Re: [PATCH 1/2] Revert "meta: Add option to specify additional dependencies for package expand-on-first-boot in case an encrypted disk has to be resized"

[Uladzimir Bely <ubely@ilbers.de>]

On Fri, 2024-11-08 at 12:27 +0100, 'Jan Kiszka' via isar-users wrote:
> From: Jan Kiszka <jan.kiszka@siemens.com>
> 
> This reverts commit 8b30a4f86cb3ea3369bff3884141872c3a7d9979.
> 
> On second thought, this approach turned out to be inapplicable on the
> long-run. It is built around the assumption that the disk encryption
> secret is still accessible after initramfs used it to unload the
> disk.
> While the downstream implementation of cip-core currently fulfills
> this,
> it is not expected to stay like that because of the increase attack
> surface.
> 
> We will need a different solution for expanding encrypted partitions,
> most likely with the help of the encryption hook in the initramfs.
> 
> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
> ---
>  .../expand-on-first-boot_1.5.bb                    | 14 +-----------
> --
>  1 file changed, 1 insertion(+), 13 deletions(-)
> 
> diff --git a/meta/recipes-support/expand-on-first-boot/expand-on-
> first-boot_1.5.bb b/meta/recipes-support/expand-on-first-boot/expand-
> on-first-boot_1.5.bb
> index 2596706d..4b9cf376 100644
> --- a/meta/recipes-support/expand-on-first-boot/expand-on-first-
> boot_1.5.bb
> +++ b/meta/recipes-support/expand-on-first-boot/expand-on-first-
> boot_1.5.bb
> @@ -10,19 +10,7 @@ inherit dpkg-raw
>  DESCRIPTION = "This service grows the last partition to the full
> medium during first boot"
>  MAINTAINER = "isar-users <isar-users@googlegroups.com>"
>  
> -# Additional packages that are needed to resize the disk if it is
> encrypted.
> -ADDITIONAL_DISK_ENCRYPTION_PACKAGES ?= ""
> -DEBIAN_DEPENDS = " \
> -    systemd, \
> -    sed, \
> -    grep, \
> -    coreutils, \
> -    mount, \
> -    e2fsprogs, \
> -    fdisk (>=2.29.2-3) | util-linux (<2.29.2-3), \
> -    util-linux, \
> -    ${ADDITIONAL_DISK_ENCRYPTION_PACKAGES} \
> -    "
> +DEBIAN_DEPENDS = "systemd, sed, grep, coreutils, mount, e2fsprogs,
> fdisk (>=2.29.2-3) | util-linux (<2.29.2-3), util-linux"
>  
>  SRC_URI = " \
>      file://expand-on-first-boot.service \
> -- 
> 2.43.0
> 

Applied to next, thanks.

-- 
Best regards,
Uladzimir.

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/4249afea0d8a06f616b31e723a858d8d595aa58f.camel%40ilbers.de.