From patchwork Tue Oct 27 11:05:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "srinuvasan.a" X-Patchwork-Id: 5571 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Tue, 27 Oct 2026 12:05:29 +0100 X-Sieve: CMU Sieve 2.4 Received: from mail-oa1-f59.google.com (mail-oa1-f59.google.com [209.85.160.59]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 69RB5SdS018136 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 27 Oct 2026 12:05:29 +0100 Received: by mail-oa1-f59.google.com with SMTP id 586e51a60fabf-4a7da05b026sf5692642fac.3 for ; Tue, 27 Oct 2026 04:05:29 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1793099122; cv=pass; d=google.com; s=arc-20260327; b=OY/PrbHt22agYtv7AXe/BPTND2DCgR7aYr1FdjKDRH+Im7frttZyM4O1lTL3Ash5ot iwa8pCSj308xzuKwLoo7uFoesq4oIAvYBmcEagQK9w4W3gxWL2qCgze8cwPt4QYrtCOB q+DzI4tYPhBpJ89CsCAjVXdUpc51yCHiawTyyGWvBpMd1zQMOoiDb8MQe3TAaFb0ECvq fyTRUjhGsPh2paBrl/NDLGZN0h/kjilSm/MfxPB/hLYG/hhldYoudF1XfCNsICZMwfEc H5dq9UImychilZd8RKO57+5VKbKSVskE27yu226NmFBF5+WRYhLO2xUHrJbmkJsij/AY xRlw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:feedback-id:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=T9x9lrouRpkGa9nerEBndypQ1YPBqzmOpCCaiawqof8=; fh=01tH4MNF2+m65zBdo3AD3Y5tgF08RYWeLrMdVKxnGmQ=; b=gf/tvzvZT50g7OAAQ2fPMJOTJY9SK0WBDY8/JYQffm2FxdiLShhfk6FW/SWCZRz200 eFiyAqG0y0FH80ZhSGwRdxQdrQ3xSlJxSUw41BTnQvDmcQ7JHLOv8YfeKh27R1IdAMkM l34t84NjU5NpBP0p3LTbHXGxsnDv+oQ9P5UF0C9MYKKSJsIWD6gNZI3vGtAQrQCINxc+ tB/p878nDZzYozwy1WsEgZM3Iy1sO+zVjvhKDlyXeevIlkrDCvbqrsf17DMtxygA+o7J FJhBexXldRf6d3rtNUjqd94l9tJvyb6q2HU21enPBkrRYihljVPa95iVz6ydLR3RfAaf 3rhw==; darn=isar-build.org ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=S2rH8HIX; spf=pass (google.com: domain of fm-1324425-20261027110516e70ce50acb00020787-duq3kh@rts-flowmailer.siemens.com designates 185.136.64.226 as permitted sender) smtp.mailfrom=fm-1324425-20261027110516e70ce50acb00020787-duq3KH@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1793099122; x=1793703922; darn=isar-build.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:content-type:reply-to :x-original-authentication-results:x-original-sender:feedback-id :mime-version:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=T9x9lrouRpkGa9nerEBndypQ1YPBqzmOpCCaiawqof8=; b=YVM0F3lmpiNGCXTduwg9NO0canzxEZKU28Vp28P5C6gVzpEATzv8gBrE3bD4c94Y+z fvSqLJyn6v9DKQC02asixb9Ki0U9P12zxbPjTTpeGlqaQJFpUA1Ll+KcVnAKyiiZzb1+ ZNMXldnBlc9qqhzOgQBMr6BVVpZlvFapXeOT7iReNKjDthvhJs7kC0EcMqCbnjiQcOTV jrEmmKCk3y9DNAIczNsabM1X7ZoztSt+/aVvuHBz3HnZJ1lgPxuw5ir3DXKBIQN0LkQb X2hPsQC/ysiUC6rzbC58dn2I0QE5b5FS9dWJPtmdplPDeoAOoxF0thoIr0QlHMIltJ5v hKPw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793099122; x=1793703922; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :content-type:reply-to:x-original-authentication-results :x-original-sender:feedback-id:mime-version:message-id:date:subject :cc:to:from:x-beenthere:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=T9x9lrouRpkGa9nerEBndypQ1YPBqzmOpCCaiawqof8=; b=fycgPQvJrl4lbk8FbKEnLXO7pFSXI6FsPlPd/kw8+Bs6gDeRm6bmUQtewgq3x8FFwp TURAgrp322coiHl3vO8GZRECF6q6idMPTwP5DfsRLrppwwu0L9fNFq8fttTNQcb8VrPo jyu1iRWAqfHOJNZqJeAibpsp/Okky1vGXzQc7i7xFHT05xqvQZFby5nEDCVDcLx7IufI A27XxnAOQpa+d8XGaeaKKN2GK9Pphztkz5Ol/1fS25clO9gnFQbAUw2uKJUe5+nHxdXc J7JF9k0aQnCBSpmqaK4dJcRxfNIV+ziiaC9eLomaqzvtv+pDXNgbQMHrxygpnWp7Heu/ Fsuw== X-Forwarded-Encrypted: i=2; AKwUvBzAMl8K/woaNWXh+C+twfqZ7Szrm50GKnESDE/BKzeP/rd07rCaViB2UqfDiEXtJZz/pgKjPiM=@isar-build.org X-Gm-Message-State: AFq9FYIS1vZ0JQRLTA9INV5CzDAzDMgaXZvFzUvW9tLgImVNmkbEAXKC sVtXmZEPZoMistnNkHHNCGoG0j5iHQjtwvcPBWio/vsdvibhtjuhnW9W X-Received: by 2002:a05:6870:224e:b0:490:eeb8:d660 with SMTP id 586e51a60fabf-4a83f68dfa7mr5934883fac.60.1793099122635; Tue, 27 Oct 2026 04:05:22 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLdecPQeL7FPCv0OdB1kK4QbIucvk1fWsCcuzue0na0O/aw==" Received: by 2002:a05:6871:85c6:20b0:49d:ccbd:1d56 with SMTP id 586e51a60fabf-4a81c2da851ls1049619fac.0.-pod-prod-02-us; Tue, 27 Oct 2026 04:05:21 -0700 (PDT) X-Received: by 2002:a05:6808:1b29:b0:4ef:2584:78a3 with SMTP id 5614622812f47-55c0035bd02mr6255164b6e.52.1793099121635; Tue, 27 Oct 2026 04:05:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793099121; cv=none; d=google.com; s=arc-20260327; b=Y7cCZe4iv6eBG40OGyORWxy/o8dXfT6hf0BQW4lxruf/rSofiqiBuRAZvdISRHWR34 JOOUiKLToC5RSyhlf+1wNM2aiVcnRoKYqLy7yxiVxFv7y2JQCwR3rAoySqaUOXaQgLTP eBNSiC8kc6ftBxB/t8tMRL2eNceTAlix9IvUHFcKIIGjnVs7FwXAJ5x7+jDW9adpSYg5 2NdMyiMp5iJ/AYVx9PjJQXNsh6bn8fG7rNLkBnzsLSKT21PYbn8BH8QyoNaDJb0fJCTu 9/Yo5v2MXjQ8yc6xiLWHDN3XNzxAbXVi0TAv1CO2J9YTdDe00SL+mcEr+HTpBrqrvGAf dN2Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=feedback-id:content-transfer-encoding:mime-version:message-id:date :subject:cc:to:from:dkim-signature; bh=zW+RVHrqlXKpmBTDml5y+giieiMomvZjdMaatUK0Fkg=; fh=tvAPq9iZXqfOCU2RVyiQk4g/Ek6hey6YRn53GL/HPQw=; b=Kb3n8htLiw9uLmb0s/Uv7bbDkowYMlzVarJaHKsyA4MyKgieIkrk4b5qL47/ElYmR/ QHxb5H00agk7/3p0cFjw0KCSHxTGeelVIoSAFESotN2m2v2h+y1+6WDavLLRHfRPCBAU WWb8CFUIWL7JfOBXWBWHyvURtTN3zsH61BVlLwUI6K3bA59VMa34NxM1Kj+6QxlYlfnI 5OfBG/72bhVmWgMjwIRBXgnB2/EnGjs03yAAxbPQpbvW0woCWLDFY5+MyBTr+1140Rr5 nTlTVQUhRHkT2+hoZrr3EvW8SKu0qPwQl0n7D66gEJi9XuZLO6Yueh9CsAwaPMqG2FRO R05Q==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=S2rH8HIX; spf=pass (google.com: domain of fm-1324425-20261027110516e70ce50acb00020787-duq3kh@rts-flowmailer.siemens.com designates 185.136.64.226 as permitted sender) smtp.mailfrom=fm-1324425-20261027110516e70ce50acb00020787-duq3KH@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from mta-64-226.siemens.flowmailer.net (mta-64-226.siemens.flowmailer.net. [185.136.64.226]) by gmr-mx.google.com with ESMTPS id 5614622812f47-55e00d8033bsi106401b6e.3.2026.10.27.04.05.20 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 27 Oct 2026 04:05:21 -0700 (PDT) Received-SPF: pass (google.com: domain of fm-1324425-20261027110516e70ce50acb00020787-duq3kh@rts-flowmailer.siemens.com designates 185.136.64.226 as permitted sender) client-ip=185.136.64.226; Received: by mta-64-226.siemens.flowmailer.net with ESMTPSA id 20261027110516e70ce50acb00020787 for ; Tue, 27 Oct 2026 12:05:16 +0100 X-Patchwork-Original-From: "srinuvasan.a via isar-users" From: "srinuvasan.a" To: isar-users@googlegroups.com Cc: cedric.hombourger@siemens.com, Srinuvasan A , Shivaschandra K L Subject: [PATCH 1/3] installer: add reusable progress gauge Date: Tue, 27 Oct 2026 16:35:59 +0530 Message-Id: <20261027110601.1197504-1-srinuvasan.a@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-1324425:519-21489:flowmailer X-Original-Sender: srinuvasan.a@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=S2rH8HIX; spf=pass (google.com: domain of fm-1324425-20261027110516e70ce50acb00020787-duq3kh@rts-flowmailer.siemens.com designates 185.136.64.226 as permitted sender) smtp.mailfrom=fm-1324425-20261027110516e70ce50acb00020787-duq3KH@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: srinuvasan.a@siemens.com Reply-To: srinuvasan.a@siemens.com Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= From: Srinuvasan A Add an independent percentage consumer for operations reporting progress. Drain progress if dialog exits early, preserving producer execution. Keep existing image-copy and RAID progress handling unchanged. Signed-off-by: Shivaschandra K L Signed-off-by: Srinuvasan A Suggested-by: Cedric Hombourger --- .../files/usr/bin/installer_ui.sh | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/meta-isar/recipes-installer/deploy-image/files/usr/bin/installer_ui.sh b/meta-isar/recipes-installer/deploy-image/files/usr/bin/installer_ui.sh index 133d7c70..aa906221 100644 --- a/meta-isar/recipes-installer/deploy-image/files/usr/bin/installer_ui.sh +++ b/meta-isar/recipes-installer/deploy-image/files/usr/bin/installer_ui.sh @@ -185,6 +185,30 @@ ui_start_progress_gauge() { UI_GAUGE_PID=$! } +#-------------------------------------------------------------------------- +# ui_progress_gauge +# +# Reads integer percentages (0-100), one per line, from stdin. +# No dialog is opened until the first percentage arrives. +# If dialog exits early, drain the remaining input so the operation is +# not interrupted by SIGPIPE. Callers must check the producer's status +# using PIPESTATUS[0]; a completed gauge does not imply operation success. +# Returns dialog's status after all progress input has been consumed. +#-------------------------------------------------------------------------- +ui_progress_gauge() { + local message="$1" + local status=0 + local percent + + IFS= read -r percent || return 0 + dialog --gauge "$message" 10 70 "$percent" || status=$? + if [ "$status" -ne 0 ]; then + echo "Warning: progress dialog failed; waiting for the operation to finish." >&2 + fi + cat >/dev/null + return "$status" +} + #-------------------------------------------------------------------------- # ui_stop_progress_gauge # From patchwork Tue Oct 27 11:06:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "srinuvasan.a" X-Patchwork-Id: 5572 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Tue, 27 Oct 2026 12:05:37 +0100 X-Sieve: CMU Sieve 2.4 Received: from mail-pj1-f58.google.com (mail-pj1-f58.google.com [209.85.216.58]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 69RB5Wv4018147 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 27 Oct 2026 12:05:32 +0100 Received: by