File disk-encryption-tool-1+git20231114.702dff6.obscpio of Package disk-encryption-tool

Overview Repositories Revisions Requests Users Attributes Meta

File disk-encryption-tool-1+git20231114.702dff6.obscpio of Package disk-encryption-tool (Revision 3b939ca406eb29fe56f8cb09d1fa9792)

Currently displaying revision 3b939ca406eb29fe56f8cb09d1fa9792 , Show latest

07070100000000000081A400000000000000000000000165539B190000042E000000000000000000000000000000000000003300000000disk-encryption-tool-1+git20231114.702dff6/LICENSEMIT License

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
07070100000001000081A400000000000000000000000165539B1900000436000000000000000000000000000000000000003500000000disk-encryption-tool-1+git20231114.702dff6/README.mdConvert a plain text kiwi image into one with LUKS full disk
encryption. Supports both raw and qcow2 images. It assumes that the
third partition is the root fs using btrfs.
After encrypting the disk, the fs is mounted and a new initrd
created as well as the grub2 config adjusted.

The script can either encrypt the image directly, or alternatively
add code to the initrd of the image. In the latter case the image
would encrypt itself on first boot.

Example to encrypt an image:

disk-encryption-tool -v SLE-Micro.x86_64-5.4.0-Default-GM.raw

Example to encrypt on first boot:

disk-encryption-tool -v --prime SLE-Micro.x86_64-5.4.0-Default-GM.raw

Parameters for cryptsetup-reencrypt(8) can be passed via
/etc/encrypt_options. One option per line, e.g.

--type=luks1
   --iter-time=2000

It's also possible to integrate with combustion. The combustion
script would have to look like this:

#!/bin/bash
    # combustion: encrypt
    if [ "$1" = "--encrypt" ]; then
        echo 12345 | disk-encryption-tool -v
    else
        echo root:12345 | chpasswd
    fi
07070100000002000081ED00000000000000000000000165539B1900002D92000000000000000000000000000000000000004000000000disk-encryption-tool-1+git20231114.702dff6/disk-encryption-tool#!/bin/bash
# SPDX-License-Identifier: MIT
# SPDX-FileCopyrightText: Copyright 2023 SUSE LLC
set -e
shopt -s nullglob

unset "${!LC_@}"
LANG="C.utf8"
export LANG

verbose=
prime=
gen_key=

switched_rw=
cr_name='cr_root'
cr_dev=
blkdev=
blkpart=
partno=
mp=
mounted=
tmpdir=$(mktemp -d -t disk-encryption-tool.XXXXXX)
cleanup()
{
	set +e
	if [ -n "$mp" ]; then
		while read -r i; do
			[ "$i" != "$mp" ] || make_ro
			umount "$i"
		done < <(findmnt -o TARGET -Rn --list "$mp" | tac)
	fi
	if [ -n "$mounted" ]; then
		if [ -e "$tmpdir/mounts" ]; then
			# restore previous mounts
			while read -r line; do
				eval "$line"
				mapfile -td, options < <(echo -n "$OPTIONS")
				if [ -n "$cr_dev" ] && [ "$SOURCE" = "$blkpart" ]; then
					SOURCE="$cr_dev"
				fi
				mount "$SOURCE" "$TARGET" -t "$FSTYPE" -o "$OPTIONS"
			done < "$tmpdir/mounts"
		fi
	else
		[ -e "$cr_dev" ] && cryptsetup close "${cr_dev##*/}"
		case "$blkdev" in
			/dev/nbd*) qemu-nbd -d "$blkdev" ;;
			/dev/loop*) losetup -d "$blkdev" ;;
		esac
	fi
	[ -d "$tmpdir" ] && ! mountpoint -q "$tmpdir/mnt" && rm -rf "$tmpdir"
}
trap cleanup EXIT

helpandquit()
{
	cat <<-EOF
		Usage: $0 [OPTIONS] IMAGE|BLOCKDEV

Encrypt IMAGE or BLOCKDEV

OPTIONS:
		  --verbose       verbose
		  --prime         add hook scripts to initrd to encrypt on first boot
		  --partno=N      partition number (default 3)
		  --gen-key       generate random recovery key
		  -h              help screen

