From f4477ae3b18e316c5b3720f9ce6ef9313b5f7d86 Mon Sep 17 00:00:00 2001 From: eabdullin Date: Mon, 15 Sep 2025 12:38:29 +0000 Subject: [PATCH] import CS rear-2.6-27.el9 --- ...r-detect-prep-boot-on-gpt-RHEL-82098.patch | 69 ++ .../rear-error-output-s390x-RHEL-99362.patch | 15 + ...t-disk-mapping-with-sizes-RHEL-83241.patch | 51 ++ ...e-ed25519-hostkey-support-RHEL-83479.patch | 27 + .../rear-skip-longhorn-iscsi-RHEL-83551.patch | 107 +++ ...rear-support-aarch64-uefi-RHEL-56045.patch | 682 ++++++++++++++++++ ...upport-multi-keyslot-luks-RHEL-83776.patch | 167 +++++ SPECS/rear.spec | 54 +- 8 files changed, 1168 insertions(+), 4 deletions(-) create mode 100644 SOURCES/rear-detect-prep-boot-on-gpt-RHEL-82098.patch create mode 100644 SOURCES/rear-error-output-s390x-RHEL-99362.patch create mode 100644 SOURCES/rear-print-disk-mapping-with-sizes-RHEL-83241.patch create mode 100644 SOURCES/rear-rescue-ed25519-hostkey-support-RHEL-83479.patch create mode 100644 SOURCES/rear-skip-longhorn-iscsi-RHEL-83551.patch create mode 100644 SOURCES/rear-support-aarch64-uefi-RHEL-56045.patch create mode 100644 SOURCES/rear-support-multi-keyslot-luks-RHEL-83776.patch diff --git a/SOURCES/rear-detect-prep-boot-on-gpt-RHEL-82098.patch b/SOURCES/rear-detect-prep-boot-on-gpt-RHEL-82098.patch new file mode 100644 index 0000000..bcee82c --- /dev/null +++ b/SOURCES/rear-detect-prep-boot-on-gpt-RHEL-82098.patch @@ -0,0 +1,69 @@ +From 1ca518c2a0e675ace956ef71bc79d67e4990562b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zaoral?= +Date: Fri, 7 Mar 2025 13:03:14 +0100 +Subject: [PATCH] 445_guess_bootloader: fix PReP Boot detection on GPT layouts + (#3420) + +In layout/save/default/445_guess_bootloader.sh +fix PPC PReP Boot detection on GPT formatted disks +by checking for a "part ... prep ..." entry in disklayout.conf +as in finalize/Linux-ppc64/680_install_PPC_bootlist.sh +The before used 'file $disk_device' output is not stable. +In particular 'grep' for "ID=0x41" (PPC PReP Boot) +in the 'file' output does not work on GPT formatted disks. +Apparently 'file' detects the GPT protective MBR ("ID=0xee"). +For example on PPC64le with PowerNV like +# file -s /dev/sdb +/dev/sdb: DOS/MBR boot sector; partition 1 : ID=0xee, ... +# parted -s /dev/sdb print +Partition Table: gpt +Disk Flags: pmbr_boot +Number ... Flags +1 ... prep +And also on x86_64 with a EFI system partition (ID=0xEF) like +# file -s /dev/nvme0n1 +/dev/nvme0n1: DOS/MBR boot sector; partition 1 : ID=0xee, ... +# parted -s /dev/nvme0n1 print +Partition Table: gpt +Number ... Flags +1 ... boot, esp + +(cherry picked from commit 1ca518c2a0e675ace956ef71bc79d67e4990562b) +--- + .../layout/save/default/445_guess_bootloader.sh | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/usr/share/rear/layout/save/default/445_guess_bootloader.sh b/usr/share/rear/layout/save/default/445_guess_bootloader.sh +index 1beffc9a9..f10a3834c 100644 +--- a/usr/share/rear/layout/save/default/445_guess_bootloader.sh ++++ b/usr/share/rear/layout/save/default/445_guess_bootloader.sh +@@ -47,6 +47,15 @@ if [ "$ARCH" = "Linux-arm" ] ; then + return + fi + ++# Check if any disk contains a PPC PReP boot partition. ++# Detection taken from usr/share/rear/finalize/Linux-ppc64/680_install_PPC_bootlist.sh ++disk_device="$( awk -F ' ' '/^part / {if ($6 ~ /prep/) {print $2}}' $LAYOUT_FILE )" ++if test "$disk_device" ; then ++ LogPrint "Using guessed bootloader 'PPC' for 'rear recover' (found PPC PReP boot partition on $disk_device)" ++ echo "PPC" >$bootloader_file ++ return ++fi ++ + # Finally guess the used bootloader by inspecting the first bytes on all disks + # and use the first one that matches a known bootloader string: + for block_device in /sys/block/* ; do +@@ -54,12 +63,6 @@ for block_device in /sys/block/* ; do + # Continue with the next block device when the current block device is not a disk that can be used for booting: + [[ $blockd = hd* || $blockd = sd* || $blockd = cciss* || $blockd = vd* || $blockd = xvd* || $blockd = nvme* || $blockd = mmcblk* || $blockd = dasd* ]] || continue + disk_device=$( get_device_name $block_device ) +- # Check if the disk contains a PPC PreP boot partition (ID=0x41): +- if file -s $disk_device | grep -q "ID=0x41" ; then +- LogPrint "Using guessed bootloader 'PPC' (found PPC PreP boot partition 'ID=0x41' on $disk_device)" +- echo "PPC" >$bootloader_file +- return +- fi + # Get all strings in the first 512*4=2048 bytes on the disk: + bootloader_area_strings_file="$TMP_DIR/bootloader_area_strings" + block_size=$( get_block_size ${disk_device##*/} ) + diff --git a/SOURCES/rear-error-output-s390x-RHEL-99362.patch b/SOURCES/rear-error-output-s390x-RHEL-99362.patch new file mode 100644 index 0000000..c900355 --- /dev/null +++ b/SOURCES/rear-error-output-s390x-RHEL-99362.patch @@ -0,0 +1,15 @@ +commit 1e9e7b3c07912b3960d077e05473dfb61d3a0796 +Author: Pavel Cahyna +Date: Wed Aug 13 16:30:46 2025 +0200 + + Error out if any unsupported OUTPUT used on s390 + +diff --git a/usr/share/rear/prep/Linux-s390/034_check_config.sh b/usr/share/rear/prep/Linux-s390/034_check_config.sh +new file mode 100644 +index 000000000..6c3eab289 +--- /dev/null ++++ b/usr/share/rear/prep/Linux-s390/034_check_config.sh +@@ -0,0 +1,3 @@ ++if [ "$OUTPUT" != "RAMDISK" ] && [ "$OUTPUT" != "IPL" ] ; then ++ Error "Currently, only OUTPUT=RAMDISK and OUTPUT=IPL are supported on s390/s390x" ++fi diff --git a/SOURCES/rear-print-disk-mapping-with-sizes-RHEL-83241.patch b/SOURCES/rear-print-disk-mapping-with-sizes-RHEL-83241.patch new file mode 100644 index 0000000..7a79c67 --- /dev/null +++ b/SOURCES/rear-print-disk-mapping-with-sizes-RHEL-83241.patch @@ -0,0 +1,51 @@ +diff --git a/usr/share/rear/layout/prepare/default/300_map_disks.sh b/usr/share/rear/layout/prepare/default/300_map_disks.sh +index 468aa35cf..40ba876c7 100644 +--- a/usr/share/rear/layout/prepare/default/300_map_disks.sh ++++ b/usr/share/rear/layout/prepare/default/300_map_disks.sh +@@ -110,7 +110,10 @@ done + # to current block devices in the currently running recovery system: + while read keyword orig_device orig_size junk ; do + # Continue with next original device when it is already used as source in the mapping file: +- is_mapping_source "$orig_device" && continue ++ if is_mapping_source "$orig_device" ; then ++ DebugPrint "Skip automapping $orig_device with size $orig_size (already exists as source in $MAPPING_FILE)" ++ continue ++ fi + # First, try to find if there is a current disk with same name and same size as the original: + # (possibly influenced by mapping hints if known) + if has_mapping_hint "$orig_device" ; then +@@ -162,7 +165,7 @@ while read keyword orig_device orig_size junk ; do + # Ensure the determined target device is really a block device: + if test -b "$preferred_target_device_name" ; then + add_mapping "$orig_device" "$preferred_target_device_name" +- LogPrint "Using $preferred_target_device_name (same size) for recreating $orig_device" ++ LogPrint "Using $preferred_target_device_name (same size $current_size) for recreating $orig_device" + # Break looping over all current block devices to find one + # and continue with next original device in the LAYOUT_FILE: + break +@@ -213,6 +216,7 @@ while read keyword orig_device orig_size junk ; do + Log "$preferred_target_device_name