Re: [PATCH v6 0/4] initramfs-crypt-hook patch

[Jan Kiszka <jan.kiszka@siemens.com>]

On 02.06.25 10:20, Claudius Heine wrote:
> On Fri May 30, 2025 at 4:19 PM CEST, Jan Kiszka wrote:
>> On 20.03.25 08:43, Claudius Heine wrote:
>>> Hi,
>>>
>>> here is v6 of my patchset.
>>>
>>> I fixed the issue I found in the last patchset, now the `format-if-empty` process is a bit more power-fail save.
>>>
>>> But I suppose that if the luks header could not be written fully, and the `luks` fs type is not detected, it might still cause issues, but I am not sure I can prevent that effectively.
>>>
>>> Kind regards,
>>> Claudius
>>>
>>> ---
>>> Changes in v6:
>>> - luks formatting of format-if-empty will now be redone when if it is a
>>>   luks partition without a TPM2 token, this makes it a bit more
>>>   power-fail save
>>> - Link to v5: https://lore.kernel.org/r/20250313-initramfs-crypt-hook-patches-2-v5-0-fc62d4a2ad29@denx.de
>>>
>>> Changes in v5:
>>> - Switch to use TPM2 protected password instead of static initial
>>>   password for encryption
>>> - Link to v4: https://lore.kernel.org/r/20250305-initramfs-crypt-hook-patches-2-v4-0-4170912e5261@denx.de
>>>
>>> Changes in v4:
>>>  - improve documentation and commit messages
>>>  - reorder commits, to put re-encryption recovery up front
>>>  - extract static temporary encryption key patch into its own
>>>  - switch from lsblk to blkid
>>>
>>> Changes in v3:
>>>  - Rebase on current next
>>>  - Extended `noencrypt` documentation
>>>  - support clevis tokens for re-encryption recovery
>>>
>>> Changes in v2:
>>>  - Added more descriptive commit message
>>>  - Added more descriptive documentation about noencrypt option
>>>  - Fixed typos in documentation
>>>  - removed unnecessary setting of /conf/param.conf in initramfs-crypt-hook
>>>  - added re-encryption recovery patch
>>>
>>> ---
>>> Claudius Heine (4):
>>>       initramfs-crypt-hook: store initial encryption key in TPM2
>>>       initramfs-crypt-hook: add re-encryption recovery
>>>       initramfs-crypt-hook: implement 'noencrypt' option
>>>       initramfs-crypt-hook: add 'format-if-empty' feature
>>>
>>>  doc/README.tpm2.encryption.md                      |  25 +++-
>>>  .../initramfs-crypt-hook/files/local-top-complete  | 127 +++++++++++++++++++--
>>>  .../initramfs-crypt-hook_0.7.bb                    |  12 +-
>>>  3 files changed, 146 insertions(+), 18 deletions(-)
>>> ---
>>> base-commit: f5661b18b9721eee984ffc3b75169b40508469cb
>>> change-id: 20250305-initramfs-crypt-hook-patches-2-9cc4a027c89a
>>>
>>> Best regards,
>>
>> Seems this got lost after 1.7, Gökhan just reminded me. Any updates for
>> this in the meantime?
> 
> From my side v6 is still awaiting review. You mentioned that you will
> not merge it now, but in the future, and I have not received any further
> comments about this code so far.

OK, then everyone in CC should please have a look now and provide
feedback. The good news is that it still applies cleanly.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center