GNU bug report logs - #51514
[PATCH 0/2] Add support for LUKS2 root partition

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Josselin Poiret <dev <at> jpoiret.xyz>
Subject: bug#51514: closed (Re: bug#51514: [PATCH 0/2] Add support for
 LUKS2 root partition)
Date: Wed, 01 Dec 2021 16:23:01 +0000

[Message part 1 (text/plain, inline)]

Your bug report

#51514: [PATCH 0/2] Add support for LUKS2 root partition

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to 51514 <at> debbugs.gnu.org.

-- 
51514: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=51514
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Ludovic Courtès <ludo <at> gnu.org>
To: Josselin Poiret <dev <at> jpoiret.xyz>
Cc: 51514-done <at> debbugs.gnu.org
Subject: Re: bug#51514: [PATCH 0/2] Add support for LUKS2 root partition
Date: Wed, 01 Dec 2021 17:22:20 +0100

Hello Josselin,

Josselin Poiret <dev <at> jpoiret.xyz> skribis:

> Here is an updated patchset, which includes the changes you suggested,
> as well as update the installer to use LUKS2 by default (I tested it
> in a VM and it works pretty well).  I don't think there's any reason
> not to use LUKS2 by default now that GRUB 2.06 supports it, and in any
> case if there are specific needs they can be addressed by a manual
> installation.
>
> Best,
>
> Josselin Poiret (3):
>   gnu: system: Add LUKS2 support for the root file system.
>   doc: Document LUKS2 GRUB support and shortcomings
>   installer: Make LUKS2 the default format for encrypted devices

Applied it all after checking:

  make check-system TESTS=encrypted-root-os

Thank you!

Ludo’.

[Message part 3 (message/rfc822, inline)]

From: Josselin Poiret <dev <at> jpoiret.xyz>
To: guix-patches <at> gnu.org
Subject: [PATCH 0/2] Add support for LUKS2 root partition
Date: Sat, 30 Oct 2021 15:56:33 +0000

Hi,

This patchset adds support for a LUKS2 root partition, leveraging its
Grub support since 2.06, and making sure that the Cryptsetup run-time
locking directory /var/cryptsetup/ exists before trying to unlock
devices (this is required for LUKS2): this used to fail in early
userspace because /var/ did not exist. I've also added some
documentation on the limited support: Grub only supports PKBDF2 and
not Argon2i which is the default key derivation function. The example
given in the Disk Partitioning section was updated as well to use
LUKS2.

My testing setup was: using a Guix VM, install onto a qcow2 disk which
is itself launched with QEMU. It felt a bit convoluted (especially
transferring the WIP guix to the VM, then building it), and I'll see if
I can simplify this workflow a bit, but everything worked fine with
those patches.

Best,
Josselin Poiret

Josselin Poiret (2):
  gnu: system: Add LUKS2 support for the root file system.
  doc: Document LUKS2 Grub support and shortcomings

 doc/guix.texi                 | 19 ++++++++++++++-----
 gnu/bootloader/grub.scm       |  3 +--
 gnu/system/mapped-devices.scm | 10 ++++++++--
 3 files changed, 23 insertions(+), 9 deletions(-)

-- 
2.33.1

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.