Skip to content

Minor fix and Enable the disk encryption for 'mvp-user-trial' profile #1420

Merged
brianmcgillion merged 2 commits intomainfrom
vs-enableEnc
Sep 23, 2025
Merged

Minor fix and Enable the disk encryption for 'mvp-user-trial' profile #1420
brianmcgillion merged 2 commits intomainfrom
vs-enableEnc

Conversation

@vunnyso
Copy link
Copy Markdown
Collaborator

@vunnyso vunnyso commented Sep 22, 2025 •
edited
Loading

Description of Changes

  • Removed tpm_clear command from luks-enroll-tpm-unit-script as its of no use.
  • Resolve the blank display issue occurs during disk resizing.
    When running the extendpersist service, I encountered the following error:
    partResizeScript[1145]: This disk is currently in use - repartitioning is probably a bad idea.
    Therefore, we will revert to the previous method of resizing using postBootCommands. more details in PR#1232
  • Enable the disk encryption for mvp-user-trial profile
    Now persist partitioning will be LUKS encrypted.

Type of Change

  • New Feature
  • Bug Fix
  • Improvement / Refactor

Related Issues / Tickets

Checklist

  • Clear summary in PR description
  • Detailed and meaningful commit message(s)
  • Commits are logically organized and squashed if appropriate
  • Contribution guidelines followed
  • Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
  • Author has run make-checks and it passes
  • All automatic GitHub Action checks pass - see actions
  • Author has added reviewers and removed PR draft status

Testing Instructions

Applicable Targets

  • Orin AGX aarch64
  • Orin NX aarch64
  • Lenovo X1 x86_64
  • Dell Latitude x86_64
  • System 76 x86_64

Installation Method

  • Requires full re-installation
  • Can be updated with nixos-rebuild ... switch
  • Other:

Test Steps To Verify:

  1. There will be change in file system type for persist partitioning,
    sda3 which is /swap will not be randomly encypted. It will use LUKS encryption
    sda5 which is /persist now will be changed to crypt file system.
Branch File system snapshot
mainline image
This PR image

  1. Monitor logs luks-enroll-tpm service, make sure it don't have any errors

    [ghaf@ghaf-host:~]$ journalctl -efu luks-enroll-tpm

  2. There will no change in debug builds startup sequence.

  3. There will be change in release builds startup sequence.
    a. On first boot user will be prompted to Please enter TPM2 PIN: need to enter any PIN two times to set it and then password.
    b. On subsequent boots, everytime need to enter TPM2 PIN and then password.

  4. Make sure it doesn't break any Automation use cases or any CI/CD builds.

@vunnyso vunnyso changed the title Minor fix and Enable the disk encryption for 'mvp-user-trial` profile Minor fix and Enable the disk encryption for 'mvp-user-trial' profile Sep 22, 2025
kajusnau
kajusnau reviewed Sep 22, 2025
View reviewed changes
kajusnau
kajusnau reviewed Sep 22, 2025
View reviewed changes
@vunnyso
Resolve the blank display issue occurs during disk resizing.
312510f 
When running the 'extendpersist' service, I encountered the
following error: "This disk is currently in use -
repartitioning is probably a bad idea."

Therefore, we will revert to the previous method
of resizing using postBootCommands.

Signed-off-by: Vunny Sodhi <vunny.sodhi@unikie.com>
@vunnyso
Copy link
Copy Markdown
Collaborator Author

vunnyso commented Sep 22, 2025

@hros-tii please review.

@vunnyso
Enable the disk encryption for mvp-user-trial profile
0d06126 
Now persist partitioning will be LUKS encrypted.

Signed-off-by: Vunny Sodhi <vunny.sodhi@unikie.com>
@hros-tii
Copy link
Copy Markdown
Contributor

hros-tii commented Sep 22, 2025

Looks good!

@vunnyso vunnyso added the Needs Testing CI Team to pre-verify label Sep 22, 2025
@brianmcgillion
Copy link
Copy Markdown
Collaborator

brianmcgillion commented Sep 22, 2025

@milva-unikie @leivos-unikie how will this affect the automated testing setups?

@leivos-unikie
Copy link
Copy Markdown
Contributor

leivos-unikie commented Sep 22, 2025

@milva-unikie @leivos-unikie how will this affect the automated testing setups?

If that disk encryption is enabled only in release image then I think it won't affect test automation. In release image ssh connection is disabled, so we can not automatically test that anyways.

@vunnyso
Copy link
Copy Markdown
Collaborator Author

vunnyso commented Sep 22, 2025

@milva-unikie @leivos-unikie how will this affect the automated testing setups?

If that disk encryption is enabled only in release image then I think it won't affect test automation. In release image ssh connection is disabled, so we can not automatically test that anyways.

Thanks @leivos-unikie for the confirmation. To clarify, disk encryption will be enabled also in debug builds, but there won't be any prompt asking for a TPM PIN as per check here

The startup sequence for debug builds will remain unchanged.

@milva-unikie
Copy link
Copy Markdown

milva-unikie commented Sep 23, 2025

Tested on Darter Pro (debug and release, new images)

  • Both images boot succesfully
  • The release image asks to create a PIN code on first boot and requires that PIN on every boot after
  • No changes in the boot of the debug image
  • Test-automation results look good

Also quickly checked that the lenovo-x1-carbon-gen11-debug-installer works without issues. It is included in our automated nightly tests, but not in the tests we run for every PR.

@milva-unikie milva-unikie added Tested on Lenovo X1 Carbon This PR has been tested on Lenovo X1 Carbon Tested on System76 and removed Needs Testing CI Team to pre-verify labels Sep 23, 2025
@brianmcgillion brianmcgillion merged commit 8f16cca into main Sep 23, 2025
28 checks passed
@brianmcgillion brianmcgillion deleted the vs-enableEnc branch September 23, 2025 05:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kajusnau kajusnau kajusnau approved these changes

@brianmcgillion brianmcgillion Awaiting requested review from brianmcgillion

+1 more reviewer

@hros-tii hros-tii hros-tii left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

Tested on Lenovo X1 Carbon This PR has been tested on Lenovo X1 Carbon Tested on System76

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@vunnyso @hros-tii @brianmcgillion @leivos-unikie @milva-unikie @kajusnau