feat(installer): implement deferred disk encryption trigger#1670
Merged
brianmcgillion merged 2 commits intotiiuae:mainfrom Jan 8, 2026
Merged
feat(installer): implement deferred disk encryption trigger#1670brianmcgillion merged 2 commits intotiiuae:mainfrom
brianmcgillion merged 2 commits intotiiuae:mainfrom
Conversation
Enable deferred LUKS encryption that applies on first boot rather than at build time. Images are now built with plain LVM, reducing size from 20GB to 7GB (compressed). Encryption is applied when user sets password on first boot, with automatic TPM2/FIDO2 enrollment. Co-authored-by: Brian McGillion <bmg.avoin@gmail.com> Co-authored-by: Vunny Sodhi <vunny.sodhi@unikie.com> Signed-off-by: Brian McGillion <bmg.avoin@gmail.com> Signed-off-by: Vunny Sodhi <vunny.sodhi@unikie.com>
Collaborator
Author
|
Eval tests are passing locally [Ghaf devshell]$ python3 .github/eval.py 0 10
[+] Evaluating flake outputs (job 0/10)
[+] Starting nix-eval-jobs...
warning: unknown setting 'allowed-users'
warning: unknown setting 'trusted-users'
[ 2.8s] ✓ devShells.aarch64-linux.default
[ 3.3s] ✓ packages.aarch64-linux.audit-rules
[ 3.3s] ✓ packages.aarch64-linux.ghaf-vms
[ 12.5s] ✓ packages.aarch64-linux.nvidia-jetson-orin-agx-release
[ 17.0s] ✓ packages.aarch64-linux.nxp-imx8mp-evk-debug
[ 40.8s] ✓ packages.x86_64-linux.alienware-m18-R2-release
[ 74.2s] ✓ packages.x86_64-linux.dell-latitude-7330-release-installer
[ 82.5s] ✓ packages.x86_64-linux.generic-x86_64-release
[ 87.2s] ✓ packages.x86_64-linux.laptop-hw-scan
[ 112.5s] ✓ packages.x86_64-linux.lenovo-x1-carbon-gen10-release-installer
[ 140.3s] ✓ packages.x86_64-linux.lenovo-x1-carbon-gen13-debug-installer
[ 169.2s] ✓ packages.x86_64-linux.lenovo-x1-gen11-hardening-release-installer
[ 172.8s] ✓ packages.x86_64-linux.nvidia-jetson-orin-agx-industrial-debug-from-x86_64-flash-qspi
[ 180.9s] ✓ packages.x86_64-linux.nvidia-jetson-orin-agx-industrial-release-nodemoapps-from-x86_64-flash-script
[ 189.3s] ✓ packages.x86_64-linux.nvidia-jetson-orin-agx64-debug-nodemoapps-from-x86_64
[ 192.7s] ✓ packages.x86_64-linux.nvidia-jetson-orin-nx-debug-from-x86_64-flash-qspi
[ 201.0s] ✓ packages.x86_64-linux.nvidia-jetson-orin-nx-release-nodemoapps-from-x86_64-flash-script
[ 228.2s] ✓ packages.x86_64-linux.system76-darp11-b-storeDisk-debug-installer
[ 230.1s] ✓ packages.x86_64-linux.windows-launcher
============================================================
Evaluated 19 attributes in 230.2s
✓ 19 succeeded
✗ 0 failed
|
This commit introduces an opt-in deferred disk encryption mechanism for the installer. The `ghaf-installer.sh` script now includes `-e` flag, when used, sets up the system for deferred encryption. It does this by creating `.ghaf-installer-encrypt` marker file on the ESP partition after the image is written to the disk. The `deferred-disk-encryption.nix` module is updated to check for this marker on boot. The encryption process will only proceed if the marker is found, preventing encryption on non-installer boots. Upon completion or failure of the encryption process, the marker is removed to prevent the process from running again on subsequent reboots. Signed-off-by: Vunny Sodhi <vunny.sodhi@unikie.com>
19 tasks
brianmcgillion
approved these changes
Jan 8, 2026
Collaborator
|
tested both encrypted and not encrypted installs work. |
19 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of Changes
This commit introduces an opt-in deferred disk encryption mechanism for the installer.
The
ghaf-installer.shscript now includes-eflag, when used, sets up the system for deferred encryption. It does this by creating.ghaf-installer-encryptmarker file on the ESP partition after the image is written to the disk.The
deferred-disk-encryption.nixmodule is updated to check for this marker on boot. The encryption process will onlyproceed if the marker is found, preventing encryption on non-installer boots. Upon completion or failure of the encryption process, the marker is removed to prevent the process from running again on subsequent reboots.
Type of Change
Related Issues / Tickets
Checklist
make-checksand it passesTesting Instructions
Applicable Targets
aarch64aarch64x86_64x86_64x86_64Installation Method
nixos-rebuild ... switchTest Steps To Verify:
-eoption.disk imageor omit the-eoption withghaf-installer.Please note: when using the
-eoption, the first boot time may vary significantly. For NVME, it may take less than 2mins, while for a 500GB USB SSD, it could take around 5-6 minutes to complete encryption.