Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package disk-encryption-tool for
openSUSE:Factory checked in at 2026-08-28 19:46:50
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/disk-encryption-tool (Old)
and /work/SRC/openSUSE:Factory/.disk-encryption-tool.new.1265 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "disk-encryption-tool"
Fri Aug 28 19:46:50 2026 rev:22 rq:1374055 version:1+git20260827.0550628
Changes:
--------
---
/work/SRC/openSUSE:Factory/disk-encryption-tool/disk-encryption-tool.changes
2026-03-06 18:16:50.183781906 +0100
+++
/work/SRC/openSUSE:Factory/.disk-encryption-tool.new.1265/disk-encryption-tool.changes
2026-08-28 19:47:12.490611201 +0200
@@ -1,0 +2,7 @@
+Thu Aug 27 11:59:02 UTC 2026 - Alberto Planas Dominguez <[email protected]>
+
+- Update to version 1+git20260827.0550628:
+ * Comment why there is no timeout in the key
+ * test: update the enrollment with the new keyring names
+
+-------------------------------------------------------------------
Old:
----
disk-encryption-tool-1+git20260304.d12960d.obscpio
New:
----
disk-encryption-tool-1+git20260827.0550628.obscpio
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ disk-encryption-tool.spec ++++++
--- /var/tmp/diff_new_pack.ZJj643/_old 2026-08-28 19:47:13.684652938 +0200
+++ /var/tmp/diff_new_pack.ZJj643/_new 2026-08-28 19:47:13.688653078 +0200
@@ -18,7 +18,7 @@
Name: disk-encryption-tool
-Version: 1+git20260304.d12960d
+Version: 1+git20260827.0550628
Release: 0
Summary: Tool to reencrypt kiwi raw images
License: MIT
++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.ZJj643/_old 2026-08-28 19:47:13.871659474 +0200
+++ /var/tmp/diff_new_pack.ZJj643/_new 2026-08-28 19:47:13.884659929 +0200
@@ -1,6 +1,6 @@
<servicedata>
<service name="tar_scm">
<param
name="url">https://github.com/openSUSE/disk-encryption-tool.git</param>
- <param
name="changesrevision">d12960d899fa893bdc94c14805d154887db52804</param></service></servicedata>
+ <param
name="changesrevision">055062883d5c0071cb507970728949a816618501</param></service></servicedata>
(No newline at EOF)
++++++ disk-encryption-tool-1+git20260304.d12960d.obscpio ->
disk-encryption-tool-1+git20260827.0550628.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/disk-encryption-tool-1+git20260304.d12960d/disk-encryption-tool
new/disk-encryption-tool-1+git20260827.0550628/disk-encryption-tool
--- old/disk-encryption-tool-1+git20260304.d12960d/disk-encryption-tool
2026-03-04 21:17:40.000000000 +0100
+++ new/disk-encryption-tool-1+git20260827.0550628/disk-encryption-tool
2026-08-27 13:57:27.000000000 +0200
@@ -272,6 +272,19 @@
if [ -z "$password" ]; then
password="$(dd if=/dev/urandom bs=8 count=1 2> /dev/null | base64)"
+ # Without a timeout, unlike every key that sdbootutil adds, and
+ # on purpose. A timer armed here would have to cover the
+ # reencryption that starts a few lines below, which takes as
+ # long as the disk is large, then the rest of the boot, and then
+ # a jeos-firstboot that waits for whoever is at the console.
