From f2821bb6574aa81bf252c60ce0f523ab3af7ac5b Mon Sep 17 00:00:00 2001
From: Ryan Hughes <ryan@heyoodle.com>
Date: Fri, 22 May 2026 00:15:04 -0400
Subject: [PATCH] limine-snapper.sh: validate parsed CMDLINE in pre-populated
 branch

The harvest branch already enforces non-empty cmdline + presence of
root=. The pre-populated branch (added in 0d2688a5) was missing the
same validation, so a malformed /etc/default/limine could slip
through and the later cryptdevice= check would silently no-op
because $CMDLINE was empty.
---
 install/login/limine-snapper.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/install/login/limine-snapper.sh b/install/login/limine-snapper.sh
index ecb96ac7..19512222 100644
--- a/install/login/limine-snapper.sh
+++ b/install/login/limine-snapper.sh
@@ -17,6 +17,15 @@ EOF
   if [[ -f /etc/default/limine ]] && ! grep -q "@@CMDLINE@@" /etc/default/limine; then
     CMDLINE=$(grep '^KERNEL_CMDLINE\[default\]+=' /etc/default/limine | head -1 |
               sed 's|^KERNEL_CMDLINE\[default\]+="||; s|"$||')
+
+    if [[ -z ${CMDLINE// } ]]; then
+      echo "Error: /etc/default/limine has no KERNEL_CMDLINE[default]+= line" >&2
+      exit 1
+    fi
+    if [[ $CMDLINE != *root=* ]]; then
+      echo "Error: cmdline parsed from /etc/default/limine has no root=: $CMDLINE" >&2
+      exit 1
+    fi
   else
     # Find config location written by archinstall (legacy harvest path)
     if [[ -f /boot/EFI/arch-limine/limine.conf ]]; then