excluded from device mapping choices (is already used as mapping target)" + continue + fi ++ LogPrint "The size of $preferred_target_device_name is $(blockdev --getsize64 $current_device_path)" + # Add the current device as possible choice for the user: + possible_targets+=( "$preferred_target_device_name" ) + done +@@ -225,7 +229,7 @@ while read keyword orig_device orig_size junk ; do + # At the end the mapping file is shown and the user can edit it if he does not like an automated mapping: + if test "1" -eq "${#possible_targets[@]}" ; then + add_mapping "$orig_device" "$possible_targets" +- LogPrint "Using $possible_targets (the only appropriate) for recreating $orig_device" ++ LogPrint "Using $possible_targets (the only available of the disks) for recreating $orig_device with size $orig_size" + # Continue with next original device in the LAYOUT_FILE: + continue + fi +@@ -233,7 +237,7 @@ while read keyword orig_device orig_size junk ; do + skip_choice="Do not map $preferred_orig_device_name" + regular_choices=( "${possible_targets[@]}" "$skip_choice" ) + rear_shell_choice="Use Relax-and-Recover shell and return back to here" +- prompt="Choose an appropriate replacement for $preferred_orig_device_name" ++ prompt="Choose an appropriate replacement for $preferred_orig_device_name with size $orig_size" + choice="" + wilful_input="" + # Generate a runtime-specific user_input_ID so that for each unmapped original device diff --git a/SOURCES/rear-rescue-ed25519-hostkey-support-RHEL-83479.patch b/SOURCES/rear-rescue-ed25519-hostkey-support-RHEL-83479.patch new file mode 100644 index 0000000..5a0d3fb --- /dev/null +++ b/SOURCES/rear-rescue-ed25519-hostkey-support-RHEL-83479.patch @@ -0,0 +1,27 @@ +From ed10cb3c612c49a6442e679052b755c52248ab3d Mon Sep 17 00:00:00 2001 +From: "D'Haese, Gratien [GTSBE - Non JJ]" +Date: Fri, 28 Feb 2025 17:05:21 +0100 +Subject: [PATCH] On EL9 sshd will not start anymore #3413 + +--- + usr/share/rear/skel/default/etc/scripts/run-sshd | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/usr/share/rear/skel/default/etc/scripts/run-sshd b/usr/share/rear/skel/default/etc/scripts/run-sshd +index 23b8233eed..3a422fe7cd 100755 +--- a/usr/share/rear/skel/default/etc/scripts/run-sshd ++++ b/usr/share/rear/skel/default/etc/scripts/run-sshd +@@ -13,6 +13,12 @@ if grep -q '^ssh:' /etc/inittab ; then + ssh-keygen -q -t rsa -N '' -f /etc/ssh/ssh_host_rsa_key + echo -e "\nSSH fingerprint: $( ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub )\n" >> /etc/issue + fi ++ if ! test -s /etc/ssh/ssh_host_ed25519_key ; then ++ # Generate the ed25519 SSH host key required on EL9 ++ ssh-keygen -q -t ed25519 -N '' -f /etc/ssh/ssh_host_ed25519_key ++ echo -e "\nSSH fingerprint: $( ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub )\n" >> /etc/issue ++ fi ++ mkdir -p /usr/share/empty.sshd # required on EL9 + mkdir -p /run/sshd + # Avoid "Could not load host key: /etc/ssh/ssh_host_..._key" messages + # that look confusing on the recovery system login screen + diff --git a/SOURCES/rear-skip-longhorn-iscsi-RHEL-83551.patch b/SOURCES/rear-skip-longhorn-iscsi-RHEL-83551.patch new file mode 100644 index 0000000..58a0b94 --- /dev/null +++ b/SOURCES/rear-skip-longhorn-iscsi-RHEL-83551.patch @@ -0,0 +1,107 @@ +From 71e854e28db3b02497cd48637cc22bda843ccab0 Mon Sep 17 00:00:00 2001 +From: gdha +Date: Thu, 13 Feb 2025 15:59:31 +0100 +Subject: [PATCH 1/2] #3401 discard longhorn devices + +Signed-off-by: gdha +--- + .../save/GNU/Linux/230_filesystem_layout.sh | 59 ++++++++++--------- + 1 file changed, 30 insertions(+), 29 deletions(-) + +diff --git a/usr/share/rear/layout/save/GNU/Linux/230_filesystem_layout.sh b/usr/share/rear/layout/save/GNU/Linux/230_filesystem_layout.sh +index 15e104403..6ac35c8db 100644 +--- a/usr/share/rear/layout/save/GNU/Linux/230_filesystem_layout.sh ++++ b/usr/share/rear/layout/save/GNU/Linux/230_filesystem_layout.sh +@@ -117,37 +117,38 @@ fi + Log "Filesystem $fstype on $device mounted at $mountpoint is below Docker Root Dir $docker_root_dir, skipping." + continue + fi +- # In case Longhorn is rebuilding a replica device it will show up as a pseudo-device and when that is the +- # case then you would find traces of it in the /var/lib/rear/layout/disklayout.conf file, which would +- # break the recovery as Longhorn Engine replica's are under control of Rancher Longhorn software and these are +- # rebuild automatically via kubernetes longhorn-engine pods. +- # Issue where we discovered this behavior was #2365 +- # In normal situations you will find traces of longhorn in the log saying skipping non-block devices. +- # For example an output of the 'df' command: +- # /dev/longhorn/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792 82045336 4500292 77528660 6% /var/lib/kubelet/pods/7f47aa55-30e2-4e7b-8fec-ec9a1e761352/volumes/kubernetes.io~csi/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792/mount +- # lsscsi shows it as: +- # [34:0:0:0] storage IET Controller 0001 - +- # [34:0:0:1] disk IET VIRTUAL-DISK 0001 /dev/sdf +- # ls -l /dev/sdf /dev/longhorn/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792 +- # brw-rw---- 1 root disk 8, 80 Apr 17 12:02 /dev/sdf +- # brw-rw---- 1 root root 8, 64 Apr 17 10:36 /dev/longhorn/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792 +- # and parted says: +- # parted /dev/longhorn/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792 print +- # Model: IET VIRTUAL-DISK (scsi) +- # Disk /dev/longhorn/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792: 85.9GB +- # Sector size (logical/physical): 512B/512B +- # Partition Table: loop +- # Disk Flags: +- # Number Start End Size File system Flags +- # 1 0.00B 85.9GB 85.9GB ext4 +- # => as result (without the next if clausule) we would end up with an entry in the disklayout.conf file: +- # fs /dev/longhorn/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792 /var/lib/kubelet/pods/61ed399a-d51b-40b8-8fe8-a78e84a1dd0b/volumes/kubernetes.io~csi/pvc-c65df331-f1c5-466a-9731-b2aa5e6da714/mount ext4 uuid=4fafdd40-a9ae-4b62-8bfb-f29036dbe3b9 label= blocksize=4096 reserved_blocks=0% max_mounts=-1 check_interval=0d bytes_per_inode=16384 default_mount_options=user_xattr,acl options=rw,relatime,data=ordered +- if echo "$device" | grep -q "^/dev/longhorn/pvc-" ; then +- Log "Longhorn Engine replica $device, skipping." +- continue +- fi + fi + fi ++ # In case Longhorn is rebuilding a replica device it will show up as a pseudo-device and when that is the ++ # case then you would find traces of it in the /var/lib/rear/layout/disklayout.conf file, which would ++ # break the recovery as Longhorn Engine replica's are under control of Rancher Longhorn software and these are ++ # rebuild automatically via kubernetes longhorn-engine pods. ++ # Issue where we discovered this behavior was #2365 ++ # In normal situations you will find traces of longhorn in the log saying skipping non-block devices. ++ # For example an output of the 'df' command: ++ # /dev/longhorn/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792 82045336 4500292 77528660 6% /var/lib/kubelet/pods/7f47aa55-30e2-4e7b-8fec-ec9a1e761352/volumes/kubernetes.io~csi/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792/mount ++ # lsscsi shows it as: ++ # [34:0:0:0] storage IET Controller 