From b2d6cdc25dea50bc7f82cae92854a52a99ea3b0f Mon Sep 17 00:00:00 2001
From: Storm Dragon <stormdragon2976@gmail.com>
Date: Fri, 17 Jul 2026 00:12:40 -0400
Subject: [PATCH] Fix SSH choice and image build safeguards

---
 pi4/build/README.md                           |  5 +--
 pi4/build/build-stormux.sh                    | 32 +++++++++++++++++++
 x86_64/README.md                              |  4 +--
 x86_64/airootfs/usr/local/bin/install-stormux |  7 ++--
 4 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/pi4/build/README.md b/pi4/build/README.md
index b2b1849..33c093f 100644
--- a/pi4/build/README.md
+++ b/pi4/build/README.md
@@ -29,9 +29,10 @@ The script is designed for an x86_64 Arch host so it can emulate ARM binaries wi
 
 ## Building Your First Image
 1. Become root (`sudo -i`) so the script can create loop devices and mount them.
-2. From `/path/to/stormux`, run:
+2. From the Pi builder directory, run:
    ```bash
-   sudo ./pi4/build/build-stormux.sh -l en_US -s 8
+   cd /path/to/stormux/pi4/build
+   sudo ./build-stormux.sh -l en_US -s 8
    ```
    - The builder creates an aarch64 image for Raspberry Pi 4/5-class systems.
    - `-l en_US` selects the locale (use `es_ES`, `fr_FR`, etc.).
diff --git a/pi4/build/build-stormux.sh b/pi4/build/build-stormux.sh
index 595f98c..891da54 100755
--- a/pi4/build/build-stormux.sh
+++ b/pi4/build/build-stormux.sh
@@ -236,6 +236,38 @@ if [ "$(whoami)" != "root" ] ; then
     exit 1
 fi
 
+# Refuse to mount the image over an unrelated filesystem already using /mnt.
+if ! command -v mountpoint > /dev/null 2>&1; then
+    echo "Error: mountpoint is required to verify that /mnt is available."
+    exit 1
+fi
+
+if [[ ! -d /mnt || ! -w /mnt ]]; then
+    echo "Error: /mnt is missing or not writable. Please create or fix permissions."
+    exit 1
+fi
+
+if mountpoint -q /mnt; then
+    if [[ -t 0 ]]; then
+        read -rp "/mnt is already mounted. Unmount it to continue? [y/N] " answerText
+        case "$answerText" in
+            y|Y|yes|YES)
+                if ! umount /mnt; then
+                    echo "Error: Failed to unmount /mnt."
+                    exit 1
+                fi
+                ;;
+            *)
+                echo "Error: Refusing to proceed while /mnt is mounted."
+                exit 1
+                ;;
+        esac
+    else
+        echo "Error: /mnt is already mounted. Refusing to proceed in non-interactive mode."
+        exit 1
+    fi
+fi
+
 # make sure the needed tools are installed
 if [[ "$(uname -m)" == "x86_64" ]]; then
     if ! pacman -Q qemu-user-static &> /dev/null ; then
diff --git a/x86_64/README.md b/x86_64/README.md
index 702f50d..461863e 100644
--- a/x86_64/README.md
+++ b/x86_64/README.md
@@ -86,7 +86,7 @@ The Stormux repository key is also embedded in the ISO at `/usr/share/stormux/st
 - **Fenrir screen reader** starts automatically (not speakup)
 - **Pipewire audio** properly initialized before Fenrir starts
 - **Speech-dispatcher** integration for speech synthesis
-- GRUB plays an audible tune on boot for accessibility
+- The UEFI systemd-boot menu enables its audible beep
 - Boot menu defaults to accessible entry
 - Service startup order ensures audio is ready before screen reader
 - First-login live-environment setup calibrates volume, checks networking and time, then offers to run the installer
@@ -165,7 +165,7 @@ Edit `packages.x86_64` and add package names (one per line).
 ### Modifying Boot Configuration
 
 - BIOS: Edit `syslinux/archiso_sys-linux.cfg`
-- UEFI: Edit `grub/grub.cfg`
+- UEFI: Edit `efiboot/loader/loader.conf` and entries under `efiboot/loader/entries/`
 
 ### Adding Overlay Files
 
diff --git a/x86_64/airootfs/usr/local/bin/install-stormux b/x86_64/airootfs/usr/local/bin/install-stormux
index fce2c87..be18ff7 100755
--- a/x86_64/airootfs/usr/local/bin/install-stormux
+++ b/x86_64/airootfs/usr/local/bin/install-stormux
@@ -1786,7 +1786,6 @@ systemctl enable NetworkManager.service
 systemctl enable brltty.path
 systemctl enable fenrirscreenreader.service
 systemctl enable cronie.service
-systemctl enable ssh-login-monitor.service
 
 # Enable bluetooth if present
 if ! systemctl enable bluetooth.service; then
@@ -1795,8 +1794,12 @@ fi
 
 # Enable SSH if requested
 if [[ "${enableSsh}" == "yes" ]]; then
-    systemctl enable sshd.service
+    systemctl enable sshd.service ssh-login-monitor.service
     echo "SSH server enabled"
+else
+    systemctl disable sshd.service ssh-login-monitor.service
+    systemctl disable sshd.socket 2> /dev/null || true
+    echo "SSH server disabled"
 fi
 
 # Setup desktop environment configurations