -371,29 +379,29 @@ chroot_exec apt-get -y autoclean
 chroot_exec apt-get -y autoremove
 
 # Unmount mounted filesystems
-umount -l "$R/proc"
-umount -l "$R/sys"
+umount -l "${R}/proc"
+umount -l "${R}/sys"
 
 # Clean up directories
-rm -rf "$R/run/*"
-rm -rf "$R/tmp/*"
+rm -rf "${R}/run/*"
+rm -rf "${R}/tmp/*"
 
 # Clean up files
-rm -f "$R/etc/ssh/ssh_host_*"
-rm -f "$R/etc/dropbear/dropbear_*"
-rm -f "$R/etc/apt/sources.list.save"
-rm -f "$R/etc/resolvconf/resolv.conf.d/original"
-rm -f "$R/etc/*-"
-rm -f "$R/root/.bash_history"
-rm -f "$R/var/lib/urandom/random-seed"
-rm -f "$R/etc/apt/apt.conf.d/10proxy"
-rm -f "$R/etc/resolv.conf"
-rm -f "$R/initrd.img"
-rm -f "$R/vmlinuz"
+rm -f "${ETCDIR}/ssh/ssh_host_*"
+rm -f "${ETCDIR}/dropbear/dropbear_*"
+rm -f "${ETCDIR}/apt/sources.list.save"
+rm -f "${ETCDIR}/resolvconf/resolv.conf.d/original"
+rm -f "${ETCDIR}/*-"
+rm -f "${ETCDIR}/apt/apt.conf.d/10proxy"
+rm -f "${ETCDIR}/resolv.conf"
+rm -f "${R}/root/.bash_history"
+rm -f "${R}/var/lib/urandom/random-seed"
+rm -f "${R}/initrd.img"
+rm -f "${R}/vmlinuz"
 rm -f "${R}${QEMU_BINARY}"
 
 # Calculate size of the chroot directory in KB
-CHROOT_SIZE=$(expr `du -s "$R" | awk '{ print $1 }'`)
+CHROOT_SIZE=$(expr `du -s "${R}" | awk '{ print $1 }'`)
 
 # Calculate the amount of needed 512 Byte sectors
 TABLE_SECTORS=$(expr 1 \* 1024 \* 1024 \/ 512)
@@ -482,7 +490,7 @@ mkdir -p "$BUILDDIR/mount/boot/firmware"
 mount "$FRMW_LOOP" "$BUILDDIR/mount/boot/firmware"
 
 # Copy all files from the chroot to the loop device mount point directory
-rsync -a "$R/" "$BUILDDIR/mount/"
+rsync -a "${R}/" "$BUILDDIR/mount/"
 
 # Unmount all temporary loop devices and mount points
 cleanup