Update boot theme

files/dracut/95dot1x-macsec/dot1x-macsec-up.sh

@@ -15,6 +15,11 @@ STAMP=/run/dot1x/.done
 [ -e "$STAMP" ] && exit 0
 mkdir -p /run/dot1x /run/wpa_supplicant
 
+# Best-effort boot-splash status for the 'fleet' Plymouth theme. NEVER fatal and
+# NEVER reorders anything — a splash call must not perturb the load-bearing
+# auth -> macsec -> DHCP -> NVMe sequence below. No-op if plymouth isn't running.
+ply() { plymouth update --status="$1" 2>/dev/null || true; }
+
 # --- knobs (override on the kernel cmdline) ---------------------------------
 NIC=$(getarg rd.dot1x.if=)
 if [ -z "$NIC" ]; then
@@ -42,6 +47,7 @@ info "dot1x-macsec: using interface $NIC, NV index $NVINDEX"
 # networks only. Remove rd.dot1x=0 from the cmdline to restore full security.
 if [ "$(getarg rd.dot1x=)" = "0" ]; then
     warn "dot1x-macsec: 802.1X/MACsec DISABLED (rd.dot1x=0) — TEST MODE, no link security"
+    ply mode-test   # splash: mark TPM/802.1X/MACsec rows as skipped (not failed)
     # Networking in test mode is owned ENTIRELY by `ip=dhcp` on the cmdline:
     # dracut's network module brings the NIC up, gets a lease and writes
     # resolv.conf. Do NOT `ifup`/`ip link set up` the NIC here — a second
@@ -70,6 +76,7 @@ if [ "$(getarg rd.dot1x=)" = "0" ]; then
 fi
 
 # --- 1. client certificate out of TPM NV ------------------------------------
+ply tpm-active
 if [ ! -s /run/dot1x/client.pem ]; then
     if ! tpm2_nvread -T device:/dev/tpmrm0 "$NVINDEX" -o /run/dot1x/client.der; then
         warn "dot1x-macsec: tpm2_nvread failed — cannot authenticate"
@@ -77,6 +84,7 @@ if [ ! -s /run/dot1x/client.pem ]; then
     fi
     openssl x509 -inform DER -in /run/dot1x/client.der -out /run/dot1x/client.pem
 fi
+ply tpm-done
 
 # --- 2. supplicant as a root storage daemon ---------------------------------
 ip link set "$NIC" up
@@ -88,6 +96,7 @@ if [ ! -e /run/dot1x/wpa.pid ]; then
         -c /etc/dot1x/wpa_supplicant-dot1x.conf \
         -P /run/dot1x/wpa.pid" &
 fi
+ply dot1x-active
 
 # --- 3. wait for authentication + macsec0 -----------------------------------
 i=0
@@ -104,9 +113,13 @@ if [ "$i" -ge "$TIMEOUT" ]; then
     exit 1
 fi
 info "dot1x-macsec: port authorized, macsec0 up after ${i}s"
+ply dot1x-done
+ply macsec-active
 
 # --- 4. address the secure interface; netroot rides on macsec0 --------------
 ip link set macsec0 up
+ply macsec-done
+ply net-active
 # DHCP on macsec0 via NetworkManager (NOT the old network-legacy `ifup`): NM owns
 # macsec0, so it RENEWS the lease in the running system after switch-root — the
 # whole point of the network-manager port. macsec0 was created externally by
@@ -127,6 +140,7 @@ if [ "$i" -ge "$TIMEOUT" ]; then
     exit 1
 fi
 info "dot1x-macsec: macsec0 addressed via NetworkManager (DHCP)"
+ply net-done
 
 # --- 5. derive per-host NVMe identity from the TPM certificate --------------
 # Keeps the image fleet-generic: the host NQN is a function of the machine