0001 - ++ # [34:0:0:1] disk IET VIRTUAL-DISK 0001 /dev/sdf ++ # ls -l /dev/sdf /dev/longhorn/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792 ++ # brw-rw---- 1 root disk 8, 80 Apr 17 12:02 /dev/sdf ++ # brw-rw---- 1 root root 8, 64 Apr 17 10:36 /dev/longhorn/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792 ++ # and parted says: ++ # parted /dev/longhorn/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792 print ++ # Model: IET VIRTUAL-DISK (scsi) ++ # Disk /dev/longhorn/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792: 85.9GB ++ # Sector size (logical/physical): 512B/512B ++ # Partition Table: loop ++ # Disk Flags: ++ # Number Start End Size File system Flags ++ # 1 0.00B 85.9GB 85.9GB ext4 ++ # => as result (without the next if clausule) we would end up with an entry in the disklayout.conf file: ++ # fs /dev/longhorn/pvc-ed09c0f2-c086-41c8-a38a-76ee8c289792 /var/lib/kubelet/pods/61ed399a-d51b-40b8-8fe8-a78e84a1dd0b/volumes/kubernetes.io~csi/pvc-c65df331-f1c5-466a-9731-b2aa5e6da714/mount ext4 uuid=4fafdd40-a9ae-4b62-8bfb-f29036dbe3b9 label= blocksize=4096 reserved_blocks=0% max_mounts=-1 check_interval=0d bytes_per_inode=16384 default_mount_options=user_xattr,acl options=rw,relatime,data=ordered ++ if echo "$device" | grep -q "^/dev/longhorn/pvc-" ; then ++ Log "Longhorn Engine replica $device, skipping." ++ continue ++ fi ++ + # Replace a symbolic link /dev/disk/by-uuid/a1b2c3 -> ../../sdXn + # by the fully canonicalized target of the link e.g. /dev/sdXn + if [[ $device == /dev/disk/by-uuid* ]]; then + +From 7805e8e440c9a2a2e7a890e8e70e5c7c285aee08 Mon Sep 17 00:00:00 2001 +From: gdha +Date: Fri, 14 Feb 2025 08:22:26 +0100 +Subject: [PATCH 2/2] replacing tab with spaces in comment + +Signed-off-by: gdha +--- + usr/share/rear/layout/save/GNU/Linux/230_filesystem_layout.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/usr/share/rear/layout/save/GNU/Linux/230_filesystem_layout.sh b/usr/share/rear/layout/save/GNU/Linux/230_filesystem_layout.sh +index 6ac35c8db..b3dd4bbc0 100644 +--- a/usr/share/rear/layout/save/GNU/Linux/230_filesystem_layout.sh ++++ b/usr/share/rear/layout/save/GNU/Linux/230_filesystem_layout.sh +@@ -119,7 +119,7 @@ fi + fi + fi + fi +- # In case Longhorn is rebuilding a replica device it will show up as a pseudo-device and when that is the ++ # In case Longhorn is rebuilding a replica device it will show up as a pseudo-device and when that is the + # case then you would find traces of it in the /var/lib/rear/layout/disklayout.conf file, which would + # break the recovery as Longhorn Engine replica's are under control of Rancher Longhorn software and these are + # rebuild automatically via kubernetes longhorn-engine pods. + diff --git a/SOURCES/rear-support-aarch64-uefi-RHEL-56045.patch b/SOURCES/rear-support-aarch64-uefi-RHEL-56045.patch new file mode 100644 index 0000000..6d3ee9a --- /dev/null +++ b/SOURCES/rear-support-aarch64-uefi-RHEL-56045.patch @@ -0,0 +1,682 @@ +diff --git a/packaging/rpm/rear.spec b/packaging/rpm/rear.spec +index afb31e1e4..910c9f89a 100644 +--- a/packaging/rpm/rear.spec ++++ b/packaging/rpm/rear.spec +@@ -29,8 +29,8 @@ BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX) + # Of course the rear bash scripts can be installed on any architecture just as any binaries can be installed on any architecture. + # But the meaning of architecture dependent packages should be on what architectures they will work. + # Therefore only those architectures that are actually supported are explicitly listed. +-# This avoids that rear can be "just installed" on architectures that are actually not supported (e.g. ARM or IBM z Systems): +-ExclusiveArch: %ix86 x86_64 ppc ppc64 ppc64le ia64 ++# This avoids that rear can be "just installed" on architectures that are actually not supported: ++ExclusiveArch: %ix86 x86_64 ppc ppc64 ppc64le ia64 s390x %arm aarch64 + # Furthermore for some architectures it requires architecture dependent packages (like syslinux for x86 and x86_64) + # so that rear must be architecture dependent because ifarch conditions never match in case of "BuildArch: noarch" + # see the GitHub issue https://github.com/rear/rear/issues/629 +diff --git a/usr/share/rear/conf/default.conf b/usr/share/rear/conf/default.conf +index 826f1ee59..17bf1a110 100644 +--- a/usr/share/rear/conf/default.conf ++++ b/usr/share/rear/conf/default.conf +@@ -784,9 +784,9 @@ ISO_RECOVER_MODE="" + ## + # + # OUTPUT=USB is only supported on PC-compatible (Linux-i386/x86/x86_64) architecture +-# see https://github.com/rear/rear/issues/2348 ++# see https://github.com/rear/rear/issues/2348 and arm/aarch64 using EFI. + # Accordingly in case of false usage of OUTPUT=USB on non-PC-compatible architectures +-# (i.e. the POWER architectures ppc64/ppc64le, IBM Z s390/s390x, and ARM) ++# (i.e. the POWER architectures ppc64/ppc64le, IBM Z s390/s390x) + # "rear mkrescue/mkbackup" errors out because on those architectures the USB medium cannot be booted + # because for non-PC-compatible architectures there are no scripts that install a USB bootloader. + # On non-PC-compatible architectures a possible alternative could be OUTPUT=RAMDISK (see above) +diff --git a/usr/share/rear/finalize/Linux-arm/610_EFISTUB_run_efibootmgr.sh b/usr/share/rear/finalize/Linux-arm/610_EFISTUB_run_efibootmgr.sh +new file mode 120000 +index 000000000..92f571a6b +--- /dev/null ++++ b/usr/share/rear/finalize/Linux-arm/610_EFISTUB_run_efibootmgr.sh +@@ -0,0 +1 @@ ++../Linux-i386/610_EFISTUB_run_efibootmgr.sh +\ No newline at end of file +diff --git a/usr/share/rear/finalize/Linux-arm/670_run_efibootmgr.sh b/usr/share/rear/finalize/Linux-arm/670_run_efibootmgr.sh +new file mode 120000 +index 000000000..5b967460e +--- /dev/null ++++ b/usr/share/rear/finalize/Linux-arm/670_run_efibootmgr.sh +@@ -0,0 +1 @@ ++../Linux-i386/670_run_efibootmgr.sh +\ No newline at end of file +diff --git a/usr/share/rear/layout/save/default/445_guess_bootloader.sh b/usr/share/rear/layout/save/default/445_guess_bootloader.sh +index 3576c387c..0211a4d6c 100644 +--- a/usr/share/rear/layout/save/default/445_guess_bootloader.sh ++++ b/usr/share/rear/layout/save/default/445_guess_bootloader.sh +@@ -30,15 +30,6 @@ if test -f /etc/sysconfig/bootloader ; then + fi + fi + +-# On ARM, guess the dummy bootloader: +-if [ "$ARCH" = "Linux-arm" ] ; then +- BOOTLOADER=ARM +- # Inform the user that we do nothing: +- LogPrint "Using guessed bootloader 'ARM'. Skipping bootloader backup, see default.conf" +- echo "$BOOTLOADER" >$bootloader_file +- return +-fi +- + # Check if any disk contains a PPC PReP boot partition. + # Detection taken from usr/share/rear/finalize/Linux-ppc64/680_install_PPC_bootlist.sh + disk_device="$( awk -F ' ' '/^part / {if ($6 ~ /prep/) {print $2}}' $LAYOUT_FILE )" +@@ -127,6 +118,15 @@ if is_true $USING_UEFI_BOOTLOADER ; then + return 0 + fi + ++# On ARM, guess the dummy bootloader: ++if [ "$ARCH" = "Linux-arm" ] ; then ++ BOOTLOADER=ARM ++ # Inform the user that we do nothing: ++ LogPrint "Using guessed bootloader 'ARM'. Skipping bootloader backup, see default.conf about 'BOOTLOADER'" ++ echo "$BOOTLOADER" >$bootloader_file ++ return ++fi ++ + # Error out when no bootloader was specified or could be autodetected: + Error "Cannot autodetect what is used as bootloader, see