diff --git a/ignition.spec b/ignition.spec index f43f532..0be3ee3 100644 --- a/ignition.spec +++ b/ignition.spec @@ -19,13 +19,15 @@ Version: 2.13.0 %global dracutlibdir %{_prefix}/lib/dracut Name: ignition -Release: 2%{?dist} +Release: 3%{?dist} Summary: First boot installer and configuration tool # Upstream license specification: Apache-2.0 License: ASL 2.0 URL: %{gourl} Source0: %{gosource} +# https://github.com/coreos/ignition/pull/1307 +Patch0: luks-volume-reuse.patch BuildRequires: libblkid-devel @@ -309,6 +311,9 @@ install -p -m 0755 ./ignition %{buildroot}/%{dracutlibdir}/modules.d/30ignition %endif %changelog +* Thu Jan 20 2022 Benjamin Gilbert - 2.13.0-3 +- Fix LUKS volume reuse + * Thu Jan 20 2022 Fedora Release Engineering - 2.13.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild diff --git a/luks-volume-reuse.patch b/luks-volume-reuse.patch new file mode 100644 index 0000000..b27f481 --- /dev/null +++ b/luks-volume-reuse.patch @@ -0,0 +1,56 @@ +From aed47c18aee593d155d45c0fe9ba29a9e3123cf6 Mon Sep 17 00:00:00 2001 +From: Benjamin Gilbert +Date: Mon, 17 Jan 2022 21:17:08 -0500 +Subject: [PATCH] disks: fix reuse of statically keyed LUKS volume + +We need to persist a volume's keyfile to the real root even if we take +the early `continue` when reusing the volume. Rather than copying code, +enable persistence up front and then disable it afterward if we decide +not to persist the key. + +Fixes error: + + CRITICAL : Ignition failed: creating crypttab entries: missing persisted keyfile for [...] + +Fixes: https://github.com/coreos/ignition/issues/1305 +Fixes: 65e9c1611128 ("stages/disks: use State to persist keyfiles for files stage") +--- + internal/exec/stages/disks/luks.go | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/internal/exec/stages/disks/luks.go b/internal/exec/stages/disks/luks.go +index 77ecc24e..5fa15e70 100644 +--- a/internal/exec/stages/disks/luks.go ++++ b/internal/exec/stages/disks/luks.go +@@ -156,6 +156,13 @@ func (s *stage) createLuks(config types.Config) error { + } + } + } ++ // store the key to be persisted into the real root ++ // do this here so device reuse works correctly ++ key, err := ioutil.ReadFile(keyFilePath) ++ if err != nil { ++ return fmt.Errorf("failed to read keyfile %q: %w", keyFilePath, err) ++ } ++ s.State.LuksPersistKeyFiles[luks.Name] = dataurl.EncodeBytes(key) + + if !util.IsTrue(luks.WipeVolume) { + // If the volume isn't forcefully being created, then we need +@@ -329,13 +336,7 @@ func (s *stage) createLuks(config types.Config) error { + ); err != nil { + return fmt.Errorf("removing key file from luks device: %v", err) + } +- } else { +- // store the key to be persisted into the real root +- key, err := ioutil.ReadFile(keyFilePath) +- if err != nil { +- return fmt.Errorf("failed to read keyfile %q: %w", keyFilePath, err) +- } +- s.State.LuksPersistKeyFiles[luks.Name] = dataurl.EncodeBytes(key) ++ delete(s.State.LuksPersistKeyFiles, luks.Name) + } + } + +-- +2.33.1 +