mail-pj1-f58.google.com with SMTP id 98e67ed59e1d1-3adc5b185bfsf4352553a91.3 for ; Tue, 27 Oct 2026 04:05:32 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1793099126; cv=pass; d=google.com; s=arc-20260327; b=dxtPMAsbry4H1l3Jdv9FEoBEAmtc6lZMsMxvmDhK9GIT86/SYM13LBFW/VjBn6RVh4 dauEnHphijARCGizmy3B0yT90nqPwvnDHIhe/htk3cxSdFoTO9lOgE3VPFN47uT0tMmB 9xECvNsXxvg5GINCt9A+EKfM+UHY3rD4DmyyeLfkuvWQq3VHu1sWaq8+EIoj/Sl0z8bS q5dYoCY3R/KdlNr6eq8Gu5hHoPUOyJdsUTwvUWd5j99wNx9lfvjSk+uu2ghbyZEKubGU rsEHQa+YAjuPCUS9BEYGvbMN/LIoPSHQ750DSIlPHqVDrIFPvOvPceMyd8+i5Rygg4oQ q1pg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:feedback-id:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=eToCYYXcNeBGRe6FyGSnHorpXIbenDUC4dSuYfc6UoY=; fh=MMkPyMMdHOgzyXohkBY6PLJ8NMhIj6c2bKm4olkmkOw=; b=eij2IOdbTnX2dJ/+FnKS8fpzI0bkH/uhgEBJDSnK40VMNWxmfvh7wrOvOi3QsB4Etl BUfbKQgh5yBO7jb1C/4VkaX4R7kfgF573yKBXD9UM7XNT0YovEcyCQgcKTbH+A/7xiBo WJLiCkYYghiDT6sG6ACLfjS3v7zrcU4egRmlUoUZwjXF3lL5Uo2iANWNaRvR417Ez2D2 Nydk5oCz5Kp6akcUu9ARIHk6zbTv6k1HAAgYFW93T3lLnNPno8emZsFsxFbg+YQcV7GB 7dYPdPKt9dhbbos/C+OFY+IV0lzyOXGcFiR3KRAB0wUKvcMaV2GZKX8UX8yPCfw88Euh KV1A==; darn=isar-build.org ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=a+JgHftm; spf=pass (google.com: domain of fm-1324425-20261027110520a964184890000207fd-ivmlgx@rts-flowmailer.siemens.com designates 185.136.65.228 as permitted sender) smtp.mailfrom=fm-1324425-20261027110520a964184890000207fd-IVmlGX@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1793099126; x=1793703926; darn=isar-build.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:content-type:reply-to :x-original-authentication-results:x-original-sender:feedback-id :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=eToCYYXcNeBGRe6FyGSnHorpXIbenDUC4dSuYfc6UoY=; b=Sf5fKcXZJg+7XCQ0Jm1s01eR9g+FiAtZvpCUWb6j12sdA+pBztcplmvpn7L/rrGur1 SEmhBcCb2Yv7jiFikFtrF8hidHpm+C7mlp8dfV3czw3vZQLCDmc4TfEOwilNpUbI20nv RJ1zl0Vi74fOVHFAXdn6KaUZ23/iOrvRiaPLBVVl+1TrxwdhhM2qWPprtCKnInLRZQMY KFAl5BgtZS1+aZpk3RMjdZFR4ba5ayt6rtal/RktnsMsjc0vcgzCchbsG1wTBQRBwi6b mk0n2pW6Ki/43PG70ixOr/cgBFRZRSRvIrGd4JZoK6EAAhkM2R77RZG17CJRR/s2U9uz K3cw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793099126; x=1793703926; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :content-type:reply-to:x-original-authentication-results :x-original-sender:feedback-id:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-beenthere:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to:content-type; bh=eToCYYXcNeBGRe6FyGSnHorpXIbenDUC4dSuYfc6UoY=; b=KezdtCzRLslpFj1Ub0lz2S70VxH7wU0uZsPMLa7sS3pW88TuSUktiBsUSkF+NEtnpn 4hn2CaGczYAHL29EevlhufrgPHK6t+UVhfg/r4mHVGXkFJ1j78eRxgH0N+ZNZ52bi/SW Ke8TbWotPpOlQU1G/5Fu+vaiUMpo//IKyJsfB+aO1z/X/MjF1lUx+W9VWkLCEfQyOO6x o2FFfvs6ab+grQmiRUcz4fQj7d94HMUrNeR5a/8CkOWerJGf76FanidGsRQ7PAIEvdBe GSB00ZSlt+9tZmNMobQ3DGF/KS7l8N61PoBHqxp21A5mjhRHx891S5X0q16w5dLyTIRK C6Xg== X-Forwarded-Encrypted: i=2; AKwUvByZaGZK93qyqfEt7ecOW06JK4+OW+z8up+GghRSJ+s+dCOeXQ8HLgsPjGjbLoReSJeERTnq8a4=@isar-build.org X-Gm-Message-State: AFq9FYJ6Wr0Gc+Ulz5c6IfFM6ikM90ldcepNkpqsQ6W1RIaXkOzBXSnh v+c/JCcWkeEKC2DXm5MTscwyrnC+AtoNR6kydY+DT/YUTwo6Iu4YucyE X-Received: by 2002:a17:90b:1d50:b0:3a7:ab31:2f4f with SMTP id 98e67ed59e1d1-3adeae9bdedmr7711321a91.28.1793099126211; Tue, 27 Oct 2026 04:05:26 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLdcHSwvablzlzTUbpNPzVCWHEJdwfAaC9co7Zopp5F9J3g==" Received: by 2002:a17:90b:1c85:b0:3a7:cdf9:8fdf with SMTP id 98e67ed59e1d1-3adc9e0225els6458411a91.2.-pod-prod-06-us; Tue, 27 Oct 2026 04:05:25 -0700 (PDT) X-Received: by 2002:a17:90b:5644:b0:3ab:d45c:59da with SMTP id 98e67ed59e1d1-3adeafd21a8mr7897787a91.40.1793099125180; Tue, 27 Oct 2026 04:05:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793099125; cv=none; d=google.com; s=arc-20260327; b=mpj8mf9DyQlsl4LT6c+R9krN5khA33WjRoxpY48ApdxI6dy5bD1YZhl1JgGO2Fm1qY 3F+oH+VslBKoSLTNQorGMnnE8gDgFnlSpiejO1KTVl/tDRagYpFlznGi0RrVlKHAY39p 23kCY6NFH0F6ASWqarcQoVDSZPVVDla3M1OxkUvYCmjZ9hE8Bne7hAL+d24YvMdfXTul TaORb/9nHBJvYYf+7E3JSQiGBAwyF4FQriU4rGWIY+tF1W+zctSRFEIlZ2WzKu2UmHU5 fP2Ib1sgTyZELy9sbrWFqtC7pba/R19YMOPIGPy9rYIDkUmt6i3io6iN+3i2yjL2TStp dZwg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=feedback-id:content-transfer-encoding:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature; bh=DybsDwjiYLhQzieMmBbAzQQASk6nZvrBQnhT4RuxU8c=; fh=VulK/l3XeLoc9JOOMl9NSLlfbMahF+GjHF6HwceMpeQ=; b=Kr/fYq3loUO4fUBDUFmNaC79uH7R54NF/OmHu2QSqoXAE/krtehDatCV4ZTw3sS8+a DM9cIHQ+XnBjAUgiclauZQ/0kz90YIAlOj4yp3rL4uvBXfrk0YPGa2zKfLhsrCyX02IX efs16ARN2TnIQd3zskghoQHFBYj+NcqR/YDqkRug1xP2SCOYiX43J74E7rK2Uv7qM6T8 HnZPhYn4/dFtM/ftQ5AHTostct2pu4SJupsRX1+irzuXHEjudHLxYIxHzoKYttYGiclT