Re: [PATCH 1/2] Revert "meta: Add option to specify additional dependencies for package expand-on-first-boot in case an encrypted disk has to be resized"

["'Jan Kiszka' via isar-users" <isar-users@googlegroups.com>]

On 16.11.24 07:00, Uladzimir Bely wrote:
> On Fri, 2024-11-08 at 12:27 +0100, 'Jan Kiszka' via isar-users wrote:
>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>
>> This reverts commit 8b30a4f86cb3ea3369bff3884141872c3a7d9979.
>>
>> On second thought, this approach turned out to be inapplicable on the
>> long-run. It is built around the assumption that the disk encryption
>> secret is still accessible after initramfs used it to unload the
>> disk.
>> While the downstream implementation of cip-core currently fulfills
>> this,
>> it is not expected to stay like that because of the increase attack
>> surface.
>>
>> We will need a different solution for expanding encrypted partitions,
>> most likely with the help of the encryption hook in the initramfs.
>>
> 
> Hello.
> 
> Does this mean that current solution we revert here is not working
> anymore in some downstream it was originally implemented for? We
> wouldn't like to revert any functionality if it's still used somewhere.
> 

It was originally designed to be used in isar-cip-core, but there it was
never pulled in, and it won't be anymore. Theoretically, there could be
users outside, but I don't expect any. And those would suffer from the
same conceptual limitation which makes this path useless.

Jan

-- 
Siemens AG, Technology
Linux Expert Center

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/7141936a-2067-416b-a5a7-a232a7646891%40siemens.com.