Re: [PATCH v2 2/4] initramfs-crypt-hook: implement 'noencrypt' option

Claudius Heine
2025-02-27T16:51:21Z

On 2025-02-27 5:46 pm, Jan Kiszka wrote:
> On 27.02.25 17:07, Quirin Gylstorff wrote:
>>
>>
>> On 2/27/25 15:49, Claudius Heine wrote:
>>> Hi Qurin,
>>>
>>> On 2025-02-27 3:42 pm, Quirin Gylstorff wrote:
>>>>
>>>>
>>>> On 2/27/25 15:30, Claudius Heine wrote:
>>>>> In case encryption needs to be enabled via an update, while still
>>>>> allowing the update fall back to work. One update step where encryption
>>>>> is supported, but no reencryption is taking place if the device is not
>>>>> encrypted.
>>>>
>>>> The scenario this patch tries to solve is update from A to B:
>>>> - Update is not confirmed
>>>> - the encryption was successful
>>>> -  Error occurs and we fallback to Partition A
>>>>
>>>> Is that correct?
>>>
>>> Yes, and it is about a shared data partition, that needs to be
>>> available on both systems and should eventually be encrypted. The root
>>> file systems do not really matter, because they are belong to each
>>> update slot.
>>>
>>> Update slot A needs to be able to mount the encrypted partition, but
>>> should not encrypt it.
>>
>> Can you add that example  to the commit message.
>>
>
> Actually, that should better go into our documentation so that the
> reference case is also clear to users not parsing the code history.

I have described this scenario in the documentation with in this patch:

> For example, with a shared data partition, the fallback system would
have the `noencrypt` option, while the encrypted system would have the
`reencrypt` option set for it. Now the fallback system can still open
the data partition if the update to the encrypted system failed.

But maybe I having it more structured instead of just an paragraph would
make it easier to consume and understand.

regards,
Claudius

>
> Jan
>

--
DENX Software Engineering GmbH, Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-54 Fax: (+49)-8142-66989-80 Email: ch@denx.de