oiQKJHcgfFG41mWkwjiTyOcpijnPIactMJsjLfYp1FL7LeC64yw6e9SfP6cZtaOzxXHl OUcg==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=a+JgHftm; spf=pass (google.com: domain of fm-1324425-20261027110520a964184890000207fd-ivmlgx@rts-flowmailer.siemens.com designates 185.136.65.228 as permitted sender) smtp.mailfrom=fm-1324425-20261027110520a964184890000207fd-IVmlGX@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from mta-65-228.siemens.flowmailer.net (mta-65-228.siemens.flowmailer.net. [185.136.65.228]) by gmr-mx.google.com with ESMTPS id 98e67ed59e1d1-3ae406af3ebsi42017a91.3.2026.10.27.04.05.24 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 27 Oct 2026 04:05:25 -0700 (PDT) Received-SPF: pass (google.com: domain of fm-1324425-20261027110520a964184890000207fd-ivmlgx@rts-flowmailer.siemens.com designates 185.136.65.228 as permitted sender) client-ip=185.136.65.228; Received: by mta-65-228.siemens.flowmailer.net with ESMTPSA id 20261027110520a964184890000207fd for ; Tue, 27 Oct 2026 12:05:21 +0100 X-Patchwork-Original-From: "srinuvasan.a via isar-users" From: "srinuvasan.a" To: isar-users@googlegroups.com Cc: cedric.hombourger@siemens.com, Srinuvasan A Subject: [PATCH 2/3] deploy-image: report the result of the console holding the lock Date: Tue, 27 Oct 2026 16:36:00 +0530 Message-Id: <20261027110601.1197504-2-srinuvasan.a@siemens.com> In-Reply-To: <20261027110601.1197504-1-srinuvasan.a@siemens.com> References: <20261027110601.1197504-1-srinuvasan.a@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-1324425:519-21489:flowmailer X-Original-Sender: srinuvasan.a@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=a+JgHftm; spf=pass (google.com: domain of fm-1324425-20261027110520a964184890000207fd-ivmlgx@rts-flowmailer.siemens.com designates 185.136.65.228 as permitted sender) smtp.mailfrom=fm-1324425-20261027110520a964184890000207fd-IVmlGX@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: srinuvasan.a@siemens.com Reply-To: srinuvasan.a@siemens.com Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= From: Srinuvasan A When several installer consoles run, only the one holding the installation lock copies the image. Consoles that do not get the lock waited for it to finish and then always reported success, even if the installation had failed. Wait for the lock holder with flock and let it record its outcome in /run/installer.result. Consoles that waited return success only if the holder succeeded. Signed-off-by: Srinuvasan A Suggested-by: Cedric Hombourger --- .../deploy-image/files/usr/bin/sys_api.sh | 27 +++++++++---------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/meta-isar/recipes-installer/deploy-image/files/usr/bin/sys_api.sh b/meta-isar/recipes-installer/deploy-image/files/usr/bin/sys_api.sh index 5f591745..26b39108 100644 --- a/meta-isar/recipes-installer/deploy-image/files/usr/bin/sys_api.sh +++ b/meta-isar/recipes-installer/deploy-image/files/usr/bin/sys_api.sh @@ -278,7 +278,9 @@ sys_bmap_options_for_image() { # # Performs the actual bmaptool copy, serializing concurrent installer # consoles via flock. When UI hook functions are available, this API -# uses them to present a progress gauge in attended mode. +# uses them to present a progress gauge in attended mode. Consoles that +# do not get the lock wait for its holder and report its result, which is +# kept in /run/installer.result. # # Optional UI hooks (if defined): # ui_start_progress_gauge @@ -289,6 +291,7 @@ sys_install_image_with_lock() { local target_device="$2" local lockfile="/run/installer.lock" local progress_pipe="/run/installer.fifo" + local result_file="/run/installer.result" local bmap_options local bmap_version local quiet_flag="" @@ -297,6 +300,7 @@ sys_install_image_with_lock() { exec 9>"$lockfile" if flock -n 9; then + rm -f "$result_file" bmap_version=$(bmaptool --version | awk '{ print $NF }') if sys_version_ge "$bmap_version" "3.6"; then @@ -323,27 +327,20 @@ sys_install_image_with_lock() { if declare -F ui_stop_progress_gauge >/dev/null; then ui_stop_progress_gauge fi + echo failed > "$result_file" return 1 fi if declare -F ui_stop_progress_gauge >/dev/null; then ui_stop_progress_gauge fi - else - echo "Installation already running in another console." - sleep 5 - if [ -e "$progress_pipe" ]; then - echo "Installation progress..." - tail -f "$progress_pipe" | while read -r line; do - printf "\r%s%%" "$line" - done - else - echo "Waiting for installation to finish..." - while pgrep -x "bmaptool" >/dev/null; do - sleep 5 - done - fi + echo ok > "$result_file" + else + echo "Installation already running in another console. Waiting for it to finish..." + flock 9 + # The other console owns the result; only report