Re: [PATCH v2 2/4] initramfs-crypt-hook: implement 'noencrypt' option

Jan Kiszka
2025-02-27T16:47:01Z

On 27.02.25 17:07, Quirin Gylstorff wrote:
>
>
> On 2/27/25 15:49, Claudius Heine wrote:
>> Hi Qurin,
>>
>> On 2025-02-27 3:42 pm, Quirin Gylstorff wrote:
>>>
>>>
>>> On 2/27/25 15:30, Claudius Heine wrote:
>>>> In case encryption needs to be enabled via an update, while still
>>>> allowing the update fall back to work. One update step where encryption
>>>> is supported, but no reencryption is taking place if the device is not
>>>> encrypted.
>>>
>>> The scenario this patch tries to solve is update from A to B:
>>> - Update is not confirmed
>>> - the encryption was successful
>>> -  Error occurs and we fallback to Partition A
>>>
>>> Is that correct?
>>
>> Yes, and it is about a shared data partition, that needs to be
>> available on both systems and should eventually be encrypted. The root
>> file systems do not really matter, because they are belong to each
>> update slot.
>>
>> Update slot A needs to be able to mount the encrypted partition, but
>> should not encrypt it.
>
> Can you add that example  to the commit message.
>

Actually, that should better go into our documentation so that the
reference case is also clear to users not parsing the code history.

Jan

--
Siemens AG, Foundational Technologies
Linux Expert Center