From aa0053a3b927fa85926fcf40deb0dc7224477731 Mon Sep 17 00:00:00 2001 From: Christopher Byrne Date: Tue, 14 Jul 2026 17:58:25 -0500 Subject: [PATCH] app-crypt/clevis: drop 19-r2, 20-r1, 21 Remove package.mask for version 20 and 21 now that they are no longer in tree. 23 needs additional testing, especially for https://github.com/latchset/clevis/issues/456 but I don't think the mask is needed anymore, and we need more testers. Signed-off-by: Christopher Byrne --- app-crypt/clevis/Manifest | 3 - app-crypt/clevis/clevis-19-r2.ebuild | 39 ---- app-crypt/clevis/clevis-20-r1.ebuild | 36 ---- app-crypt/clevis/clevis-21.ebuild | 36 ---- app-crypt/clevis/files/clevis-dracut.patch | 216 --------------------- app-crypt/clevis/files/clevis-meson.patch | 11 -- app-crypt/clevis/metadata.xml | 1 - profiles/package.mask | 6 - 8 files changed, 348 deletions(-) delete mode 100644 app-crypt/clevis/clevis-19-r2.ebuild delete mode 100644 app-crypt/clevis/clevis-20-r1.ebuild delete mode 100644 app-crypt/clevis/clevis-21.ebuild delete mode 100644 app-crypt/clevis/files/clevis-dracut.patch delete mode 100644 app-crypt/clevis/files/clevis-meson.patch diff --git a/app-crypt/clevis/Manifest b/app-crypt/clevis/Manifest index f3dea06463..a97939902b 100644 --- a/app-crypt/clevis/Manifest +++ b/app-crypt/clevis/Manifest @@ -1,4 +1 @@ -DIST clevis-19.tar.gz 81324 BLAKE2B 75323940d0b53e307f5dbc197e3117e7ddc900d76ae1043bac3d17cc3af0264ba00a5f840c5c9dd3c2dd9c8fbde2cf05934b8ab3e89cd403ad8a8eb28609bb78 SHA512 dee19354c908c3843fc295a84b431780d5d6062c77766ee7ce9550636d3623d92b0cd1f6d4c40d57bef14debddc161da2b72289a5d6185cdd17b09a1ef67409a -DIST clevis-20.tar.gz 83668 BLAKE2B df00752f630762e8d52fb3fb9e0cd76129a53cf3c85300eb2c3967f9cb39139eb2b38e434e72dd879a5062555d7b5933558b87bba2dd01533bf92d0c059fbc5e SHA512 bee42f1e44b8ca8b1be7b9abf265d1bef14a8ecca6e18f48fbc33f3624b6633c5d150a83745eb8ea13a9a343235de07b0754b6ff9b462a1e7376964e7672a80d -DIST clevis-21.tar.gz 101599 BLAKE2B 3c02b409e3571d73ad46383da1863e2e2af33786e5a4d4a671b0423133442f379cd42e63f0d8c907604f3339bbf253c255eeefc7567b636ccf1cdb9993efa6dd SHA512 f069969a45195679cc5e521ed0b4ec2199d774aab59ec1d60533a3e9af70468aa2c75dfc695e9d48a255828971a3cf199388c92ffa999faadfc16d7c80eb9fde DIST clevis-23.tar.gz 137146 BLAKE2B d3a3a898ecc5124f40bb19cadda7e3ae395426a537d843f303dd552f92c69691c0121f817cd9453f081ce9d3084a8f2d13b4de150da46975a26474eca9286751 SHA512 305d9ee4d180314a646e6010ee2755c9e6dc981dbebc3c3194c53980d14fbf78a48427ccd15c2b7c89465ab5389550c53a47065866ce97afc604d9fdee86c546 diff --git a/app-crypt/clevis/clevis-19-r2.ebuild b/app-crypt/clevis/clevis-19-r2.ebuild deleted file mode 100644 index 097d18b218..0000000000 --- a/app-crypt/clevis/clevis-19-r2.ebuild +++ /dev/null @@ -1,39 +0,0 @@ -# Copyright 2022-2024 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -inherit meson - -DESCRIPTION="Automated Encryption Framework" -HOMEPAGE="https://github.com/latchset/clevis" -SRC_URI="https://github.com/latchset/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz" - -LICENSE="GPL-3" -SLOT="0" -KEYWORDS="~amd64" -IUSE="+luks +tpm" - -DEPEND=" - dev-libs/jose - sys-fs/cryptsetup - luks? ( - app-misc/jq - dev-libs/libpwquality - dev-libs/luksmeta - ) - tpm? ( app-crypt/tpm2-tools ) -" -RDEPEND=" - ${DEPEND} - dev-libs/jansson - dev-libs/openssl:= -" - -PATCHES=( - # From https://github.com/latchset/clevis/pull/347 - # Allows using dracut without systemd - "${FILESDIR}/clevis-dracut.patch" - # Fix for systemd on Gentoo - "${FILESDIR}/clevis-meson.patch" -) diff --git a/app-crypt/clevis/clevis-20-r1.ebuild b/app-crypt/clevis/clevis-20-r1.ebuild