success if it did. + [ "$(cat "$result_file" 2>/dev/null)" = ok ] || return 1 fi return 0 From patchwork Tue Oct 27 11:06:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "srinuvasan.a" X-Patchwork-Id: 5573 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Tue, 27 Oct 2026 12:05:38 +0100 X-Sieve: CMU Sieve 2.4 Received: from mail-pj1-f55.google.com (mail-pj1-f55.google.com [209.85.216.55]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 69RB5agY018223 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 27 Oct 2026 12:05:37 +0100 Received: by mail-pj1-f55.google.com with SMTP id 98e67ed59e1d1-3adcb81f487sf6442994a91.3 for ; Tue, 27 Oct 2026 04:05:37 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1793099131; cv=pass; d=google.com; s=arc-20260327; b=AKbX6E8yks0/HMM7l1025P8JJnkjyicw2s/5c8QeWDH+rNC4i+PZTs4xec9N2VBc8t pJU+p16zArynClz+U56cohjj1e1lp2eb6ps48WAR/bGCnpOYfwpO1B8vopsfP2FogPoQ giunvBkE+qHZOs6BY8Fj9uh6R1oV3QudszruJzekmdPX0M8VFitXwDL23V6s1d5F2dLu /sn8VopnEeJQ4t/R1g4WLKxh+jo0UVhxbT1r0rM6e0kPrU0mBOkBND2W/lNYFG9B2UBC Ss4W7y4cqqAkOUwhWqkEx4ajOCgqQ8r84KMMNqFlhdIr72rpUWQIsR4iYqy//u4kIErk M1Vg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:feedback-id:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=y8rCDCB7AZFeYuBJIRAkL8/BE9mBZrzXyMdMwaLtnBg=; fh=4say46dYkotbJMkfMkuUMagtq63wZew4SHJbtCMFdk4=; b=FUpL2s+dQUaT5FZyVGpeHXDvBlVfhIB5j/7fgEx7EB5G/gZnF1F2I1PFansdQfVKpC IRw7pnDdqRrMr+qTN+oAwaKqaw3Eph5Wq+mQ2fSenOmLinc644KwZ/m03nIihOLxeKFw IqndoOVu4vDJrq5AEJp8VHRsM1kBQhvR5pWKVSkMa3wFSGoLSrjW6edMd6ufbu9P64Qv U4lRzDtvrL+3qQ905UWvkmzHCgRQEK22dgrpb/ZB0pLw9wZcc26NIP26A/8dL5qVMmE6 0Wh+wUgCBTe8ouEKF9ovKkBgg7sqSpwZG13hQOXDsLlqSPkiccdK6w5EPAlwlMCRayFi 6NvA==; darn=isar-build.org ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=BZitemSQ; spf=pass (google.com: domain of fm-1324425-202610271105245f263c63fd00020789-ts0myf@rts-flowmailer.siemens.com designates 185.136.65.226 as permitted sender) smtp.mailfrom=fm-1324425-202610271105245f263c63fd00020789-tS0MYF@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1793099131; x=1793703931; darn=isar-build.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:content-type:reply-to :x-original-authentication-results:x-original-sender:feedback-id :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=y8rCDCB7AZFeYuBJIRAkL8/BE9mBZrzXyMdMwaLtnBg=; b=kglZIpd5siZRCxwLyvvhS3JPwx85ePJr5MgDDAxvgQjjQAgWsuTBi1xRAsTg8YpMVf g6AA3LEnDErDE0hiNCywRMAbFepz+y7cz0D6AvRAMI/cD9zQRPg+ZLJ7Kho+eHB2N9Yz qglZWK6/uN+SHdA38pMbUzHr0jOC2CWrLLZgPLt3bUcWits0LAR0SHYalngx2rDhidc5 AMXpwORZ3lCV5TGlNrX3TmQJTxrvTPyWQhOGaeaNoqv8aSqsXRDQoQX2TJD0lan2RAYz D6sTcqdFNbne7gfoI37/AsH9DXDVK9w8B/5wsednMWIpbvSHwdt8PC+oeItKsi/zZ0R1 8amA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793099131; x=1793703931; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :content-type:reply-to:x-original-authentication-results :x-original-sender:feedback-id:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-beenthere:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to:content-type; bh=y8rCDCB7AZFeYuBJIRAkL8/BE9mBZrzXyMdMwaLtnBg=; b=hpQep4yS1hEzdnuCmFE9hsondLClDZoFAAkT/T8A2MeWKLNPz2toNc7I+2IushlrDU 6FfmfPoZCSdL/zjkOZRNb4RKhG1dbeMXPVLfoXW8MASKQDFQ/1smrK1Y0NqsNATyzae9 JN+arV0gePTYNT6Neb23CLbwTX9qDZwJvaD3q4V26xjEC5bCBQ7OzR67b9HjNT3qYp1M YA5uY2i1FrvxpjbGNKGvu+B/iTLZEdoiKqw8T/HpuTv6GpkJoBF2FnlCY7rqEVok+CEo qWuM44EGcehWTwOjenyFlrYx/tBTaRb+wMXuvtUd8Hqc5z1vlzIjMkZSY91kMF8nwZ9h rIXQ== X-Forwarded-Encrypted: i=2; AKwUvBw3uhYkrDm1CsIZw3DE+NG7rGSUTZcx7ZeLi4zuQMKfJ2m23xipamFImGupxkPsC91MGMFtgp4=@isar-build.org X-Gm-Message-State: AFq9FYLGTXxCIB8UUsZPGF3h6eDT1WLeSFog31vK5Wl15siI4qquy8wu gVB0ow7qN2z8TCZaWrjWr5dCewMZY5QbJ5Gi0KbvuRj52PbGeem5fY6j X-Received: by 2002:a17:90b:1647:b0:3ac:b145:8f4 with SMTP id 98e67ed59e1d1-3adeae9c56bmr8521652a91.41.1793099130572; Tue, 27 Oct 2026 04:05:30 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLddZLA/+6lzXTieZCx4Hfz2VOGC2Kn3fVtTQLk8JsAAiyw==" Received: by 2002:a17:90b:1c85:b0:3ad:6c5f:feaa with SMTP id 98e67ed59e1d1-3adc9922502ls5329601a91.0.