Background

siderolabs/go-cmd#9 fixes a bug where RunContext allocated the stdout circbuf with MaxStderrLen (4096 bytes). Any subprocess writing more than 4 KiB to stdout had its output silently truncated — no error was returned to the caller.

Impact on go-blockdevice

LUKS.ReadToken calls cryptsetup token export --json-file=-, which writes the token JSON to stdout. Tokens whose JSON exceeds 4096 bytes are silently truncated, causing token.Decode to fail with a JSON parse error:

invalid character 'e' looking for beginning of value

This makes disk unsealing fail permanently on every reboot for affected devices.

Action required

Once go-cmd PR #9 is merged and a new version tagged, bump the dependency:

go get github.com/siderolabs/go-cmd@<new-version>
go mod tidy

No code changes are needed in go-blockdevice itself.