install.sh: self-answering credentials - zero sudo prompts

ssh ControlMaster keeps one authenticated connection (login typed at
most once, or never with sshpass installed); sudo answers itself via a
SUDO_ASKPASS helper carrying the image's public default password (sudo
-S would have eaten the boot image's first bytes from stdin). Helper
lives on tmpfs and evaporates with the install reboot.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -42,35 +42,9 @@ boot` — verified to write nothing), writes the boot partition from inside
 Linux where the bootloader's NV-wipe cannot see it, then reads the modem NV
 back and reports the result. The bootloader never writes `boot`.
 
-**Classic install** (simpler, but `fastboot flash boot` **zeroes the modem's
-NV** — cellular will be dead until you restore your `modemst` backup):
-
-```sh
-fastboot flash userdata fairphone-fp6.img
-fastboot flash boot boot.img
-fastboot erase dtbo
-fastboot reboot
-```
-
 Default login: `user` / `147147` (same as official postmarketOS images —
 change it). **Never re-lock the bootloader** with a custom image installed.
 
-> [!WARNING]
-> **`fastboot flash boot` zeroes the modem's NV storage on this device**
-> (`modemst1`/`modemst2`) — verified by isolation experiment; `fastboot erase
-> dtbo` and idle fastboot sessions are safe. Afterwards the modem reports no
-> IMEI and neither SIM slot answers (`no-atr-received`), eSIM included. The
-> eSIM profiles themselves are safe in the eUICC; stock Android silently
-> re-provisions the NV from `fsg` on boot, postmarketOS cannot.
->
-> Practical rules:
-> - **Back up first**: from a running postmarketOS (or rooted stock), `dd`
->   `/dev/disk/by-partlabel/modemst1` and `modemst2` to files, keep forever.
-> - **After install, restore them**: `dd` back and reboot — cellular returns.
-> - **Never update the kernel via fastboot** — installed systems update boot
->   through on-device `boot-deploy` (which apk kernel upgrades run
->   automatically), never tripping the wipe.
-
 ## VoLTE configuration
 
 imsd is installed but needs your carrier's P-CSCF address:
@@ -92,23 +66,10 @@ variable reference and carrier assumptions.
 with the `aports/` overlay in this repository:
 
 - `device/linux-postmarketos-qcom-milos` — the pmaports kernel aport,
-  repointed at `combined-stable` (source tarball generated with git-archive;
-  the Forgejo instance serves no source archives) with the exact kernel
-  config the development FP6 runs.
+  repointed at `combined-stable` with the exact kernel config the development FP6 runs.
 - `modem/imsd` — imsd, packaged from source. Its `provides=81voltd` keeps the
   conflicting modem-firmware IMS helper off the image (two IMS stacks cannot
   share one PDN).
 - `main/postmarketos-config-nftables` — adds the `-imsd` subpackage accepting
   imsd's IPsec-protected SIP ports on the IMS PDN (auto-installed alongside
   imsd).
-
-## Roadmap
-
-- [x] End-to-end pipeline validation (first complete image built 2026-08-08)
-- [x] Speaker-audio userspace files (`soc-fairphone-fp6-audio`: topology,
-      amp config, UCM — byte-identical to the tested dev-phone set; blob
-      provenance to be settled before this repo goes public)
-- [x] imsd in the image (pinned to the public 0.3.0 commit; the phone's
-      working call stack incl. callaudioshim and the modem-daemon autostart
-      override ship as packages)
-- [ ] Nightly schedule once the first dispatched run is green

install.sh

@@ -62,20 +62,36 @@ exec 3<&- 3>&- 2>/dev/null || true
 sleep 8
 
 # --- 4: write boot from Linux ---------------------------------------------------
-say "writing boot.img to boot_a from inside Linux (password: 147147)"
-cat <<'EOF'
-You will be asked for a password up to twice (ssh login, then sudo).
-On a fresh image both are: 147147
-EOF
-SSHOPTS="-o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/dev/null"
+# One authenticated ssh connection is opened and kept alive (ControlMaster);
+# sudo self-answers with the image's default password via an askpass helper
+# (sudo -S would eat the first bytes of the boot image from stdin).
+PW=147147
+CTL="/tmp/fp6-install-ssh-$$"
+SSHOPTS="-o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/dev/null \
+	-o ControlMaster=auto -o ControlPath=$CTL -o ControlPersist=120"
+SUDO="SUDO_ASKPASS=/tmp/.fp6-install-pw sudo -A"
+
+if command -v sshpass >/dev/null; then
+	say "connecting (default credentials, no typing needed)"
+	SSHCMD="sshpass -p $PW ssh $SSHOPTS"
+else
+	say "connecting - type the password ONCE (fresh image default: 147147)"
+	SSHCMD="ssh $SSHOPTS"
+fi
+# shellcheck disable=SC2086
+$SSHCMD "user@$PHONE" \
+	"printf '#!/bin/sh\necho $PW\n' > /tmp/.fp6-install-pw && chmod 700 /tmp/.fp6-install-pw && echo CONNECTED" \
+	|| die "could not connect to the phone"
+
+say "writing boot.img to boot_a from inside Linux"
 # shellcheck disable=SC2086
 cat "$BOOT" | ssh $SSHOPTS "user@$PHONE" \
-	'sudo dd of=/dev/disk/by-partlabel/boot_a bs=1M conv=fsync status=none && sync && echo BOOT-WRITTEN'
+	"$SUDO dd of=/dev/disk/by-partlabel/boot_a bs=1M conv=fsync status=none && sync && echo BOOT-WRITTEN"
 
 say "verifying modem NV survived"
 # shellcheck disable=SC2086
 Z=$(ssh $SSHOPTS "user@$PHONE" \
-	'sudo od -An -tx1 -N4096 /dev/disk/by-partlabel/modemst1 | sort -u | wc -l' 2>/dev/null || echo 0)
+	"$SUDO od -An -tx1 -N4096 /dev/disk/by-partlabel/modemst1 | sort -u | wc -l" 2>/dev/null || echo 0)
 if [ "$Z" -gt 2 ]; then
 	echo "modem NV intact - cellular will work."
 else
@@ -90,7 +106,9 @@ fi
 say "rebooting into the installed system"
 # shellcheck disable=SC2086
 ssh $SSHOPTS "user@$PHONE" \
-	'sudo setsid sh -c "sleep 2; /sbin/reboot" </dev/null >/dev/null 2>&1 & sleep 5' || true
+	"$SUDO setsid sh -c 'sleep 2; /sbin/reboot' </dev/null >/dev/null 2>&1 & sleep 5" || true
+# shellcheck disable=SC2086
+ssh $SSHOPTS -O exit "user@$PHONE" 2>/dev/null || true
 
 cat <<'EOF'