Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package fde-tools for openSUSE:Factory checked in at 2026-10-20 12:36:16 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/fde-tools (Old) and /work/SRC/openSUSE:Factory/.fde-tools.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "fde-tools" Tue Oct 20 12:36:16 2026 rev:39 rq:1386100 version:0.7.10 Changes: -------- --- /work/SRC/openSUSE:Factory/fde-tools/fde-tools.changes 2026-09-23 14:35:33.428851049 +0200 +++ /work/SRC/openSUSE:Factory/.fde-tools.new.3698736/fde-tools.changes 2026-10-20 12:36:36.094202940 +0200 @@ -1,0 +2,8 @@ +Fri Oct 16 07:05:31 UTC 2026 - Gary Ching-Pang Lin <[email protected]> + +- Update to 0.7.10 + + Check FDE_LUKS_PBKDF and set iterations accordingly + + Preserve well-known password in LUKS when used to regenerate + key (bsc#1284427) + +------------------------------------------------------------------- Old: ---- fde-tools-0.7.9.tar.bz2 New: ---- fde-tools-0.7.10.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ fde-tools.spec ++++++ --- /var/tmp/diff_new_pack.955kVg/_old 2026-10-20 12:36:36.946238460 +0200 +++ /var/tmp/diff_new_pack.955kVg/_new 2026-10-20 12:36:36.948238544 +0200 @@ -21,7 +21,7 @@ %endif Name: fde-tools -Version: 0.7.9 +Version: 0.7.10 Release: 0 Summary: Tools required for Full Disk Encryption License: GPL-2.0-only ++++++ fde-tools-0.7.9.tar.bz2 -> fde-tools-0.7.10.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fde-tools-0.7.9/fde.sh new/fde-tools-0.7.10/fde.sh --- old/fde-tools-0.7.9/fde.sh 2026-09-21 09:01:35.111879156 +0200 +++ new/fde-tools-0.7.10/fde.sh 2026-10-16 08:54:10.331932389 +0200 @@ -22,7 +22,7 @@ : ${SHAREDIR:=/usr/share/fde} -version=0.7.9 +version=0.7.10 opt_bootloader=grub2 opt_uefi_bootdir="" @@ -202,6 +202,11 @@ . /etc/sysconfig/fde-tools . "$SHAREDIR/ui/$opt_ui" . "$SHAREDIR/util" + +if ! luks_verify_config_pbkdf; then + exit 1 +fi + . "$SHAREDIR/tpm" . "$SHAREDIR/$opt_bootloader" . "$SHAREDIR/commands/$command" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fde-tools-0.7.9/share/commands/remove-secondary-password new/fde-tools-0.7.10/share/commands/remove-secondary-password --- old/fde-tools-0.7.9/share/commands/remove-secondary-password 2025-07-29 05:00:40.734993675 +0200 +++ new/fde-tools-0.7.10/share/commands/remove-secondary-password 2026-10-16 08:53:12.005277616 +0200 @@ -36,15 +36,44 @@ fi ################################################################## - # Nuke the LUKS header slot associated with this password + # Nuke the LUKS header slot associated with this password unless + # it was explicitly supplied to authorize regenerate-key. ################################################################## luks_keyfile=$(luks_write_password pass "${insecure_password}") - for luks_dev in ${luks_devices}; do - if ! luks_drop_key "$luks_dev" "$luks_keyfile"; then - display_errorbox "Unable to disable firstboot password(${luks_dev})" - return 1 + + # The order of the checks below must mirror how the recovery + # credential was obtained in fde_request_recovery_passfile and + # fde_request_recovery_password: passfile, --password, prompt. + local match_supplied_pass=false + if [ "$command" = "regenerate-key" ]; then + if [ -n "$opt_passfile" ] && [ -f "$opt_passfile" ]; then + # cryptsetup uses the key file verbatim, so compare bytes + if cmp -s "$opt_passfile" "$luks_keyfile"; then + match_supplied_pass=true + fi + elif [ -n "$opt_password" ]; then + if [ "$opt_password" = "$insecure_password" ]; then + match_supplied_pass=true + fi + elif [ -n "$__fde_cached_recovery_password" ] && \ + [ "$__fde_cached_recovery_password" = "$insecure_password" ]; then + match_supplied_pass=true fi - done + fi + + if $match_supplied_pass; then + fde_trace "Keeping firstboot password in LUKS:" \ + "used to authorize regenerate-key" + else + for luks_dev in ${luks_devices}; do + if ! luks_drop_key "$luks_dev" "$luks_keyfile"; then + rm -f "$luks_keyfile" + display_errorbox "Unable to disable firstboot password(${luks_dev})" + return 1 + fi + done + fi + rm -f "$luks_keyfile" ################################################################## # And finally, wipe the password from the boot loader config files. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fde-tools-0.7.9/share/luks new/fde-tools-0.7.10/share/luks --- old/fde-tools-0.7.9/share/luks 2026-09-21 08:57:10.278341256 +0200 +++ new/fde-tools-0.7.10/share/luks 2026-10-16 08:53:12.005277616 +0200 @@ -331,6 +331,10 @@ local luks_keyfile="$2" local luks_new_keyfile="$3" + if ! luks_verify_config_pbkdf; then + return 1 + fi + display_infobox "Updating LUKS password (${luks_dev})" if ! cryptsetup --key-file "${luks_keyfile}" luksChangeKey --pbkdf "$FDE_LUKS_PBKDF" "${luks_dev}" ${luks_new_keyfile}; then @@ -399,6 +403,10 @@ local luks_keyfile="$2" local luks_new_password="$3" + if ! luks_verify_config_pbkdf; then + return 1 + fi + if [ -z "$luks_new_password" ]; then request_new_password "Please enter new LUKS recovery password" if [ -z "$result_password" ]; then @@ -419,6 +427,30 @@ rm -f ${new_keyfile} } +################################################################## +# Minimum iterations for $FDE_LUKS_PBKDF allowed by cryptsetup +################################################################## +function luks_get_minimum_pbkdf_iterations { + + case "$FDE_LUKS_PBKDF" in + pbkdf2) + echo 1000 + ;; + argon2id) + echo 4 + ;; + *) + fde_trace "Error: Invalid FDE_LUKS_PBKDF '$FDE_LUKS_PBKDF'. Must be either pbkdf2 or argon2id." + return 1 + ;; + esac +} + +function luks_verify_config_pbkdf { + + luks_get_minimum_pbkdf_iterations > /dev/null +} + function luks_add_key { local luks_dev="$1" @@ -426,17 +458,22 @@ local new_keyfile="$3" local luks_output local luks_keyslot + local tpm_pbkdf_iterations + + # Note: we try to reduce the cost of PBKDF to (almost) nothing. + # There's no need in slowing down this operation for a + # key that was random to begin with. + if ! tpm_pbkdf_iterations=$(luks_get_minimum_pbkdf_iterations); then + return 1 + fi if [ -z "$new_keyfile" ]; then echo "Unable to obtain new key" >&2 return 1 fi - # Note: we try to reduce the cost of PBKDF to (almost) nothing. - # There's no need in slowing down this operation for a - # key that was random to begin with. luks_output=$(LC_ALL=C cryptsetup --verbose --key-file "${luks_keyfile}" luksAddKey \ - --pbkdf "$FDE_LUKS_PBKDF" --pbkdf-force-iterations 1000 \ + --pbkdf "$FDE_LUKS_PBKDF" --pbkdf-force-iterations ${tpm_pbkdf_iterations} \ ${luks_dev} ${new_keyfile}) if test $? -ne 0; then fde_trace "Warning: luksAddKey indicates failure" @@ -469,12 +506,17 @@ local luks_dev="$1" local luks_keyfile="$2" local new_keyfile="$3" + local tpm_pbkdf_iterations # Note: we try to reduce the cost of PBKDF to (almost) nothing. # There's no need in slowing down this operation for a # key that was random to begin with. + if ! tpm_pbkdf_iterations=$(luks_get_minimum_pbkdf_iterations); then + return 1 + fi + cryptsetup --key-file "${luks_keyfile}" luksChangeKey \ - --pbkdf "$FDE_LUKS_PBKDF" --pbkdf-force-iterations 1000 \ + --pbkdf "$FDE_LUKS_PBKDF" --pbkdf-force-iterations ${tpm_pbkdf_iterations} \ $luks_dev $new_keyfile } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fde-tools-0.7.9/sysconfig.fde new/fde-tools-0.7.10/sysconfig.fde --- old/fde-tools-0.7.9/sysconfig.fde 2026-09-14 05:08:22.069883546 +0200 +++ new/fde-tools-0.7.10/sysconfig.fde 2026-10-16 08:53:12.006277611 +0200 @@ -15,7 +15,8 @@ FDE_TPM2_SRK_ATTRS="userwithauth|restricted|decrypt|fixedtpm|fixedparent|noda|sensitivedataorigin" # The PBKDF algorithm to use for deriving LUKS keys from a given password -# For grub2 based schemes, you have to use pbkdf2 for now. +# Must be either pbkdf2 or argon2id +# For grub2 below 2.14, you have to use pbkdf2. FDE_LUKS_PBKDF="pbkdf2" # Enable/disable tracing output