deleted file mode 100644 index 12627f913e..0000000000 --- a/app-crypt/clevis/clevis-20-r1.ebuild +++ /dev/null @@ -1,36 +0,0 @@ -# Copyright 2022-2024 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -inherit meson - -DESCRIPTION="Automated Encryption Framework" -HOMEPAGE="https://github.com/latchset/clevis" -SRC_URI="https://github.com/latchset/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz" - -LICENSE="GPL-3" -SLOT="0" -KEYWORDS="~amd64" -IUSE="+luks +tpm" - -DEPEND=" - dev-libs/jose - sys-fs/cryptsetup - luks? ( - app-misc/jq - dev-libs/libpwquality - dev-libs/luksmeta - ) - tpm? ( app-crypt/tpm2-tools ) -" -RDEPEND=" - ${DEPEND} - dev-libs/jansson - dev-libs/openssl:= -" - -PATCHES=( - # Fix for systemd on Gentoo - "${FILESDIR}/clevis-meson.patch" -) diff --git a/app-crypt/clevis/clevis-21.ebuild b/app-crypt/clevis/clevis-21.ebuild deleted file mode 100644 index 12627f913e..0000000000 --- a/app-crypt/clevis/clevis-21.ebuild +++ /dev/null @@ -1,36 +0,0 @@ -# Copyright 2022-2024 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -inherit meson - -DESCRIPTION="Automated Encryption Framework" -HOMEPAGE="https://github.com/latchset/clevis" -SRC_URI="https://github.com/latchset/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz" - -LICENSE="GPL-3" -SLOT="0" -KEYWORDS="~amd64" -IUSE="+luks +tpm" - -DEPEND=" - dev-libs/jose - sys-fs/cryptsetup - luks? ( - app-misc/jq - dev-libs/libpwquality - dev-libs/luksmeta - ) - tpm? ( app-crypt/tpm2-tools ) -" -RDEPEND=" - ${DEPEND} - dev-libs/jansson - dev-libs/openssl:= -" - -PATCHES=( - # Fix for systemd on Gentoo - "${FILESDIR}/clevis-meson.patch" -) diff --git a/app-crypt/clevis/files/clevis-dracut.patch b/app-crypt/clevis/files/clevis-dracut.patch deleted file mode 100644 index 60873b84e4..0000000000 --- a/app-crypt/clevis/files/clevis-dracut.patch +++ /dev/null @@ -1,216 +0,0 @@ -diff --git a/src/luks/systemd/dracut/clevis-pin-sss/meson.build b/src/dracut/clevis-pin-sss/meson.build -similarity index 100% -rename from src/luks/systemd/dracut/clevis-pin-sss/meson.build -rename to src/dracut/clevis-pin-sss/meson.build -diff --git a/src/luks/systemd/dracut/clevis-pin-sss/module-setup.sh.in b/src/dracut/clevis-pin-sss/module-setup.sh.in -similarity index 100% -rename from src/luks/systemd/dracut/clevis-pin-sss/module-setup.sh.in -rename to src/dracut/clevis-pin-sss/module-setup.sh.in -diff --git a/src/luks/systemd/dracut/clevis-pin-tang/meson.build b/src/dracut/clevis-pin-tang/meson.build -similarity index 100% -rename from src/luks/systemd/dracut/clevis-pin-tang/meson.build -rename to src/dracut/clevis-pin-tang/meson.build -diff --git a/src/luks/systemd/dracut/clevis-pin-tang/module-setup.sh.in b/src/dracut/clevis-pin-tang/module-setup.sh.in -similarity index 100% -rename from src/luks/systemd/dracut/clevis-pin-tang/module-setup.sh.in -rename to src/dracut/clevis-pin-tang/module-setup.sh.in -diff --git a/src/luks/systemd/dracut/clevis-pin-tpm2/meson.build b/src/dracut/clevis-pin-tpm2/meson.build -similarity index 100% -rename from src/luks/systemd/dracut/clevis-pin-tpm2/meson.build -rename to src/dracut/clevis-pin-tpm2/meson.build -diff --git a/src/luks/systemd/dracut/clevis-pin-tpm2/module-setup.sh.in b/src/dracut/clevis-pin-tpm2/module-setup.sh.in -similarity index 100% -rename from src/luks/systemd/dracut/clevis-pin-tpm2/module-setup.sh.in -rename to src/dracut/clevis-pin-tpm2/module-setup.sh.in -diff --git a/src/dracut/clevis/clevis-hook.sh.in b/src/dracut/clevis/clevis-hook.sh.in -new file mode 100755 -index 0000000..91ff2bd ---- /dev/null -+++ b/src/dracut/clevis/clevis-hook.sh.in -@@ -0,0 +1,3 @@ -+#!