Version 2.7.1.

tests: Fix Makefile * Meson to include all fs images.
Update LUKS2 spec.
2025-12-06 08:20:07 +01:00 · 2024-03-07 15:47:06 +01:00 · 2024-03-07 15:39:12 +01:00 · 2024-03-07 15:27:52 +01:00 · 2024-03-07 15:27:44 +01:00 · 2024-03-07 14:26:46 +01:00
50 changed files with 5199 additions and 4644 deletions
--- a/.github/workflows/cibuild.yml
+++ b/.github/workflows/cibuild.yml
@@ -4,8 +4,7 @@ on:
    branches:
      - 'main'
      - 'wip-luks2'
-      - 'v2.3.x'
-      - 'v2.4.x'
+      - 'v2.*.x'
    paths-ignore:
      - 'docs/**'

--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -5,8 +5,7 @@ on:
    branches:
      - 'main'
      - 'wip-luks2'
-      - 'v2.3.x'
-      - 'v2.4.x'
+      - 'v2.*.x'

 permissions:
  contents: read
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,15 +1,14 @@
 stages:
  - test

-.dump_kernel_log:
+.fail_if_coredump_generated:
  after_script:
-    - sudo dmesg > /mnt/artifacts/dmesg.log
-    - sudo journalctl > /mnt/artifacts/journalctl.log
    - '[ "$(ls -A /var/coredumps)" ] && exit 1 || true'

 include:
  - local: .gitlab/ci/debian.yml
  - local: .gitlab/ci/fedora.yml
+  - local: .gitlab/ci/fedora-opal.yml
  - local: .gitlab/ci/rhel.yml
  - local: .gitlab/ci/centos.yml
  - local: .gitlab/ci/annocheck.yml
@@ -19,5 +18,5 @@ include:
  - local: .gitlab/ci/compilation-gcc.gitlab-ci.yml
  - local: .gitlab/ci/compilation-clang.gitlab-ci.yml
  - local: .gitlab/ci/alpinelinux.yml
-  - local: .gitlab/ci/ubuntu-32bit.yml
+  - local: .gitlab/ci/debian-i686.yml
  - local: .gitlab/ci/cifuzz.yml
--- a/.gitlab/ci/alpinelinux.yml
+++ b/.gitlab/ci/alpinelinux.yml
@@ -1,12 +1,12 @@
 .alpinelinux-dependencies:
-  after_script:
-    - sudo dmesg > /mnt/artifacts/dmesg.log
-    - sudo cp /var/log/messages /mnt/artifacts/
-    - '[ "$(ls -A /var/coredumps)" ] && exit 1 || true'
+  variables:
+    DISTRO: cryptsetup-alpine-edge
+  extends:
+    - .fail_if_coredump_generated
  before_script:
    - >
      sudo apk add
-      lvm2-dev openssl1.1-compat-dev popt-dev util-linux-dev json-c-dev
+      lvm2-dev openssl-dev popt-dev util-linux-dev json-c-dev
      argon2-dev device-mapper which sharutils gettext gettext-dev automake
      autoconf libtool build-base keyutils tar jq expect git asciidoctor
    - ./autogen.sh
@@ -17,7 +17,7 @@ test-main-commit-job-alpinelinux:
    - .alpinelinux-dependencies
  tags:
    - libvirt
-    - alpinelinux
+    - cryptsetup-alpine-edge
  stage: test
  interruptible: true
  variables:
@@ -38,7 +38,7 @@ test-mergerq-job-alpinelinux:
    - .alpinelinux-dependencies
  tags:
    - libvirt
-    - alpinelinux
+    - cryptsetup-alpine-edge
  stage: test
  interruptible: true
  variables:
--- a/.gitlab/ci/annocheck.yml
+++ b/.gitlab/ci/annocheck.yml
@@ -1,13 +1,14 @@
 test-main-commit-job-annocheck:
  extends:
-    - .dump_kernel_log
+    - .fail_if_coredump_generated
  tags:
    - libvirt
-    - rhel9-annocheck
+    - cryptsetup-rhel-9
  stage: test
  interruptible: true
  allow_failure: true
  variables:
+    DISTRO: cryptsetup-rhel-9
    RUN_SSH_PLUGIN_TEST: "1"
  rules:
    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
--- a/.gitlab/ci/centos.yml
+++ b/.gitlab/ci/centos.yml
@@ -1,6 +1,8 @@
 .centos-openssl-backend:
+  variables:
+    DISTRO: cryptsetup-centos-stream-9
  extends:
-    - .dump_kernel_log
+    - .fail_if_coredump_generated
  before_script:
    - >
      sudo dnf -y -q  install
@@ -21,7 +23,7 @@ test-main-commit-centos-stream9:
    - .centos-openssl-backend
  tags:
    - libvirt
-    - centos-stream9
+    - cryptsetup-centos-stream-9
  stage: test
  interruptible: true
  variables:
@@ -42,7 +44,7 @@ test-mergerq-centos-stream9:
    - .centos-openssl-backend
  tags:
    - libvirt
-    - centos-stream9
+    - cryptsetup-centos-stream-9
  stage: test
  interruptible: true
  variables:
--- a/.gitlab/ci/csmock.yml
+++ b/.gitlab/ci/csmock.yml
@@ -1,14 +1,16 @@
 test-commit-job-csmock:
  extends:
-    - .dump_kernel_log
+    - .fail_if_coredump_generated
  tags:
    - libvirt
-    - rhel9-csmock
+    - cryptsetup-rhel-9
  stage: test
  interruptible: true
  allow_failure: true
  variables:
+    DISTRO: cryptsetup-rhel-9
    RUN_SSH_PLUGIN_TEST: "1"
+    DISK_SIZE: 20
  rules:
    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
      when: never
--- a/.gitlab/ci/ubuntu-32bit.yml
+++ b/.gitlab/ci/ubuntu-32bit.yml
@@ -1,12 +1,13 @@
-test-mergerq-job-ubuntu-32bit:
+test-mergerq-job-debian-i686:
  extends:
    - .debian-prep
  tags:
    - libvirt
-    - ubuntu-bionic-32bit
+    - cryptsetup-debian-12i686
  stage: test
  interruptible: true
  variables:
+    DISTRO: cryptsetup-debian-12i686
    RUN_SSH_PLUGIN_TEST: "1"
  rules:
    - if: $RUN_SYSTEMD_PLUGIN_TEST != null
@@ -19,15 +20,16 @@ test-mergerq-job-ubuntu-32bit:
    - make -j -C tests check-programs
    - sudo -E make check

-test-main-commit-job-ubuntu-32bit:
+test-main-commit-job-debian-i686:
  extends:
    - .debian-prep
  tags:
    - libvirt
-    - ubuntu-bionic-32bit
+    - cryptsetup-debian-12i686
  stage: test
  interruptible: true
  variables:
+    DISTRO: cryptsetup-debian-12i686
    RUN_SSH_PLUGIN_TEST: "1"
  rules:
    - if: $RUN_SYSTEMD_PLUGIN_TEST != null
--- a/.gitlab/ci/debian.yml
+++ b/.gitlab/ci/debian.yml
@@ -1,6 +1,6 @@
 .debian-prep:
  extends:
-    - .dump_kernel_log
+    - .fail_if_coredump_generated
  before_script:
    - sudo apt-get -y update
    - >
@@ -11,7 +11,7 @@
      sudo apt-get -y install -y -qq git gcc make autoconf automake autopoint
      pkgconf libtool libtool-bin gettext libssl-dev libdevmapper-dev
      libpopt-dev uuid-dev libsepol-dev libjson-c-dev libssh-dev libblkid-dev
-      tar libargon2-0-dev libpwquality-dev sharutils dmsetup jq xxd expect
+      tar libargon2-dev libpwquality-dev sharutils dmsetup jq xxd expect
      keyutils netcat-openbsd passwd openssh-client sshpass asciidoctor
    - sudo apt-get -y build-dep cryptsetup
    - sudo -E git clean -xdf
@@ -23,10 +23,11 @@ test-mergerq-job-debian:
    - .debian-prep
  tags:
    - libvirt
-    - debian12
+    - cryptsetup-debian-12
  stage: test
  interruptible: true
  variables:
+    DISTRO: cryptsetup-debian-12
    RUN_SSH_PLUGIN_TEST: "1"
  rules:
    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
@@ -42,10 +43,11 @@ test-main-commit-job-debian:
    - .debian-prep
  tags:
    - libvirt
-    - debian12
+    - cryptsetup-debian-12
  stage: test
  interruptible: true
  variables:
+    DISTRO: cryptsetup-debian-12
    RUN_SSH_PLUGIN_TEST: "1"
  rules:
    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
@@ -62,10 +64,11 @@ test-mergerq-job-debian-meson:
    - .debian-prep
  tags:
    - libvirt
-    - debian12
+    - cryptsetup-debian-12
  stage: test
  interruptible: true
  variables:
+    DISTRO: cryptsetup-debian-12
    RUN_SSH_PLUGIN_TEST: "1"
  rules:
    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
@@ -82,10 +85,11 @@ test-main-commit-job-debian-meson:
    - .debian-prep
  tags:
    - libvirt
-    - debian12
+    - cryptsetup-debian-12
  stage: test
  interruptible: true
  variables:
+    DISTRO: cryptsetup-debian-12
    RUN_SSH_PLUGIN_TEST: "1"
  rules:
    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
--- a/.gitlab/ci/fedora-opal.yml
+++ b/.gitlab/ci/fedora-opal.yml
@@ -0,0 +1,134 @@
+.dnf-openssl-backend:
+  variables:
+    DISTRO: cryptsetup-fedora-rawhide
+  extends:
+    - .fail_if_coredump_generated
+  before_script:
+    - >
+      [ -z "$RUN_SYSTEMD_PLUGIN_TEST" ] ||
+      sudo dnf -y -q install
+      swtpm meson ninja-build python3-jinja2 gperf libcap-devel tpm2-tss-devel
+      libmount-devel swtpm-tools
+    - >
+      sudo dnf -y -q install
+      autoconf automake device-mapper-devel gcc gettext-devel json-c-devel
+      libargon2-devel libblkid-devel libpwquality-devel libselinux-devel
+      libssh-devel libtool libuuid-devel make popt-devel
+      libsepol-devel.x86_64 netcat openssh-clients passwd pkgconfig sharutils
+      sshpass tar uuid-devel vim-common device-mapper expect gettext git jq
+      keyutils openssl-devel openssl asciidoctor
+    - sudo -E git clean -xdf
+    - ./autogen.sh
+    - ./configure --enable-fips --enable-pwquality --enable-libargon2 --with-crypto_backend=openssl --enable-asciidoc
+
+.opal-template-fedora:
+  extends:
+    - .dnf-openssl-backend
+  tags:
+    - libvirt
+    - cryptsetup-fedora-rawhide
+  stage: test
+  interruptible: true
+  variables:
+    OPAL2_DEV: "/dev/nvme0n1"
+    OPAL2_PSID_FILE: "/home/gitlab-runner/psid.txt"
+    VOLATILE: 1
+  script:
+    - sudo dnf install -y -q nvme-cli
+    - sudo nvme list
+    - make -j
+    - make -j -C tests check-programs
+    - sudo -E make check TESTS="00modules-test compat-test-opal"
+
+# Samsung SSD 980 500GB (on tiber machine)
+test-commit-rawhide-samsung980:
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+  extends:
+    - .opal-template-fedora
+  tags:
+    - tiber
+  stage: test
+  interruptible: true
+  variables:
+    PCI_PASSTHROUGH_VENDOR_ID: "144d"
+    PCI_PASSTHROUGH_DEVICE_ID: "a809"
+
+test-mergerq-rawhide-samsung980:
+  rules:
+    - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+      when: never
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  extends:
+    - .opal-template-fedora
+  tags:
+    - tiber
+  stage: test
+  interruptible: true
+  variables:
+    PCI_PASSTHROUGH_VENDOR_ID: "144d"
+    PCI_PASSTHROUGH_DEVICE_ID: "a809"
+
+# # WD PC SN740 SDDQNQD-512G-1014 (on tiber machine)
+# test-commit-rawhide-sn740:
+#   rules:
+#     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+#       when: never
+#     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+#   extends:
+#     - .opal-template-fedora
+#   tags:
+#     - tiber
+#   stage: test
+#   interruptible: true
+#   variables:
+#     PCI_PASSTHROUGH_VENDOR_ID: "15b7"
+#     PCI_PASSTHROUGH_DEVICE_ID: "5017"
+#
+# test-mergerq-rawhide-sn740:
+#   rules:
+#     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+#       when: never
+#     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+#   extends:
+#     - .opal-template-fedora
+#   tags:
+#     - tiber
+#   stage: test
+#   interruptible: true
+#   variables:
+#     PCI_PASSTHROUGH_VENDOR_ID: "15b7"
+#     PCI_PASSTHROUGH_DEVICE_ID: "5017"
+#
+# # UMIS RPETJ256MGE2MDQ (on tiber machine)
+# test-commit-rawhide-umis:
+#   rules:
+#     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+#       when: never
+#     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
+#   extends:
+#     - .opal-template-fedora
+#   tags:
+#     - tiber
+#   stage: test
+#   interruptible: true
+#   variables:
+#     PCI_PASSTHROUGH_VENDOR_ID: "1cc4"
+#     PCI_PASSTHROUGH_DEVICE_ID: "6302"
+#
+# test-mergerq-rawhide-umis:
+#   rules:
+#     - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
+#       when: never
+#     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+#   extends:
+#     - .opal-template-fedora
+#   tags:
+#     - tiber
+#   stage: test
+#   interruptible: true
+#   variables:
+#     PCI_PASSTHROUGH_VENDOR_ID: "1cc4"
+#     PCI_PASSTHROUGH_DEVICE_ID: "6302"
--- a/.gitlab/ci/fedora.yml
+++ b/.gitlab/ci/fedora.yml
@@ -1,6 +1,8 @@
 .dnf-openssl-backend:
+  variables:
+    DISTRO: cryptsetup-fedora-rawhide
  extends:
-    - .dump_kernel_log
+    - .fail_if_coredump_generated
  before_script:
    - >
      [ -z "$RUN_SYSTEMD_PLUGIN_TEST" ] ||
@@ -24,7 +26,7 @@ test-main-commit-job-rawhide:
    - .dnf-openssl-backend
  tags:
    - libvirt
-    - fedora-rawhide
+    - cryptsetup-fedora-rawhide
  stage: test
  interruptible: true
  allow_failure: true
@@ -44,7 +46,7 @@ test-mergerq-job-rawhide:
    - .dnf-openssl-backend
  tags:
    - libvirt
-    - fedora-rawhide
+    - cryptsetup-fedora-rawhide
  stage: test
  interruptible: true
  allow_failure: true
--- a/.gitlab/ci/rhel.yml
+++ b/.gitlab/ci/rhel.yml
@@ -1,6 +1,6 @@
 .rhel-openssl-backend:
  extends:
-    - .dump_kernel_log
+    - .fail_if_coredump_generated
  before_script:
    - >
      sudo yum -y -q  install
@@ -21,10 +21,11 @@ test-main-commit-rhel8:
    - .rhel-openssl-backend
  tags:
    - libvirt
-    - rhel8
+    - cryptsetup-rhel-8
  stage: test
  interruptible: true
  variables:
+    DISTRO: cryptsetup-rhel-8
    RUN_SSH_PLUGIN_TEST: "1"
  rules:
    - if: $RUN_SYSTEMD_PLUGIN_TEST != null
@@ -42,10 +43,11 @@ test-main-commit-rhel9:
    - .rhel-openssl-backend
  tags:
    - libvirt
-    - rhel9
+    - cryptsetup-rhel-9
  stage: test
  interruptible: true
  variables:
+    DISTRO: cryptsetup-rhel-9
    RUN_SSH_PLUGIN_TEST: "1"
  rules:
    - if: $RUN_SYSTEMD_PLUGIN_TEST != null
@@ -65,10 +67,11 @@ test-main-commit-rhel8-fips:
    - .rhel-openssl-backend
  tags:
    - libvirt
-    - rhel8-fips
+    - cryptsetup-rhel-8-fips
  stage: test
  interruptible: true
  variables:
+    DISTRO: cryptsetup-rhel-8-fips
    RUN_SSH_PLUGIN_TEST: "1"
  rules:
    - if: $RUN_SYSTEMD_PLUGIN_TEST != null
@@ -87,11 +90,12 @@ test-main-commit-rhel9-fips:
    - .rhel-openssl-backend
  tags:
    - libvirt
-    - rhel9-fips
+    - cryptsetup-rhel-9-fips
  stage: test
  interruptible: true
  allow_failure: true
  variables:
+    DISTRO: cryptsetup-rhel-9-fips
    RUN_SSH_PLUGIN_TEST: "1"
  rules:
    - if: $RUN_SYSTEMD_PLUGIN_TEST != null
--- a/.gitlab/issue_templates/Bug.md
+++ b/.gitlab/issue_templates/Bug.md
@@ -9,7 +9,10 @@

