Using FIDO2 automatically generates a temporary password for setting up LUKS
which is not available on subsequent runs of the script causing the format
script to crash with `password: unbound variable`.
`boot.initrd.preDeviceCommands` only runs in the script-based stage 1
and is gated on `!config.boot.initrd.systemd.enable`. Tests that
enable systemd initrd therefore never get `/tmp/secret.key` staged,
and disko's encrypted-filesystem mount hooks fail to find the
configured `passwordFile`.
The nixpkgs test driver was refactored: `driver.machines` is now a
computed property that returns a fresh sorted list combining
`driver.machines_qemu` and `driver.machines_nspawn`. Appending to the
property therefore mutates only the temporary returned list, so the
machines created via `create_test_machine` are no longer registered
with the driver.
This introduces what has been described in
https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html.
That is: support for FIDO2 and recovery passphrases and their boot
mechanism.
Testing is hard right now because of canokey-qemu being broken and U2F
is not a valid replacement for FIDO2…
I tried to keep as much as possible the previous behavior and make it
possible to mix FIDO2 and normal passphrases or key files without any
problem.
PIV support is out of scope for this change but can easily be added.
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
Use the `fsBefore` function from NixOS to sort the file-systems.
The function originates from `nixpkgs/nixos/lib/utils.nix`, but the file
is a lambda that requires more arguments than we have available.
Use the `fsBefore` function from NixOS to sort the file-systems.
The function originates from `nixpkgs/nixos/lib/utils.nix`, but the file
is a lambda that requires more arguments than we have available.
The device of the bind mounts is incorrectly taken verbatim while making
the image. The root hierarchy is mounted at `config.rootMountDir`
(`/mnt` by default) during the process, and this commit prepends that
path to the `device` in these cases.
Nix refuses to operate when the store path or its parent directories
contain symlinks. On some systems /mnt can be a symlink, causing
disko-install to fail with:
error: the path '"/mnt"' is a symlink; this is not allowed for the
Nix store and its parent directories
Use realpath to resolve symlinks before passing the mount point to
nix-store and nixos-install commands.
Allow users to override the automatic thread count detection for nix
store copying. The default "auto" behavior remains unchanged (min of
nproc and 8), but users can now specify a fixed thread count for
environments where the automatic detection isn't optimal.
The value for device is copied into the SOURCE column of findmnt.
By default this is "none". The mount and unmount scripts
branch on SOURCE=fsType specifically, and the existence of "none"
in the SOURCE column causes wrong branches to be executed.
For a list of special filesystems, the default value "none"
is replaced by the value for fsType.
QEMU on aarch64 requires an explicit machine type (e.g., '-machine virt'),
unlike x86_64 which has a default. Previously, the test script hardcoded
'qemu-kvm' without machine type arguments, causing aarch64 tests to fail
with "No machine specified, and there is no default".
By importing and using nixpkgs' qemu-common.nix library, we reuse the
existing platform-specific QEMU configuration logic.
Even though we don't depend on the MBR bootable flag in the following
steps, not running udevadm trigger and waiting for settle can cause
/dev/disk/by-partlabel entries to be absent when formatting filesystems
immediately after modifying the partition table.