/bin/bash -+ -+@libexecdir@/clevis-luks-generic-unlocker -l -diff --git a/src/dracut/clevis/clevis-luks-generic-unlocker b/src/dracut/clevis/clevis-luks-generic-unlocker -new file mode 100755 -index 0000000..a3b9d62 ---- /dev/null -+++ b/src/dracut/clevis/clevis-luks-generic-unlocker -@@ -0,0 +1,70 @@ -+#!/bin/bash -+set -eu -+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: -+# -+# Copyright (c) 2020-2021 Red Hat, Inc. -+# Author: Sergio Correia -+# -+# This program is free software: you can redistribute it and/or modify -+# it under the terms of the GNU General Public License as published by -+# the Free Software Foundation, either version 3 of the License, or -+# (at your option) any later version. -+# -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with this program. If not, see . -+# -+ -+. clevis-luks-common-functions -+ -+# Make sure to exit cleanly if SIGTERM is received. -+trap 'echo "Exiting due to SIGTERM" && exit 0' TERM -+ -+loop= -+while getopts ":l" o; do -+ case "${o}" in -+ l) loop=true;; -+ *) ;; -+ esac -+done -+ -+to_unlock() { -+ local _devices='' _d _uuid -+ for _d in $(lsblk -o PATH,FSTYPE,RM \ -+ | awk '$2 == "crypto_LUKS" && $3 == "0" { print $1 }' | sort -u); -+ do -+ if ! bindings="$(clevis luks list -d "${_d}" 2>/dev/null)" \ -+ || [ -z "${bindings}" ]; then -+ continue -+ fi -+ _uuid="$(cryptsetup luksUUID "${_d}")" -+ if clevis_is_luks_device_by_uuid_open "${_uuid}"; then -+ continue -+ fi -+ _devices="$(printf '%s\n%s' "${_devices}" "${_d}")" -+ done -+ echo "${_devices}" | sed -e 's/^\n$//' -+} -+ -+while true; do -+ for d in $(to_unlock); do -+ uuid="$(cryptsetup luksUUID "${d}")" -+ if ! clevis luks unlock -d "${d}"; then -+ echo "Unable to unlock ${d} (UUID=${uuid})" >&2 -+ continue -+ fi -+ echo "Unlocked ${d} (UUID=${uuid}) successfully" >&2 -+ done -+ -+ [ "${loop}" != true ] && break -+ # Checking for pending devices to be unlocked. -+ if remaining=$(to_unlock) && [ -z "${remaining}" ]; then -+ break; -+ fi -+ -+ sleep 0.5 -+done -diff --git a/src/luks/systemd/dracut/clevis/meson.build b/src/dracut/clevis/meson.build -similarity index 87% -rename from src/luks/systemd/dracut/clevis/meson.build -rename to src/dracut/clevis/meson.build -index 167e708..224e27f 100644 ---- a/src/luks/systemd/dracut/clevis/meson.build -+++ b/src/dracut/clevis/meson.build -@@ -16,6 +16,7 @@ if dracut.found() - install_dir: dracutdir, - configuration: data, - ) -+ install_data('clevis-luks-generic-unlocker', install_dir: libexecdir) - else - warning('Will not install dracut module due to missing dependencies!') - endif -diff --git a/src/luks/systemd/dracut/clevis/module-setup.sh.in b/src/dracut/clevis/module-setup.sh.in -similarity index 76% -rename from src/luks/systemd/dracut/clevis/module-setup.sh.in -rename to src/dracut/clevis/module-setup.sh.in -index bfe657c..dbce790 100755 ---- a/src/luks/systemd/dracut/clevis/module-setup.sh.in -+++ b/src/dracut/clevis/module-setup.sh.in -@@ -19,7 +19,11 @@ - # - - depends() { -- echo crypt systemd -+ local __depends=crypt -+ if dracut_module_included "systemd"; then -+ __depends=$(printf '%s systemd' "${_depends}") -+ fi -+ echo "${__depends}" - return 255 - } - -@@ -27,17 +31,24 @@ install() { - if dracut_module_included "systemd"; then - inst_multiple \ - $systemdsystemunitdir/clevis-luks-askpass.service \ -- $systemdsystemunitdir/clevis-luks-askpass.path -+ $systemdsystemunitdir/clevis-luks-askpass.path \ -+ @SYSTEMD_REPLY_PASS@ \ -+ @libexecdir@/clevis-luks-askpass - systemctl -q --root "$initdir" add-wants cryptsetup.target clevis-luks-askpass.path - else - inst_hook