EOF
	exit 0
}

log_info()
{
	[ "${verbose:-0}" -gt 0 ] || return 0
	echo "$@"
}

err()
{
	echo "Error: $*" >&2
	exit 1
}

warn()
{
	echo "Warning: $*" >&2
}

isdigits()
{
       local v="${1:?}"
       [ -z "${v//[0-9]*/}" ]
}

settle_umount_events()
{
        # Manual umount confuses systemd sometimes because it's async and the
        # .mount unit might still be active when the "start" is queued, making
        # it a noop, which ultimately leaves /sysroot unmounted
        # (https://github.com/systemd/systemd/issues/20329). To avoid that,
        # wait until systemd processed the umount events. In a chroot (or with
        # SYSTEMD_OFFLINE=1) systemctl always succeeds, so avoid an infinite loop.
	if [ "$mounted" = "/sysroot" ] && ! systemctl --quiet is-active does-not-exist.mount; then
		while systemctl --quiet is-active sysroot.mount; do sleep 0.5; done
	fi
}

read_password()
{
	local password2
	[ -z "$password" ] || return 0
	if ! [ -t 0 ]; then
		read -r -s password
		return "$?"
	fi
        while true; do
                read -r -s -p "Enter encryption passphrase: " password
		echo
		if type -p pwscore &>/dev/null; then
			echo "$password" | pwscore || continue
		fi
                read -r -s -p "Confirm encryption passphrase: " password2
		echo
                if [ "$password" != "$password2" ]; then
                        echo "Entered passwords don't match"
                        continue
                fi
                [ -n "$password" ] || err "No password, no encryption"
                break
        done
}

encrypt()
{
	local encrypt_options=(\
		--reduce-device-size 32m \
		--progress-frequency=1 \
	)
	if [ -e "${ENCRYPTION_CONFIG:-/etc/encrypt_options}" ]; then
		while read -r op; do
			[ "${op//#}" = "$op" ] || continue
			encrypt_options+=("$op")
		done < "${ENCRYPTION_CONFIG:-/etc/encrypt_options}"
	fi
	# sle 15 compat code
	if type -p cryptsetup-reencrypt &> /dev/null; then
		read_password

echo "$password" | cryptsetup-reencrypt --new --type luks1 "${encrypt_options[@]}" "$@" "${blkpart}"

log_info "Encryption done"

log_info "open encrypted image"
		echo "$password" | cryptsetup open "${blkpart}" "$cr_name"
	else
		log_info "encrypt with options ${encrypt_options[*]}"
		if [ -n "$password" ]; then
			# XXX: hopefully we can use the kernel keyring in the future here
			cryptsetup reencrypt --force-password --verbose --encrypt "${encrypt_options[@]}" "$@" "${blkpart}" "$cr_name" <<<"$password"
			[ -z "$gen_key" ] ||  echo '{"type":"systemd-recovery","keyslots":["0"]}' | cryptsetup token import "${blkpart}"
		else
			cryptsetup reencrypt --batch-mode --verify-passphrase --force-password --verbose --encrypt "${encrypt_options[@]}" "$@" "${blkpart}" "$cr_name"
		fi
	fi
	cr_dev="/dev/mapper/$cr_name"
}

call_dracut()
{
	if [ -L "$mp/boot/initrd" ]; then
		local initrd kv
		initrd="$(readlink "$mp/boot/initrd")"
		kv="${initrd#initrd-}"
		log_info "create initrd for $kv"
		chroot "$mp" dracut --add-drivers dm_crypt -q -f "/boot/$initrd" "$kv" "$@"
	elif [ -e "$mp/etc/kernel/entry-token" ]; then
		local token kernel kv
		read -r token < "$mp/etc/kernel/entry-token"
		log_info "token $token"
		for initrd in "$mp/boot/efi/$token"/*/initrd-*; do
			kv="${initrd%/*}"
			kv="${kv##*/}"
			initrd="${initrd#"$mp"}"
			log_info "create $initrd for $kv"
			chroot "$mp" dracut --add qemu --add-drivers "dm_crypt nls_iso8859-1 nls_cp437" -q --reproducible -f "$initrd" "$kv" "$@"
		done
	else
		err "Unsupported boot loader or fs layout"
	fi
}

