GNU logs - #72889, boring messages

Message sent to bug-guix@HIDDEN:

Subject: bug#72889: Support for root filesystem on btrfs raid1 on two LUKS devices
Resent-From: "amano.kenji" <amano.kenji@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Fri, 30 Aug 2024 08:49:04 +0000
Resent-Message-ID: <handler.72889.B.172500768919863 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 72889 <at> debbugs.gnu.org
Date: Fri, 30 Aug 2024 07:07:55 +0000
From: "amano.kenji" <amano.kenji@HIDDEN>
Message-ID: <-0PYKHO0ibVEYpJmDoSQAxcjyCsrp6q43lhdJeWrLK-axts_Oe8bd25m8I-URuDnpv6eBPBbmz5wb0WOqx3wonFOMYXzX9uqgpGgyc8jlYk=@proton.me>
Feedback-ID: 48725158:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Received-SPF: pass client-ip=185.70.40.132; envelope-from=amano.kenji@HIDDEN;
 helo=mail-40132.protonmail.ch
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
 RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001,
 RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001,
 SPF_HELO_PASS=-0.001, SPF_PASS=-0.001,
 T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.3 (-)
X-Mailman-Approved-At: Fri, 30 Aug 2024 04:48:04 -0400
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.3 (--)

Imagine that root filesystem is btrfs raid1 on two LUKS devices.

To mount it on initial ram disk, guix has to first unlock two LUKS devices =
with one password.

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: "amano.kenji" <amano.kenji@HIDDEN>
Subject: bug#72889: Acknowledgement (Support for root filesystem on btrfs
 raid1 on two LUKS devices)
Message-ID: <handler.72889.B.172500768919863.ack <at> debbugs.gnu.org>
References: <-0PYKHO0ibVEYpJmDoSQAxcjyCsrp6q43lhdJeWrLK-axts_Oe8bd25m8I-URuDnpv6eBPBbmz5wb0WOqx3wonFOMYXzX9uqgpGgyc8jlYk=@proton.me>
X-Gnu-PR-Message: ack 72889
X-Gnu-PR-Package: guix
Reply-To: 72889 <at> debbugs.gnu.org
Date: Fri, 30 Aug 2024 08:49:04 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-guix@HIDDEN

If you wish to submit further information on this problem, please
send it to 72889 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
72889: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D72889
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message sent to bug-guix@HIDDEN:

Subject: bug#72889: A new insight
References: <-0PYKHO0ibVEYpJmDoSQAxcjyCsrp6q43lhdJeWrLK-axts_Oe8bd25m8I-URuDnpv6eBPBbmz5wb0WOqx3wonFOMYXzX9uqgpGgyc8jlYk=@proton.me>
In-Reply-To: <-0PYKHO0ibVEYpJmDoSQAxcjyCsrp6q43lhdJeWrLK-axts_Oe8bd25m8I-URuDnpv6eBPBbmz5wb0WOqx3wonFOMYXzX9uqgpGgyc8jlYk=@proton.me>
Resent-From: "amano.kenji" <amano.kenji@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Thu, 05 Sep 2024 01:58:02 +0000
Resent-Message-ID: <handler.72889.B72889.172550146626610 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: "72889 <at> debbugs.gnu.org" <72889 <at> debbugs.gnu.org>
Date: Thu, 05 Sep 2024 01:56:25 +0000
From: "amano.kenji" <amano.kenji@HIDDEN>
Message-ID: <A_TAuyeNIZ7YW8B-C1J0QAeOkZd2ZJFO7eybwej6N--mx3SMcWbp54afXfpr07zkyF5K3xCCT9QwCzTnvD1cl0rSS709W06f_8rzaRbPGvs=@proton.me>
Feedback-ID: 48725158:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

I guess this is going to require passphrase reuse for mapped devices.

Message sent to bug-guix@HIDDEN:

Subject: bug#72889: I thought of a possible way to do this.
References: <-0PYKHO0ibVEYpJmDoSQAxcjyCsrp6q43lhdJeWrLK-axts_Oe8bd25m8I-URuDnpv6eBPBbmz5wb0WOqx3wonFOMYXzX9uqgpGgyc8jlYk=@proton.me>
In-Reply-To: <-0PYKHO0ibVEYpJmDoSQAxcjyCsrp6q43lhdJeWrLK-axts_Oe8bd25m8I-URuDnpv6eBPBbmz5wb0WOqx3wonFOMYXzX9uqgpGgyc8jlYk=@proton.me>
Resent-From: "amano.kenji" <amano.kenji@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Tue, 10 Sep 2024 13:15:02 +0000
Resent-Message-ID: <handler.72889.B72889.172597409710312 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: "72889 <at> debbugs.gnu.org" <72889 <at> debbugs.gnu.org>
Date: Tue, 10 Sep 2024 13:14:38 +0000
From: "amano.kenji" <amano.kenji@HIDDEN>
Message-ID: <EKx5__W2YAog5dIoQd-wnv5iQT-p1MULD8UZKuYlku7QckCkfV1mY7ke59qapK33KhxA8BSBpB2JxtE12BhDC-j8IUKf9dFObhNMiXCZr5A=@proton.me>
Feedback-ID: 48725158:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

- /dev/sda

/dev/sda1: A tiny LUKS partition that's filled with the content of a keyfil=
e without any filesystem format.
/dev/sda2: /boot for grub. It also serves as FAT32 EFI partition.

- /dev/sdb

/dev/sdb1: /gnu/store on btrfs raid1
/dev/sdb2: / on btrfs raid1 on LUKS

- /dev/sdc

/dev/sdc1: /gnu/store on btrfs raid1
/dev/sdc2: / on btrfs raid1 on LUKS

Open /dev/sda1 as a luke device, /dev/mapper/key, with one password. It con=
tains a keyfile without any filesystem format. Use /dev/mapper/key as a key=
file for all other LUKS devices in mapped devices.

This exposes /gnu/store, but /gnu/store is not supposed to have any sensiti=
ve data. This obviously makes it practically impossible to detect physical =
tempering of data, but if you store it at a secure location, you don't have=
 to worry too much about evil maid attack.

RAID1 for physically secure servers is enough to ensure some availability w=
hen a disk fails.

For laptops that you carry, you are not going to use btrfs raid1, and you c=
an just have unencrypted /boot on fat32 and / on btrfs on luks. extra-initr=
d contains a keyfile for / so that I don't have to type the password twice.

A desktop computer doesn't require server-level availability, but people wh=
o have money can still put root on encrypted btrfs raid1.

Perhaps, can this be documented in the cook book?

Last modified: Sun, 12 Jan 2025 05:45:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.