 ### Debug log
 <!-- Paste a debug log of the failing command (add --debug option) between the markers below (to keep raw debug format).-->
+<!-- We need a lot of information from the debug log; without it, we cannot process your report. -->
+<!-- Debug log does not contain any private information. Do not paste private data; we'll ask you for more information if needed. -->
 ```
 Output with --debug option:

 ```
+<!-- NOTE: WITHOUT DEBUG LOG, THE BUG REPORT WILL BE CLOSED. ALSO, PLEASE DO NOT TRY TO REMOVE PARTS OF THE DEBUG LOG! -->
--- a/README.md
+++ b/README.md
@@ -39,11 +39,11 @@ Download
 Release notes and tarballs are available at
 [kernel.org](https://www.kernel.org/pub/linux/utils/cryptsetup/).

-**The latest stable cryptsetup release version is 2.7.0**
-  * [cryptsetup-2.7.0.tar.xz](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.7/cryptsetup-2.7.0.tar.xz)
-  * Signature [cryptsetup-2.7.0.tar.sign](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.7/cryptsetup-2.7.0.tar.sign)
+**The latest stable cryptsetup release version is 2.7.1**
+  * [cryptsetup-2.7.1.tar.xz](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.7/cryptsetup-2.7.1.tar.xz)
+  * Signature [cryptsetup-2.7.1.tar.sign](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.7/cryptsetup-2.7.1.tar.sign)
    _(You need to decompress file first to check signature.)_
-  * [Cryptsetup 2.7.0 Release Notes](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes).
+  * [Cryptsetup 2.7.1 Release Notes](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.1-ReleaseNotes).

 Previous versions
 * [Version 2.6.1](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.6/cryptsetup-2.6.1.tar.xz) -
--- a/configure.ac
+++ b/configure.ac
@@ -1,5 +1,5 @@
 AC_PREREQ([2.67])
-AC_INIT([cryptsetup],[2.7.0])
+AC_INIT([cryptsetup],[2.7.1])

 dnl library version from <major>.<minor>.<release>[-<suffix>]
 LIBCRYPTSETUP_VERSION=$(echo $PACKAGE_VERSION | cut -f1 -d-)
@@ -346,7 +346,7 @@ AC_DEFUN([CONFIGURE_OPENSSL], [

 	saved_LIBS=$LIBS
 	AC_CHECK_DECLS([OSSL_get_max_threads], [], [], [#include <openssl/thread.h>])
-	AC_CHECK_DECLS([OSSL_KDF_PARAM_ARGON2_VERSION], [], [], [#include <openssl/core_names.h>])
+	AC_CHECK_DECLS([OSSL_KDF_PARAM_ARGON2_VERSION], [use_internal_argon2=0], [], [#include <openssl/core_names.h>])
 	LIBS=$saved_LIBS
 ])

@@ -521,9 +521,9 @@ AC_ARG_ENABLE([internal-argon2],
 AC_ARG_ENABLE([libargon2],
 	AS_HELP_STRING([--enable-libargon2], [enable external libargon2 (PHC) library (disables internal bundled version)]))

-if test $use_internal_argon2 = 0 -o "x$enable_internal_argon2" = "xno" ; then
-	if test "x$enable_internal_argon2" = "xyes" -o "x$enable_libargon" = "xyes"; then
-		AC_MSG_WARN([Argon2 in $with_crypto_backend lib is used; internal Argon2 options are ignored.])
+if test $use_internal_argon2 = 0 || ( test "x$enable_internal_argon2" = "xno" && test "x$enable_libargon2" != "xyes" ); then
+	if test "x$enable_internal_argon2" = "xyes" || test "x$enable_libargon2" = "xyes"; then
+		AC_MSG_NOTICE([Argon2 in $with_crypto_backend lib is used; internal Argon2 options are ignored.])
 	fi
 	enable_internal_argon2=no
 	enable_internal_sse_argon2=no
@@ -535,6 +535,7 @@ elif test "x$enable_libargon2" = "xyes" ; then
 	AC_CHECK_DECL(Argon2_id,,[AC_MSG_ERROR([You need more recent Argon2 library with support for Argon2id.])], [#include <argon2.h>])
 	PKG_CHECK_MODULES([LIBARGON2], [libargon2],,[LIBARGON2_LIBS="-largon2"])
 	enable_internal_argon2=no
+	use_internal_argon2=0
 else
 	AC_MSG_WARN([Argon2 bundled (slow) reference implementation will be used, please consider to use system library with --enable-libargon2.])

--- a/docs/on-disk-format-luks2.pdf
+++ b/docs/on-disk-format-luks2.pdf
--- a/docs/v2.7.1-ReleaseNotes
+++ b/docs/v2.7.1-ReleaseNotes
@@ -0,0 +1,30 @@
+Cryptsetup 2.7.1 Release Notes
+==============================
+Stable bug-fix release with minor extensions.
+
+All users of cryptsetup 2.7.0 should upgrade to this version.
+
+Changes since version 2.7.0
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+* Fix interrupted LUKS1 decryption resume.
+  With the replacement of the cryptsetup-reencrypt tool by the cryptsetup
+  reencrypt command, resuming the interrupted LUKS1 decryption operation
+  could fail. LUKS2 was not affected.
+
+* Allow --link-vk-to-keyring with --test-passphrase option.
+  This option allows uploading the volume key in a user-specified kernel
+  keyring without activating the device.
+
+* Fix crash when --active-name was used in decryption initialization.
+
+* Updates and changes to man pages, including indentation, sorting options
+  alphabetically, fixing mistakes in crypt_set_keyring_to_link, and fixing
+  some typos.
+
+* Fix compilation with libargon2 when --disable-internal-argon2 was used.
+
+* Do not require installed argon2.h header and never compile internal
+  libargon2 code if the crypto library directly supports Argon2.
+
+* Fixes to regression tests to support older Linux distributions.
--- a/lib/crypto_backend/argon2_generic.c
+++ b/lib/crypto_backend/argon2_generic.c
@@ -21,15 +21,18 @@

 #include <errno.h>
 #include "crypto_backend_internal.h"
+
+/* Check for HAVE_ARGON2_H is run only if libargon2 code is used */
+#if USE_INTERNAL_ARGON2 || HAVE_ARGON2_H
+
+#define CONST_CAST(x) (x)(uintptr_t)
+
 #if HAVE_ARGON2_H
 #include <argon2.h>
 #else
 #include "argon2/argon2.h"
 #endif

-#define CONST_CAST(x) (x)(uintptr_t)
-
-#if USE_INTERNAL_ARGON2 || HAVE_ARGON2_H
 int argon2(const char *type, const char *password, size_t password_length,
 	   const char *salt, size_t salt_length,
 	   char *key, size_t key_length,
--- a/lib/libcryptsetup.h
+++ b/lib/libcryptsetup.h
@@ -3135,7 +3135,7 @@ void crypt_safe_memzero(void *data, size_t size);
 *
 * @note keyring_to_link_vk may be passed in various string formats:
 * 	 It can be kernel key numeric id of existing keyring written as a string,
- * 	 keyring name prefixed optionally be either "%:" or "%keyring:" substrings or keyctl
+ * 	 keyring name prefixed by either "%:" or "%keyring:" substrings or keyctl
 * 	 special values for keyrings "@t", "@p", "@s" and so on. See keyctl(1) man page,
 * 	 section KEY IDENTIFIERS for more information. All other prefixes starting "%<type>:"
 * 	 are ignored.
--- a/man/common_options.adoc
+++ b/man/common_options.adoc
--- a/man/cryptsetup-ssh.8.adoc
+++ b/man/cryptsetup-ssh.8.adoc
@@ -37,6 +37,15 @@ required for this operation.