default.conf about 'BOOTLOADER'" + +diff --git a/usr/share/rear/lib/uefi-functions.sh b/usr/share/rear/lib/uefi-functions.sh +index 47f3c4fc3..bb79035e5 100644 +--- a/usr/share/rear/lib/uefi-functions.sh ++++ b/usr/share/rear/lib/uefi-functions.sh +@@ -36,7 +36,7 @@ function trim { + echo -n "$var" + } + +-function build_bootx86_efi { ++function build_boot_efi { + local outfile="$1" + local embedded_config="" + local gmkstandalone="" +@@ -62,9 +62,10 @@ function build_bootx86_efi { + # At least SUSE systems use 'grub2' prefixed names for GRUB2 programs: + gmkstandalone=grub2-mkstandalone + else +- # This build_bootx86_efi function is only called in output/ISO/Linux-i386/250_populate_efibootimg.sh +- # which runs only if UEFI is used so that we simply error out here if we cannot make a bootable EFI image of GRUB2 +- # (normally a function should not exit out but return to its caller with a non-zero return code): ++ # This build_boot_efi function is only called in 250_populate_efibootimg.sh ++ # and 100_create_efiboot.sh and 940_grub2_rescue.sh ++ # only if UEFI is used so that we simply error out here if we cannot make a bootable EFI image of GRUB2 ++ # (normally a function should not exit but return to its caller with a non-zero return code): + Error "Cannot make bootable EFI image of GRUB2 (neither grub-mkstandalone nor grub2-mkstandalone found)" + fi + +@@ -80,9 +81,9 @@ function build_bootx86_efi { + LogPrint "Neither grub-probe nor grub2-probe found" + # Since openSUSE Leap 15.1 things were moved from /usr/lib/grub2/ to /usr/share/grub2/ + # cf. https://github.com/rear/rear/issues/2338#issuecomment-594432946 +- if test /usr/*/grub*/x86_64-efi/partmap.lst ; then ++ if test /usr/*/grub*/"$GRUB2_IMAGE_FORMAT"/partmap.lst ; then + LogPrint "including all partition modules" +- modules=( $( cat /usr/*/grub*/x86_64-efi/partmap.lst ) ) ++ modules=( $( cat /usr/*/grub*/"$GRUB2_IMAGE_FORMAT"/partmap.lst ) ) + else + Error "Can not determine partition modules, ${dirs[*]} would be likely inaccessible in GRUB2" + fi +@@ -98,25 +99,25 @@ function build_bootx86_efi { + fi + fi + +- # grub-mkstandalone needs a .../grub*/x86_64-efi/moddep.lst file (cf. https://github.com/rear/rear/issues/1193) ++ # grub-mkstandalone needs a .../grub*/$GRUB2_IMAGE_FORMAT/moddep.lst file (cf. https://github.com/rear/rear/issues/1193) + # At least on SUSE systems that is in different 'grub2' directories (cf. https://github.com/rear/rear/issues/2338) + # e.g. on openSUSE Leap 15.0 it is in /usr/lib/grub2/x86_64-efi/moddep.lst + # but on openSUSE Leap 15.1 that was moved to /usr/share/grub2/x86_64-efi/moddep.lst + # and the one in /boot/grub2/x86_64-efi/moddep.lst is a copy of the one in /usr/*/grub2/x86_64-efi/moddep.lst + # so we do not error out if we do not find a /x86_64-efi/moddep.lst file because it could be "anywhere else" in the future + # but we inform the user here in advance about possible problems when there is no /x86_64-efi/moddep.lst file. +- # Careful: usr/sbin/rear sets nullglob so that /usr/*/grub*/x86_64-efi/moddep.lst gets empty if nothing matches +- # and 'test -f' succeeds with empty argument so that we cannot use 'test -f /usr/*/grub*/x86_64-efi/moddep.lst' ++ # Careful: usr/sbin/rear sets nullglob so that /usr/*/grub*/$GRUB2_IMAGE_FORMAT/moddep.lst gets empty if nothing matches ++ # and 'test -f' succeeds with empty argument so that we cannot use 'test -f /usr/*/grub*/$GRUB2_IMAGE_FORMAT/moddep.lst' + # also 'test -n' succeeds with empty argument but (fortunately/intentionally?) plain 'test' fails with empty argument. +- # Another implicit condition that this 'test' works is that '/usr/*/grub*/x86_64-efi/moddep.lst' matches at most one file +- # because otherwise e.g. "test /usr/*/grub*/x86_64-efi/mod*" where two files moddep.lst and modinfo.sh match ++ # Another implicit condition that this 'test' works is that '/usr/*/grub*/$GRUB2_IMAGE_FORMAT/moddep.lst' matches at most one file ++ # because otherwise e.g. "test /usr/*/grub*/$GRUB2_IMAGE_FORMAT/mod*" where two files moddep.lst and modinfo.sh match + # would falsely fail with "bash: test: ... unary operator expected": +- test /usr/*/grub*/x86_64-efi/moddep.lst || LogPrintError "$gmkstandalone may fail to make a bootable EFI image of GRUB2 (no /usr/*/grub*/x86_64-efi/moddep.lst file)" ++ test /usr/*/grub*/"$GRUB2_IMAGE_FORMAT"/moddep.lst || LogPrintError "$gmkstandalone may fail to make a bootable EFI image of GRUB2 (no /usr/*/grub*/$GRUB2_IMAGE_FORMAT/moddep.lst file)" + + (( ${#GRUB2_MODULES_UEFI[@]} )) && LogPrint "Installing only ${GRUB2_MODULES_UEFI[*]} modules into $outfile memdisk" + (( ${#modules[@]} )) && LogPrint "GRUB2 modules to load: ${modules[*]}" + +- if ! $gmkstandalone $v ${GRUB2_MODULES_UEFI:+"--install-modules=${GRUB2_MODULES_UEFI[*]}"} ${modules:+"--modules=${modules[*]}"} -O x86_64-efi -o $outfile $embedded_config ; then ++ if ! $gmkstandalone $v ${GRUB2_MODULES_UEFI:+"--install-modules=${GRUB2_MODULES_UEFI[*]}"} ${modules:+"--modules=${modules[*]}"} -O "$GRUB2_IMAGE_FORMAT" -o $outfile $embedded_config ; then + Error "Failed to make bootable EFI image of GRUB2 (error during $gmkstandalone of $outfile)" + fi + } +diff --git a/usr/share/rear/output/ISO/Linux-arm/250_populate_efibootimg.sh b/usr/share/rear/output/ISO/Linux-arm/250_populate_efibootimg.sh +new file mode 120000 +index 000000000..847e8f465 +--- /dev/null ++++ b/usr/share/rear/output/ISO/Linux-arm/250_populate_efibootimg.sh +@@ -0,0 +1 @@ ++../Linux-i386/250_populate_efibootimg.sh +\ No newline at end of file +diff --git a/usr/share/rear/output/ISO/Linux-arm/260_EFISTUB_populate.sh b/usr/share/rear/output/ISO/Linux-arm/260_EFISTUB_populate.sh +new file mode 120000 +index 000000000..93113f663 +--- /dev/null ++++ b/usr/share/rear/output/ISO/Linux-arm/260_EFISTUB_populate.sh +@@ -0,0 +1 @@ ++../Linux-i386/260_EFISTUB_populate.sh +\ No newline at end of file +diff --git a/usr/share/rear/output/ISO/Linux-arm/700_create_efibootimg.sh b/usr/share/rear/output/ISO/Linux-arm/700_create_efibootimg.sh +new file mode 120000 +index 000000000..8aa6a84a3 +--- /dev/null ++++ b/usr/share/rear/output/ISO/Linux-arm/700_create_efibootimg.sh +@@ -0,0 +1 @@ ++../Linux-i386/700_create_efibootimg.sh +\ No newline at end of file +diff --git a/usr/share/rear/output/ISO/Linux-arm/800_create_isofs.sh b/usr/share/rear/output/ISO/Linux-arm/800_create_isofs.sh +new file mode 100644 +index 000000000..0108dac05 +--- /dev/null ++++ b/usr/share/rear/output/ISO/Linux-arm/800_create_isofs.sh +@@ -0,0 +1,36 @@ ++# 800_create_isofs.sh ++# ++# create initramfs for Relax-and-Recover ++# ++# This file is part of Relax-and-Recover, licensed under the GNU General ++# Public License. Refer to the included COPYING for full text of license. ++ ++# Based on output/ISO/Linux-i386/800_create_isofs.sh with the creation of the ++# $TMP_DIR/isofs/isolinux directory added. This allows us to share scripts ++# used on x86_64 EFI machines. ++ ++# check that we have mkisofs ++test -x "$ISO_MKISOFS_BIN" || Error "No executable ISO_MKISOFS_BIN '$ISO_MKISOFS_BIN'" ++ ++# create some sub-dirs under $TMP_DIR for booting ++# The isolinux directory is used so that the x86_64 EFI scripts can be symlinked directly. ++[[ ! -d $TMP_DIR/isofs/isolinux ]] && mkdir $v -m 755 $TMP_DIR/isofs/isolinux >&2 ++ ++# kernel