[isar-cip-core][PATCH v9 0/8] initramfs-crypt-hook patch

[Jan Kiszka <jan.kiszka@siemens.com>]

As Claudius left denx, I took over this series and addressed remaining
issues.

Changes in v9:
- stub-out initial key persistence on buster (tpm2-tools 3.x)
- replace open-coded random key with pwgen
- Link to v9: https://lore.kernel.org/cip-dev/20250626-initramfs-crypt-hook-patches-2-v8-0-46f000788686@denx.de/

Changes in v8:
- Rebased on next
- Added documentation about the power fail scenarios and the LUKS header
  example.
- Link to v7: https://lore.kernel.org/r/20250616-initramfs-crypt-hook-patches-2-v7-0-82dc9d0dbbcf@denx.de

Changes in v7:
- readded tpm2_createpolicy for clevis
- Link to v6: https://lore.kernel.org/r/20250320-initramfs-crypt-hook-patches-2-v6-0-ef10c11cad94@denx.de

Changes in v6:
- luks formatting of format-if-empty will now be redone when if it is a
  luks partition without a TPM2 token, this makes it a bit more
  power-fail save
- Link to v5: https://lore.kernel.org/r/20250313-initramfs-crypt-hook-patches-2-v5-0-fc62d4a2ad29@denx.de

Changes in v5:
- Switch to use TPM2 protected password instead of static initial
  password for encryption
- Link to v4: https://lore.kernel.org/r/20250305-initramfs-crypt-hook-patches-2-v4-0-4170912e5261@denx.de

Changes in v4:
 - improve documentation and commit messages
 - reorder commits, to put re-encryption recovery up front
 - extract static temporary encryption key patch into its own
 - switch from lsblk to blkid

Changes in v3:
 - Rebase on current next
 - Extended 'noencrypt' documentation
 - support clevis tokens for re-encryption recovery

Changes in v2:
 - Added more descriptive commit message
 - Added more descriptive documentation about noencrypt option
 - Fixed typos in documentation
 - removed unnecessary setting of /conf/param.conf in initramfs-crypt-hook
 - added re-encryption recovery patch

Claudius Heine (4):
  initramfs-crypt-hook: store initial encryption key in TPM2
  initramfs-crypt-hook: add re-encryption recovery
  initramfs-crypt-hook: implement 'noencrypt' option
  initramfs-crypt-hook: add 'format-if-empty' feature

Jan Kiszka (4):
  initramfs-crypt-hook: Use pwgen instead of openssl for initial
    passphrase
  initramfs-crypt-hook: Drop redundant copy-execs for
    systemd-cryptenroll
  initramfs-crypt-hook: Only use resource-managed TPM instances
  initramfs-crypt-hook: Factor out tpm2_functions script

 doc/README.tpm2.encryption.md                 |  57 ++++++++--
 .../initramfs-crypt-hook/files/hook           |   3 +-
 .../files/local-top-complete                  | 103 +++++++++++++-----
 .../initramfs-crypt-hook/files/tpm2_functions |  66 +++++++++++
 .../files/tpm2_functions.buster               |  24 ++++
 ...ook_0.8.bb => initramfs-crypt-hook_0.9.bb} |  22 ++--
 6 files changed, 229 insertions(+), 46 deletions(-)
 create mode 100644 recipes-initramfs/initramfs-crypt-hook/files/tpm2_functions
 create mode 100644 recipes-initramfs/initramfs-crypt-hook/files/tpm2_functions.buster
 rename recipes-initramfs/initramfs-crypt-hook/{initramfs-crypt-hook_0.8.bb => initramfs-crypt-hook_0.9.bb} (85%)

-- 
2.43.0