mountstuff()
{
	mount -t tmpfs -o size=10m tmpfs "$mp/run"
	for i in proc dev sys; do
		mount --bind "/$i" "$mp/$i"
	done

for i in /.snapshots /boot/efi /boot/writable /var; do
		grep -q "\s$i\s" "$mp/etc/fstab" || continue
		[ -d "$mp/$i" ] || continue
		mountpoint -q "$mp/$i" && continue
		mount -T "$mp"/etc/fstab --target-prefix="$mp" "/$i"
	done
}

make_rw()
{
	log_info "switch to rw"
	btrfs prop set -t s "$mp" ro false
	switched_rw=1
}

make_ro()
{
	[ -n "$switched_rw" ] || return 0
	unset switched_rw
	log_info "set ro again"
	btrfs prop set -t s "$mp" ro true
}

####### main #######

getopttmp=$(getopt -o hv --long help,verbose,prime,partno:,gen-key -n "${0##*/}" -- "$@")
eval set -- "$getopttmp"

while true ; do
        case "$1" in
                -h|--help) helpandquit ;;
		-v|--verbose) verbose=$((++verbose)); shift ;;
		--prime) prime="1"; shift ;;
		--partno) partno="$2"; shift 2;;
		--gen-key) gen_key="1"; shift;;
                --) shift ; break ;;
                *) echo "Internal error!" ; exit 1 ;;
        esac
done

[ -z "$1" ] && [ -e /etc/initrd-release ] && set -- /sysroot

[ -n "$1" ] || helpandquit

[ -z "$prime" ] && [ -e "/dev/mapper/$cr_name" ] && err "$cr_name exists. Exit."

if [ -d "$1" ] || [ -b "$1" ]; then
	if [ -b "$1" ]; then
		blkpart="$1"
	else
		mountpoint -q "$1" || err "$1 is not a valid mountpoint"
		mp="$1"
		mounted="$1"
		blkpart="$(findmnt -nvo SOURCE "$mp")"
	fi
	[ -L "/sys/class/block/${blkpart##*/}" ] || err "$blkpart is not a partition"
	blkdev="$(readlink -f "/sys/class/block/${blkpart##*/}")"
	blkdev="${blkdev%/*}"
	blkdev="/dev/${blkdev##*/}"
	read -r partno < "/sys/class/block/${blkpart##*/}"/partition
else
	[ -n "$partno" ] || warn "--partno not specified, assuming 3"
	: "${partno:=3}"
	case "${1##*/}" in
		*.raw )
			log_info "setting up loop device"
			blkdev="$(losetup --show -fP "$1")"
			log_info "loop device $blkdev"
			;;
		*.qcow2)
			[ -e "/dev/nbd0" ] || modprobe nbd
			blkdev=/dev/nbd0
			qemu-nbd -c "$blkdev" "$1"
			udevadm settle
			;;
		*) err "Unsupported image" ;;
	esac
	blkpart="${blkdev}p${partno}"
fi
shift

eval "$(blkid -c /dev/null -o export "$blkpart"|sed 's/^/loop_/')"

[ "$loop_TYPE" != crypto_LUKS ] || { echo "Already encrypted"; exit 0; }
[ "$loop_TYPE" = btrfs ] || err "File system is ${loop_TYPE:-unknown} but only btrfs is supported"

if [ -z "$mounted" ]; then
	log_info "mounting fs"
	mkdir -p "$tmpdir/mnt"
	mount -t btrfs -o rw "${blkpart}" "$tmpdir/mnt"
	mp="$tmpdir/mnt"
else
	mountpoint -q "$mp" || err "$mp is not mounted"
	findmnt -o SOURCE,TARGET,FSTYPE,OPTIONS -Rvn --pairs "$mp" > "$tmpdir/mounts"
	mount -o remount,rw "$mp"
fi

