Re: [PATCH v6 0/4] initramfs-crypt-hook patch

["Claudius Heine" <ch@denx.de>]

On Fri May 30, 2025 at 4:19 PM CEST, Jan Kiszka wrote:
> On 20.03.25 08:43, Claudius Heine wrote:
>> Hi,
>> 
>> here is v6 of my patchset.
>> 
>> I fixed the issue I found in the last patchset, now the `format-if-empty` process is a bit more power-fail save.
>> 
>> But I suppose that if the luks header could not be written fully, and the `luks` fs type is not detected, it might still cause issues, but I am not sure I can prevent that effectively.
>> 
>> Kind regards,
>> Claudius
>> 
>> ---
>> Changes in v6:
>> - luks formatting of format-if-empty will now be redone when if it is a
>>   luks partition without a TPM2 token, this makes it a bit more
>>   power-fail save
>> - Link to v5: https://lore.kernel.org/r/20250313-initramfs-crypt-hook-patches-2-v5-0-fc62d4a2ad29@denx.de
>> 
>> Changes in v5:
>> - Switch to use TPM2 protected password instead of static initial
>>   password for encryption
>> - Link to v4: https://lore.kernel.org/r/20250305-initramfs-crypt-hook-patches-2-v4-0-4170912e5261@denx.de
>> 
>> Changes in v4:
>>  - improve documentation and commit messages
>>  - reorder commits, to put re-encryption recovery up front
>>  - extract static temporary encryption key patch into its own
>>  - switch from lsblk to blkid
>> 
>> Changes in v3:
>>  - Rebase on current next
>>  - Extended `noencrypt` documentation
>>  - support clevis tokens for re-encryption recovery
>> 
>> Changes in v2:
>>  - Added more descriptive commit message
>>  - Added more descriptive documentation about noencrypt option
>>  - Fixed typos in documentation
>>  - removed unnecessary setting of /conf/param.conf in initramfs-crypt-hook
>>  - added re-encryption recovery patch
>> 
>> ---
>> Claudius Heine (4):
>>       initramfs-crypt-hook: store initial encryption key in TPM2
>>       initramfs-crypt-hook: add re-encryption recovery
>>       initramfs-crypt-hook: implement 'noencrypt' option
>>       initramfs-crypt-hook: add 'format-if-empty' feature
>> 
>>  doc/README.tpm2.encryption.md                      |  25 +++-
>>  .../initramfs-crypt-hook/files/local-top-complete  | 127 +++++++++++++++++++--
>>  .../initramfs-crypt-hook_0.7.bb                    |  12 +-
>>  3 files changed, 146 insertions(+), 18 deletions(-)
>> ---
>> base-commit: f5661b18b9721eee984ffc3b75169b40508469cb
>> change-id: 20250305-initramfs-crypt-hook-patches-2-9cc4a027c89a
>> 
>> Best regards,
>
> Seems this got lost after 1.7, Gökhan just reminded me. Any updates for
> this in the meantime?

From my side v6 is still awaiting review. You mentioned that you will
not merge it now, but in the future, and I have not received any further
comments about this code so far.

regards,
Claudius




-- 
DENX Software Engineering GmbH,        Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-54 Fax: (+49)-8142-66989-80 Email: ch@denx.de