-pod-prod-03-us; Tue, 27 Oct 2026 04:05:29 -0700 (PDT) X-Received: by 2002:a17:90b:1d47:b0:3ac:a203:e0a5 with SMTP id 98e67ed59e1d1-3adeac04a17mr8818579a91.11.1793099129579; Tue, 27 Oct 2026 04:05:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793099129; cv=none; d=google.com; s=arc-20260327; b=QosTj7HcMn9YDDHmnNu9Go7GlPxirxM5dIia5MLhxYaaGLINR0VQ5Sq1Au4O5yJnSP 7VlYQqTa7srF4t64U07Brh7b6uoOBFWaEcLz2PjDmMW1F/t3VgymylXDSdn5dLBoYb7x QW//ceof5dRFENYFzGk+/trrG7CKXjiul5G2ZIwQxFrVfb8bhhAr0pjnxtOi823yedWE +LmVr9Ws7Or/C1A4V5/gtswim2ojqreC//Bc5YsEDyDvFUEM4FO4VKCoN6tXuc2zY6eI KZJs001901A7Gri15ucrX01GX+E973JNfUi4yh9gNHq2CoBRkxIO2iAttBFcu7BG8hA5 dX7w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=feedback-id:content-transfer-encoding:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature; bh=8DNRW4i2m9anNZhhF0uuM/xOJB46E5uGdxgDPsTgbSo=; fh=VulK/l3XeLoc9JOOMl9NSLlfbMahF+GjHF6HwceMpeQ=; b=LlIPIi189mxWdch/DA71Ry3s6ZNSrBml1nnh2HV10o7kjZ5Leo6UySKC1RtaGOHwmg Cwja9gT0lYHq3PrYlSpKHZwqj1W4B47cvEU2ncdO34uhJR/XvyD82+hUCoLM/lcxEE2Y wD+68TvdycdeOlq2jENPAw7rClz1PSFJ/Kswt8lgV+KKh02Wcf7055I6syj4IvP8LpZ5 UZDUaVINfly6J3DZI4+tpUlDe4/T9pDfrKw5aEd2asxx52u+Z2nl7Hmz8hnBh3BmAhz3 CJwzwCEzlfd2/36I2KL78B/Kx2SllDuU78eJ/oW2kF8LXPOvi7XPnkx87cW23AJylDGt ORWg==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=BZitemSQ; spf=pass (google.com: domain of fm-1324425-202610271105245f263c63fd00020789-ts0myf@rts-flowmailer.siemens.com designates 185.136.65.226 as permitted sender) smtp.mailfrom=fm-1324425-202610271105245f263c63fd00020789-tS0MYF@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net. [185.136.65.226]) by gmr-mx.google.com with ESMTPS id 41be03b00d2f7-cd8ccc5afc0si185777a12.11.2026.10.27.04.05.28 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 27 Oct 2026 04:05:29 -0700 (PDT) Received-SPF: pass (google.com: domain of fm-1324425-202610271105245f263c63fd00020789-ts0myf@rts-flowmailer.siemens.com designates 185.136.65.226 as permitted sender) client-ip=185.136.65.226; Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 202610271105245f263c63fd00020789 for ; Tue, 27 Oct 2026 12:05:24 +0100 X-Patchwork-Original-From: "srinuvasan.a via isar-users" From: "srinuvasan.a" To: isar-users@googlegroups.com Cc: cedric.hombourger@siemens.com, Srinuvasan A Subject: [PATCH 3/3] deploy-image: re-encrypt LUKS volumes with new master keys Date: Tue, 27 Oct 2026 16:36:01 +0530 Message-Id: <20261027110601.1197504-3-srinuvasan.a@siemens.com> In-Reply-To: <20261027110601.1197504-1-srinuvasan.a@siemens.com> References: <20261027110601.1197504-1-srinuvasan.a@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-1324425:519-21489:flowmailer X-Original-Sender: srinuvasan.a@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm2 header.b=BZitemSQ; spf=pass (google.com: domain of fm-1324425-202610271105245f263c63fd00020789-ts0myf@rts-flowmailer.siemens.com designates 185.136.65.226 as permitted sender) smtp.mailfrom=fm-1324425-202610271105245f263c63fd00020789-tS0MYF@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: srinuvasan.a@siemens.com Reply-To: srinuvasan.a@siemens.com Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= From: Srinuvasan A Raw image installation clones the LUKS volume keys of the source image to every installed device. Add sys_api functions that rotate them on the offline target before the installation lock is released: - sys_luks_list_volumes: verify the target is idle and every LUKS2 volume is a pristine provisioning container - sys_luks_reencrypt_volume: reencrypt one volume (no resilience journal, as a failure requires reinstalling) emitting percentages - sys_luks_rotate_keys: orchestrate the above, one progress gauge per volume through the optional ui_reencrypt_volume_gauge hook, which uses ui_progress_gauge The initial passphrase defaults to empty and can be supplied through the optional sys_luks_passphrase_hook callback. cryptsetup and jq are only required when an encrypted volume is found; when missing, key rotation is skipped with a warning. A failed rotation is recorded as the installation result, so that other consoles report it. Signed-off-by: Srinuvasan A Suggested-by: Cedric Hombourger --- .../files/usr/bin/installer_ui.sh | 14 ++ .../deploy-image/files/usr/bin/sys_api.sh | 212 +++++++++++++++++- 2 files changed, 222 insertions(+), 4 deletions(-) diff --git a/meta-isar/recipes-installer/deploy-image/files/usr/bin/installer_ui.sh b/meta-isar/recipes-installer/deploy-image/files/usr/bin/installer_ui.sh index aa906221..6f2433e6 100644 --- a/meta-isar/recipes-installer/deploy-image/files/usr/bin/installer_ui.sh +++ b/meta-isar/recipes-installer/deploy-image/files/usr/bin/installer_ui.sh @@ -209,6 +209,20 @@ ui_progress_gauge() { return "$status" } +#-------------------------------------------------------------------------- +# ui_reencrypt_volume_gauge +# +# Shows a gauge for one encrypted volume, fed with percentages on stdin +# (see sys_luks_reencrypt_volume). +#-------------------------------------------------------------------------- +ui_reencrypt_volume_gauge() { + local device="$1" + local index="$2" + local count="$3" + + ui_progress_gauge "Securing volume $index/$count ($device) with a new encryption key.