if [ -n "$prime" ]; then
	mkdir -p "$tmpdir/overlay-w"
	dst="$tmpdir/overlay/95disk-encryption-tool"
	mkdir -p "$dst"
	for i in disk-encryption-tool disk-encryption-tool-dracut module-setup.sh \
			disk-encryption-tool-dracut.service generate-recovery-key; do
		cp "${0%/*}/$i" "$dst/$i"
	done
	if [ -e "${ENCRYPTION_CONFIG:-/etc/encrypt_options}" ]; then
		cp "${ENCRYPTION_CONFIG:-/etc/encrypt_options}" "$dst/encrypt_options"
		export ENCRYPTION_CONFIG="/usr/lib/dracut/modules.d/95disk-encryption-tool/encrypt_options"
	fi

make_rw

mountstuff

# dirty
	if [ -d "$mp/usr/share/jeos-firstboot/modules" ]; then
		install -D -m 644 "${0%/*}/jeos-firstboot-diskencrypt-override.conf" "$mp/usr/lib/systemd/system/jeos-firstboot.service.d/jeos-firstboot-diskencrypt-override.conf"
		cp "${0%/*}/jeos-firstboot-diskencrypt" "$mp/usr/share/jeos-firstboot/modules/diskencrypt"
	fi

mount -t overlay overlay \
		-o lowerdir="$mp/usr/lib/dracut/modules.d/,upperdir=$tmpdir/overlay,workdir=$tmpdir/overlay-w" \
		"$mp/usr/lib/dracut/modules.d/"

call_dracut

exit 0
fi

read -r minsize bytes _rest < <(btrfs inspect-internal min-dev-size "$mp")
isdigits "$minsize" || err "Failed to read minimum btrfs size"
[ "$bytes" = 'bytes' ] || err "Failed to read minimum btrfs size"

log_info "resizing fs"
btrfs filesystem resize "$minsize" "$mp"

if [ -e "$tmpdir/mounts" ]; then
	# subshell intentional here
	tac "$tmpdir/mounts" | while read -r line; do
		eval "$line"
		umount "$TARGET"
	done
else
	umount "$mp"
fi
unset mp

settle_umount_events

# shrink partition to a minimum so reencryption doesn't write everything
log_info "resizing partition"
echo "size=$((minsize/1024+32*1024))KiB" | sfdisk -q -N "$partno" "$blkdev"
udevadm settle

if [ -n "$gen_key" ]; then
	read -r password < <(generate-recovery-key)
	echo -e "Recovery key: \e[1m$password\e[m"
	read -r key_id < <(echo -n "$password" | keyctl padd user disk-encryption-tool-recovery-key @u)
fi

echo "Encrypting..."
encrypt "$@"

log_info "grow partition again"
echo ", +" | sfdisk --no-reread -q -N "$partno" "$blkdev"

if [ -z "$mounted" ]; then
	mount -o rw "$cr_dev" "/mnt"
	mp="/mnt"
else
	read -r line < "$tmpdir/mounts"
	eval "$line"
	mapfile -td, options < <(echo -n "$OPTIONS")
	for ((i=0;i<${#options};++i)); do [ "${options[i]}" = ro ] && options[i]=rw; done
	OPTIONS="$(IFS=, eval echo '"${options[*]}"')"
	[ "$SOURCE" = "$blkpart" ] && SOURCE="$cr_dev"
	mount "$cr_dev" "$TARGET" -t "$FSTYPE" -o "$OPTIONS"
	mp="$TARGET"
fi

log_info "resizing fs to max again"
btrfs filesystem resize max "$mp"

make_rw

crypttab_options="x-initrd.attach"
# this triggers dracut to add tpm2 code. should actually look at tokens
if [ -e "/sys/class/tpm/tpm0" ]; then
	crypttab_options+=",tpm2-device=auto"
fi
eval "$(blkid -c /dev/null -o export "$blkpart"|sed 's/^/loop_/')"
echo "$cr_name /dev/disk/by-uuid/$loop_UUID none $crypttab_options" > "$mp"/etc/crypttab

mountstuff

if grep -q "LOADER_TYPE.*grub2" "$mp"/etc/sysconfig/bootloader; then
	log_info "Update bootloader"

