[bug#65002] [PATCH 0/2] Add support for unlocking root device via a key file

[Tomas Volf <wolf@wolfsden.cz>]

When having an encrypted /boot, it is currently necessary to input a password
twice, once for the /boot (so that grub can find its configuration) and later
once more in order to actually unlock the / itself.  It is not very user
friendly and gets annoying quickly in more exotic setups.  For example with /
on RAID1 BTRFS, password needs to be entered 4 times.  And even without that,
for large encrypted arrays, password needs to be entered once per drive.

The obvious solution to this is to just use --key-file option of the luksOpen
command, however support for that was not implemented.  This series adds that
support.

Another problem is where to store the key file, since it needs to be both
present in the initrd, but it cannot be in the store (since that would make it
world-readable, and you do not want that for an encryption key).  Luckily for
us, grub can load multiple initrds and merge them, so option to specify
additional initrd (not from the store) is added as well.

Since extlinux does not look like supporting encrypted /boot (and this new
option should not be used for anything else), it was added only into into
grub.

Tomas Volf (2):
  mapped-devices: Allow unlocking by a key file
  gnu: bootloader: grub: Add support for loading an additional initrd

 doc/guix.texi                 | 32 +++++++++++++++++
 gnu/bootloader.scm            |  6 +++-
 gnu/bootloader/grub.scm       |  6 ++--
 gnu/system/mapped-devices.scm | 67 ++++++++++++++++++++++-------------
 4 files changed, 83 insertions(+), 28 deletions(-)


base-commit: 5a293d0830aa9369e388d37fe767d5bf98af01b7
-- 
2.41.0