 == OPTIONS

+*--debug*::
+Show debug messages
+
+*--debug-json*::
+Show debug messages including JSON metadata
+
+*--help, -?*::
+Show help
+
 **--key-slot**=_NUM_::
 Keyslot to assign the token to. If not specified, the token will be
 assigned to the first key slot matching provided passphrase.
@@ -53,18 +62,9 @@ IP address/URL of the remote server for this token.
 **--ssh-user**=_STRING_::
 Username used for the remote server.

-*--debug*::
-Show debug messages
-
-*--debug-json*::
-Show debug messages including JSON metadata
-
 *--verbose, -v*::
 Shows more detailed error messages

-*--help, -?*::
-Show help
-
 *--version, -V*::
 Print program version

--- a/man/integritysetup.8.adoc
+++ b/man/integritysetup.8.adoc
@@ -89,44 +89,80 @@ kernel version 5.7, shrinking should work on older kernels too.
 *<options>* can be [--size, --device-size, --wipe].

 == OPTIONS
-*--progress-frequency <seconds>*::
-Print separate line every <seconds> with wipe progress.
+*--allow-discards*::
+Allow the use of discard (TRIM) requests for the device. This option
+is available since the Linux kernel version 5.7.

-*--progress-json*::
-Prints wipe progress data in json format suitable mostly for machine
-processing. It prints separate line every half second (or based on
--progress-frequency value). The JSON output looks as follows during
-wipe progress (except it's compact single line):
+*--batch-mode, -q*::
+Do not ask for confirmation.
+
+*--bitmap-flush-time MS*::
+Bitmap flush time in milliseconds.
 +
-....
-{
-  "device":"/dev/sda"       // backing device or file
-  "device_bytes":"8192",    // bytes wiped so far
-  "device_size":"44040192", // total bytes to wipe
-  "speed":"126877696",      // calculated speed in bytes per second (based on progress so far)
-  "eta_ms":"2520012"        // estimated time to finish wipe in milliseconds
-  "time_ms":"5561235"       // total time spent wiping device in milliseconds
-}
-....
+*WARNING:*
+In case of a crash, it is possible that the data and integrity tag
+doesn't match if the journal is disabled.
+
+*--bitmap-sectors-per-bit SECTORS*::
+Number of 512-byte sectors per bitmap bit, the value must be power of
+two.
+
+*--buffer-sectors SECTORS*::
+The number of sectors in one buffer.
 +
-Note on numbers in JSON output: Due to JSON parsers limitations all
-numbers are represented in a string format due to need of full 64bit
-unsigned integers.
+The tag area is accessed using buffers, the large buffer size means that
+the I/O size will be larger, but there could be less I/Os issued.

-*--no-wipe*::
-Do not wipe the device after format. A device that is not initially
-wiped will contain invalid checksums.
+*--cancel-deferred*::
+Removes a previously configured deferred device removal in *close*
+command.

-*--wipe*::
-Wipe the newly allocated area after resize to bigger size. If this
-flag is not set, checksums will be calculated for the data previously
-stored in the newly allocated area.
+*--data-device <data_device>*::
+Specify a separate data device that contains existing data. The
+<device> then will contain calculated integrity tags and journal for
+data on <data_device>.
+
+*NOTE:* To not wipe the data device after initial format, also specify
+--no-wipe option and activate with --integrity-recalculate to
+automatically recalculate integrity tags.

-*--journal-size, -j BYTES*::
-Size of the journal.
+*--debug*::
+Run in debug mode with full diagnostic logs. Debug output lines are
+always prefixed by *#*.

-*--interleave-sectors SECTORS*::
-The number of interleaved sectors.
+*--deferred*::
+Defers device removal in *close* command until the last user closes
+it.
+
+*--help, -?*::
+Show help text and default parameters.
+
+*--integrity, -I ALGORITHM*::
+Use internal integrity calculation (standalone mode). The integrity
+algorithm can be CRC (crc32c/crc32), non-cryptographic hash function
+(xxhash64) or hash function (sha1, sha256).
+
+For HMAC (hmac-sha256) you have also to specify an integrity key and its
+size.
+
+*--integrity-bitmap-mode. -B*::
+Use alternate bitmap mode (available since Linux kernel 5.2) where
+dm-integrity uses bitmap instead of a journal. If a bit in the bitmap
+is 1, the corresponding region's data and integrity tags are not
+synchronized - if the machine crashes, the unsynchronized regions will
+be recalculated. The bitmap mode is faster than the journal mode,
+because we don't have to write the data twice, but it is also less
+reliable, because if data corruption happens when the machine crashes,
+it may not be detected.
+
+*--integrity-key-file FILE*::
+The file with the integrity key.
+
+*--integrity-key-size BYTES*::
+The size of the data integrity key. Maximum is 4096 bytes.
+
+*--integrity-no-journal, -D*::
+Disable journal for integrity device.

 *--integrity-recalculate*::
 Automatically recalculate integrity tags in kernel on activation. The
@@ -141,14 +177,78 @@ to change the integrity checksum function. Note it does not change the
 tag length. This option is available since the Linux kernel version
 5.13.

-*--journal-watermark PERCENT*::
-Journal watermark in percents. When the size of the journal exceeds
-this watermark, the journal flush will be started.
+*--integrity-recovery-mode. -R*::
+Recovery mode (no journal, no tag checking).
+
+*--interleave-sectors SECTORS*::
+The number of interleaved sectors.

 *--journal-commit-time MS*::
 Commit time in milliseconds. When this time passes (and no explicit
 flush operation was issued), the journal is written.

+*--journal-crypt ALGORITHM*::
+Encryption algorithm for journal data area. You can use a block cipher
+here such as cbc-aes or a stream cipher, for example, chacha20 or
+ctr-aes.
+
+*NOTE:* The journal encryption options are only intended for testing.
+Using journal encryption does not make sense without encryption of the data.
+
+*--journal-crypt-key-file FILE*::
+The file with the journal encryption key.
+
+*--journal-crypt-key-size BYTES*::
+The size of the journal encryption key. Maximum is 4096 bytes.
+
+*--journal-integrity ALGORITHM*::
+Integrity algorithm for journal area. See --integrity option for
+detailed specification.
+
+*--journal-integrity-key-file FILE*::
+The file with the integrity key.
+
+*--journal-integrity-key-size BYTES*::
+The size of the journal integrity key. Maximum is 4096 bytes.
+
+*--journal-size, -j BYTES*::
+Size of the journal.
+
+*--journal-watermark PERCENT*::
+Journal watermark in percents. When the size of the journal exceeds
+this watermark, the journal flush will be started.
+
+*--no-wipe*::
+Do not wipe the device after format. A device that is not initially
+wiped will contain invalid checksums.
+
+*--progress-frequency <seconds>*::
+Print separate line every <seconds> with wipe progress.
+
+*--progress-json*::
+Prints wipe progress data in json format suitable mostly for machine
+processing. It prints separate line every half second (or based on
+--progress-frequency value). The JSON output looks as follows during
+wipe progress (except it's compact single line):
+
+....
+{
+  "device":"/dev/sda",      // backing device or file
+  "device_bytes":"8192",    // bytes wiped so far
+  "device_size":"44040192", // total bytes to wipe
+  "speed":"126877696",      // calculated speed in bytes per second (based on progress so far)
+  "eta_ms":"2520012",       // estimated time to finish wipe in milliseconds
+  "time_ms":"5561235"       // total time spent wiping device in milliseconds
+}
+....
+
+Note on numbers in JSON output: Due to JSON parsers limitations all
+numbers are represented in a string format due to need of full 64bit
+unsigned integers.
+
+*--sector-size, -s BYTES*::
+Sector size (power of two: 512, 1024, 2048, 4096).
+
 *--tag-size, -t BYTES*::
 Size of the integrity tag per-sector (here the integrity function will
 store authentication tag).
@@ -156,121 +256,19 @@ store authentication tag).
 *NOTE:* The size can be smaller that output size of the hash function,
 in that case only part of the hash will be stored.

-*--data-device <data_device>*::
-Specify a separate data device that contains existing data. The
-<device> then will contain calculated integrity tags and journal for
-data on <data_device>.
-+
-*NOTE:* To not wipe the data device after initial format, also specify
--no-wipe option and activate with --integrity-recalculate to
-automatically recalculate integrity tags.
-
-*--sector-size, -s BYTES*::
-Sector size (power of two: 512, 1024, 2048, 4096).
-
-*--buffer-sectors SECTORS*::
-The number of sectors in one buffer.
-+
-The tag area is accessed using buffers, the large buffer size means that
-the I/O size will be larger, but there could be less I/Os issued.
-
-*--integrity, -I ALGORITHM*::
-Use internal integrity calculation (standalone mode). The integrity
-algorithm can be CRC (crc32c/crc32), non-cryptographic hash function
-(xxhash64) or hash function (sha1, sha256).
-+
-For HMAC (hmac-sha256) you have also to specify an integrity key and its
-size.
-
-*--integrity-key-size BYTES*::
-The size of the data integrity key. Maximum is 4096 bytes.
-
-*--integrity-key-file FILE*::
-The file with the integrity key.
-
-*--integrity-no-journal, -D*::
-Disable journal for integrity device.
-
-*--integrity-bitmap-mode. -B*::
-Use alternate bitmap mode (available since Linux kernel 5.2) where
-dm-integrity uses bitmap instead of a journal. If a bit in the bitmap
-is 1, the corresponding region's data and integrity tags are not
-synchronized - if the machine crashes, the unsynchronized regions will
-be recalculated. The bitmap mode is faster than the journal mode,
-because we don't have to write the data twice, but it is also less
-reliable, because if data corruption happens when the machine crashes,
-it may not be detected.
-
-*--bitmap-sectors-per-bit SECTORS*::
-Number of 512-byte sectors per bitmap bit, the value must be power of
-two.
-
-*--bitmap-flush-time MS*::
-Bitmap flush time in milliseconds.
-+
-*WARNING:*::
-In case of a crash, it is possible that the data and integrity tag
-doesn't match if the journal is disabled.
-
-*--integrity-recovery-mode. -R*::
-Recovery mode (no journal, no tag checking).
-
-*NOTE:* The following options are intended for testing purposes only.:
-Using journal encryption does not make sense without encryption the
-data, these options are internally used in authenticated disk
-encryption with *cryptsetup(8)*.
-
-*--journal-integrity ALGORITHM*::
-Integrity algorithm for journal area. See --integrity option for
-detailed specification.
-
-*--journal-integrity-key-size BYTES*::
-The size of the journal integrity key. Maximum is 4096 bytes.
-
-*--journal-integrity-key-file FILE*::
-The file with the integrity key.
-
-*--journal-crypt ALGORITHM*::
-Encryption algorithm for journal data area. You can use a block cipher
-here such as cbc-aes or a stream cipher, for example, chacha20 or
-ctr-aes.
-
-*--journal-crypt-key-size BYTES*::
-The size of the journal encryption key. Maximum is 4096 bytes.
-
-*--journal-crypt-key-file FILE*::
-The file with the journal encryption key.
-
-*--allow-discards*::
-Allow the use of discard (TRIM) requests for the device. This option
-is available since the Linux kernel version 5.7.
-
-*--deferred*::
-Defers device removal in *close* command until the last user closes
-it.
-
-*--cancel-deferred*::
-Removes a previously configured deferred device removal in *close*
-command.
+*--usage*::
+Show short option help.

 *--verbose, -v*::
 Print more information on command execution.

-*--debug*::
-Run in debug mode with full diagnostic logs. Debug output lines are
-always prefixed by *#*.
-
 *--version, -V*::
 Show the program version.

-*--batch-mode, -q*::
-Do not ask for confirmation.
-
-*--usage*::
-Show short option help.
-
-*--help, -?*::
-Show help text and default parameters.
+*--wipe*::
+Wipe the newly allocated area after resize to bigger size. If this
+flag is not set, checksums will be calculated for the data previously
+stored in the newly allocated area.