\nDo not power off." +} + #-------------------------------------------------------------------------- # ui_stop_progress_gauge # diff --git a/meta-isar/recipes-installer/deploy-image/files/usr/bin/sys_api.sh b/meta-isar/recipes-installer/deploy-image/files/usr/bin/sys_api.sh index 26b39108..4f246697 100644 --- a/meta-isar/recipes-installer/deploy-image/files/usr/bin/sys_api.sh +++ b/meta-isar/recipes-installer/deploy-image/files/usr/bin/sys_api.sh @@ -273,18 +273,215 @@ sys_bmap_options_for_image() { fi } +#-------------------------------------------------------------------------- +# sys_luks_list_volumes +# +# Prints the LUKS2 volumes found on target_device (and its partitions), +# one per line, once the target has been verified to be offline and every +# volume to be a pristine provisioning container: a single keyslot, no +# tokens and no pending reencryption. Unencrypted targets yield no output +# and need neither cryptsetup nor jq; encrypted ones yield no output (with a +# warning) when either is missing, so that key rotation is skipped. +# +# Returns: +# 0 on success (also when tools are missing, see above), 1 when the +# target is busy or a volume is unsupported (reason on stderr). +#-------------------------------------------------------------------------- +sys_luks_list_volumes() { + local target_device="$1" + local devices device mounts fstype metadata probe_status + local holders + local volumes=() + + partprobe "$target_device" || true + ! command -v udevadm >/dev/null || udevadm settle || true + + devices=$(lsblk --list --noheadings --paths --output NAME "$target_device") || return 1 + while IFS= read -r device; do + mounts=$(lsblk --nodeps --noheadings --output MOUNTPOINTS "$device") + if [ -n "${mounts//[[:space:]]/}" ]; then + echo "Error: $device is mounted" >&2 + return 1 + fi + holders=(/sys/class/block/"${device##*/}"/holders/*) + if [ -e "${holders[0]}" ]; then + echo "Error: $device has active holders" >&2 + return 1 + fi + + probe_status=0 + fstype=$(blkid --probe --output value --match-tag TYPE "$device" 2>/dev/null) || probe_status=$? + if [ "$probe_status" != 0 ] && [ "$probe_status" != 2 ]; then + echo "Error: cannot probe $device" >&2 + return 1 + fi + [ "$fstype" = crypto_LUKS ] || continue + + # Optional tools: without them keys are not rotated (see sys_luks_rotate_keys). + if ! command -v cryptsetup >/dev/null || ! command -v jq >/dev/null; then + echo "Warning: $device is encrypted but cryptsetup/jq are missing, skipping key rotation" >&2 + return 0 + fi + if ! cryptsetup isLuks --type luks2 "$device"; then + echo "Error: $device is not a LUKS2 volume" >&2 + return 1 + fi + metadata=$(cryptsetup luksDump --dump-json-metadata "$device") || return 1 + if ! jq -e ' + (.tokens | length) == 0 and + (.keyslots | length) == 1 and + all(.keyslots[]; .type == "luks2") and + (.segments | length) == 1 and + all(.segments[]; .type == "crypt" and ((.flags // []) | length) == 0) + ' <<< "$metadata" >/dev/null; then + echo "Error: unsupported or interrupted LUKS state on $device" >&2 + return 1 + fi + volumes+=("$device") + done <<< "$devices" + + [ ${#volumes[@]} -eq 0 ] || printf '%s\n' "${volumes[@]}" +} + +#-------------------------------------------------------------------------- +# sys_luks_make_keyfile +# +# Creates a private key file holding the initial passphrase of and +# prints its path. The passphrase is empty unless the optional hook +# sys_luks_passphrase_hook is defined; it is called with the device and +# must print the passphrase on stdout (no trailing newline is added). +#-------------------------------------------------------------------------- +sys_luks_make_keyfile() { + local device="$1" + local keyfile passphrase="" + + if declare -F sys_luks_passphrase_hook >/dev/null; then + passphrase=$(sys_luks_passphrase_hook "$device") || return 1 + fi + keyfile=$(mktemp /run/installer-luks-key.XXXXXX) || return 1 + printf '%s' "$passphrase" > "$keyfile" || { rm -f -- "$keyfile"; return 1; } + echo "$keyfile" +} + +#-------------------------------------------------------------------------- +# sys_luks_reencrypt_volume +# +# Generates a new volume key for a provisioning LUKS2 volume, unlocking it +# with its initial passphrase (see sys_luks_make_keyfile), and emits one +# integer percentage per line on stdout so callers can drive a progress +# indicator. The volume is offline and a failed run requires reinstalling, +# so no resilience journal is kept (this halves the amount of data written). +# +# Returns: +# 0 when the volume was reencrypted and verified, 1 otherwise. +#-------------------------------------------------------------------------- +sys_luks_reencrypt_volume() { + local device="$1" + local keyfile log uuid metadata status + + keyfile=$(sys_luks_make_keyfile "$device") || return 1 + uuid=$(cryptsetup luksUUID "$device") || { rm -f -- "$keyfile"; return 1; } + log=$(mktemp /run/installer-luks-reencrypt.XXXXXX) || { rm -f -- "$keyfile"; return 1; } + + # Progress is printed on stdout, errors on stderr (kept for reporting). + cryptsetup reencrypt --batch-mode --force-offline-reencrypt \ + --resilience none --progress-json --progress-frequency 1 \ + --key-file "$keyfile" "$device" 2> "$log" | + jq -R --unbuffered -r ' + fromjson? | select(.device_size != null) | + (((.device_bytes | tonumber) * 100) / (.device_size | tonumber) | floor)' + status=${PIPESTATUS[0]} + [ "$status" = 0 ] || cat "$log" >&2 + rm -f -- "$log" + + if [ "$status" = 0 ]; then + [ "$(cryptsetup luksUUID "$device")" = "$uuid" ] || status=1 + fi + if [ "$status" = 0 ]; then + cryptsetup open --test-passphrase --key-file "$keyfile" "$device" || status=1 + fi + if [ "$status" = 0 ]; then + metadata=$(cryptsetup luksDump --dump-json-metadata "$device") || status=1 + jq -e 'all(.keyslots[]; .type != "reencrypt") and + all(.segments[]; .type == "crypt" and ((.flags // []) | length) == 0)' \ + <<< "$metadata" >/dev/null || status=1 + fi + + rm -f -- "$keyfile" + [ "$status" = 0 ] || echo "Error: reencryption of $device failed" >&2 + [ "$status" = 0 ] +} + +#-------------------------------------------------------------------------- +# sys_luks_rotate_keys +# +# Installed images share the volume keys of the image they were built +# from. Reencrypt every LUKS2 volume of target_device so the installed +# system uses its own master keys. Must run while the target is offline. +# +# Optional hooks (if defined): +# sys_luks_passphrase_hook +# prints the initial passphrase of (default: empty) +# ui_reencrypt_volume_gauge +# reads percentages from stdin while a volume is reencrypted +# +# Returns: +# 0 when all volumes were rotated, none are encrypted, or rotation was +# skipped because cryptsetup or jq is missing (warning on stderr); +# 1 otherwise. On failure the target must not be booted and must be +# reinstalled. +#-------------------------------------------------------------------------- +sys_luks_rotate_keys() { + local target_device="$1" + local volumes=() + local device keyfile listing status index=0 count + + listing=$(sys_luks_list_volumes "$target_device") || return 1 + [ -n "$listing" ] || return 0 + mapfile -t volumes <<< "$listing" + count=${#volumes[@]} + + # Fail before touching any volume when the initial credential is wrong. + for device in "${volumes[@]}"; do + keyfile=$(sys_luks_make_keyfile "$device") || return 1 + if ! cryptsetup open --test-passphrase --key-file "$keyfile" "$device"; then + echo "Error: initial unlock credential is unavailable for $device" >&2 + rm -f -- "$keyfile" + return 1 + fi + rm -f -- "$keyfile" + done + + for device in "${volumes[@]}"; do + index=$((index + 1)) + if declare -F ui_reencrypt_volume_gauge >/dev/null; then + sys_luks_reencrypt_volume "$device" | ui_reencrypt_volume_gauge "$device" "$index" "$count" + status=${PIPESTATUS[0]} + else + echo "Reencrypting $device ($index/$count); do not power off." + sys_luks_reencrypt_volume "$device" | while read -r percent; do + printf '\r%s: %s%%' "$device" "$percent" + done + status=${PIPESTATUS[0]} + echo + fi + [ "$status" = 0 ] || return 1 + done +} + #-------------------------------------------------------------------------- # sys_install_image_with_lock # # Performs the actual bmaptool copy, serializing concurrent installer -# consoles via flock. When UI hook functions are available, this API -# uses them to present a progress gauge in attended mode. Consoles that -# do not get the lock wait for its holder and report its result, which is -# kept in /run/installer.result. +# consoles via flock, then rotates the LUKS volume keys of the target +# (see sys_luks_rotate_keys) before the lock is released. When UI hook +# functions are available, this API uses them to present progress gauges +# in attended mode. # # Optional UI hooks (if defined): # ui_start_progress_gauge # ui_stop_progress_gauge +# ui_reencrypt_volume_gauge #-------------------------------------------------------------------------- sys_install_image_with_lock() { local image_path="$1" @@ -335,6 +532,13 @@ sys_install_image_with_lock() { ui_stop_progress_gauge fi + # Still under the lock: give the installed system its own volume keys. + if ! sys_luks_rotate_keys "$target_device"; then + echo "Volume-key rotation failed. Installation is incomplete; do not boot the target." >&2 + echo failed > "$result_file" + return 1 + fi + echo ok > "$result_file" else echo "Installation already running in another console. Waiting for it to finish..."