xdbob / mkinitcpio-gpg-encrypt Goto Github PK
View Code? Open in Web Editor NEWGnuPG hook for Arch Linux initcpio (deprecated: replaced by `mkinitcpio-gnupg`)
GnuPG hook for Arch Linux initcpio (deprecated: replaced by `mkinitcpio-gnupg`)
Hi,
I'm currently using the hook provided here: https://github.com/grazzolini/mkinitcpio-utils
on my desktop PC.
I'm now using your hook on my laptop and I'm quite happy with it.
I looked into it a little but can't quite figure it out.
Would it be possible to combine both hooks for my desktop PC?
The idea then would be:
I'm sure this is doable but I haven't quite figured out how. Can you help me?
Hi! Thank you for maintaining this great tool. I tested gpg-encrypt-hook
with shellcheck (avalaible in Archlinux here) tool and it found following issues:
In gpg-encrypt-hook line 1:
#!/usr/bin/ash
^-- SC2187: Ash scripts will be checked as Dash. Add '# shellcheck shell=dash' to silence.
In gpg-encrypt-hook line 5:
[ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
^-- SC2154: quiet is referenced but not assigned.
In gpg-encrypt-hook line 9:
if [ -n "$cryptkey" ]; then
^-- SC2154: cryptkey is referenced but not assigned (did you mean 'cryptdev'?).
In gpg-encrypt-hook line 10:
IFS=: read ckdev ckarg1 ckarg2 <<EOF
^-- SC2162: read without -r will mangle backslashes.
In gpg-encrypt-hook line 16:
elif resolved=$(resolve_device "${ckdev}" ${rootdelay}); then
^-- SC2154: rootdelay is referenced but not assigned.
^-- SC2086: Double quote to prevent globbing and word splitting.
In gpg-encrypt-hook line 36:
[ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
^-- SC2086: Double quote to prevent globbing and word splitting.
In gpg-encrypt-hook line 39:
if [ -n "${cryptdevice}" ]; then
^-- SC2154: cryptdevice is referenced but not assigned.
In gpg-encrypt-hook line 41:
IFS=: read cryptdev cryptname cryptoptions <<EOF
^-- SC2162: read without -r will mangle backslashes.
In gpg-encrypt-hook line 55:
for cryptopt in ${cryptoptions//,/ }; do
^-- SC2169: In dash, string replacement is not supported.
In gpg-encrypt-hook line 66:
if resolved=$(resolve_device "${cryptdev}" ${rootdelay}); then
^-- SC2086: Double quote to prevent globbing and word splitting.
In gpg-encrypt-hook line 67:
if cryptsetup isLuks ${resolved} >/dev/null 2>&1; then
^-- SC2086: Double quote to prevent globbing and word splitting.
In gpg-encrypt-hook line 76:
/usr/bin/pcscd --auto-exit &> /dev/null
^-- SC2169: In dash, &> is not supported.
In gpg-encrypt-hook line 81:
/usr/bin/gpg --homedir "/etc/initcpio/gpg" --card-status &> /dev/null
^-- SC2169: In dash, &> is not supported.
In gpg-encrypt-hook line 90:
/bin/killall gpg-agent scdaemon pcscd &> /dev/null
^-- SC2169: In dash, &> is not supported.
In gpg-encrypt-hook line 93:
if eval cryptsetup --key-file ${ckeyfile} open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; then
^-- SC2086: Double quote to prevent globbing and word splitting.
^-- SC2086: Double quote to prevent globbing and word splitting.
In gpg-encrypt-hook line 95:
shred -u "/decrypted.bin" &> /dev/null
^-- SC2169: In dash, &> is not supported.
In gpg-encrypt-hook line 108:
while ! eval cryptsetup open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; do
^-- SC2086: Double quote to prevent globbing and word splitting.
^-- SC2086: Double quote to prevent globbing and word splitting.
In gpg-encrypt-hook line 120:
elif [ -n "${crypto}" ]; then
^-- SC2154: crypto is referenced but not assigned (did you mean 'cryptopt'?).
In gpg-encrypt-hook line 129:
IFS=: read c_hash c_cipher c_keysize c_offset c_skip <<EOF
^-- SC2162: read without -r will mangle backslashes.
In gpg-encrypt-hook line 146:
if [ $? -ne 0 ]; then
^-- SC2181: Check exit code directly with e.g. 'if mycmd;', not indirectly with $?.
I don't have great knowledge about internals so I leave this to your best judgment for now.
Hi,
I installed your AUR package and I seem to have some issues. I followed all your instructions, but once I try to boot I get the following message:
No key available with this passphrase.
Invalid keyfile. Reverting to passphrase.
Furthermore, I don't get prompted for my pin for my YubiKey Neo. To test this further I added the GPG encrypted keyfile to my LUKS. This immediately worked, but of course should not happen. It seems my GPG encrypted file it immediately given to the decryption process of the LUKS volume.
My keyfile is located in the root directory and is called crypto_keyfile.bin.gpg
, I added this to my mkinitcpio.conf
FILES="/crypto_keyfile.bin.gpg"
and this is my GRUB Kernel command line (without UUID):
GRUB_CMDLINE_LINUX="cryptdevice=UUID=XXXXX cryptkey=rootfs:/crypto_keyfile.bin.gpg"
Any idea what might be wrong or how I could debug this further? Thank you for any help you might be able to offer!
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.