Fixed case where a LUKS root is protected by a GPG-encrypted keyfile

[sakaki-]

...and plymouth is in use. Previously, this would use plymouth's ask-for-password action, passing it a --command argument that included a pipeline (line 206 in previous version of 00-crypt.sh). As plymouth does not shell-interpret its command however, this fails. In this version, we create a temporary script file with the necessary pipeline command in it, and pass this temporary script to plymouth instead. The script is in /tmp so disappears when the switch to the real root takes place. (In theory, it should be possible to construct a "/bin/sh -c 'cmd'"-style invocation for the --command, thereby avoiding this, but I have had no luck with this approach, due to plymouth's argument parser.) I've tested this against the following cases (on Gentoo):

• using gpg encrypted keyfile for LUKS partition
• using unencrypted keyfile for LUKS partition
• using straight passphrase for LUKS partition

with both plymouth in use, and not in use (text console boot).

Obviously, for the GPG cases to work, you need to have the static version (with no pinentry) in your initramfs.

Best sakaki sakaki@deciban.com

[sakaki-]

OK no problem, I'll make the change suggested at some point today and get back to you.

[sakaki-]

I've done a push -f of the new version (hope that's ok, a bit cleaner than having two log messages and leaving you to squash them). Commit hash is 0ab05d72e03bf4a8ab4819f75800c19a33ed2878 New version uses mktemp as suggested, plus I removed an old dangling reference to gpg_cmd (line 67 in old 00-crypt.sh). I've retested on Gentoo for the 3 x 2 cases mentioned above. Best sakaki