and initrd are already included in virtual image of ISO if ebiso is used ++if [[ $(basename $ISO_MKISOFS_BIN) = "ebiso" && $(basename ${UEFI_BOOTLOADER}) = "elilo.efi" ]]; then ++ Log "ebiso is used where kernel and initrd are already included in virtual image of ISO, skipping copying kernel and initrd" ++else ++ Log "Copying kernel and initrd" ++ cp -pL $v $KERNEL_FILE $TMP_DIR/isofs/isolinux/kernel || Error "Failed to copy KERNEL_FILE '$KERNEL_FILE'" ++ cp $v $TMP_DIR/$REAR_INITRD_FILENAME $TMP_DIR/isofs/isolinux/$REAR_INITRD_FILENAME || Error "Failed to copy initrd '$REAR_INITRD_FILENAME'" ++fi ++ ++#ISO_FILES+=( $TMP_DIR/kernel $TMP_DIR/$REAR_INITRD_FILENAME ) ++# in case the user populates this array manually we must not forget to copy ++# these files to our temporary isofs ++if test "${#ISO_FILES[@]}" -gt 0 ; then ++ cp -pL $v "${ISO_FILES[@]}" $TMP_DIR/isofs/isolinux/ || Error "Failed to copy ISO_FILES ${ISO_FILES[*]}" ++fi ++ ++mkdir -p $v "$ISO_DIR" || Error "Failed to create ISO_DIR '$ISO_DIR'" ++ +diff --git a/usr/share/rear/output/ISO/Linux-arm/810_prepare_multiple_iso.sh b/usr/share/rear/output/ISO/Linux-arm/810_prepare_multiple_iso.sh +new file mode 120000 +index 000000000..04f8a4955 +--- /dev/null ++++ b/usr/share/rear/output/ISO/Linux-arm/810_prepare_multiple_iso.sh +@@ -0,0 +1 @@ ++../Linux-i386/810_prepare_multiple_iso.sh +\ No newline at end of file +diff --git a/usr/share/rear/output/ISO/Linux-arm/820_create_iso_image.sh b/usr/share/rear/output/ISO/Linux-arm/820_create_iso_image.sh +new file mode 100644 +index 000000000..37842e018 +--- /dev/null ++++ b/usr/share/rear/output/ISO/Linux-arm/820_create_iso_image.sh +@@ -0,0 +1,40 @@ ++# Based on output/ISO/Linux-i386/820_create_iso_image.sh with the support ++# for non-EFI machines removed. ++ ++is_true $EFI_STUB && return 0 ++ ++Log "Starting '$ISO_MKISOFS_BIN'" ++LogPrint "Making ISO image" ++ ++is_true $USING_UEFI_BOOTLOADER || Error "OUTPUT=ISO on Linux-arm works only with UEFI" ++if [ -f /etc/slackware-version ] ; then ++ # slackware mkisofs uses different command line options ++ EFIBOOT="-eltorito-alt-boot -no-emul-boot -eltorito-platform efi -eltorito-boot boot/efiboot.img" ++else ++ EFIBOOT="-eltorito-alt-boot -e boot/efiboot.img -no-emul-boot" ++fi ++ ++pushd $TMP_DIR/isofs >/dev/null ++ ++# Error out when files greater or equal ISO_FILE_SIZE_LIMIT should be included in the ISO (cf. default.conf). ++# Consider all regular files and follow symbolic links to also get regular files where symlinks point to: ++assert_ISO_FILE_SIZE_LIMIT $( find -L . -type f ) ++ ++# ebiso uses different command line options and parameters: ++if test "ebiso" = $( basename $ISO_MKISOFS_BIN ) ; then ++ $ISO_MKISOFS_BIN $ISO_MKISOFS_OPTS -R -o $ISO_DIR/$ISO_PREFIX.iso -e boot/efiboot.img . ++else ++ $ISO_MKISOFS_BIN $v $ISO_MKISOFS_OPTS -o "$ISO_DIR/$ISO_PREFIX.iso" -no-emul-boot \ ++ -R -J -volid "$ISO_VOLID" $EFIBOOT -v -iso-level 3 . >/dev/null ++ ##-R -J -volid "$ISO_VOLID" $EFIBOOT "${ISO_FILES[@]}" >/dev/null ++fi ++StopIfError "Could not create ISO image (with $ISO_MKISOFS_BIN)" ++popd >/dev/null ++ ++iso_image_size=( $(du -h "$ISO_DIR/$ISO_PREFIX.iso") ) ++LogPrint "Wrote ISO image: $ISO_DIR/$ISO_PREFIX.iso ($iso_image_size)" ++ ++# Add ISO image to result files ++RESULT_FILES+=( "$ISO_DIR/$ISO_PREFIX.iso" ) ++ ++# vim: set et ts=4 sw=4: +diff --git a/usr/share/rear/output/ISO/Linux-arm/830_create_iso_image_EFISTUB.sh b/usr/share/rear/output/ISO/Linux-arm/830_create_iso_image_EFISTUB.sh +new file mode 100644 +index 000000000..83c2d1eeb +--- /dev/null ++++ b/usr/share/rear/output/ISO/Linux-arm/830_create_iso_image_EFISTUB.sh +@@ -0,0 +1,25 @@ ++# Based on output/ISO/Linux-i386/830_create_iso_image_EFISTUB.sh with the ++# support for non-EFI machines removed. ++ ++is_true $EFI_STUB || return 0 ++ ++Log "EFI_STUB: Starting '$ISO_MKISOFS_BIN'" ++LogPrint "EFI_STUB: Making ISO image" ++ ++pushd $TMP_DIR/isofs >/dev/null ++ ++# Error out when files greater or equal ISO_FILE_SIZE_LIMIT should be included in the ISO (cf. default.conf). ++# Consider all regular files and follow symbolic links to also get regular files where symlinks point to: ++assert_ISO_FILE_SIZE_LIMIT $( find -L . -type f ) ++ ++$ISO_MKISOFS_BIN $v $ISO_MKISOFS_OPTS -o "$ISO_DIR/$ISO_PREFIX.iso" -no-emul-boot \ ++ -R -J -volid "$ISO_VOLID" -v -iso-level 3 . >/dev/null ++ ++StopIfError "EFI_STUB: Could not create ISO image (with $ISO_MKISOFS_BIN)" ++popd >/dev/null ++ ++iso_image_size=( $(du -h "$ISO_DIR/$ISO_PREFIX.iso") ) ++LogPrint "EFI_STUB: Wrote ISO image: $ISO_DIR/$ISO_PREFIX.iso ($iso_image_size)" ++ ++# Add ISO image to result files ++RESULT_FILES+=( "$ISO_DIR/$ISO_PREFIX.iso" ) +diff --git a/usr/share/rear/output/ISO/Linux-i386/250_populate_efibootimg.sh b/usr/share/rear/output/ISO/Linux-i386/250_populate_efibootimg.sh +index 74ed1df3a..141cfbeae 100644 +--- a/usr/share/rear/output/ISO/Linux-i386/250_populate_efibootimg.sh ++++ b/usr/share/rear/output/ISO/Linux-i386/250_populate_efibootimg.sh +@@ -15,7 +15,7 @@ mkdir $v -p $efi_boot_tmp_dir/locale || Error "Could not create $efi_boot_tmp_di + + # Copy the grub*.efi executable to EFI/BOOT/BOOTX64.efi + # Intentionally an empty UEFI_BOOTLOADER results an invalid "cp -v /tmp/.../mnt/EFI/BOOT/BOOTX64.efi" command that fails: +-cp $v "$UEFI_BOOTLOADER" $efi_boot_tmp_dir/BOOTX64.efi || Error "Could not find UEFI_BOOTLOADER '$UEFI_BOOTLOADER'" ++cp $v "$UEFI_BOOTLOADER" $efi_boot_tmp_dir/BOOT$EFI_ARCH_UPPER.efi || Error "Could not find UEFI_BOOTLOADER '$UEFI_BOOTLOADER'" + local uefi_bootloader_dirname="$( dirname $UEFI_BOOTLOADER )" + if test -f "$SECURE_BOOT_BOOTLOADER" ; then + # FIXME: Explain why it tests that a SECURE_BOOT_BOOTLOADER file exists +@@ -52,7 +52,7 @@ if test "ebiso" = "$( basename $ISO_MKISOFS_BIN )" ; then + fi + + if [[ -n "$(type -p grub)" ]]; then +- cat > $efi_boot_tmp_dir/BOOTX64.conf << EOF ++ cat > $efi_boot_tmp_dir/BOOT$EFI_ARCH_UPPER.conf << EOF + default=0 + timeout 5 + splashimage=/EFI/BOOT/splash.xpm.gz +@@ -70,9 +70,9 @@ fi + # We are not able to create signed boot loader + # so we need to reuse existing one. + # See issue #1374 +-# build_bootx86_efi () can be safely used for other scenarios. ++# build_boot_efi () can be safely used for other scenarios. + if ! test -f "$SECURE_BOOT_BOOTLOADER" ; then +- build_bootx86_efi $TMP_DIR/mnt/EFI/BOOT/BOOTX64.efi $efi_boot_tmp_dir/grub.cfg "$boot_dir" "$UEFI_BOOTLOADER" ++ build_boot_efi $TMP_DIR/mnt/EFI/BOOT/BOOT$EFI_ARCH_UPPER.efi $efi_boot_tmp_dir/grub.cfg "$boot_dir" "$UEFI_BOOTLOADER" + fi + + # We will be using grub-efi or grub2 (with efi capabilities) to boot from ISO. +@@ -111,7 +111,7 @@ cp $v -r $TMP_DIR/mnt/EFI $TMP_DIR/isofs/ || Error "Could not create the isofs/E + # Make /boot/grub/grub.cfg available on isofs/ + mkdir $v -p -m 755 $TMP_DIR/isofs/boot/grub + if test "$( type -p grub )" ; then +- cp $v $TMP_DIR/isofs/EFI/BOOT/BOOTX64.conf $TMP_DIR/isofs/boot/grub/ || Error "Could not copy EFI/BOOT/BOOTX64.conf to isofs/boot/grub" ++ cp $v $TMP_DIR/isofs/EFI/BOOT/BOOT$EFI_ARCH_UPPER.conf $TMP_DIR/isofs/boot/grub/ || Error "Could not copy EFI/BOOT/BOOT${EFI_ARCH_UPPER}.conf to isofs/boot/grub" + else + cp $v $TMP_DIR/isofs/EFI/BOOT/grub.cfg $TMP_DIR/isofs/boot/grub/ || Error "Could not copy EFI/BOOT/grub.cfg