echo GRUB_ENABLE_CRYPTODISK=y >> "$mp"/etc/default/grub

sed -i -e 's/^LOADER_TYPE=.*/LOADER_TYPE="grub2"/' "$mp"/etc/sysconfig/bootloader
	chroot "$mp" update-bootloader --reinit
	sed -i -e 's/^LOADER_TYPE=.*/LOADER_TYPE="grub2-efi"/' "$mp"/etc/sysconfig/bootloader
	chroot "$mp" update-bootloader --reinit
	mv "$mp/boot/grub2/grub.cfg" "$mp/boot/grub2/grub.cfg.bak"
	cat > "$mp/boot/grub2/grub.cfg" <<-'EOF'
	set linux=linux
	set initrd=initrd
	if [ "${grub_cpu}" = "x86_64" -o "${grub_cpu}" = "i386" ]; then
	    if [ "${grub_platform}" = "efi" ]; then
		set linux=linuxefi
		set initrd=initrdefi
	    fi
	fi
	export linux initrd
	EOF
	sed -e 's/linuxefi/$linux/;s/initrdefi/$initrd/' < "$mp/boot/grub2/grub.cfg.bak" >> "$mp/boot/grub2/grub.cfg"
	rm "$mp/boot/grub2/grub.cfg.bak"
elif [ -e "$mp/etc/kernel/entry-token" ]; then
	: # sd-boot
else
	log_info "unsupported boot loader"
	grep LOADER_TYPE "$mp"/etc/sysconfig/bootloader
fi

call_dracut

make_ro

echo "Image encryption completed"
07070100000003000081ED00000000000000000000000165539B19000002AC000000000000000000000000000000000000004700000000disk-encryption-tool-1+git20231114.702dff6/disk-encryption-tool-dracut#!/bin/sh
exec < /dev/console >/dev/console 2>&1
type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
script=/run/combustion/mount/combustion/script
if [ -e "$script" ] && grep -qE '^# combustion:(.*)\<encrypt\>' "$script"; then
	systemctl start sysroot.mount
	# silence systemd
	kill -SIGRTMIN+21 1
	chmod a+x "$script"
	"$script" --encrypt
elif getargbool 0 rd.encrypt || [ ! -e /sysroot/etc/machine-id ]; then
	systemctl start sysroot.mount
	# silence systemd
	kill -SIGRTMIN+21 1
	echo -ne '\a'
	read -n1 -s -r -t 5 -p "Press ESC to prevent encrypting the disk" inhibitor
	echo
	[ "$inhibitor" = $'\e' ] || /usr/bin/disk-encryption-tool -v --gen-key || die "Encryption failed"
fi
07070100000004000081A400000000000000000000000165539B19000003C8000000000000000000000000000000000000004F00000000disk-encryption-tool-1+git20231114.702dff6/disk-encryption-tool-dracut.service[Unit]
Description=Encrypt root disk
DefaultDependencies=false

# /sysroot needs to be available, but it's temporarily stopped
# for remounting so a direct requirement is not possible
Requires=initrd-root-device.target
After=initrd-root-device.target

# we want to run after combustion copied the config but before combustion
# itself runs
Requires=combustion.service
After=firstboot-detect.service
After=combustion-prepare.service
Before=combustion.service

# After ignition completed its stuff
After=ignition-complete.target

# So that /etc/fstab's x-initrd.mount entries are read (again) later
Before=initrd-parse-etc.service

Conflicts=initrd-switch-root.target umount.target
Conflicts=dracut-emergency.service emergency.service emergency.target

# Without this it goes into an endless loop on failure
OnFailure=emergency.target
OnFailureJobMode=isolate

[Service]
Type=oneshot
ExecStart=/usr/bin/disk-encryption-tool-dracut

[Install]
RequiredBy=firstboot.target
07070100000005000081A400000000000000000000000165539B1900000B6D000000000000000000000000000000000000004500000000disk-encryption-tool-1+git20231114.702dff6/disk-encryption-tool.spec#
# spec file for package aaa_base
#
# Copyright (c) 2022 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.

# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
# icecream 0

%if 0%{?_build_in_place}
%define git_version %(git log '-n1' '--date=format:%Y%m%d' '--no-show-signature' "--pretty=format:+git%cd.%h")
BuildRequires:  git-core
%else
# this is required for obs' source validator. It's
# 20-files-present-and-referenced ignores all conditionals. So the
# definition of git_version actually happens always.
%define git_version %{nil}
%endif

Name:           disk-encryption-tool
Version:        84.87%{git_version}
Release:        0
Summary:        Tool to reencrypt kiwi raw images
License:        MIT
URL:            https://github.com/lnussel/disk-encryption-tool
Source:         disk-encryption-tool-%{version}.tar
Requires:       cryptsetup
Requires:       keyutils

%description
Convert a plain text kiwi image into one with LUKS full disk
encryption. Supports both raw and qcow2 images. It assumes that the
third partition is the root fs using btrfs.
After encrypting the disk, the fs is mounted and a new initrd
created as well as the grub2 config adjusted.

%prep
%setup -q

%build

%install
mkdir -p %buildroot/usr/lib/dracut/modules.d/95disk-encryption-tool
for i in disk-encryption-tool{,-dracut,-dracut.service}  module-setup.sh generate-recovery-key; do
  cp "$i" %buildroot/usr/lib/dracut/modules.d/95disk-encryption-tool/"$i"
done
mkdir -p %buildroot/usr/bin
ln -s ../lib/dracut/modules.d/95disk-encryption-tool/disk-encryption-tool %buildroot/usr/bin
ln -s ../lib/dracut/modules.d/95disk-encryption-tool/generate-recovery-key %buildroot/usr/bin
install -D -m 644 jeos-firstboot-diskencrypt-override.conf \
	%{buildroot}/usr/lib/systemd/system/jeos-firstboot.service.d/jeos-firstboot-diskencrypt-override.conf
install -D -m 644 jeos-firstboot-diskencrypt %buildroot/usr/share/jeos-firstboot/modules/diskencrypt

%files
%license LICENSE
/usr/bin/disk-encryption-tool
/usr/bin/generate-recovery-key
%dir /usr/lib/dracut
%dir /usr/lib/dracut/modules.d
/usr/lib/dracut/modules.d/95disk-encryption-tool
%dir /usr/share/jeos-firstboot
%dir /usr/share/jeos-firstboot/modules
/usr/share/jeos-firstboot/modules/diskencrypt
%dir /usr/lib/systemd/system/jeos-firstboot.service.d
/usr/lib/systemd/system/jeos-firstboot.service.d/jeos-firstboot-diskencrypt-override.conf

%changelog

07070100000006000081ED00000000000000000000000165539B19000001C9000000000000000000000000000000000000004100000000disk-encryption-tool-1+git20231114.702dff6/generate-recovery-key#!/bin/bash
set -e
modhex=('c' 'b' 'd' 'e' 'f' 'g' 'h' 'i' 'j' 'k' 'l' 'n' 'r' 't' 'u' 'v')
mapfile -t raw_key < <(hexdump -v --format '1/1 "%u\n"' -n 32 /dev/random)
[ "${#raw_key[@]}" = 32 ]
key=""
for ((i=0;i<"${#raw_key[@]}";++i)); do
	[ "$i" -gt 0 ] && [ "$((i%4))" -eq 0 ] && key="$key-"
	c="${raw_key[i]}"
	key="$key${modhex[$((c>>4))]}${modhex[$((c&15))]}"
done
[ -x /usr/bin/qrencode ] && [ -t 1 ] && echo -n "$key" | qrencode -t utf8i
echo "$key"
07070100000007000081A400000000000000000000000165539B190000076C000000000000000000000000000000000000004600000000disk-encryption-tool-1+git20231114.702dff6/jeos-firstboot-diskencrypt#!/bin/bash

crypt_keyid=""
crypt_pw=""
crypt_devs=()