 == LEGACY COMPATIBILITY OPTIONS

--- a/man/veritysetup.8.adoc
+++ b/man/veritysetup.8.adoc
@@ -109,59 +109,12 @@ Reports parameters of verity device from on-disk stored superblock.
 *<options>* can be [--hash-offset].

 == OPTIONS
+*--batch-mode, -q*::
+Do not ask for confirmation.

-*--no-superblock*::
-Create or use dm-verity without permanent on-disk superblock.
-
-*--format=number*::
-Specifies the hash version type. Format type 0 is original Chrome OS
-version. Format type 1 is current version.
-
-*--data-block-size=bytes*::
-Used block size for the data device. (Note kernel supports only
-page-size as maximum here.)
-
-*--hash-block-size=bytes*::
-Used block size for the hash device. (Note kernel supports only
-page-size as maximum here.)
-
-*--data-blocks=blocks*::
-Size of data device used in verification. If not specified, the whole
-device is used.
-
-*--hash-offset=bytes*::
-Offset of hash area/superblock on hash_device. Value must be aligned
-to disk sector offset.
-
-*--salt=hex string*::
-Salt used for format or verification. Format is a hexadecimal string.
-
-*--uuid=UUID*::
-Use the provided UUID for format command instead of generating new
-one.
-+
-The UUID must be provided in standard UUID format, e.g.
-12345678-1234-1234-1234-123456789abc.
-*--ignore-corruption , --restart-on-corruption ,
--panic-on-corruption*::
-Defines what to do if data integrity problem is detected (data
-corruption).
-+
-Without these options kernel fails the IO operation with I/O error. With
--ignore-corruption option the corruption is only logged. With
--restart-on-corruption or --panic-on-corruption the kernel is restarted
-(panicked) immediately. (You have to provide way how to avoid restart
-loops.)
-+
-*WARNING:* Use these options only for very specific cases. These options
-are available since Linux kernel version 4.1.
-
-*--ignore-zero-blocks*::
-Instruct kernel to not verify blocks that are expected to contain
-zeroes and always directly return zeroes instead.
-+
-*WARNING:* Use this option only in very specific cases. This option is
-available since Linux kernel version 4.5.
+*--cancel-deferred*::
+Removes a previously configured deferred device removal in *close*
+command.

 *--check-at-most-once*::
 Instruct kernel to verify blocks only the first time they are read
@@ -171,8 +124,21 @@ from the data device, rather than every time.
 tampering of the data device's content will be detected, not online
 tampering. This option is available since Linux kernel version 4.17.

-*--hash=hash*::
-Hash algorithm for dm-verity. For default see --help option.
+*--data-blocks=blocks*::
+Size of data device used in verification. If not specified, the whole
+device is used.
+
+*--data-block-size=bytes*::
+Used block size for the data device. (Note kernel supports only
+page-size as maximum here.)
+
+*--debug*::
+Run in debug mode with full diagnostic logs. Debug output lines are
+always prefixed by *#*.
+
+*--deferred*::
+Defers device removal in *close* command until the last user closes
+it.

 *--fec-device=fec_device*::
 Use forward error correction (FEC) to recover from corruption if hash
@@ -205,6 +171,47 @@ Number of generator roots. This equals to the number of parity bytes
 in the encoding data. In RS(M, N) encoding, the number of roots is
 M-N. M is 255 and M-N is between 2 and 24 (including).

+*--format=number*::
+Specifies the hash version type. Format type 0 is original Chrome OS
+version. Format type 1 is current version.
+
+*--hash=hash*::
+Hash algorithm for dm-verity. For default see --help option.
+
+*--hash-block-size=bytes*::
+Used block size for the hash device. (Note kernel supports only
+page-size as maximum here.)
+
+*--hash-offset=bytes*::
+Offset of hash area/superblock on hash_device. Value must be aligned
+to disk sector offset.
+
+*--help, -?*::
+Show help text and default parameters.
+
+*--ignore-corruption, --restart-on-corruption, --panic-on-corruption*::
+Defines what to do if data integrity problem is detected (data
+corruption).
+
+Without these options kernel fails the IO operation with I/O error. With
+--ignore-corruption option the corruption is only logged. With
+--restart-on-corruption or --panic-on-corruption the kernel is restarted
+(panicked) immediately. (You have to provide way how to avoid restart
+loops.)
+
+*WARNING:* Use these options only for very specific cases. These options
+are available since Linux kernel version 4.1.
+
+*--ignore-zero-blocks*::
+Instruct kernel to not verify blocks that are expected to contain
+zeroes and always directly return zeroes instead.
+
+*WARNING:* Use this option only in very specific cases. This option is
+available since Linux kernel version 4.5.
+
+*--no-superblock*::
+Create or use dm-verity without permanent on-disk superblock.
+
 *--root-hash-file=FILE*::
 Path to file with stored root hash in hex-encoded text.

@@ -213,36 +220,28 @@ Path to root hash signature file used to verify the root hash (in
 kernel). This feature requires Linux kernel version 5.4 or more
 recent.

-*--use-tasklets*::
-Try to use kernel tasklets in dm-verity driver for performance reasons.
-This option is available since Linux kernel version 6.0.
-
-*--deferred*::
-Defers device removal in *close* command until the last user closes
-it.
-
-*--cancel-deferred*::
-Removes a previously configured deferred device removal in *close*
-command.
-
-*--verbose, -v*::
-Print more information on command execution.
-
-*--debug*::
-Run in debug mode with full diagnostic logs. Debug output lines are
-always prefixed by *#*.
-
-*--version, -V*::
-Show the program version.
-
-*--batch-mode, -q*::
-Do not ask for confirmation.
+*--salt=hex string*::
+Salt used for format or verification. Format is a hexadecimal string.

 *--usage*::
 Show short option help.

-*--help, -?*::
-Show help text and default parameters.
+*--use-tasklets*::
+Try to use kernel tasklets in dm-verity driver for performance reasons.
+This option is available since Linux kernel version 6.0.
+
+*--uuid=UUID*::
+Use the provided UUID for format command instead of generating new
+one.
+
+The UUID must be provided in standard UUID format, e.g.
+12345678-1234-1234-1234-123456789abc.
+
+*--verbose, -v*::
+Print more information on command execution.
+
+*--version, -V*::
+Show the program version.

 == RETURN CODES

--- a/meson.build
+++ b/meson.build
@@ -2,7 +2,7 @@ project('cryptsetup',
    'c',
    default_options: [ 'prefix=/usr' ],
    meson_version: '>=0.64',
-    version: '2.7.0')
+    version: '2.7.1')

 libcryptsetup_version = '12.10.0'

@@ -512,6 +512,9 @@ elif get_option('crypto-backend') == 'openssl'
    conf.set10('HAVE_DECL_OSSL_KDF_PARAM_ARGON2_VERSION',
        cc.has_header_symbol('openssl/core_names.h', 'OSSL_KDF_PARAM_ARGON2_VERSION',
            dependencies: crypto_backend_library))
+    if conf.get('HAVE_DECL_OSSL_KDF_PARAM_ARGON2_VERSION') == 1
+        use_internal_argon2 = false
+    endif
 elif get_option('crypto-backend') == 'nss'
    if get_option('fips')
        error('nss crypto backend is not supported with FIPS enabled')
@@ -560,7 +563,7 @@ threads = []
 use_internal_sse_argon2 = false
 if not use_internal_argon2 or get_option('argon-implementation') == 'none'
    if get_option('argon-implementation') == 'internal' or get_option('argon-implementation') == 'libargon2'
-        warning('Argon2 in crypto library is used; internal Argon2 options are ignored.')
+        message('Argon2 in crypto library is used; internal Argon2 options are ignored.')
    endif
    conf.set10('USE_INTERNAL_ARGON2', false,
        description: 'Use internal Argon2.')
--- a/misc/fedora/cryptsetup.spec
+++ b/misc/fedora/cryptsetup.spec
@@ -2,13 +2,13 @@

 Summary: Utility for setting up encrypted disks
 Name: cryptsetup
-Version: 2.7.0
+Version: 2.7.1
 Release: 1%{?dist}
 License: GPL-2.0-or-later WITH cryptsetup-OpenSSL-exception AND LGPL-2.1-or-later WITH cryptsetup-OpenSSL-exception
 URL: https://gitlab.com/cryptsetup/cryptsetup
 BuildRequires: autoconf, automake, libtool, gettext-devel,
 BuildRequires: openssl-devel, popt-devel, device-mapper-devel
-BuildRequires: libuuid-devel, gcc, json-c-devel, libargon2-devel
+BuildRequires: libuuid-devel, gcc, json-c-devel
 BuildRequires: libpwquality-devel, libblkid-devel
 BuildRequires: make libssh-devel
 BuildRequires: asciidoctor
@@ -70,7 +70,7 @@ disk integrity protection using dm-integrity kernel module.
 rm -f man/*.8

 ./autogen.sh
-%configure --enable-fips --enable-pwquality --enable-libargon2 --enable-asciidoc
+%configure --enable-fips --enable-pwquality --enable-asciidoc
 %make_build

 %install
--- a/po/cryptsetup.pot
+++ b/po/cryptsetup.pot
@@ -5,9 +5,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: cryptsetup 2.7.0\n"
+"Project-Id-Version: cryptsetup 2.7.1\n"
 "Report-Msgid-Bugs-To: cryptsetup@lists.linux.dev\n"
-"POT-Creation-Date: 2024-01-24 09:44+0100\n"
+"POT-Creation-Date: 2024-03-07 15:42+0100\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -191,7 +191,7 @@ msgstr ""
 #: lib/luks2/luks2_json_metadata.c:1374 src/cryptsetup.c:1878
 #: src/cryptsetup.c:2059 src/cryptsetup.c:2114 src/cryptsetup.c:2319
 #: src/cryptsetup.c:2489 src/cryptsetup.c:2770 src/cryptsetup.c:3078
-#: src/cryptsetup.c:3146 src/utils_reencrypt.c:1488
+#: src/cryptsetup.c:3146 src/utils_reencrypt.c:1498
 #: src/utils_reencrypt_luks1.c:1192 tokens/ssh/cryptsetup-ssh.c:85
 #, c-format
 msgid "Device %s is not a valid LUKS device."
@@ -760,7 +760,7 @@ msgid "Cannot read requested amount of data."
 msgstr ""

 #: lib/utils_device.c:213 lib/utils_storage_wrappers.c:110
-#: lib/luks1/keyencryption.c:91 src/utils_reencrypt.c:1461
+#: lib/luks1/keyencryption.c:91 src/utils_reencrypt.c:1471
 #, c-format
 msgid "Device %s does not exist or access denied."
 msgstr ""
@@ -2111,7 +2111,7 @@ msgid "Enter token %d PIN: "
 msgstr ""

 #: src/cryptsetup.c:196 src/cryptsetup.c:1182 src/cryptsetup.c:1523
-#: src/utils_reencrypt.c:1137 src/utils_reencrypt_luks1.c:517
+#: src/utils_reencrypt.c:1146 src/utils_reencrypt_luks1.c:517
 #: src/utils_reencrypt_luks1.c:580
 msgid "No known cipher specification pattern detected."
 msgstr ""
@@ -2149,7 +2149,7 @@ msgid ""
 msgstr ""

 #: src/cryptsetup.c:266 src/cryptsetup.c:1368 src/cryptsetup.c:1566
-#: src/integritysetup.c:197 src/utils_reencrypt.c:1346
+#: src/integritysetup.c:197 src/utils_reencrypt.c:1355
 #, c-format
 msgid "Blkid scan failed for %s."
 msgstr ""
@@ -2165,7 +2165,7 @@ msgstr ""
 #: src/cryptsetup.c:1375 src/cryptsetup.c:1500 src/cryptsetup.c:1578
 #: src/cryptsetup.c:2622 src/cryptsetup.c:3049 src/integritysetup.c:187
 #: src/utils_reencrypt.c:138 src/utils_reencrypt.c:314
-#: src/utils_reencrypt.c:764
+#: src/utils_reencrypt.c:772
 msgid "Operation aborted.\n"
 msgstr ""

@@ -3549,37 +3549,37 @@ msgstr ""
 msgid "Can't do passphrase verification on non-tty inputs."
 msgstr ""

-#: src/utils_luks.c:183
+#: src/utils_luks.c:186
 #, c-format
 msgid "Failed to open file %s in read-only mode."
 msgstr ""

