Build broken with CRYPTROOT_ENABLE=yes about build

[github-actions]

Jira ticket: AR-2068

[igorpecovnik]

It passes compilation when added:

--- a/extensions/grub.sh
+++ b/extensions/grub.sh
@@ -276,6 +276,7 @@ configure_grub() {
                GRUB_DISABLE_OS_PROBER=false                             # Have to be explicit about enabling os-prober
                GRUB_FONT="/usr/share/grub/unicode.pf2"                  # Be explicit about the font to use so Ubuntu does not freak out and mess gfxterm
                GRUB_GFXPAYLOAD=keep
+                GRUB_ENABLE_CRYPTODISK=y

... but resulting image does not work properly. Grub prompts for password, it prompts for disk-unlock but then it doesn't mount /root ... so there is some other problem too. This needs deeper inspection.

[doodlebro]

Thanks for confirming, my last successful build was Jan 21st at 1:21 UTC. Hope it helps.

[doodlebro]

Adding a few notes as I found time to debug parts of this:

The main issue comes from forced encryption on the boot partition by grub, but I'm not sure when this started. Forcing encrypted /boot breaks remote access since the password must be entered at the grub menu.

Prior to Jan 21st, using the Armbian build flag "CRYPTROOT_ENABLE=yes" only encrypted the root partition, which allowed grub to boot into the initramfs so that I can remotely unlock the root partition. I would expect this to be preserved, or at least have a flag for the boot partition's inclusion.

I don't think we want "GRUB_ENABLE_CRYPTODISK=y" added to extensions/grub.sh for every build, or at all in my case. When I add this, images build and boot alright, so forced encryption of /boot by grub seems like the only thing to handle.