From unknown Sat Jun 14 03:49:06 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#55723 <55723@debbugs.gnu.org> To: bug#55723 <55723@debbugs.gnu.org> Subject: Status: Full disk encryption with grub-efi and LUKS2 Reply-To: bug#55723 <55723@debbugs.gnu.org> Date: Sat, 14 Jun 2025 10:49:06 +0000 retitle 55723 Full disk encryption with grub-efi and LUKS2 reassign 55723 guix submitter 55723 Lars-Dominik Braun severity 55723 normal thanks From debbugs-submit-bounces@debbugs.gnu.org Mon May 30 06:08:08 2022 Received: (at submit) by debbugs.gnu.org; 30 May 2022 10:08:08 +0000 Received: from localhost ([127.0.0.1]:42814 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nvcJk-0007ST-9L for submit@debbugs.gnu.org; Mon, 30 May 2022 06:08:08 -0400 Received: from lists.gnu.org ([209.51.188.17]:39402) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nvcJf-0007SJ-Ju for submit@debbugs.gnu.org; Mon, 30 May 2022 06:08:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:48814) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nvcJf-0001AX-Fa for bug-guix@gnu.org; Mon, 30 May 2022 06:08:03 -0400 Received: from mout-p-201.mailbox.org ([80.241.56.171]:49710) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_CHACHA20_POLY1305:256) (Exim 4.90_1) (envelope-from ) id 1nvcJc-0000uU-Hp for bug-guix@gnu.org; Mon, 30 May 2022 06:08:02 -0400 Received: from smtp102.mailbox.org (smtp102.mailbox.org [10.196.197.102]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-201.mailbox.org (Postfix) with ESMTPS id 4LBWLY1yHyz9sWx for ; Mon, 30 May 2022 12:07:49 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6xq.net; s=MBO0001; t=1653905269; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FJSMLbjsscUK1VGPn93bHTXRjDjVjy55YfzCSsG0EXo=; b=AcufqX8Eq9YqmY0WYAFshC49EXpKkIZQoEj8xziLt4PTuGxtSEp/3b/Hz+HX2EzBD60f8g inlLeKH6k7+5sI+GNhAwXoVMcvNPrF8iGnUai0qID6pHVX6GpdZZjWb019amLJrslPGFeu 5s/9piQwgiu9NG8JF/K//e1pnwlXp1lbvA3NWZXdChks4IcJmPXgIJ1XgxJZEuYHmnfyVX W6Ch3gqBaMGDHu9w45H4tvhKzUbB1PDD8TlMpjQIk0zBXJ0ZtK9Vvqr1fP+N5yfQzfO8U0 8x43/hk4C1BT5IsWiFXusDC7wZh24j29F+wh9MYvVD/WQIWDeJ36KueMEmxKAw== Date: Mon, 30 May 2022 12:07:47 +0200 From: Lars-Dominik Braun To: bug-guix@gnu.org Subject: Full disk encryption with grub-efi and LUKS2 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=80.241.56.171; envelope-from=lars@6xq.net; helo=mout-p-201.mailbox.org X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-Spam-Score: -1.7 (-) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -2.7 (--) Hi, I followed the manual to manually install Guix with full disk encryption using LUKS2 and PBKDF2. However this leaves me with an unbootable system, stuck at Grub’s rescue prompt, because `grub-install` apparently does not know how to detect a LUKS2 target and therefore does not include the modules required to open the encrypted volume in the EFI image. See [1]. I managed to manually create a core.img with the help of ArchLinux’ Wiki[2] (see also [3]), boot into the system and reconfigure with a modified bootloader: ---snip--- (define install-grub-efi-mkimage "Create an Grub EFI image with included cryptomount support for luks2, which grub-install does not handle yet." #~(lambda (bootloader efi-dir mount-point) (when efi-dir (let ((grub-mkimage (string-append bootloader "/bin/grub-mkimage")) ;; Required modules, YMMV. (modules (list "luks2" "part_gpt" "cryptodisk" "gcry_rijndael" "pbkdf2" "gcry_sha256" "ext2")) (prefix (string-append mount-point "/boot/grub")) ;; Different configuration required to set up a crypto ;; device. Change crypto_uuid to match your output of ;; `cryptsetup luksUUID /device`. ;; XXX: Maybe cryptomount -a could work? (config #$(plain-file "grub.cfg" "set crypto_uuid=755e547f78f44dc38dab58399e1780a6 cryptomount -u $crypto_uuid set root=crypto0 set prefix=($root)/boot/grub insmod normal normal")) (target-esp (if (file-exists? (string-append mount-point efi-dir)) (string-append mount-point efi-dir) efi-dir))) (apply invoke (append (list grub-mkimage "-p" prefix "-O" "x86_64-efi" "-c" config "-o" (string-append target-esp "/EFI/Guix/grubx64.efi")) modules)))))) (define grub-efi-bootloader-luks2 (bootloader (inherit grub-efi-bootloader) (name 'grub-efi-luks2) (installer install-grub-efi-mkimage))) ---snap--- Supposedly there are also patches for grub-mkimage, but maybe we can include a workaround like the above by default until then or remove the section about LUKS2 entirely? Cheers, Lars [1] https://logs.guix.gnu.org/guix/2022-05-27.log#111808 [2] https://wiki.archlinux.org/title/GRUB#LUKS2 [3] https://wiki.archlinux.org/title/GRUB/Tips_and_tricks#Manual_configuration_of_core_image_for_early_boot From debbugs-submit-bounces@debbugs.gnu.org Tue May 31 06:44:49 2022 Received: (at 55723) by debbugs.gnu.org; 31 May 2022 10:44:49 +0000 Received: from localhost ([127.0.0.1]:46743 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nvzMn-00011p-2d for submit@debbugs.gnu.org; Tue, 31 May 2022 06:44:49 -0400 Received: from jpoiret.xyz ([206.189.101.64]:36660) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nvzMl-00011h-9U for 55723@debbugs.gnu.org; Tue, 31 May 2022 06:44:48 -0400 Received: from authenticated-user (jpoiret.xyz [206.189.101.64]) by jpoiret.xyz (Postfix) with ESMTPA id 21475184D3D; Tue, 31 May 2022 10:44:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jpoiret.xyz; s=dkim; t=1653993884; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=s1XK5Sehi0HVzaPShCv8ZDmB3Xxzyx/6AzhRx+9d+LQ=; b=EoEdo6Zo3g3jLiMiNt8po52TXb/d/wTz+phtma9zjys3y7279X0F4Gn9xlbinDd6b6yoKs U+0lqCrnL7Xq8abL8AvGYTbnHrZ7rBDUymLnQCiYS3gP9flbBShn9FWvp32g5utW/uXjRV HWnmRgRPbqvDCZndbSmLRfCagIliMpDNm+Ubt0WmZ3UNv3cE+IMZNNg2ejHUxHVLIeh5I5 u4i9t2qucV8ahCqLsgzSjE6hjgmFMC5L8qEGMBIsAgKAlQ5QkI9R5So7vmTvWaUHj/v0eq RCkUsDpN784bAgdBGUNu3GGaAjMLv4i2ZIgSJJpBRcXsOSgLuO6cMj3WzYny8Q== From: Josselin Poiret To: Lars-Dominik Braun , 55723@debbugs.gnu.org Subject: Re: bug#55723: Full disk encryption with grub-efi and LUKS2 In-Reply-To: References: Date: Tue, 31 May 2022 12:44:43 +0200 Message-ID: <87fskqgew4.fsf@jpoiret.xyz> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Authentication-Results: jpoiret.xyz; auth=pass smtp.auth=jpoiret@jpoiret.xyz smtp.mailfrom=dev@jpoiret.xyz X-Spamd-Bar: / X-Spam-Score: 2.1 (++) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Hello Lars, Lars-Dominik Braun writes: > Hi, > > I followed the manual to manually install Guix with full disk encryption > using LUKS2 and PBKDF2. However this leaves me with an unbootable system, > stuck at Grub’s rescue prompt, becaus [...] Content analysis details: (2.1 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record 1.6 PDS_OTHER_BAD_TLD Untrustworthy TLDs [URI: jpoiret.xyz (xyz)] 0.5 FROM_SUSPICIOUS_NTLD From abused NTLD -0.0 T_SCC_BODY_TEXT_LINE No description available. X-Debbugs-Envelope-To: 55723 