-#: src/utils_luks.c:196
+#: src/utils_luks.c:199
 msgid "Provide valid LUKS2 token JSON:\n"
 msgstr ""

-#: src/utils_luks.c:203
+#: src/utils_luks.c:206
 msgid "Failed to read JSON file."
 msgstr ""

-#: src/utils_luks.c:208
+#: src/utils_luks.c:211
 msgid ""
 "\n"
 "Read interrupted."
 msgstr ""

-#: src/utils_luks.c:249
+#: src/utils_luks.c:252
 #, c-format
 msgid "Failed to open file %s in write mode."
 msgstr ""

-#: src/utils_luks.c:258
+#: src/utils_luks.c:261
 msgid ""
 "\n"
 "Write interrupted."
 msgstr ""

-#: src/utils_luks.c:262
+#: src/utils_luks.c:265
 msgid "Failed to write JSON file."
 msgstr ""

@@ -3667,7 +3667,7 @@ msgid ""
 "(block size: %<PRIu32> bytes) detected on device %s."
 msgstr ""

-#: src/utils_reencrypt.c:533 src/utils_reencrypt.c:1412
+#: src/utils_reencrypt.c:533 src/utils_reencrypt.c:1421
 msgid ""
 "Encryption without detached header (--header) is not possible without data "
 "device size reduction (--reduce-device-size)."
@@ -3723,124 +3723,124 @@ msgstr ""
 msgid "Original LUKS2 header restore failed."
 msgstr ""

-#: src/utils_reencrypt.c:759
+#: src/utils_reencrypt.c:765
 #, c-format
 msgid ""
 "Header file %s does not exist. Do you want to initialize LUKS2 decryption of "
 "device %s and export LUKS2 header to file %s?"
 msgstr ""

-#: src/utils_reencrypt.c:807
+#: src/utils_reencrypt.c:815
 msgid "Failed to add read/write permissions to exported header file."
 msgstr ""

-#: src/utils_reencrypt.c:860
+#: src/utils_reencrypt.c:869
 #, c-format
 msgid "Reencryption initialization failed. Header backup is available in %s."
 msgstr ""

-#: src/utils_reencrypt.c:888
+#: src/utils_reencrypt.c:897
 msgid ""
 "LUKS2 decryption is supported with detached header device only (with data "
 "offset set to 0)."
 msgstr ""

-#: src/utils_reencrypt.c:1023 src/utils_reencrypt.c:1032
+#: src/utils_reencrypt.c:1032 src/utils_reencrypt.c:1041
 msgid "Not enough free keyslots for reencryption."
 msgstr ""

-#: src/utils_reencrypt.c:1053 src/utils_reencrypt_luks1.c:1100
+#: src/utils_reencrypt.c:1062 src/utils_reencrypt_luks1.c:1100
 msgid ""
 "Key file can be used only with --key-slot or with exactly one key slot "
 "active."
 msgstr ""

-#: src/utils_reencrypt.c:1062 src/utils_reencrypt_luks1.c:1147
+#: src/utils_reencrypt.c:1071 src/utils_reencrypt_luks1.c:1147
 #: src/utils_reencrypt_luks1.c:1158
 #, c-format
 msgid "Enter passphrase for key slot %d: "
 msgstr ""

-#: src/utils_reencrypt.c:1074
+#: src/utils_reencrypt.c:1083
 #, c-format
 msgid "Enter passphrase for key slot %u: "
 msgstr ""

-#: src/utils_reencrypt.c:1126
+#: src/utils_reencrypt.c:1135
 #, c-format
 msgid "Switching data encryption cipher to %s.\n"
 msgstr ""

-#: src/utils_reencrypt.c:1180
+#: src/utils_reencrypt.c:1189
 msgid "No data segment parameters changed. Reencryption aborted."
 msgstr ""

-#: src/utils_reencrypt.c:1282
+#: src/utils_reencrypt.c:1291
 msgid ""
 "Encryption sector size increase on offline device is not supported.\n"
 "Activate the device first or use --force-offline-reencrypt option "
 "(dangerous!)."
 msgstr ""

-#: src/utils_reencrypt.c:1322 src/utils_reencrypt_luks1.c:726
+#: src/utils_reencrypt.c:1331 src/utils_reencrypt_luks1.c:726
 #: src/utils_reencrypt_luks1.c:798
 msgid ""
 "\n"
 "Reencryption interrupted."
 msgstr ""

-#: src/utils_reencrypt.c:1327
+#: src/utils_reencrypt.c:1336
 msgid "Resuming LUKS reencryption in forced offline mode.\n"
 msgstr ""

-#: src/utils_reencrypt.c:1350
+#: src/utils_reencrypt.c:1359
 #, c-format
 msgid "Device %s contains broken LUKS metadata. Aborting operation."
 msgstr ""

-#: src/utils_reencrypt.c:1366 src/utils_reencrypt.c:1388
+#: src/utils_reencrypt.c:1375 src/utils_reencrypt.c:1397
 #, c-format
 msgid "Device %s is already LUKS device. Aborting operation."
 msgstr ""

-#: src/utils_reencrypt.c:1394
+#: src/utils_reencrypt.c:1403
 #, c-format
 msgid "Device %s is already in LUKS reencryption. Aborting operation."
 msgstr ""

-#: src/utils_reencrypt.c:1476
+#: src/utils_reencrypt.c:1486
 msgid "LUKS2 decryption requires --header option."
 msgstr ""

-#: src/utils_reencrypt.c:1524
+#: src/utils_reencrypt.c:1534
 msgid "Command requires device as argument."
 msgstr ""

-#: src/utils_reencrypt.c:1537
+#: src/utils_reencrypt.c:1547
 #, c-format
 msgid "Conflicting versions. Device %s is LUKS1."
 msgstr ""

-#: src/utils_reencrypt.c:1543
+#: src/utils_reencrypt.c:1553
 #, c-format
 msgid "Conflicting versions. Device %s is in LUKS1 reencryption."
 msgstr ""

-#: src/utils_reencrypt.c:1549
+#: src/utils_reencrypt.c:1559
 #, c-format
 msgid "Conflicting versions. Device %s is LUKS2."
 msgstr ""

-#: src/utils_reencrypt.c:1555
+#: src/utils_reencrypt.c:1565
 #, c-format
 msgid "Conflicting versions. Device %s is in LUKS2 reencryption."
 msgstr ""

-#: src/utils_reencrypt.c:1561
+#: src/utils_reencrypt.c:1571
 msgid "LUKS2 reencryption already initialized. Aborting operation."
 msgstr ""

-#: src/utils_reencrypt.c:1568
+#: src/utils_reencrypt.c:1578
 msgid "Device reencryption not in progress."
 msgstr ""

--- a/po/cs.po
+++ b/po/cs.po
--- a/po/de.po
+++ b/po/de.po
--- a/po/fr.po
+++ b/po/fr.po
--- a/po/ja.po
+++ b/po/ja.po
--- a/po/pl.po
+++ b/po/pl.po
--- a/po/ro.po
+++ b/po/ro.po
--- a/po/uk.po
+++ b/po/uk.po
--- a/src/utils_luks.c
+++ b/src/utils_luks.c
@@ -104,6 +104,9 @@ void set_activation_flags(uint32_t *flags)
            (ARG_SET(OPT_KEY_SLOT_ID) || ARG_SET(OPT_UNBOUND_ID)))
 		*flags |= CRYPT_ACTIVATE_ALLOW_UNBOUND_KEY;

+	if (ARG_SET(OPT_LINK_VK_TO_KEYRING_ID))
+		*flags |= CRYPT_ACTIVATE_KEYRING_KEY;
+
 	if (ARG_SET(OPT_SERIALIZE_MEMORY_HARD_PBKDF_ID))
 		*flags |= CRYPT_ACTIVATE_SERIALIZE_MEMORY_HARD_PBKDF;

--- a/src/utils_reencrypt.c
+++ b/src/utils_reencrypt.c
@@ -736,50 +736,58 @@ static int reencrypt_restore_header(struct crypt_device **cd,
 }

 static int decrypt_luks2_datashift_init(struct crypt_device **cd,
-	const char *data_device,
 	const char *expheader)
 {
 	int fd, r;
 	size_t passwordLen;
 	struct stat hdr_st;
+	char *msg, *data_device, *active_name = NULL, *password = NULL;
 	bool remove_header = false;
-	char *msg, *active_name = NULL, *password = NULL;
 	struct crypt_params_reencrypt params = {
 		.mode = CRYPT_REENCRYPT_DECRYPT,
 		.direction = CRYPT_REENCRYPT_FORWARD,
 		.resilience = "datashift-checksum",
 		.hash = ARG_STR(OPT_RESILIENCE_HASH_ID) ?: "sha256",
-		.data_shift = crypt_get_data_offset(*cd),
 		.device_size = ARG_UINT64(OPT_DEVICE_SIZE_ID) / SECTOR_SIZE,
 		.max_hotzone_size = ARG_UINT64(OPT_HOTZONE_SIZE_ID) / SECTOR_SIZE,
 		.flags = CRYPT_REENCRYPT_MOVE_FIRST_SEGMENT
 	};

+	assert(expheader);
+	assert(cd && *cd);
+
+	params.data_shift = crypt_get_data_offset(*cd);
+
+	if (!(data_device = strdup(crypt_get_device_name(*cd))))
+		return -ENOMEM;
+
 	if (!ARG_SET(OPT_BATCH_MODE_ID)) {
 		r = asprintf(&msg, _("Header file %s does not exist. Do you want to initialize LUKS2 "
 				     "decryption of device %s and export LUKS2 header to file %s?"),
 			     expheader, data_device, expheader);
-		if (r < 0)
-			return -ENOMEM;
+		if (r < 0) {
+			r = -ENOMEM;
+			goto out;
+		}
 		r = yesDialog(msg, _("Operation aborted.\n")) ? 0 : -EINVAL;
 		free(msg);
 		if (r < 0)
-			return r;
+			goto out;
 	}

 	if ((r = decrypt_verify_and_set_params(&params)))
-		return r;
+		goto out;

 	r = reencrypt_hint_force_offline_reencrypt(data_device);
 	if (r < 0)
-		return r;
+		goto out;

 	r = tools_get_key(NULL, &password, &passwordLen,
 			ARG_UINT64(OPT_KEYFILE_OFFSET_ID), ARG_UINT32(OPT_KEYFILE_SIZE_ID),
 			ARG_STR(OPT_KEY_FILE_ID), ARG_UINT32(OPT_TIMEOUT_ID),
 			verify_passphrase(0), 0, *cd);
 	if (r < 0)
-		return r;
+		goto out;

 	r = reencrypt_check_passphrase(*cd, ARG_INT32(OPT_KEY_SLOT_ID), password, passwordLen);
 	if (r < 0)
@@ -854,6 +862,7 @@ static int decrypt_luks2_datashift_init(struct crypt_device **cd,
 	}
 out:
 	free(active_name);
+	free(data_device);
 	crypt_safe_free(password);

 	if (r < 0 && !remove_header && !stat(expheader, &hdr_st) && S_ISREG(hdr_st.st_mode))
@@ -1442,7 +1451,8 @@ static int _decrypt(struct crypt_device **cd, enum device_status_info dev_st, co

 	assert(cd);

-	if (dev_st == DEVICE_LUKS1 || dev_st == DEVICE_LUKS1_UNUSABLE)
+	if (dev_st == DEVICE_LUKS1 || dev_st == DEVICE_LUKS1_UNUSABLE ||
+	    (dev_st == DEVICE_NOT_LUKS && ARG_SET(OPT_UUID_ID) && !ARG_SET(OPT_HEADER_ID)))
 		return reencrypt_luks1(data_device);

 	/* header file does not exist, try loading device type from data device */
@@ -1478,7 +1488,7 @@ static int _decrypt(struct crypt_device **cd, enum device_status_info dev_st, co
 		}

 		if (export_header)
-			r = decrypt_luks2_datashift_init(cd, data_device, ARG_STR(OPT_HEADER_ID));
+			r = decrypt_luks2_datashift_init(cd, ARG_STR(OPT_HEADER_ID));
 		else
 			r = decrypt_luks2_init(*cd, data_device);