+ # There is no later point to re-arm it from either: this script
+ # is done once the disk is encrypted, and nothing runs again
+ # until the enrollment. A key that expires first leaves a
+ # device whose only keyslot is one that nobody can open
+ #
+ # What it costs is bounded: the entry is readable by root alone,
+ # it is gone at the next boot, and the keyslot it opens is wiped
+ # as soon as something else is enrolled
[ -z "$keyring" ] || echo -n "$password" | keyctl padd user "$keyring"
@u > /dev/null
[ -z "$verbose" ] || echo -e "Enrollment key: \e[1m$password\e[m"
fi
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/disk-encryption-tool-1+git20260304.d12960d/test/testscript
new/disk-encryption-tool-1+git20260827.0550628/test/testscript
--- old/disk-encryption-tool-1+git20260304.d12960d/test/testscript
2026-03-04 21:17:40.000000000 +0100
+++ new/disk-encryption-tool-1+git20260827.0550628/test/testscript
2026-08-27 13:57:27.000000000 +0200
@@ -33,23 +33,23 @@
# Enroll extra password
# echo "SECRET_PASSWORD" > "$credential"
echo "linux" > "$credential"
-systemd-creds encrypt --name=disk-encryption-tool-enroll.pw "$credential" \
- /etc/credstore.encrypted/disk-encryption-tool-enroll.pw
+systemd-creds encrypt --name=sdbootutil-enroll.pw "$credential" \
+ /etc/credstore.encrypted/sdbootutil-enroll.pw
# # Enroll TPM2 with secret PIN
# echo "SECRET_PIN" > "$credential"
-# systemd-creds encrypt --name=disk-encryption-tool-enroll.tpm2+pin
"$credential" \
-# /etc/credstore.encrypted/disk-encryption-tool-enroll.tpm2+pin
+# systemd-creds encrypt --name=sdbootutil-enroll.tpm2+pin "$credential" \
+# /etc/credstore.encrypted/sdbootutil-enroll.tpm2+pin
# # Enroll TPM2
# echo "1" > "$credential"
-# systemd-creds encrypt --name=disk-encryption-tool-enroll.tpm2 "$credential" \
-# /etc/credstore.encrypted/disk-encryption-tool-enroll.tpm2
+# systemd-creds encrypt --name=sdbootutil-enroll.tpm2 "$credential" \
+# /etc/credstore.encrypted/sdbootutil-enroll.tpm2
# # Enroll FIDO2
# echo "1" > "$credential"
-# systemd-creds encrypt --name=disk-encryption-tool-enroll.fido2 "$credential"
\
-# /etc/credstore.encrypted/disk-encryption-tool-enroll.fido2
+# systemd-creds encrypt --name=sdbootutil-enroll.fido2 "$credential" \
+# /etc/credstore.encrypted/sdbootutil-enroll.fido2
shred -u "$credential"
@@ -72,6 +72,16 @@
echo "Not encrypted?"
exit 1
fi
+# The root filesystem is on /dev/mapper/cr_root whether the enrollment
+# ran or not, opened by the key that disk-encryption-tool generated, so
+# the check above says nothing about it. The credential asked for
+# "linux" as an extra password, and only the device can confirm it
+backing="$(cryptsetup status cr_root | sed -n 's,^ *device: *,,p')"
+systemd-cryptenroll "$backing"
+if ! printf 'linux' | cryptsetup luksOpen --test-passphrase "$backing"; then
+ echo "The password credential was not enrolled"
+ exit 1
+fi
mount -t 9p -o trans=virtio tmpdir /mnt
touch /mnt/done
umount /mnt
@@ -80,8 +90,14 @@
chmod a+x /usr/bin/combustion-validate
cat >>/etc/systemd/system/combustion-validate.service <<'EOF'
+[Unit]
+# Both are pulled by default.target with nothing ordering them, so
+# without this the check for the enrolled password can run first
+After=sdbootutil-enroll.service
+
[Service]
ExecStart=/usr/bin/combustion-validate
+
[Install]
RequiredBy=default.target
EOF
++++++ disk-encryption-tool.obsinfo ++++++
--- /var/tmp/diff_new_pack.ZJj643/_old 2026-08-28 19:47:14.382677337 +0200
+++ /var/tmp/diff_new_pack.ZJj643/_new 2026-08-28 19:47:14.396677826 +0200
@@ -1,5 +1,5 @@
name: disk-encryption-tool
-version: 1+git20260304.d12960d
-mtime: 1772655460
-commit: d12960d899fa893bdc94c14805d154887db52804
+version: 1+git20260827.0550628
+mtime: 1787831847
+commit: 055062883d5c0071cb507970728949a816618501