initqueue/online 60 "$moddir/clevis-hook.sh" - inst_hook initqueue/settled 60 "$moddir/clevis-hook.sh" -+ -+ inst_multiple \ -+ @libexecdir@/clevis-luks-generic-unlocker \ -+ clevis-luks-unlock \ -+ lsblk \ -+ sort \ -+ awk - fi - - inst_multiple \ - /etc/services \ -- @SYSTEMD_REPLY_PASS@ \ -- @libexecdir@/clevis-luks-askpass \ - clevis-luks-common-functions \ - grep sed cut \ - clevis-decrypt \ -diff --git a/src/luks/systemd/dracut/meson.build b/src/dracut/meson.build -similarity index 78% -rename from src/luks/systemd/dracut/meson.build -rename to src/dracut/meson.build -index 7ad5b14..fdb264b 100644 ---- a/src/luks/systemd/dracut/meson.build -+++ b/src/dracut/meson.build -@@ -2,4 +2,3 @@ subdir('clevis') - subdir('clevis-pin-tang') - subdir('clevis-pin-tpm2') - subdir('clevis-pin-sss') --subdir('clevis-pin-null') -diff --git a/src/luks/systemd/dracut/clevis/clevis-hook.sh.in b/src/luks/systemd/dracut/clevis/clevis-hook.sh.in -deleted file mode 100755 -index cb257c9..0000000 ---- a/src/luks/systemd/dracut/clevis/clevis-hook.sh.in -+++ /dev/null -@@ -1,2 +0,0 @@ --#!/bin/bash --@libexecdir@/clevis-luks-askpass -diff --git a/src/luks/systemd/meson.build b/src/luks/systemd/meson.build -index e3b3d91..b10494e 100644 ---- a/src/luks/systemd/meson.build -+++ b/src/luks/systemd/meson.build -@@ -10,7 +10,6 @@ sd_reply_pass = find_program( - - if systemd.found() and sd_reply_pass.found() - data.set('SYSTEMD_REPLY_PASS', sd_reply_pass.path()) -- subdir('dracut') - - unitdir = systemd.get_pkgconfig_variable('systemdsystemunitdir') - -diff --git a/src/meson.build b/src/meson.build -index c4e696f..a0dff5b 100644 ---- a/src/meson.build -+++ b/src/meson.build -@@ -1,6 +1,7 @@ - subdir('bash') - subdir('luks') - subdir('pins') -+subdir('dracut') - subdir('initramfs-tools') - - bins += join_paths(meson.current_source_dir(), 'clevis-decrypt') diff --git a/app-crypt/clevis/files/clevis-meson.patch b/app-crypt/clevis/files/clevis-meson.patch deleted file mode 100644 index bfd517d3e1..0000000000 --- a/app-crypt/clevis/files/clevis-meson.patch +++ /dev/null @@ -1,11 +0,0 @@ -diff --git a/src/luks/systemd/meson.build b/src/luks/systemd/meson.build -index b10494e3ca4d620437aee0d5e440eecf323b03d9..09f7fb51e7320aa71e275c34baa0561233821d69 100644 ---- a/src/luks/systemd/meson.build -+++ b/src/luks/systemd/meson.build -@@ -5,6 +5,7 @@ sd_reply_pass = find_program( - join_paths(get_option('prefix'), 'lib', 'systemd', 'systemd-reply-password'), - join_paths('/', 'usr', get_option('libdir'), 'systemd', 'systemd-reply-password'), - join_paths('/', 'usr', 'lib', 'systemd', 'systemd-reply-password'), -+ join_paths('/', 'lib', 'systemd', 'systemd-reply-password'), - required: false - ) diff --git a/app-crypt/clevis/metadata.xml b/app-crypt/clevis/metadata.xml index 49edd02196..9acfab6472 100644 --- a/app-crypt/clevis/metadata.xml +++ b/app-crypt/clevis/metadata.xml @@ -14,7 +14,6 @@ Install dracut modules - Enable LUKS support Enable PKCS#11 smartcard support Enable support for Trusted Platform Module (TPM) 2.0 Enable support for Trusted Platform Module (TPM) 1.2 diff --git a/profiles/package.mask b/profiles/package.mask index e3b1127ba6..2a23dd7ceb 100644 --- a/profiles/package.mask +++ b/profiles/package.mask @@ -106,12 +106,6 @@ app-admin/run0edit # sys-libs/libucontext is masked in ::gentoo sys-libs/gcompat -# Julien Roy (2024-03-09) -# Dracut fails to boot with Clevis 20 -# https://github.com/latchset/clevis/issues/456 -~app-crypt/clevis-20 -~app-crypt/clevis-21 - # Viorel Munteanu (2023-06-07) # Does not work on no-multilib profiles and cannot be masked per profile # (See also top comment)