Order clevis-luks-askpass after network-online.target

Resolves: RHEL-186032

Signed-off-by: Sergio Correia <scorreia@redhat.com>

0001-dracut-tang-Order-clevis-luks-askpass-after-network-.patch

@@ -0,0 +1,43 @@
+From 809abea0977627023d7258a02ac4e288bb2df5fc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
+Date: Thu, 18 Jun 2026 10:53:59 +0200
+Subject: [PATCH 1/3] dracut/tang: Order clevis-luks-askpass after
+ network-online.target
+
+When Tang bindings are present, rd.neednet=1 is set to bring up the
+network in the initramfs, but clevis-luks-askpass.path has no ordering
+dependency on network-online.target. This means systemd can activate
+the askpass path unit before the network is ready, causing curl to fail
+when contacting the Tang server.
+
+Install a systemd drop-in for clevis-luks-askpass.path that adds
+After=network-online.target and Wants=network-online.target, ensuring
+the network is online before clevis attempts to decrypt via Tang.
+---
+ src/luks/dracut/clevis-pin-tang/module-setup.sh.in | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
+index 364f866..2368cb1 100755
+--- a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
++++ b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
+@@ -37,6 +37,16 @@ have_tang_bindings() {
+ install() {
+     if [ "${hostonly_cmdline}" = "yes" ] && have_tang_bindings; then
+         echo "rd.neednet=1" > "${initdir}/etc/cmdline.d/99clevis-pin-tang.conf"
++
++        if dracut_module_included "systemd"; then
++            # shellcheck disable=SC2154 # $systemdsystemunitdir is a dracut variable
++            mkdir -p "${initdir}/${systemdsystemunitdir}/clevis-luks-askpass.path.d"
++            cat > "${initdir}/${systemdsystemunitdir}/clevis-luks-askpass.path.d/network-online.conf" <<EOF
++[Unit]
++After=network-online.target
++Wants=network-online.target
++EOF
++        fi
+     fi
+ 
+     inst_multiple \
+-- 
+2.54.0
+

0002-dracut-tang-Harden-the-search-for-tang-bounded-devic.patch

@@ -0,0 +1,27 @@
+From a15cfa98986fcfda18f2cf9a1d8b47a64bc5fa2f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
+Date: Thu, 18 Jun 2026 15:09:08 +0200
+Subject: [PATCH 2/3] dracut/tang: Harden the search for "tang" bounded devices
+
+Let's say in the future that we have another PIN and we can write something
+like "tango" in its configuration, we don't want it to match there.
+---
+ src/luks/dracut/clevis-pin-tang/module-setup.sh.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
+index 2368cb1..5bed4be 100755
+--- a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
++++ b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
+@@ -27,7 +27,7 @@ have_tang_bindings() {
+     . clevis-luks-common-functions
+     local dev
+     for dev in $(clevis_devices_to_unlock "list-open-devices"); do
+-        if clevis luks list -d "${dev}" -p | grep -q tang; then
++        if clevis luks list -d "${dev}" -p | grep -qw tang; then
+             return 0
+         fi
+     done
+-- 
+2.54.0
+

0003-dracut-tang-Fix-have_tang_bindings-failure-with-mult.patch

@@ -0,0 +1,44 @@
+From 86e31d757d12757180fdab97b30be74c09d54adf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
+Date: Thu, 18 Jun 2026 15:51:40 +0200
+Subject: [PATCH 3/3] dracut/tang: Fix have_tang_bindings failure with multiple
+ tang slots
+
+Dracut sets 'set -o pipefail'. When have_tang_bindings runs
+'clevis luks list -d DEV -p | grep -qw tang' on a device with
+multiple tang slots, grep -q exits after matching the first slot,
+closing the pipe. The still-running clevis luks list then gets
+SIGPIPE when writing the second slot, exiting with code 141.
+With pipefail, the pipeline returns 141 instead of 0, causing
+have_tang_bindings to return 1 even though tang bindings exist.
+
+This means rd.neednet=1 is never written to the initramfs, so
+NetworkManager is never started, and clevis cannot reach the
+Tang server to unlock the LUKS volume.
+
+Fix by capturing the output in a variable first, then grepping
+on the variable, avoiding the pipeline and SIGPIPE entirely.
+---
+ src/luks/dracut/clevis-pin-tang/module-setup.sh.in | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
+index 5bed4be..431ac68 100755
+--- a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
++++ b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
+@@ -25,9 +25,10 @@ depends() {
+ 
+ have_tang_bindings() {
+     . clevis-luks-common-functions
+-    local dev
++    local dev bindings
+     for dev in $(clevis_devices_to_unlock "list-open-devices"); do
+-        if clevis luks list -d "${dev}" -p | grep -qw tang; then
++        bindings="$(clevis luks list -d "${dev}" -p 2>/dev/null)" || :
++        if echo "${bindings}" | grep -qw tang; then
+             return 0
+         fi
+     done
+-- 
+2.54.0
+

clevis.spec

@@ -8,6 +8,12 @@ URL:            https://github.com/latchset/%{name}
 Source0:        https://github.com/latchset/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.xz
 Source1:        clevis.sysusers
 
+# Backport https://github.com/latchset/clevis/pull/562
+# dracut/tang: Order clevis-luks-askpass after network-online.target and more fixes
+Patch: 0001-dracut-tang-Order-clevis-luks-askpass-after-network-.patch
+Patch: 0002-dracut-tang-Harden-the-search-for-tang-bounded-devic.patch
+Patch: 0003-dracut-tang-Fix-have_tang_bindings-failure-with-mult.patch
+
 BuildRequires:  git-core
 BuildRequires:  gcc
 BuildRequires:  meson