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 2.1 (++) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Hello Lars, Lars-Dominik Braun writes: > Hi, > > I followed the manual to manually install Guix with full disk encryption > using LUKS2 and PBKDF2. However this leaves me with an unbootable system, > stuck at Grub’s rescue prompt, becaus [...] Content analysis details: (2.1 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record 1.6 PDS_OTHER_BAD_TLD Untrustworthy TLDs [URI: jpoiret.xyz (xyz)] 1.0 BULK_RE_SUSP_NTLD Precedence bulk and RE: from a suspicious TLD 0.5 FROM_SUSPICIOUS_NTLD From abused NTLD -0.0 T_SCC_BODY_TEXT_LINE No description available. -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager Hello Lars, Lars-Dominik Braun writes: > Hi, > > I followed the manual to manually install Guix with full disk encryption > using LUKS2 and PBKDF2. However this leaves me with an unbootable system, > stuck at Grub=E2=80=99s rescue prompt, because `grub-install` apparently = does > not know how to detect a LUKS2 target and therefore does not include > the modules required to open the encrypted volume in the EFI image. See > [1]. > > I managed to manually create a core.img with the help of ArchLinux=E2=80= =99 > Wiki[2] (see also [3]), boot into the system and reconfigure with a > modified bootloader: > > [...] > > Supposedly there are also patches for grub-mkimage, but maybe we can > include a workaround like the above by default until then or remove the > section about LUKS2 entirely? Thank you for posting this bug and sorry for taking so long with this. I'd suggest that we instead add a warning that `/boot/` must be unencrypted for LUKS2+GRUB to work for now, possibly pointing to this bug. Let me explain the whole situation so that we have good summary of the LUKS2+GRUB situation: * GRUB the bootloader itself supports unlocking LUKS2 cryptodisks, with its `luks2` module, that we load via `insmod luks2` in the grub.cfg. It doesn't contain support for Argon2i yet, so only the PBKDF2 key derivation function can be used, which is unfortunately not the default for cryptsetup. * Now, while the `luks2` module lets you unlock your disk, you have the usual chicken-and-egg problem: GRUB modules are stored in /boot/grub/. If this resides on a LUKS2 drive, then you'd be out of luck! However, this is a common issue with bootloaders, and GRUB allows embedding modules inside its own image, so that some modules are preloaded. You can either create the image manually using grub-mkimage, or grub-install can take care of it for you, by detecting which modules should be embedded using a user-space version of GRUB. This is where the LUKS2 support isn't finished yet: the userspace utilities don't recognize LUKS2, and will thus not try to include luks2 and friends if /boot/grub/ is on such a device. The crux of the issue is that when running in user-space, GRUB cheats by "pretending" to mount the device itself (called cheatmounting), and actually relays all reads to the underlying dm-crypt device! For LUKS1, this works well, but LUKS2 can have multiple keyslots and data segments, each with different algorithms, and since we don't know which keyslot was used to unlock the device, we won't know which GRUB crypto modules to include. My approach at [1] is to ask device-mapper directly, but there are also other patches trying various other methods, and the consensus now seems to