Re: [ptxdist] [PATCH] cryptsetup: new package

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Tue, Sep 19, 2017 at 04:00:44PM +0200, Sascha Hauer wrote:
> This adds support for the cryptsetup tools to ptxdist.
> 
> Cryptsetup is a utility used to conveniently setup disk encryption based
> on DMCrypt kernel module.
> 
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> ---
>  rules/cryptsetup.in   | 22 ++++++++++++
>  rules/cryptsetup.make | 96 +++++++++++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 118 insertions(+)
>  create mode 100644 rules/cryptsetup.in
>  create mode 100644 rules/cryptsetup.make
> 
> diff --git a/rules/cryptsetup.in b/rules/cryptsetup.in
> new file mode 100644
> index 000000000..04d123615
> --- /dev/null
> +++ b/rules/cryptsetup.in
> @@ -0,0 +1,22 @@
> +## SECTION=disk_and_file
> +
> +menuconfig CRYPTSETUP
> +	select LVM2
> +	select LIBUUID
> +	tristate
> +	prompt "cryptsetup                    "
> +	help
> +	  Cryptsetup is a utility used to conveniently setup disk encryption
> +	  based on DMCrypt kernel module.
> +
> +if CRYPTSETUP
> +
> +config CRYPTSETUP_CRYPTSETUP
> +	bool
> +	prompt "install cryptsetup"
> +
> +config CRYPTSETUP_VERITYSETUP
> +	bool
> +	prompt "install veritysetup"
> +
> +endif
> diff --git a/rules/cryptsetup.make b/rules/cryptsetup.make
> new file mode 100644
> index 000000000..303da5484
> --- /dev/null
> +++ b/rules/cryptsetup.make
> @@ -0,0 +1,96 @@
> +# -*-makefile-*-
> +#
> +# Copyright (C) 2017 by Sascha Hauer <s.hauer@pengutronix.de>
> +#
> +# See CREDITS for details about who has contributed to this project.
> +#
> +# For further information about the PTXdist project and license conditions
> +# see the README file.
> +#
> +
> +#
> +# We provide this package
> +#
> +PACKAGES-$(PTXCONF_CRYPTSETUP) += cryptsetup
> +
> +#
> +# Paths and names
> +#
> +CRYPTSETUP_VERSION	:= 1.7.5
> +CRYPTSETUP_MD5		:= dde798a883b06a2903379dcd593480e1
> +CRYPTSETUP		:= cryptsetup-$(CRYPTSETUP_VERSION)
> +CRYPTSETUP_SUFFIX	:= tar.gz
> +CRYPTSETUP_URL		:= https://www.kernel.org/pub/linux/utils/cryptsetup/v1.7//$(CRYPTSETUP).$(CRYPTSETUP_SUFFIX)
> +CRYPTSETUP_SOURCE	:= $(SRCDIR)/$(CRYPTSETUP).$(CRYPTSETUP_SUFFIX)
> +CRYPTSETUP_DIR		:= $(BUILDDIR)/$(CRYPTSETUP)
> +CRYPTSETUP_LICENSE	:= GPL-2.0+
> +
> +# ----------------------------------------------------------------------------
> +# Prepare
> +# ----------------------------------------------------------------------------
> +
> +#
> +# autoconf
> +#
> +CRYPTSETUP_CONF_TOOL	:= autoconf
> +CRYPTSETUP_CONF_OPT	:= \
> +	$(CROSS_AUTOCONF_USR) \
> +	$(GLOBAL_LARGE_FILE_OPTION) \
> +	--disable-nls \
> +	--disable-rpath \
> +	--disable-pwquality \
> +	--disable-static-cryptsetup \
> +	--enable-veritysetup \
> +	--enable-cryptsetup-reencrypt \
> +	--disable-selinux \
> +	--enable-udev \
> +	--enable-kernel_crypto \
> +	--enable-gcrypt-pbkdf2 \
> +	--enable-dev-random \
> +	--disable-python \
> +	--with-crypto_backend=gcrypt \

This requires a 'select LIBGCRYPT' and LIBPOPT is used as well.

> +	--with-plain-hash=ripemd160 \
> +	--with-plain-cipher=aes \
> +	--with-plain-mode=cbc-essiv:sha256 \
> +	--with-plain-keybits=256 \
> +	--with-luks1-hash=sha256 \
> +	--with-luks1-cipher=aes \
> +	--with-luks1-mode=xts-plain64 \
> +	--with-luks1-keybits=256 \
> +	--with-luks1-iter-time=2000 \
> +	--with-loopaes-cipher=sea \
> +	--with-loopaes-keybits=256 \
> +	--with-keyfile-size-maxkb=8192 \
> +	--with-passphrase-size-max=512 \
> +	--with-verity-hash=sha256 \
> +	--with-verity-data-block=4096 \
> +	--with-verity-hash-block=4096 \
> +	--with-verity-salt-size=32

These are all the defaults, and not in any way autodetected, right? I think
these options should be removed. The upstream defaults are good in this
case, unless you changed something.

Michael

> +
> +# ----------------------------------------------------------------------------
> +# Target-Install
> +# ----------------------------------------------------------------------------
> +
> +$(STATEDIR)/cryptsetup.targetinstall:
> +	@$(call targetinfo)
> +
> +	@$(call install_init, cryptsetup)
> +	@$(call install_fixup, cryptsetup,PRIORITY,optional)
> +	@$(call install_fixup, cryptsetup,SECTION,base)
> +	@$(call install_fixup, cryptsetup,AUTHOR,"Sascha Hauer <s.hauer@pengutronix.de>")
> +	@$(call install_fixup, cryptsetup,DESCRIPTION,missing)
> +
> +	@$(call install_lib, cryptsetup, 0, 0, 0644, libcryptsetup)
> +
> +ifdef PTXCONF_CRYPTSETUP_VERITYSETUP
> +	@$(call install_copy, cryptsetup, 0, 0, 0755, -, /usr/sbin/veritysetup)
> +endif
> +ifdef PTXCONF_CRYPTSETUP_CRYPTSETUP
> +	@$(call install_copy, cryptsetup, 0, 0, 0755, -, /usr/sbin/cryptsetup)
> +endif
> +
> +	@$(call install_finish, cryptsetup)
> +
> +	@$(call touch)
> +
> +# vim: syntax=make
> -- 
> 2.11.0
> 
> 
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de