diskencrypt_systemd_firstboot() {
	crypt_keyid="$(keyctl search @u user disk-encryption-tool-recovery-key)"
	[ -n "$crypt_keyid" ] || return 0
	local dev
	while read -r dev fstype; do
		[ "$fstype" = 'crypto_LUKS' ] || continue
		crypt_devs+=("$dev")
	done < <(lsblk --noheadings -o PATH,FSTYPE)
	if [ -z "${crypt_devs[0]}" ]; then
		d --msgbox $"Error: recovery set but no encrypted disks found" 0 0
		unset crypt_keyid
		return 0
	fi

if [ -n "$password" ] && d --yesno $"Use root password as encryption password?" 0 0; then
		crypt_pw="$password"
	else
		while true; do
			d --insecure --passwordbox  $"Enter encryption password" 0 0
			if [ -z "$result" ]; then
				d --aspect 29 --msgbox $"No encryption password set. You can add more keys manually using cryptsetup." 0 0
				break
			fi
			crypt_pw="$result"
			d --insecure --passwordbox  $"Confirm encryption password" 0 0
			[ "$crypt_pw" != "$result" ] || break
			d --msgbox $"Passwords don't match. Try again" 0 0
		done
	fi
}

diskencrypt_post() {
	[ -n "$crypt_keyid" ] || return 0
	if [ -e '/usr/sbin/issue-generator' ] && [ -z "$dry" ]; then
		mkdir -p "/run/issue.d/"
		issuefile="/run/issue.d/90-diskencrypt.conf"
	else
		issuefile='/dev/stdout'
	fi

echo -ne "Encryption recovery key:\n  " > "$issuefile"
	keyctl pipe "$crypt_keyid" >> "$issuefile"
	echo -e "\n" >> "$issuefile"
	if [ -x /usr/bin/qrencode ]; then
		echo "You can also scan it with your mobile phone:" >> "$issuefile"
		keyctl pipe "$crypt_keyid" | qrencode -t utf8i >> "$issuefile"
	fi

run issue-generator
	[ -n "$dry" ] || cat "$issuefile"

if [ -n "$crypt_pw" ]; then
		local dev
		for dev in "${crypt_devs[@]}"; do
			echo "adding password to $dev"
			echo -n "$password" | run cryptsetup luksAddKey --verbose --batch-mode --force-password --key-file <(keyctl pipe "$crypt_keyid") "$dev"
		done
	fi
}
07070100000008000081A400000000000000000000000165539B190000001D000000000000000000000000000000000000005400000000disk-encryption-tool-1+git20231114.702dff6/jeos-firstboot-diskencrypt-override.conf[Service]
KeyringMode=shared
07070100000009000081ED00000000000000000000000165539B19000003B6000000000000000000000000000000000000003B00000000disk-encryption-tool-1+git20231114.702dff6/module-setup.sh#!/bin/bash

# called by dracut
check() {
	require_any_binary cryptsetup || return 1
	return 0
}

# called by dracut
depends() {
	echo "crypt"
	return 0
}

# called by dracut
install() {
	inst_multiple -o cryptsetup-reencrypt
	inst_multiple cryptsetup btrfs mktemp getopt mountpoint findmnt sfdisk tac sed hexdump keyctl

inst_script "$moddir"/disk-encryption-tool /usr/bin/disk-encryption-tool
	inst_script "$moddir"/disk-encryption-tool-dracut /usr/bin/disk-encryption-tool-dracut
	inst_script "$moddir"/generate-recovery-key /usr/bin/generate-recovery-key

for service in "disk-encryption-tool-dracut.service"; do
		inst_simple "${moddir}/$service" "${systemdsystemunitdir}/$service"
		$SYSTEMCTL -q --root "$initdir" enable "$service"
		#$SYSTEMCTL -q --root "$initdir" enable "debug-shell.service"
	done

: "${ENCRYPTION_CONFIG:=/etc/encrypt_options}"
	[ -e "$ENCRYPTION_CONFIG" ] && inst_simple "$ENCRYPTION_CONFIG" "/etc/encrypt_options"
}
07070100000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000B00000000TRAILER!!!47 blocks

Places

File disk-encryption-tool-1+git20231114.702dff6.obscpio of Package disk-encryption-tool (Revision 3b939ca406eb29fe56f8cb09d1fa9792)

Places