--- a/tests/LUKS-d238e48a-0ed3-4169-b841-f26b44693134.tar.xz
+++ b/tests/LUKS-d238e48a-0ed3-4169-b841-f26b44693134.tar.xz
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -55,7 +55,7 @@ EXTRA_DIST = compatimage.img.xz compatv10image.img.xz \
 	compatimage2.img.xz \
 	conversion_imgs.tar.xz \
 	luks2_keyslot_unassigned.img.xz \
-	img_fs_ext4.img.xz img_fs_vfat.img.xz img_fs_xfs.img.xz \
+	img_fs_ext4.img.xz img_fs_vfat.img.xz img_fs_xfs.img.xz img_fs_xfs5.img.xz \
 	xfs_512_block_size.img.xz \
 	valid_header_file.xz \
 	luks2_valid_hdr.img.xz \
@@ -100,7 +100,8 @@ EXTRA_DIST = compatimage.img.xz compatv10image.img.xz \
 	run-all-symbols \
 	fake_systemd_tpm_path.c \
 	unit-wipe-test \
-	systemd-test-plugin
+	systemd-test-plugin \
+	LUKS-d238e48a-0ed3-4169-b841-f26b44693134.tar.xz

 CLEANFILES = cryptsetup-tst* valglog* *-fail-*.log test-symbols-list.h fake_systemd_tpm_path.so
 clean-local:
--- a/tests/align-test
+++ b/tests/align-test
@@ -292,7 +292,7 @@ format_plain_fail 4096
 cleanup

 # skip tests using empty passphrase (LUKS1 cipher_null)
-if [ ! fips_mode ]; then
+if ! fips_mode; then
 echo "# Offset check: 512B sector drive"
 add_device dev_size_mb=16 sector_size=512 num_tgts=1
 #           |k| expO reqO expected slot offsets
@@ -338,12 +338,19 @@ echo "# Create enterprise-class 4K drive with fs and LUKS images."
 # cryptsetup should properly use 4k block on direct-io
 add_device dev_size_mb=32 sector_size=4096 physblk_exp=0 num_tgts=1 opt_blks=64
 for file in $(ls img_fs_*.img.xz) ; do
-	echo "Format using fs image $file."
+	echo -n "Format using fs image $file "
 	xz -d -c $file | dd of=$DEV bs=1M 2>/dev/null || fail "bad image"
 	[ ! -d $MNT_DIR ] && mkdir $MNT_DIR
-	mount $DEV $MNT_DIR || skip "Mounting image is not available."
+	mount $DEV $MNT_DIR 2>/dev/null
+	if [ $? -ne 0 ] ; then
+		echo "[N/A]"
+		continue
+	fi
 	echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 --key-size 256 $FAST_PBKDF $MNT_DIR/luks.img || fail
 	echo $PWD2 | $CRYPTSETUP luksFormat --type luks1 --key-size 256 $FAST_PBKDF $MNT_DIR/luks.img --header $MNT_DIR/luks_header.img || fail
-	umount $MNT_DIR
+	umount $MNT_DIR || fail
+	echo "[OK]"
 done
 cleanup
+
+exit 0
--- a/tests/align-test2
+++ b/tests/align-test2
@@ -421,13 +421,18 @@ echo "# Create enterprise-class 4K drive with fs and LUKS images."
 # cryptsetup should properly use 4k block on direct-io
 add_device dev_size_mb=32 sector_size=4096 physblk_exp=0 num_tgts=1 opt_blks=64
 for file in $(ls img_fs_*.img.xz) ; do
-	echo "Format using fs image $file."
+	echo -n "Format using fs image $file. "
 	xz -d -c $file | dd of=$DEV bs=1M 2>/dev/null || fail "bad image"
 	[ ! -d $MNT_DIR ] && mkdir $MNT_DIR
-	mount $DEV $MNT_DIR || skip "Mounting image is not available."
+	mount $DEV $MNT_DIR 2>/dev/null
+	if [ $? -ne 0 ] ; then
+		echo "[N/A]"
+		continue
+	fi
 	echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF --type luks2 $MNT_DIR/luks.img --offset 8192 || fail
 	echo $PWD2 | $CRYPTSETUP luksFormat $FAST_PBKDF --type luks2 $MNT_DIR/luks.img --header $MNT_DIR/luks_header.img || fail
-	umount $MNT_DIR
+	umount $MNT_DIR || fail
+	echo "[OK]"
 done
 cleanup

@@ -454,3 +459,5 @@ add_device dev_size_mb=32 sector_size=4096 num_tgts=1 opt_blks=64
 auto_sector 4096 $DEV
 auto_sector 4096 $DEV $HDR
 cleanup
+
+exit 0
--- a/tests/api-test-2.c
+++ b/tests/api-test-2.c
@@ -5304,6 +5304,11 @@ static void KeyslotContextAndKeyringLink(void)
 		pbkdf.iterations = 1000;
 	}

+	if (!t_dm_crypt_keyring_support()) {
+		printf("WARNING: dm-crypt does not support keyring, skipping test.\n");
+		return;
+	}
+
 	OK_(get_luks2_offsets(0, 0, 0, NULL, &r_payload_offset));
 	OK_(create_dmdevice_over_loop(L_DEVICE_1S, r_payload_offset + 1));

--- a/tests/blockwise-compat-test
+++ b/tests/blockwise-compat-test
@@ -80,12 +80,12 @@ falloc() {

 run_all_in_fs() {
 	for file in $(ls img_fs_*.img.xz) ; do
-		echo "Run tests in $file put on top block device."
+		echo -n "Run tests in $file put on top block device. "
 		xz -d -c $file | dd of=$DEV bs=1M 2>/dev/null || fail "bad image"
 		[ ! -d $MNT_DIR ] && mkdir $MNT_DIR
-		mount $DEV $MNT_DIR
+		mount $DEV $MNT_DIR 2>/dev/null
 		if [ $? -ne 0 ]; then
-			echo "Mounting image $file failed, skipped."
+			echo "[N/A]"
 			continue;
 		fi
 		rm -rf $MNT_DIR/* 2>/dev/null
@@ -97,7 +97,8 @@ run_all_in_fs() {
 		BSIZE=$iobsize
 		run_all $tfile
 		BSIZE=$oldbsize
-		umount $MNT_DIR
+		umount $MNT_DIR || fail
+		echo "[OK]"
 	done
 }

--- a/tests/compat-test
+++ b/tests/compat-test
@@ -331,7 +331,7 @@ $CRYPTSETUP -q luksClose  $DEV_NAME || fail
 $CRYPTSETUP luksHeaderRestore -q $IMG --header-backup-file $HEADER_IMG || fail

 # Repeat for V1.0 header - not aligned first keyslot
-if [ ! fips_mode ] ; then
+if ! fips_mode; then
 echo $PWD0 | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME || fail
 check_exists
 ORG_SHA1=$(sha1sum -b /dev/mapper/$DEV_NAME | cut -f 1 -d' ')
@@ -459,7 +459,7 @@ if [ -d /dev/disk/by-uuid ] ; then
 	$CRYPTSETUP -q luksClose  $DEV_NAME || fail
 fi
 # skip tests using empty passphrase
-if [ ! fips_mode ]; then
+if ! fips_mode; then
 # empty keyfile
 $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEYE || fail
 $CRYPTSETUP luksOpen -d $KEYE $LOOPDEV $DEV_NAME || fail
@@ -740,7 +740,7 @@ echo $PWDW | $CRYPTSETUP luksResume $DEV_NAME 2>/dev/null && fail
 echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME  || fail
 $CRYPTSETUP -q luksClose $DEV_NAME || fail
 # skip tests using empty passphrase
-if [ ! fips_mode ]; then
+if ! fips_mode; then
 echo | $CRYPTSETUP -q luksFormat -c null $FAST_PBKDF_OPT --type luks1 $LOOPDEV || fail
 echo | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
 $CRYPTSETUP luksSuspend $DEV_NAME || fail
--- a/tests/compat-test-opal
+++ b/tests/compat-test-opal
@@ -231,6 +231,30 @@ function setup_luks2_env() {
 	$CRYPTSETUP close $DEV_NAME || fail
 }

+# $1 key name
+# $2 keyring to link VK to
+# $3 key type (optional)
+test_vk_link_with_passphrase_check() {
+	KEY_TYPE=${3:-user}
+	if [ -z "$3" ]; then
+		KEY_DESC=$1
+	else
+		KEY_DESC="%$3:$1"
+	fi
+
+	KEYCTL_KEY_NAME="%$KEY_TYPE:$1"
+
+	echo $PWD1 | $CRYPTSETUP open --test-passphrase $OPAL2_DEV --link-vk-to-keyring "$2"::"$KEY_DESC" || fail
+	keyctl search "$2" $KEY_TYPE $1 > /dev/null 2>&1 || fail "VK is not linked to the specified keyring after --test-passphrase."
+	if [ $KEY_TYPE = "user" ]; then
+		$CRYPTSETUP open $OPAL2_DEV --test-passphrase --volume-key-keyring $KEY_DESC <&-|| fail "Failed to check volume passed via kernel keyring."
+	fi
+	keyctl unlink "$KEYCTL_KEY_NAME" "$2" || fail
+
+	echo $PWD1 | $CRYPTSETUP open --test-passphrase $OPAL2_DEV || fail
+	keyctl search "$2" $KEY_TYPE $1 > /dev/null 2>&1 && fail "VK is unexpectedly linked to the specified keyring."
+}
+
 # $1 key name
 # $2 keyring to link VK to
 # $3 key type (optional)
@@ -512,9 +536,9 @@ if [ -d /dev/disk/by-uuid ] ; then
 	$CRYPTSETUP -q luksClose  $DEV_NAME || fail
 fi
 # skip tests using empty passphrases
-if [ ! fips_mode ]; then
+if ! fips_mode; then
 # empty passphrase (OPAL admin pin cannot be empty)
-echo -e "\n$OPAL2_ADMIN_PIN" | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 --hw-opal $OPAL2_DEV || fail
+echo -e "\n$OPAL2_ADMIN_PIN" | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 --hw-opal $OPAL2_DEV --force-password || fail
 $CRYPTSETUP luksOpen -d $KEYE $OPAL2_DEV $DEV_NAME || fail
 $CRYPTSETUP -q luksClose  $DEV_NAME || fail
 fi
@@ -531,9 +555,9 @@ if [ -d /dev/disk/by-uuid ] ; then
 	$CRYPTSETUP -q luksClose  $DEV_NAME || fail
 fi
 # skip tests using empty passphrases
-if [ ! fips_mode ]; then
+if ! fips_mode; then
 # empty passphrase (OPAL admin pin cannot be empty)
-echo -e "\n$OPAL2_ADMIN_PIN" | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 --hw-opal-only $OPAL2_DEV || fail
+echo -e "\n$OPAL2_ADMIN_PIN" | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 --hw-opal-only $OPAL2_DEV --force-password || fail
 $CRYPTSETUP luksOpen -d $KEYE $OPAL2_DEV $DEV_NAME || fail
 $CRYPTSETUP -q luksClose  $DEV_NAME || fail
 fi
@@ -1234,6 +1258,10 @@ if [ $HAVE_KEYRING -gt 0 -a -d /proc/sys/kernel/keys ]; then
 	# explicitly specify keyring key type
 	test_vk_link $KEY_NAME "%keyring:$TEST_KEYRING_NAME"

+	test_vk_link_with_passphrase_check $KEY_NAME "%:$TEST_KEYRING_NAME"
+	test_vk_link_with_passphrase_check $KEY_NAME "%:$TEST_KEYRING_NAME" "user"
+	test_vk_link_with_passphrase_check $KEY_NAME "%:$TEST_KEYRING_NAME" "logon"
+
 	test_vk_link_and_reactivate $KEY_NAME "@u" "user"
 	test_vk_link_and_reactivate $KEY_NAME "@u"
 	[[ ! -z "$SESSION_KEYRING_WORKS" ]] && test_vk_link_and_reactivate $KEY_NAME "@s" "user"
--- a/tests/compat-test2
+++ b/tests/compat-test2
@@ -173,6 +173,20 @@ function valgrind_run()
 	INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${CRYPTSETUP_VALGRIND} "$@"
 }