be that each patch does one thing well and that we should combine all of the good parts. In any case, I can send a documentation patch to warn about the current situation later today. [1] https://lists.gnu.org/archive/html/grub-devel/2021-12/msg00076.html Best, --=20 Josselin Poiret From debbugs-submit-bounces@debbugs.gnu.org Tue May 31 10:36:49 2022 Received: (at 55723) by debbugs.gnu.org; 31 May 2022 14:36:49 +0000 Received: from localhost ([127.0.0.1]:48626 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nw2zJ-0001nB-8v for submit@debbugs.gnu.org; Tue, 31 May 2022 10:36:49 -0400 Received: from jpoiret.xyz ([206.189.101.64]:46672) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nw2zH-0001n2-24 for 55723@debbugs.gnu.org; Tue, 31 May 2022 10:36:47 -0400 Received: from authenticated-user (jpoiret.xyz [206.189.101.64]) by jpoiret.xyz (Postfix) with ESMTPA id E5DE5183B21; Tue, 31 May 2022 14:36:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jpoiret.xyz; s=dkim; t=1654007801; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZQCRZ0gegHW/3w9nG9if0CdEtQc5ivTNA4k+MVYIg3M=; b=c3NE1MbGqkQbxyOcuw4R9HlM1nNj28imRYbQM2t7DDIgGoIMeYXiGwWv10i6uW+D/wU6dh d0TzZi0og9S+lkpW9VjVwrIJsyrPPdeVW5D4Rdo130sv43z9REako7l6I/qXy/+jYHbca2 uAHDKBjcp95jl/khlxPi+9uV6I2RLqTRZN3je4ldOm3XNDcjecrba10EjfAlmPq+Jz/Rg9 U/CfEz7jKcf+q19zMd2JxeHUR491fxkf/2muLTF4lwgym8pquTCCeVNLfgQ+h1J6ItmDuX 6Yexq5a74EeE3GFabcbUzVUI3dq0bqULBWKfOxgVRZ6Zzd3qHPUD887oIpE2fw== From: Josselin Poiret To: Josselin Poiret , Lars-Dominik Braun , 55723@debbugs.gnu.org Subject: [PATCH] doc: Warn about LUKS2-encrypted boot not working with GRUB. Date: Tue, 31 May 2022 16:36:37 +0200 Message-Id: <20220531143637.22201-1-dev@jpoiret.xyz> In-Reply-To: <87fskqgew4.fsf@jpoiret.xyz> References: <87fskqgew4.fsf@jpoiret.xyz> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Authentication-Results: jpoiret.xyz; auth=pass smtp.auth=jpoiret@jpoiret.xyz smtp.mailfrom=dev@jpoiret.xyz X-Spamd-Bar: / X-Spam-Score: 2.1 (++) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: * doc/guix.texi (Disk Partitioning): Do it. --- doc/guix.texi | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/doc/guix.texi b/doc/guix.texi index 1666466958..c7f6070ced 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -2560,6 +2560,11 @@ for @command{cryptsetup luksFormat}. You can check which k [...] Content analysis details: (2.1 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record 1.6 PDS_OTHER_BAD_TLD Untrustworthy TLDs [URI: jpoiret.xyz (xyz)] 0.5 FROM_SUSPICIOUS_NTLD From abused NTLD -0.0 T_SCC_BODY_TEXT_LINE No description available. X-Debbugs-Envelope-To: 55723 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 1.1 (+) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: * doc/guix.texi (Disk Partitioning): Do it. --- doc/guix.texi | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/doc/guix.texi b/doc/guix.texi index 1666466958..c7f6070ced 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -2560,6 +2560,11 @@ for @command{cryptsetup luksFormat}. You can check which k [...] Content analysis details: (1.1 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record 1.6 PDS_OTHER_BAD_TLD Untrustworthy TLDs [URI: jpoiret.xyz (xyz)] 0.5 FROM_SUSPICIOUS_NTLD From abused NTLD -0.0 T_SCC_BODY_TEXT_LINE No description available. -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager * doc/guix.texi (Disk Partitioning): Do it. --- doc/guix.texi | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/doc/guix.texi b/doc/guix.texi index 1666466958..c7f6070ced 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -2560,6 +2560,11 @@ for @command{cryptsetup luksFormat}. You can check which key derivation function is being used by a device by running @command{cryptsetup luksDump @var{device}}, and looking for the PBKDF field of your keyslots. + +Note also that having @file{/boot/} reside on a LUKS2-encrypted device +is currently unsupported because of a GRUB 2.06 bug, see +@url{https://issues.guix.gnu.org/55723, bug #55723}. The graphical +installer defaults to LUKS1 for this reason. @end quotation Assuming you want to store the root partition on @file{/dev/sda2}, the -- 2.36.0 From debbugs-submit-bounces@debbugs.gnu.org Thu Jun 02 09:44:38 2022 Received: (at 55723) by debbugs.gnu.org; 2 Jun 2022 13:44:38 +0000 Received: from localhost ([127.0.0.1]:53191 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nwl7u-0001Yo-Hn for submit@debbugs.gnu.org; Thu, 02 Jun 2022 09:44:38 -0400 Received: from ns13.heimat.it ([46.4.214.66]:54472) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nwl7s-0001YY-D9 for 55723@debbugs.gnu.org; Thu, 02 Jun 2022 09:44:36 -0400 Received: from localhost (ip6-localhost [127.0.0.1]) by ns13.heimat.it (Postfix) with ESMTP id ED76E30087D; Thu, 2 Jun 2022 13:44:29 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at ns13.heimat.it Received: from ns13.heimat.it ([127.0.0.1]) by localhost (ns13.heimat.it [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 17MPEOfbeWpZ; Thu, 2 Jun 2022 13:44:28 +0000 (UTC) Received: from bourrache.mug.xelera.it (unknown [93.56.171.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by ns13.heimat.it (Postfix) with ESMTPSA id 18E0D30085C; Thu, 2 Jun 2022 13:44:28 +0000 (UTC) Received: from roquette.mug.biscuolo.net (roquette [10.38.2.14]) by bourrache.mug.xelera.it (Postfix) with SMTP id A64171B3E32C; Thu, 2 Jun 2022 15:44:27 +0200 (CEST) Received: (nullmailer pid 11199 invoked by uid 1000); Thu, 02 Jun 2022 13:44:27 -0000 From: Giovanni Biscuolo To: Josselin Poiret , Lars-Dominik Braun , 55723@debbugs.gnu.org Subject: Re: bug#55723: Full disk encryption with grub-efi and LUKS2 In-Reply-To: <87fskqgew4.fsf@jpoiret.xyz> Organization: Xelera.eu References: <87fskqgew4.fsf@jpoiret.xyz> Date: Thu, 02 Jun 2022 15:44:26 +0200 Message-ID: <87zgiv5ged.fsf@xelera.eu> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 55723 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Hello Josselin and Lars-Dominik Josselin Poiret via Bug reports for GNU Guix writes: [...] >> Supposedly there are also patches for grub-mkimage, but maybe we can >> include a workaround like the above by default until then or remove the >> section about LUKS2 entirely? > > Thank you for posting this bug and sorry for taking so long with this. > I'd suggest that we instead add a warning that `/boot/` must be > unencrypted for LUKS2+GRUB to work for now, possibly pointing to this > bug. As Josselin wrote in the proposed patch, actually /boot/ on LUKS1 is working well In case it is helpful, it's possible to "Downgrade" a LUKS2 volume to LUKS1, I found this guide useful: https://cryptsetup-team.pages.debian.net/cryptsetup/encrypted-boot.html [...] > to include. My approach at [1] is to ask device-mapper directly, but > there are also other patches trying various other methods, and