GNU bug report logs - #65002
[PATCH 0/2] Add support for unlocking root device via a key file

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Tomas Volf <~@wolfsden.cz>
Subject: bug#65002: closed (Re: [bug#65002] [PATCH v3 1/6] mapped-devices:
 Allow unlocking by a key file.)
Date: Sun, 14 Jan 2024 20:54:02 +0000

[Message part 1 (text/plain, inline)]

Your bug report

#65002: [PATCH 0/2] Add support for unlocking root device via a key file

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to 65002 <at> debbugs.gnu.org.

-- 
65002: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=65002
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Ludovic Courtès <ludo <at> gnu.org>
To: Tomas Volf <~@wolfsden.cz>
Cc: 65002-done <at> debbugs.gnu.org, Tomas Volf <wolf <at> wolfsden.cz>
Subject: Re: [bug#65002] [PATCH v3 1/6] mapped-devices: Allow unlocking by a
 key file.
Date: Sun, 14 Jan 2024 21:53:30 +0100

Hi Tomas,

I finally applied v3 of this patch series, it looks great to me.

Thank you, and again apologies for the long delay!

Ludo’.

[Message part 3 (message/rfc822, inline)]

From: Tomas Volf <wolf <at> wolfsden.cz>
To: guix-patches <at> gnu.org
Cc: Tomas Volf <wolf <at> wolfsden.cz>
Subject: [PATCH 0/2] Add support for unlocking root device via a key file
Date: Tue,  1 Aug 2023 22:53:10 +0200

When having an encrypted /boot, it is currently necessary to input a password
twice, once for the /boot (so that grub can find its configuration) and later
once more in order to actually unlock the / itself.  It is not very user
friendly and gets annoying quickly in more exotic setups.  For example with /
on RAID1 BTRFS, password needs to be entered 4 times.  And even without that,
for large encrypted arrays, password needs to be entered once per drive.

The obvious solution to this is to just use --key-file option of the luksOpen
command, however support for that was not implemented.  This series adds that
support.

Another problem is where to store the key file, since it needs to be both
present in the initrd, but it cannot be in the store (since that would make it
world-readable, and you do not want that for an encryption key).  Luckily for
us, grub can load multiple initrds and merge them, so option to specify
additional initrd (not from the store) is added as well.

Since extlinux does not look like supporting encrypted /boot (and this new
option should not be used for anything else), it was added only into into
grub.

Tomas Volf (2):
  mapped-devices: Allow unlocking by a key file
  gnu: bootloader: grub: Add support for loading an additional initrd

 doc/guix.texi                 | 32 +++++++++++++++++
 gnu/bootloader.scm            |  6 +++-
 gnu/bootloader/grub.scm       |  6 ++--
 gnu/system/mapped-devices.scm | 67 ++++++++++++++++++++++-------------
 4 files changed, 83 insertions(+), 28 deletions(-)


base-commit: 5a293d0830aa9369e388d37fe767d5bf98af01b7
-- 
2.41.0

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.