+function dm_crypt_capi_support()
+{
+	VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv)
+	[ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version."
+
+	VER_MAJ=$(echo $VER_STR | cut -f 1 -d.)
+	VER_MIN=$(echo $VER_STR | cut -f 2 -d.)
+
+	if [ $VER_MIN -ge 16 ]; then
+		return 0
+	fi
+	return 1
+}
+
 function dm_crypt_keyring_support()
 {
 	$CRYPTSETUP --version | grep -q KEYRING || return 1
@@ -297,6 +311,30 @@ function add_scsi_device() {
 	[ -b $DEV ] || fail "Cannot find $DEV."
 }

+# $1 key name
+# $2 keyring to link VK to
+# $3 key type (optional)
+test_vk_link_with_passphrase_check() {
+	KEY_TYPE=${3:-user}
+	if [ -z "$3" ]; then
+		KEY_DESC=$1
+	else
+		KEY_DESC="%$3:$1"
+	fi
+
+	KEYCTL_KEY_NAME="%$KEY_TYPE:$1"
+
+	echo $PWD1 | $CRYPTSETUP open --test-passphrase $LOOPDEV --link-vk-to-keyring "$2"::"$KEY_DESC" || fail
+	keyctl search "$2" $KEY_TYPE $1 > /dev/null 2>&1 || fail "VK is not linked to the specified keyring after --test-passphrase."
+	if [ $KEY_TYPE = "user" ]; then
+		$CRYPTSETUP open $LOOPDEV --test-passphrase --volume-key-keyring $KEY_DESC <&-|| fail "Failed to check volume passed via kernel keyring."
+	fi
+	keyctl unlink "$KEYCTL_KEY_NAME" "$2" || fail
+
+	echo $PWD1 | $CRYPTSETUP open --test-passphrase $LOOPDEV || fail
+	keyctl search "$2" $KEY_TYPE $1 > /dev/null 2>&1 && fail "VK is unexpectedly linked to the specified keyring."
+}
+
 # $1 key name
 # $2 keyring to link VK to
 # $3 key type (optional)
@@ -606,7 +644,7 @@ if [ -d /dev/disk/by-uuid ] ; then
 	$CRYPTSETUP -q luksClose  $DEV_NAME || fail
 fi
 # skip tests using empty passphrases
-if [ ! fips_mode ]; then
+if ! fips_mode; then
 # empty keyfile
 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEYE || fail
 $CRYPTSETUP luksOpen -d $KEYE $LOOPDEV $DEV_NAME || fail
@@ -1430,17 +1468,19 @@ if [ $HAVE_KEYRING -gt 0 -a -d /proc/sys/kernel/keys ]; then
 	$CRYPTSETUP open -q --test-passphrase --token-only --token-id 0 -q $IMG || fail
 fi

-prepare "[44] LUKS2 invalid cipher (kernel cipher driver name)" wipe
-xz -dk $HEADER_LUKS2_INV.xz
-dd if=$HEADER_LUKS2_INV of=$IMG conv=notrunc >/dev/null 2>&1
-$CRYPTSETUP -q luksDump $LOOPDEV | grep -q "capi:xts(ecb(aes-generic))-plain64" || fail
-echo $PWD1 | $CRYPTSETUP open $LOOPDEV --test-passphrase || fail
-echo $PWD1 | $CRYPTSETUP open $LOOPDEV $DEV_NAME 2>&1 | grep -q "No known cipher specification pattern" || fail
-echo $PWD1 | $CRYPTSETUP reencrypt $LOOPDEV >/dev/null 2>&1 && fail
-dmsetup create $DEV_NAME --uuid CRYPT-LUKS2-3d20686f551748cb89911ad32379821b-test --table \
-  "0 8 crypt capi:xts(ecb(aes-generic))-plain64 edaa40709797973715e572bf7d86fcbb9cfe2051083c33c28d58fe4e1e7ff642 0 $LOOPDEV 32768"
-$CRYPTSETUP status $DEV_NAME | grep -q "n/a" || fail
-$CRYPTSETUP close $DEV_NAME ||fail
+if dm_crypt_capi_support; then
+	prepare "[44] LUKS2 invalid cipher (kernel cipher driver name)" wipe
+	xz -dk $HEADER_LUKS2_INV.xz
+	dd if=$HEADER_LUKS2_INV of=$IMG conv=notrunc >/dev/null 2>&1
+	$CRYPTSETUP -q luksDump $LOOPDEV | grep -q "capi:xts(ecb(aes-generic))-plain64" || fail
+	echo $PWD1 | $CRYPTSETUP open $LOOPDEV --test-passphrase || fail
+	echo $PWD1 | $CRYPTSETUP open $LOOPDEV $DEV_NAME 2>&1 | grep -q "No known cipher specification pattern" || fail
+	echo $PWD1 | $CRYPTSETUP reencrypt $LOOPDEV >/dev/null 2>&1 && fail
+	dmsetup create $DEV_NAME --uuid CRYPT-LUKS2-3d20686f551748cb89911ad32379821b-test --table \
+         "0 8 crypt capi:xts(ecb(aes-generic))-plain64 edaa40709797973715e572bf7d86fcbb9cfe2051083c33c28d58fe4e1e7ff642 0 $LOOPDEV 32768"
+	$CRYPTSETUP status $DEV_NAME | grep -q "n/a" || fail
+	$CRYPTSETUP close $DEV_NAME ||fail
+fi

 if [ $HAVE_KEYRING -gt 0 -a -d /proc/sys/kernel/keys ]; then
 	prepare "[45] Link VK to a keyring and use custom VK type." wipe
@@ -1474,6 +1514,10 @@ if [ $HAVE_KEYRING -gt 0 -a -d /proc/sys/kernel/keys ]; then
 	test_vk_link_and_reactivate $KEY_NAME "%keyring:$TEST_KEYRING_NAME" "user"
 	test_vk_link_and_reactivate $KEY_NAME "%keyring:$TEST_KEYRING_NAME"

+	test_vk_link_with_passphrase_check $KEY_NAME "%:$TEST_KEYRING_NAME"
+	test_vk_link_with_passphrase_check $KEY_NAME "%:$TEST_KEYRING_NAME" "user"
+	test_vk_link_with_passphrase_check $KEY_NAME "%:$TEST_KEYRING_NAME" "logon"
+
 	# test numeric keyring name -5 is user session (@us) keyring
 	echo $PWD1 | $CRYPTSETUP open $LOOPDEV $DEV_NAME --link-vk-to-keyring -5::%logon:$KEY_NAME || fail
 	keyctl search @us logon $KEY_NAME > /dev/null 2>&1 || fail "VK is not linked to the specified keyring after activation."
--- a/tests/crypto-vectors.c
+++ b/tests/crypto-vectors.c
@@ -1533,10 +1533,12 @@ int main(__attribute__ ((unused)) int argc, __attribute__ ((unused))char *argv[]
 {
 	setvbuf(stdout, NULL, _IONBF, 0);

+#ifndef NO_CRYPTSETUP_PATH
 	if (getenv("CRYPTSETUP_PATH")) {
 		printf("Cannot run this test with CRYPTSETUP_PATH set.\n");
 		exit(77);
 	}
+#endif

 	if (crypt_backend_init(fips_mode()))
 		exit_test("Crypto backend init error.", EXIT_FAILURE);
--- a/tests/img_fs_xfs5.img.xz
+++ b/tests/img_fs_xfs5.img.xz
--- a/tests/luks2-reencryption-test
+++ b/tests/luks2-reencryption-test
@@ -858,6 +858,7 @@ function setup_luks2_env() {
 	echo $PWD1 | $CRYPTSETUP open $DEV $DEV_NAME || fail
 	local check_keyring=$($CRYPTSETUP status $DEV_NAME | grep "key location: keyring")
 	if [ -n "$check_keyring" ]; then
+		bin_check keyctl
 		HAVE_KEYRING=1
 		prepare_vk_keyring
 	fi
@@ -2137,7 +2138,7 @@ rm -f $IMG_HDR
 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $DEV --offset 8192 || fail
 echo $PWD1 | $CRYPTSETUP open $DEV $DEV_NAME || fail
 wipe_dev /dev/mapper/$DEV_NAME
-echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q --decrypt --header $IMG_HDR --active-name $DEV_NAME || fail
+echo $PWD1 | $CRYPTSETUP reencrypt -q --decrypt --header $IMG_HDR --active-name $DEV_NAME || fail
 check_hash_dev_head $DEV 2048 $HASH2
 rm -f $IMG_HDR

@@ -2145,12 +2146,20 @@ rm -f $IMG_HDR
 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $DEV --offset 8192 || fail
 echo $PWD1 | $CRYPTSETUP open $DEV $DEV_NAME || fail
 wipe_dev /dev/mapper/$DEV_NAME
-echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q --decrypt --header $IMG_HDR --active-name $DEV_NAME --init-only || fail
+echo $PWD1 | $CRYPTSETUP reencrypt -q --decrypt --header $IMG_HDR --active-name $DEV_NAME --init-only || fail
 check_hash_dev /dev/mapper/$DEV_NAME $HASH2
 echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q --header $IMG_HDR --active-name $DEV_NAME || fail
 check_hash_dev_head $DEV 2048 $HASH2
 rm -f $IMG_HDR

+# run in single command by --active-name parameter
+echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $DEV --offset 8192 || fail
+echo $PWD1 | $CRYPTSETUP open $DEV $DEV_NAME || fail
+wipe_dev /dev/mapper/$DEV_NAME
+echo $PWD1 | $CRYPTSETUP reencrypt -q --decrypt --header $IMG_HDR --active-name $DEV_NAME || fail
+check_hash_dev_head $DEV 2048 $HASH2
+rm -f $IMG_HDR
+
 echo "[33] Decryption with datashift recovery (error in shift area)."
 prepare_linear_dev 32
 echo "sector size 512"
--- a/tests/meson.build
+++ b/tests/meson.build
@@ -16,6 +16,9 @@ test_files_to_copy = [
    'fvault2-images.tar.xz',
    'generators/generate-luks2-area-in-json-hdr-space-json0.img.sh',
    'img_fs_ext4.img.xz',
+    'img_fs_vfat.img.xz',
+    'img_fs_xfs.img.xz',
+    'img_fs_xfs5.img.xz',
    'luks1-images.tar.xz',
    'luks2_header_requirements.tar.xz',
    'luks2_keyslot_unassigned.img.xz',
@@ -27,6 +30,7 @@ test_files_to_copy = [
    'xfs_512_block_size.img.xz',
    'valg.sh',
    'cryptsetup-valg-supps',
+    'LUKS-d238e48a-0ed3-4169-b841-f26b44693134.tar.xz'
 ]

 foreach file : test_files_to_copy
--- a/tests/mode-test
+++ b/tests/mode-test
@@ -52,6 +52,22 @@ skip()
 	exit 77
 }