the > consensus now seems to be that each patch does one thing well and that > we should combine all of the good parts. Thank you very much for the update and the work on GRUB! Please is there any upstream (GRUB) bug report we can point to in this one so we can follow the situation and know when upsstream will release the patch? [...] Happy hacking! Gio' =2D-=20 Giovanni Biscuolo Xelera IT Infrastructures --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQJABAEBCgAqFiEERcxjuFJYydVfNLI5030Op87MORIFAmKYvroMHGdAeGVsZXJh LmV1AAoJENN9DqfOzDkSsmgP/1vijdwVrU9BqnuqD25jBH5FhgeGe5evfsNyGAA/ lbX6H+kA/nqxJEhPeVyWFim8RhCuPT9qxeExmq424bUfK+LwV9If0WzUq7q7MIOj Lw2G990G10kup2qTcCJHEXG7hdbl83yEv8SQD9AFA9iwdIysEyi9DFh+CJj4xQwv 6Ghzx9FOu8NtzrL3t+Sh6+APEBzoFDpu2NsKE8CUFDs0m/NDMS4fx8vqhbj040xk 9fyVD5NyEMmaLAlsbgQlAL/r6eyxaxKqwVsSRMVUYYJy5u+VGQqixxYOrT3wB0HA y1Mb5KR6Htn9/0bzJYgJPKzwAsSEjz/dx14pGRAu4lYktkEXYHzyr2N0BxWfuqeQ k4eVfJkfE9PQmmuWlxLboaTg6JIGqF9S1ouNuYG6BIbDmO6lmomlerTNWzZYppmt JoJj6zMlX0/RJJ0FhhBxrgeGX9Dp9RHrUZ3Bwowq38q9jrgBWi8e5f6xt+Zbg74b GJNoT0zxPWXZHjQ/+1OqlX48YISezjOUFpME5IQP5IKYuTcFo0WomVdtF9hG7ED/ bl9ptSraS7T8JtIgqQpZMFGvPUnsIQsYq8Eb9YsHm0qZWcLjJu1aP6lLSpN/W6hk sxUQvzSw79FwwilIx4dwSFodOv5ETnDnLJK8JjT3E10IVHbWcTeI9+AH+jFiXXyX tDMg =21df -----END PGP SIGNATURE----- --=-=-=-- From debbugs-submit-bounces@debbugs.gnu.org Sun Jun 05 06:38:22 2022 Received: (at 55723) by debbugs.gnu.org; 5 Jun 2022 10:38:22 +0000 Received: from localhost ([127.0.0.1]:60137 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nxneH-0000Zz-WC for submit@debbugs.gnu.org; Sun, 05 Jun 2022 06:38:22 -0400 Received: from mout-p-101.mailbox.org ([80.241.56.151]:60418) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1nxneD-0000Zi-50 for 55723@debbugs.gnu.org; Sun, 05 Jun 2022 06:38:20 -0400 Received: from smtp2.mailbox.org (smtp2.mailbox.org [10.196.197.2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-101.mailbox.org (Postfix) with ESMTPS id 4LGCkm2Q6Sz9sWk; Sun, 5 Jun 2022 12:38:08 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6xq.net; s=MBO0001; t=1654425488; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FyXfRRbTQnZoxtCj1NQGP/y7x+D7K0lqN8fOUYW2kOI=; b=hBIel8lr0zN8Wl2iDoknidyQ50/l0Sd/ddQeM0MFJ20pQhu6zfl6FQGERwvAKRes1Xnzs8 BcXddNe8JXjmKq11GgVw1S37usLHpixBzwhsotHCflL2dP9xm1PtsvYvcesTwI3UKtzlvX g5kPtEMUTtitd1cnoIh64qPvTxCYkX7kZhfu++BeQMMCUJ/v0wsyiJuCuCuCLYCtzj2Zks ogeNb0Nt3RqRHJ0HqJbBFqPzwgXFcbA5W8nGRvxK89WLdS6bdnKnNwTtkMMCzdsA+IJhRp RTG1cwDs/APP22TnTVkG/VceioG1PS2IsFGeHUWXTTFkalHZDd9hArtto2RsTQ== Date: Sun, 5 Jun 2022 12:38:03 +0200 From: Lars-Dominik Braun To: Josselin Poiret Subject: Re: [PATCH] doc: Warn about LUKS2-encrypted boot not working with GRUB. Message-ID: References: <87fskqgew4.fsf@jpoiret.xyz> <20220531143637.22201-1-dev@jpoiret.xyz> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20220531143637.22201-1-dev@jpoiret.xyz> X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 55723 Cc: 55723@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) Hi Josselin, > +Note also that having @file{/boot/} reside on a LUKS2-encrypted device > +is currently unsupported because of a GRUB 2.06 bug, see > +@url{https://issues.guix.gnu.org/55723, bug #55723}. The graphical > +installer defaults to LUKS1 for this reason. instead of adding yet another exception, why not just document how to do it with LUKS1, which – as I understand it – works without these quirks? Cheers, Lars