+function dm_crypt_capi_support()
+{
+	VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv)
+	[ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version."
+
+	VER_MAJ=$(echo $VER_STR | cut -f 1 -d.)
+	VER_MIN=$(echo $VER_STR | cut -f 2 -d.)
+	VER_PTC=$(echo $VER_STR | cut -f 3 -d.)
+
+	if [ $VER_MIN -ge 16 ]; then
+		return 0
+	fi
+
+	return 1
+}
+
 function valgrind_setup()
 {
 	command -v valgrind >/dev/null || fail "Cannot find valgrind."
@@ -132,7 +148,7 @@ dmcrypt()
 		echo -n -e "PLAIN:"
 		dmcrypt_check "$DEV_NAME"_tstdev $OUT
 	else
-		echo -n "[n/a]"
+		echo -n "[N/A]"
 	fi

 	echo $PASSWORD | $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF2 -c $1 -s 256 /dev/mapper/$DEV_NAME >/dev/null 2>&1
@@ -193,12 +209,17 @@ dmcrypt xchacha12,aes-adiantum-plain64
 dmcrypt xchacha20,aes-adiantum-plain64

 echo -n "CAPI format:"
-echo $PASSWORD | $CRYPTSETUP create -h sha256 -c 'capi:xts(aes)-plain64' -s 256 "$DEV_NAME"_tstdev /dev/mapper/$DEV_NAME || fail
-$CRYPTSETUP close "$DEV_NAME"_tstdev || fail
-echo $PASSWORD | $CRYPTSETUP create -h sha256 -c 'capi:xts(ecb(aes-generic))-plain64' -s 256 "$DEV_NAME"_tstdev /dev/mapper/$DEV_NAME 2>/dev/null && fail
-dmsetup create "$DEV_NAME"_tstdev --table "0 8 crypt capi:xts(ecb(aes-generic))-plain64 $KEY 0 /dev/mapper/$DEV_NAME 0" || fail
-$CRYPTSETUP status "$DEV_NAME"_tstdev 2>/dev/null | grep "type:" | grep -q "n/a" || fail
-$CRYPTSETUP close "$DEV_NAME"_tstdev 2>/dev/null || fail
-echo [OK]
+if dm_crypt_capi_support ; then
+	echo $PASSWORD | $CRYPTSETUP create -h sha256 -c 'capi:xts(aes)-plain64' -s 256 "$DEV_NAME"_tstdev /dev/mapper/$DEV_NAME --debug || fail
+	$CRYPTSETUP close "$DEV_NAME"_tstdev || fail
+	echo $PASSWORD | $CRYPTSETUP create -h sha256 -c 'capi:xts(ecb(aes-generic))-plain64' -s 256 "$DEV_NAME"_tstdev /dev/mapper/$DEV_NAME 2>/dev/null && fail
+	dmsetup create "$DEV_NAME"_tstdev --table "0 8 crypt capi:xts(ecb(aes-generic))-plain64 $KEY 0 /dev/mapper/$DEV_NAME 0" || fail
+	$CRYPTSETUP status "$DEV_NAME"_tstdev 2>/dev/null | grep "type:" | grep -q "n/a" || fail
+	$CRYPTSETUP close "$DEV_NAME"_tstdev 2>/dev/null || fail
+	echo [OK]
+else
+	echo [N/A]
+fi

 cleanup
+exit 0
--- a/tests/reencryption-compat-test
+++ b/tests/reencryption-compat-test
@@ -25,6 +25,9 @@ PWD1="93R4P4pIqAH8"
 PWD2="1cND4319812f"
 PWD3="1-9Qu5Ejfnqv"

+LUKS1_DECRYPT_UUID=d238e48a-0ed3-4169-b841-f26b44693134
+LUKS1_DECRYPT="LUKS-$LUKS1_DECRYPT_UUID"
+
 MNT_DIR=./mnt_luks
 START_DIR=$(pwd)
 FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)
@@ -45,7 +48,7 @@ function remove_mapping()
 	[ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove --retry $DEV_NAME2
 	[ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME
 	[ ! -z "$LOOPDEV1" ] && losetup -d $LOOPDEV1 >/dev/null 2>&1
-	rm -f $IMG $IMG_HDR $ORIG_IMG $KEY1 $HEADER_LUKS2_PV $DEV_LINK >/dev/null 2>&1
+	rm -f $IMG $IMG_HDR $ORIG_IMG $KEY1 $HEADER_LUKS2_PV $DEV_LINK $LUKS1_DECRYPT.{org\|new\|log} >/dev/null 2>&1
 	umount $MNT_DIR > /dev/null 2>&1
 	rmdir $MNT_DIR > /dev/null 2>&1
 	LOOPDEV1=""
@@ -211,7 +214,7 @@ function simple_scsi_reenc()
 function mount_and_test() {
 	test -d $MNT_DIR || mkdir -p $MNT_DIR
 	mount $@ $MNT_DIR 2>/dev/null || {
-		echo -n "failed to mount [SKIP]"
+		echo -n "[N/A]"
 		return 0
 	}
 	rm $MNT_DIR/* 2>/dev/null
@@ -239,7 +242,7 @@ function test_logging() {
 	echo -n "$1:"
 	for img in $(ls img_fs*img.xz) ; do
 		wipefs -a $SCSI_DEV > /dev/null
-		echo -n "[${img%.img.xz}]"
+		echo -n " [${img%.img.xz}]"
 		xz -d -c $img | dd of=$SCSI_DEV bs=4k >/dev/null 2>&1
 		mount_and_test $SCSI_DEV || return 1
 	done
@@ -325,7 +328,7 @@ ln -s $IMG $DEV_LINK || fail
 echo $PWD1 | $REENC $IMG --type luks1 --new --header $DEV_LINK -q $FAST_PBKDF_ARGON 2>/dev/null && fail
 $CRYPTSETUP isLUKS $IMG 2>/dev/null && fail

-if [ ! fips_mode ]; then
+if ! fips_mode; then
 # well, movin' zeroes :-)
 OFFSET=2048
 SIZE=$(blockdev --getsz $LOOPDEV1)
@@ -425,7 +428,7 @@ add_scsi_device sector_size=512 dev_size_mb=32 physblk_exp=3
 test_logging "[4096/512 sector]" || fail
 test_logging_tmpfs || fail

-if [ ! fips_mode ]; then
+if ! fips_mode; then
 echo "[10] Removal of encryption"
 prepare 8192
 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF $LOOPDEV1 || fail
@@ -490,7 +493,16 @@ if [ "$HAVE_BLKID" -gt 0 ]; then
 	echo $PWD1 | $REENC --header $IMG_HDR $HEADER_LUKS2_PV -q $FAST_PBKDF --new --type luks1 2>/dev/null && fail
 	test -f $IMG_HDR && fail
 fi
-fi # if [ ! fips_mode ]
+
+# Only test if the LUKS1 decryption can be resumed with provided --uuid
+echo "[14] Resume LUKS1 decryption"
+prepare 8192
+tar xJf $LUKS1_DECRYPT.tar.xz || fail
+echo $PWD1 | $REENC $LOOPDEV1 -q --decrypt --uuid $LUKS1_DECRYPT_UUID >/dev/null || fail
+test -f $LUKS1_DECRYPT.org && fail
+test -f $LUKS1_DECRYPT.new && fail
+test -f $LUKS1_DECRYPT.log && fail
+fi # if ! fips_mode

 remove_mapping
 exit 0
Author	SHA1	Message	Date
Milan Broz	ca50f2cd33	Version 2.7.1.	2024-03-07 15:47:06 +01:00
Milan Broz	d5559df2cc	tests: Fix Makefile * Meson to include all fs images.	2024-03-07 15:39:12 +01:00
Milan Broz	a2d820649b	Update LUKS2 spec.	2024-03-07 15:27:52 +01:00
Milan Broz	94286c387f	Add 2.7.1 release notes.	2024-03-07 15:27:44 +01:00
Milan Broz	2c53e71415	test: Fix tests on RHEL7 clones (no keyring in dm-crypt).	2024-03-07 14:26:46 +01:00
Milan Broz	2f0e804fd1	Add xfs V5 image to tests. XFS V4 can be disabled in kernel, add image V5. Minimal 300M xfs size avoided by using QA variables magic in format: export TEST_DIR=1 TEST_DEV=1 QA_CHECK_FS=1 ; mkfs -t xfs ...	2024-03-07 14:26:34 +01:00
Ondrej Kozina	d478e09f2e	tests: fix compat-test-opal bug for empty LUKS2 passphrase. The bug was hidden due to previously contradicting condition.	2024-03-07 14:26:22 +01:00
Ondrej Kozina	0645219c9d	tests: move luks1 decryption resume test. It cannot be run in fips mode due to empty passphrase is no longer allowed.	2024-03-07 14:26:09 +01:00
Ondrej Kozina	ba7973236b	tests: fix fips mode detection contradiction in various tests.	2024-03-07 14:25:53 +01:00
Yuri Chornoivan	5d6bcc2c3b	po: update uk.po (from translationproject.org)	2024-03-06 09:53:01 +01:00
Remus-Gabriel Chelu	05b16f73f9	po: update ro.po (from translationproject.org)	2024-03-06 09:53:01 +01:00
Jakub Bogusz	60274f1fcf	po: update pl.po (from translationproject.org)	2024-03-06 09:53:01 +01:00
Hiroshi Takekawa	f8b4931bb1	po: update ja.po (from translationproject.org)	2024-03-06 09:53:01 +01:00
Frédéric Marchal	cb59aeb85a	po: update fr.po (from translationproject.org)	2024-03-06 09:53:01 +01:00
Roland Illig	2f72f227b5	po: update de.po (from translationproject.org)	2024-03-06 09:53:01 +01:00
Petr Pisar	004419e1d6	po: update cs.po (from translationproject.org)	2024-03-06 09:53:01 +01:00
Ondrej Kozina	5c3dba8688	Add regression test for resuming LUKS1 decryption.	2024-03-06 09:52:55 +01:00
Ondrej Kozina	25e3adab7e	Fix regression in LUKS1 decryption. With removal of cryptsetup-reencrypt there was a bug introduced that broke resuming interrupted LUKS1 decryption operation. LUKS2 code was not affected.	2024-03-06 09:52:44 +01:00
Milan Broz	bbdf692104	Set version 2.7.1-rc0.	2024-02-29 20:45:28 +01:00
Milan Broz	9d38ea70e2	Require --debug log in bug report issue template.	2024-02-29 17:07:41 +00:00
Milan Broz	2cd0be9501	Allow all stable branches in GitHub actions.	2024-02-29 17:07:41 +00:00
Ondrej Kozina	5a0208cd06	Allow --link-vk-to-keyring with --test-passphrase option. To make it possible to upload volume key in user specified kernel keyring without need to (re)activate the device.	2024-02-29 16:25:17 +01:00
Ondrej Kozina	db635c428b	Fix abort triggered by initializing decryption via --active-name. The invalid test unfortunately hid an error in processing of --active-name command line option.	2024-02-28 17:11:46 +01:00
Milan Broz	678b28989b	Fix indentation in integritysetup man page and crypt description.	2024-02-22 20:58:35 +00:00
Milan Broz	82f37d7a10	Sort options in man pages alphabetically.	2024-02-22 20:58:35 +00:00
Milan Broz	cbf818a660	Fix JSON exampe in progress-frequency option.	2024-02-22 20:58:35 +00:00
Milan Broz	3ff8d55a8b	Fix veritysetup man page typo.	2024-02-22 20:58:35 +00:00
Sergei Ilinykh	349572e69e	Fix compilation with libargon2 argon when internal disabled This fixes a regression introduced somewhere on the way to 2.7.0. A specific set of options led to complete lack of Argon2 regardless of --enable-libargon2 option.	2024-02-22 20:43:35 +03:00
Daniel Zatovic	0725efefa7	CI: fix improper distro specification for 32-bit Debian. The `variables` section is repeated for 32-bit Debian job. Therefore the `DISTRO` environment variable is ignored and 64-bit distro name is inherited from the `.debian-prep` job.	2024-02-22 16:50:46 +01:00
Daniel Zatovic	af35c93332	CI: don't store kernel log, only check for coredumps. The kernel log is uploaded automatically by the custom executor, no need to upload it from inside the VM (and /mnt/artifacts is not mounted in the new CI scripts).	2024-02-22 11:41:37 +00:00
Daniel Zatovic	193f8ff595	CI: increase disk size for csmock job.	2024-02-22 11:41:37 +00:00
Daniel Zatovic	f91524dc63	CI: add OPAL jobs.	2024-02-22 11:41:37 +00:00
Daniel Zatovic	f8e79cdbe6	CI: update jobs for new CI infrastrucure	2024-02-22 11:41:37 +00:00
Ondrej Kozina	35cd898c63	Fix crypto vectors test in meson. Otherwise it gets skipped in meson everytime.	2024-02-21 15:56:14 +01:00
Tobias Rosenkranz	91c1d2202a	Skip test if keyctl is missing	2024-02-18 14:46:37 +01:00
Milan Broz	a6d9dc0a16	Do not require argon2.h if implemented natively in crypto library.	2024-02-13 12:38:00 +01:00
Ondrej Kozina	f681194b57	Fix mistake in crypt_set_keyring_to_link documentation. The keyring_to_link_vk parameter must be prefixed by either "%:" or "%keyring:" substrings provided caller opted for text description of the target keyring.	2024-02-13 11:40:13 +01:00
Ondrej Kozina	fdac0d7ee2	cryptsetup.spec: drop libargon2 in favour of openssl implementation.	2024-02-12 10:43:47 +00:00
Milan Broz	b417154e71	Fix configure Argon2 OpenSSL detection to not compile internal Argon2. Code is not called anyway, but should be completely disabled. Note: there is intentionally no way to disable OpenSSL Argon2 if present.	2024-02-09 12:51:34 +01:00