to isofs/boot/grub" + fi +diff --git a/usr/share/rear/output/ISO/Linux-i386/260_EFISTUB_populate.sh b/usr/share/rear/output/ISO/Linux-i386/260_EFISTUB_populate.sh +index a91264494..3c2380d8b 100644 +--- a/usr/share/rear/output/ISO/Linux-i386/260_EFISTUB_populate.sh ++++ b/usr/share/rear/output/ISO/Linux-i386/260_EFISTUB_populate.sh +@@ -33,7 +33,7 @@ else + Error "EFI_STUB: EFI executable $OUTPUT_EFISTUB_SYSTEMD_BOOTLOADER not found" + fi + +-cp $v "$OUTPUT_EFISTUB_SYSTEMD_BOOTLOADER" $efi_boot_tmp_dir/BOOTX64.efi ++cp $v "$OUTPUT_EFISTUB_SYSTEMD_BOOTLOADER" $efi_boot_tmp_dir/BOOT${EFI_ARCH_UPPER}.efi + + + # Create boot menu entries for systemd-bootx64.efi. +diff --git a/usr/share/rear/output/RAWDISK/Linux-i386/260_create_syslinux_efi_bootloader.sh b/usr/share/rear/output/RAWDISK/Linux-i386/260_create_syslinux_efi_bootloader.sh +index cca8caf6b..155f433c9 100644 +--- a/usr/share/rear/output/RAWDISK/Linux-i386/260_create_syslinux_efi_bootloader.sh ++++ b/usr/share/rear/output/RAWDISK/Linux-i386/260_create_syslinux_efi_bootloader.sh +@@ -33,7 +33,7 @@ local efi_boot_directory="$RAWDISK_BOOT_EFI_STAGING_ROOT/BOOT" + + mkdir $v -p "$efi_boot_directory" || Error "Could not create $efi_boot_directory" + +-cp $v "$syslinux_efi" "$efi_boot_directory/BOOTX64.EFI" >&2 ++cp $v "$syslinux_efi" "$efi_boot_directory/BOOT${EFI_ARCH_UPPER}.EFI" >&2 + cp $v "$ldlinux_e64" "$efi_boot_directory" >&2 + + +diff --git a/usr/share/rear/output/RAWDISK/Linux-i386/270_create_grub2_efi_bootloader.sh b/usr/share/rear/output/RAWDISK/Linux-i386/270_create_grub2_efi_bootloader.sh +index 8b543d8c8..0dbf17547 100644 +--- a/usr/share/rear/output/RAWDISK/Linux-i386/270_create_grub2_efi_bootloader.sh ++++ b/usr/share/rear/output/RAWDISK/Linux-i386/270_create_grub2_efi_bootloader.sh +@@ -21,7 +21,7 @@ fi + # cf. https://github.com/rear/rear/issues/2338#issuecomment-594432946 + local efi_modules_directory + local dir +-for dir in /usr/lib/grub/x86_64-efi /usr/lib/grub2/x86_64-efi /usr/share/grub2/x86_64-efi; do ++for dir in "/usr/lib/grub/$GRUB2_IMAGE_FORMAT" "/usr/lib/grub2/$GRUB2_IMAGE_FORMAT" "/usr/share/grub2/$GRUB2_IMAGE_FORMAT"; do + if [[ -d "$dir" ]]; then + efi_modules_directory="$dir" + break +@@ -71,10 +71,10 @@ if [[ -n "$SECURE_BOOT_BOOTLOADER" ]]; then + # If /boot/$grub2_name exists, it contains additional Grub modules, which are not compiled into the grub core image. + # Pick required ones from there, too. + local additional_grub_directory="/boot/$grub2_name" +- local grub_modules_directory="x86_64-efi" ++ local grub_modules_directory="$GRUB2_IMAGE_FORMAT" + local additional_grub_modules=( all_video.mod ) + if [[ -d "$additional_grub_directory/$grub_modules_directory" ]]; then +- local grub_target_directory="$(dirname "$(find "$RAWDISK_BOOT_EFI_STAGING_ROOT" -iname grubx64.efi -print)")" ++ local grub_target_directory="$(dirname "$(find "$RAWDISK_BOOT_EFI_STAGING_ROOT" -iname grub${EFI_ARCH}.efi -print)")" + [[ "$grub_target_directory" == "." ]] && Error "Could not find Grub executable" # dirname "" returns "." + + mkdir "$grub_target_directory/$grub_modules_directory" || Error "Could not create Grub modules directory" +@@ -102,9 +102,9 @@ else + + # Create a Grub 2 EFI core image and install it as boot loader. (NOTE: This version will not be signed.) + # Use the UEFI default boot loader name, so that firmware will find it without an existing boot entry. +- local boot_loader="$efi_boot_directory/BOOTX64.EFI" ++ local boot_loader="$efi_boot_directory/BOOT${EFI_ARCH_UPPER}.EFI" + local grub_modules=( part_gpt fat normal configfile linux video all_video ) + [[ -f "$efi_modules_directory/linuxefi.mod" ]] && grub_modules+=("$efi_modules_directory/linuxefi.mod") +- $grub2_name-mkimage -O x86_64-efi -o "$boot_loader" -p "/EFI/BOOT" "${grub_modules[@]}" ++ $grub2_name-mkimage -O "$GRUB2_IMAGE_FORMAT" -o "$boot_loader" -p "/EFI/BOOT" "${grub_modules[@]}" + StopIfError "Error occurred during $grub2_name-mkimage of $boot_loader" + fi +diff --git a/usr/share/rear/output/USB/Linux-arm/100_create_efiboot.sh b/usr/share/rear/output/USB/Linux-arm/100_create_efiboot.sh +new file mode 120000 +index 000000000..3846131fb +--- /dev/null ++++ b/usr/share/rear/output/USB/Linux-arm/100_create_efiboot.sh +@@ -0,0 +1 @@ ++../Linux-i386/100_create_efiboot.sh +\ No newline at end of file +diff --git a/usr/share/rear/output/USB/Linux-i386/100_create_efiboot.sh b/usr/share/rear/output/USB/Linux-i386/100_create_efiboot.sh +index fd631c444..cfcd001d7 100644 +--- a/usr/share/rear/output/USB/Linux-i386/100_create_efiboot.sh ++++ b/usr/share/rear/output/USB/Linux-i386/100_create_efiboot.sh +@@ -51,8 +51,8 @@ if test -f "$SECURE_BOOT_BOOTLOADER" ; then + # (cf. rescue/default/850_save_sysfs_uefi_vars.sh) + # then Shim (usually shim.efi) must be copied as EFI/BOOT/BOOTX64.efi + # and Shim's second stage bootloader must be also copied where Shim already is. +- DebugPrint "Using '$SECURE_BOOT_BOOTLOADER' as first stage Secure Boot bootloader BOOTX64.efi" +- cp -L $v "$SECURE_BOOT_BOOTLOADER" "$EFI_DST/BOOTX64.efi" || Error "Failed to copy SECURE_BOOT_BOOTLOADER '$SECURE_BOOT_BOOTLOADER' to $EFI_DST/BOOTX64.efi" ++ DebugPrint "Using '$SECURE_BOOT_BOOTLOADER' as first stage Secure Boot bootloader BOOT${EFI_ARCH_UPPER}.efi" ++ cp -L $v "$SECURE_BOOT_BOOTLOADER" "$EFI_DST/BOOT${EFI_ARCH_UPPER}.efi" || Error "Failed to copy SECURE_BOOT_BOOTLOADER '$SECURE_BOOT_BOOTLOADER' to $EFI_DST/BOOT${EFI_ARCH_UPPER}.efi" + # When Shim is used, its second stage bootloader can be actually anything + # named grub*.efi (second stage bootloader is Shim compile time option), see + # http://www.rodsbooks.com/efi-bootloaders/secureboot.html#initial_shim +@@ -65,9 +65,8 @@ if test -f "$SECURE_BOOT_BOOTLOADER" ; then + DebugPrint "Using second stage Secure Boot bootloader files: $second_stage_UEFI_bootloader_files" + cp -L $v $second_stage_UEFI_bootloader_files $EFI_DST/ || Error "Failed to copy second stage Secure Boot bootloader files" + else +- cp -L $v "$UEFI_BOOTLOADER" "$EFI_DST/BOOTX64.efi" || Error "Failed to copy UEFI_BOOTLOADER '$UEFI_BOOTLOADER' to $EFI_DST/BOOTX64.efi" ++ cp -L $v "$UEFI_BOOTLOADER" "$EFI_DST/BOOT${EFI_ARCH_UPPER}.efi" || Error "Failed to copy UEFI_BOOTLOADER '$UEFI_BOOTLOADER' to $EFI_DST/BOOT${EFI_ARCH_UPPER}.efi" + fi +-cp $v $UEFI_BOOTLOADER "$EFI_DST/BOOTX64.efi" || Error "Failed to copy UEFI_BOOTLOADER '$UEFI_BOOTLOADER' to $EFI_DST/BOOTX64.efi" + + # Copy kernel + cp -pL $v "$KERNEL_FILE" "$EFI_DST/kernel" || Error "Failed to copy KERNEL_FILE '$KERNEL_FILE' to $EFI_DST/kernel" +@@ -109,7 +108,7 @@ else + Log "Configuring grub 0.97 for EFI boot" + + # Create config for grub 0.97 +- cat > ${EFI_DST}/BOOTX64.conf << EOF ++ cat > ${EFI_DST}/BOOT${EFI_ARCH_UPPER}.conf << EOF + default=0 + timeout=5 + +@@ -117,7 +116,7 @@ title Relax-and-Recover (no Secure Boot) + kernel ${EFI_DIR}/kernel $KERNEL_CMDLINE + initrd ${EFI_DIR}/$REAR_INITRD_FILENAME + EOF +- ;; ++ ;; + 2) + Log "Configuring grub 2.0 for EFI boot" + # We need to explicitly set $root variable to $EFI_LABEL +@@ -128,22 +127,22 @@ EOF + grub2_set_usb_root="search --no-floppy --set=root --label ${EFI_LABEL}" + + # Create config for grub 2.0 +- create_grub2_cfg ${EFI_DIR}/kernel ${EFI_DIR}/$REAR_INITRD_FILENAME > ${EFI_DST}/grub.cfg ++ create_grub2_cfg ${EFI_DIR}/kernel ${EFI_DIR}/$REAR_INITRD_FILENAME > ${EFI_DST}/grub.cfg + + # Create bootloader, this overwrite BOOTX64.efi copied in previous step ... +- # Create BOOTX86.efi but only if we are NOT secure booting. +- # We are not able to create signed boot loader +- # so we need to reuse existing one. +- # See issue #1374 +- # build_bootx86_efi () can be safely used for other scenarios. +- if ! test -f "$SECURE_BOOT_BOOTLOADER" ; then +- build_bootx86_efi ${EFI_DST}/BOOTX64.efi ${EFI_DST}/grub.cfg "/boot" "$UEFI_BOOTLOADER" +- fi +- ;; ++ # Create BOOTX86.efi but only if we are NOT secure booting. ++ # We are not able to create signed boot loader ++ # so we need to reuse existing one. ++ # See issue #1374 ++ # build_boot_efi () can be safely used for other scenarios. ++ if ! test -f "$SECURE_BOOT_BOOTLOADER" ; then ++ build_boot_efi $EFI_DST/BOOT$EFI_ARCH_UPPER.efi $EFI_DST/grub.cfg "/boot" "$UEFI_BOOTLOADER" ++ fi ++ ;; + *) + BugError "Neither grub 0.97 nor 2.0" +- ;; +- esac ++ ;; ++ esac + else + BugIfError "Unknown EFI bootloader" + fi +diff --git a/usr/share/rear/output/USB/Linux-i386/300_create_extlinux.sh b/usr/share/rear/output/USB/Linux-i386/300_create_extlinux.sh +index 47c7dc80c..3bbb66e2b 100644 +--- a/usr/share/rear/output/USB/Linux-i386/300_create_extlinux.sh ++++ b/usr/share/rear/output/USB/Linux-i386/300_create_extlinux.sh +@@ -95,12 +95,6 @@ case "$WORKFLOW" in + (*) BugError "Workflow $WORKFLOW should not run this script." + esac + +-USB_REAR_DIR="$BUILD_DIR/outputfs/$USB_PREFIX" +-if [ ! -d "$USB_REAR_DIR" ]; then +- mkdir -p $v "$USB_REAR_DIR" >/dev/null +- StopIfError "Could not create USB ReaR dir [$USB_REAR_DIR] !" +-fi +- + # We generate a single syslinux.cfg for the current system + Log "Creating $USB_PREFIX/syslinux.cfg" + # FIXME: # type -a time +diff --git a/usr/share/rear/output/USB/default/200_make_usb_prefix_dir.sh b/usr/share/rear/output/USB/default/200_make_usb_prefix_dir.sh +new file mode 100644 +index 000000000..3c8ff6e6c +--- /dev/null ++++ b/usr/share/rear/output/USB/default/200_make_usb_prefix_dir.sh +@@ -0,0 +1,8 @@ ++# The $BUILD_DIR/outputfs/$USB_PREFIX directory is needed by subsequent scripts ++# like output/USB/default/830_copy_kernel_initrd.sh to store kernel and initrd ++# and for parts of the syslinux config in 'syslinux.cfg' if syslinux/extlinux is used ++ ++USB_REAR_DIR="$BUILD_DIR/outputfs/$USB_PREFIX" ++if [ ! -d "$USB_REAR_DIR" ] ; then ++ mkdir -p $v "$USB_REAR_DIR" || Error "Failed to create USB ReaR dir '$usb_rear_dir'" ++fi +diff --git a/usr/share/rear/output/USB/Linux-i386/830_copy_kernel_initrd.sh b/usr/share/rear/output/USB/default/830_copy_kernel_initrd.sh +similarity index 100% +rename from usr/share/rear/output/USB/Linux-i386/830_copy_kernel_initrd.sh +rename to usr/share/rear/output/USB/default/830_copy_kernel_initrd.sh +diff --git a/usr/share/rear/output/default/940_grub2_rescue.sh b/usr/share/rear/output/default/940_grub2_rescue.sh +index 38e816389..af09ca381 100644 +--- a/usr/share/rear/output/default/940_grub2_rescue.sh ++++ b/usr/share/rear/output/default/940_grub2_rescue.sh +@@ -173,7 +173,8 @@ if is_true $USING_UEFI_BOOTLOADER ; then + ) > $grub_config_dir/rear.cfg + + # Create rear.efi at UEFI default boot directory location. +- build_bootx86_efi $boot_dir/efi/EFI/BOOT/rear.efi $grub_config_dir/rear.cfg "$boot_dir" "$UEFI_BOOTLOADER" ++ # The build_boot_efi errors out if it cannot make a bootable EFI image of GRUB2: ++ build_boot_efi $boot_dir/efi/EFI/BOOT/rear.efi $grub_config_dir/rear.cfg "$boot_dir" "$UEFI_BOOTLOADER" + + # If UEFI boot entry for "Relax-and-Recover" does not exist, create it. + # This will also add "Relax-and-Recover" to boot order because if UEFI entry is not listed in BootOrder, +diff --git a/usr/share/rear/prep/Linux-arm/060_check_config.sh b/usr/share/rear/prep/Linux-arm/060_check_config.sh +deleted file mode 100644 +index ca0978a12..000000000 +--- a/usr/share/rear/prep/Linux-arm/060_check_config.sh ++++ /dev/null +@@ -1,3 +0,0 @@ +-if [ "$OUTPUT" != "PXE" ] ; then +- Error "Currently only OUTPUT=PXE is supported on ARM" +-fi +diff --git a/usr/share/rear/prep/Linux-arm/330_set_efi_arch.sh b/usr/share/rear/prep/Linux-arm/330_set_efi_arch.sh +new file mode 100644 +index 000000000..2dfd82d24 +--- /dev/null ++++ b/usr/share/rear/prep/Linux-arm/330_set_efi_arch.sh +@@ -0,0 +1,21 @@ ++ ++# Set EFI architecture, used as suffix for various files in the ESP ++# See https://github.com/rhboot/shim/blob/main/Make.defaults ++ ++# Set the variables even if USING_UEFI_BOOTLOADER empty or no explicit 'true' value ++# cf. prep/Linux-i386/330_set_efi_arch.sh ++ ++case "$REAL_MACHINE" in ++ (arm64|aarch64) ++ EFI_ARCH=aa64 ++ GRUB2_IMAGE_FORMAT=arm64-efi ++ ;; ++ (arm*) ++ EFI_ARCH=arm ++ GRUB2_IMAGE_FORMAT=arm-efi ++ ;; ++ (*) ++ BugError "Unknown architecture $REAL_MACHINE" ++esac ++ ++EFI_ARCH_UPPER="${EFI_ARCH^^}" +diff --git a/usr/share/rear/prep/Linux-i386/330_set_efi_arch.sh b/usr/share/rear/prep/Linux-i386/330_set_efi_arch.sh +new file mode 100644 +index 000000000..51a320767 +--- /dev/null ++++ b/usr/share/rear/prep/Linux-i386/330_set_efi_arch.sh +@@ -0,0 +1,32 @@ ++ ++# Set EFI architecture, used as suffix for various files in the ESP ++# See https://github.com/rhboot/shim/blob/main/Make.defaults ++ ++# Set the variables even if USING_UEFI_BOOTLOADER empty or no explicit 'true' value ++# which sets GRUB2_IMAGE_FORMAT (used as argument for 'grub-mkstandalone -O ...') ++# to a value for EFI systems ('x86_64-efi' or 'i386-efi') also on BIOS systems ++# but that does not matter for now because currently GRUB2_IMAGE_FORMAT ++# is only used in case of EFI in the scripts lib/uefi-functions.sh ++# and output/RAWDISK/Linux-i386/270_create_grub2_efi_bootloader.sh ++# see https://github.com/rear/rear/pull/3157 ++# and https://github.com/rear/rear/issues/3191 ++# and https://github.com/rear/rear/issues/3195 ++ ++case "$REAL_MACHINE" in ++ # cf. the seting of REAL_MACHINE ('uname -m') and MACHINE in default.conf ++ (i686|i586|i386) ++ # all these behave exactly like i386. ++ # ia32 is another name for i386, used by EFI ++ # (but ia64 is not x86_64 aka amd64, it is the architecture of Itanium) ++ EFI_ARCH=ia32 ++ GRUB2_IMAGE_FORMAT=i386-efi ++ ;; ++ (x86_64) ++ EFI_ARCH=x64 ++ GRUB2_IMAGE_FORMAT=x86_64-efi ++ ;; ++ (*) ++ BugError "Unknown architecture $REAL_MACHINE" ++esac ++ ++EFI_ARCH_UPPER="${EFI_ARCH^^}" +diff --git a/usr/share/rear/prep/Linux-ia64/330_set_efi_arch.sh b/usr/share/rear/prep/Linux-ia64/330_set_efi_arch.sh +new file mode 100644 +index 000000000..668a3262e +--- /dev/null ++++ b/usr/share/rear/prep/Linux-ia64/330_set_efi_arch.sh +@@ -0,0 +1,12 @@ ++ ++# Set EFI architecture, used as suffix for various files in the ESP ++# See https://github.com/rhboot/shim/blob/main/Make.defaults ++ ++# Set the variables even if USING_UEFI_BOOTLOADER empty or no explicit 'true' value ++# cf. prep/Linux-i386/330_set_efi_arch.sh ++ ++EFI_ARCH=ia64 ++# argument for grub2-mkstandalone -O ... ++GRUB2_IMAGE_FORMAT=ia64-efi ++ ++EFI_ARCH_UPPER="${EFI_ARCH^^}" +diff --git a/usr/share/rear/prep/USB/Linux-arm/350_safeguard_error_out.sh b/usr/share/rear/prep/USB/Linux-arm/350_safeguard_error_out.sh +deleted file mode 120000 +index 49a162aeb..000000000 +--- a/usr/share/rear/prep/USB/Linux-arm/350_safeguard_error_out.sh ++++ /dev/null +@@ -1 +0,0 @@ +-../Linux-ppc64/350_safeguard_error_out.sh +\ No newline at end of file +diff --git a/usr/share/rear/prep/USB/Linux-ppc64/350_safeguard_error_out.sh b/usr/share/rear/prep/USB/Linux-ppc64/350_safeguard_error_out.sh +index 412014ea3..6b56a5dee 100644 +--- a/usr/share/rear/prep/USB/Linux-ppc64/350_safeguard_error_out.sh ++++ b/usr/share/rear/prep/USB/Linux-ppc64/350_safeguard_error_out.sh +@@ -27,10 +27,6 @@ + # OUTPUT=USB on IBM Z (s390/s390x) architecture: + # The symbolic link prep/USB/Linux-s390/350_safeguard_error_out.sh + # and its link target prep/USB/Linux-ppc64/350_safeguard_error_out.sh +-# +-# OUTPUT=USB on ARM architecture: +-# The symbolic link prep/USB/Linux-arm/350_safeguard_error_out.sh +-# and its link target prep/USB/Linux-ppc64/350_safeguard_error_out.sh + + Error "OUTPUT=USB not supported on $ARCH (no support to install a bootloader)" + +diff --git a/usr/share/rear/rescue/default/850_save_sysfs_uefi_vars.sh b/usr/share/rear/rescue/default/850_save_sysfs_uefi_vars.sh +index 678b9c598..8e4f902d3 100644 +--- a/usr/share/rear/rescue/default/850_save_sysfs_uefi_vars.sh ++++ b/usr/share/rear/rescue/default/850_save_sysfs_uefi_vars.sh +@@ -55,11 +55,11 @@ for dummy in "once" ; do + UEFI_BOOTLOADER=$( find /boot/efi -name 'elilo.efi' | tail -1 ) + test -f "$UEFI_BOOTLOADER" && continue + # In case we have a 64-bit systemd bootloader we might be lucky with next statement: +- UEFI_BOOTLOADER=$( find /boot/EFI -name 'BOOTX64.EFI' | tail -1 ) ++ UEFI_BOOTLOADER=$( find /boot/EFI -name "BOOT${EFI_ARCH_UPPER}.EFI" | tail -1 ) + test -f "$UEFI_BOOTLOADER" && continue + # Try more generic finds in whole /boot with case insensitive filename matching. + # On older systems where 'find' does not support '-iname' this does not make it really worse because there 'find' just fails. +- for find_name_pattern in 'grub*.efi' 'elilo.efi' 'BOOTX64.EFI' ; do ++ for find_name_pattern in 'grub*.efi' 'elilo.efi' "BOOT${EFI_ARCH_UPPER}.EFI" ; do + # No need to test if find_name_pattern is empty because 'find' does not find anything with empty '-iname': + UEFI_BOOTLOADER=$( find /boot -iname "$find_name_pattern" | tail -1 ) + # Continue with the code after the outer 'for' loop: diff --git a/SOURCES/rear-support-multi-keyslot-luks-RHEL-83776.patch b/SOURCES/rear-support-multi-keyslot-luks-RHEL-83776.patch new file mode 100644 index 0000000..973e75a --- /dev/null +++ b/SOURCES/rear-support-multi-keyslot-luks-RHEL-83776.patch @@ -0,0 +1,167 @@ +From b448f6c71e96d01909ec8d877f78201e9f9efa45 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Renaud=20M=C3=A9trich?= + <1163635+rmetrich@users.noreply.github.com> +Date: Fri, 27 Jun 2025 14:39:01 +0200 +Subject: [PATCH] LUKS2: try to handle multiple key slots (#3430) + +LUKS2: try to handle multiple key slots: +The current code doesn't deal properly with multiple key slots nor +extracts the Hash that was used at LUKS creation properly. +With current code, when multiple key slots are found or PBKDF algorithm +is "pbkdf2" (instead of default "argon2id"), the disk layout file +contains 2 lines for 'crypt' parameters, causing havoc during recovery. +This new code tries to do better: +It searches for the Hash in Keyslots section only +(and falls back to Digests section if not found). +It warns the admin if multiple keyslots are in use +(e.g. because of multiple passphrases or Clevis binding). +It handles the PBKDF algorithm. +It makes sure that the 'crypt' parameters are always on one line. +--- + doc/user-guide/06-layout-configuration.adoc | 2 +- + .../GNU/Linux/160_include_luks_code.sh | 3 + + .../layout/save/GNU/Linux/260_crypt_layout.sh | 69 ++++++++++++++++--- + 3 files changed, 62 insertions(+), 12 deletions(-) + +diff --git a/doc/user-guide/06-layout-configuration.adoc b/doc/user-guide/06-layout-configuration.adoc +index 680d69640..8a56cb77a 100644 +--- a/doc/user-guide/06-layout-configuration.adoc ++++ b/doc/user-guide/06-layout-configuration.adoc +@@ -612,7 +612,7 @@ lvmvol [key:value ...] + + === LUKS Devices === + ---------------------------------- +-crypt /dev/mapper/ [type=] [cipher=] [key_size=] [hash=] [uuid=] [keyfile=] [password=] ++crypt /dev/mapper/ [type=] [cipher=] [key_size=] [hash=] [uuid=] [pbkdf= ] [keyfile=] [password=] + ---------------------------------- + + === DRBD === +diff --git a/usr/share/rear/layout/prepare/GNU/Linux/160_include_luks_code.sh b/usr/share/rear/layout/prepare/GNU/Linux/160_include_luks_code.sh +index 0c662f677..3b0b34cd1 100644 +--- a/usr/share/rear/layout/prepare/GNU/Linux/160_include_luks_code.sh ++++ b/usr/share/rear/layout/prepare/GNU/Linux/160_include_luks_code.sh +@@ -62,6 +62,9 @@ create_crypt() { + (uuid) + test $value && cryptsetup_options+=" --uuid $value" + ;; ++ (pbkdf) ++ test $value && cryptsetup_options+=" --pbkdf $value" ++ ;; + (keyfile) + test $value && keyfile=$value + ;; +diff --git a/usr/share/rear/layout/save/GNU/Linux/260_crypt_layout.sh b/usr/share/rear/layout/save/GNU/Linux/260_crypt_layout.sh +index afeabf6a7..c13cdb94a 100644 +--- a/usr/share/rear/layout/save/GNU/Linux/260_crypt_layout.sh ++++ b/usr/share/rear/layout/save/GNU/Linux/260_crypt_layout.sh +@@ -53,31 +53,73 @@ while read target_name junk ; do + fi + luks_type=luks$version + ++ luksDump_cmd="cryptsetup luksDump $source_device" ++ + # Gather crypt information: +- if ! cryptsetup luksDump $source_device >$TMP_DIR/cryptsetup.luksDump ; then +- LogPrintError "Error: Cannot get LUKS$version values for $target_name ('cryptsetup luksDump $source_device' failed)" ++ if ! $luksDump_cmd >$TMP_DIR/cryptsetup.luksDump ; then ++ LogPrintError "Error: Cannot get LUKS$version values for $target_name ('$luksDump_cmd' failed)" + continue + fi ++ + uuid=$( grep "UUID" $TMP_DIR/cryptsetup.luksDump | sed -r 's/^.+:\s*(.+)$/\1/' ) + keyfile_option=$( [ -f /etc/crypttab ] && awk '$1 == "'"$target_name"'" && $3 != "none" && $3 != "-" && $3 != "" { print "keyfile=" $3; }' /etc/crypttab ) ++ pbkdf_option="" ++ + if test $luks_type = "luks1" ; then ++ + cipher_name=$( grep "Cipher name" $TMP_DIR/cryptsetup.luksDump | sed -r 's/^.+:\s*(.+)$/\1/' ) + cipher_mode=$( grep "Cipher mode" $TMP_DIR/cryptsetup.luksDump | cut -d: -f2- | awk '{printf("%s",$1)};' ) + cipher=$cipher_name-$cipher_mode + key_size=$( grep "MK bits" $TMP_DIR/cryptsetup.luksDump | sed -r 's/^.+:\s*(.+)$/\1/' ) + hash=$( grep "Hash spec" $TMP_DIR/cryptsetup.luksDump | sed -r 's/^.+:\s*(.+)$/\1/' ) ++ + elif test $luks_type = "luks2" ; then +- cipher=$( grep "cipher:" $TMP_DIR/cryptsetup.luksDump | sed -r 's/^.+:\s*(.+)$/\1/' ) +- # More than one keyslot may be defined - use key_size from the first slot. ++ ++ keyslots_section=$( awk '/^Keyslots:/ {include=1;next} /^[[:upper:]]/ && include {exit} include' $TMP_DIR/cryptsetup.luksDump ) ++ if [ -z "$keyslots_section" ]; then ++ LogPrintError "Error: No Keyslots section found in '$luksDump_cmd' output" ++ continue ++ fi ++ if [ $( grep -c -P '^\s+\d+: luks2' <<< "$keyslots_section" ) -gt 1 ]; then ++ LogPrintError "Warning: More than one luks2 keyslot found in '$luksDump_cmd' output, will only consider the first keyslot during recovery" ++ fi ++ luks2_section=$( awk '/^[[:blank:]]+[[:digit:]]+:/ && include {exit} /^[[:blank:]]+[[:digit:]]+: luks2/{include=1} include' <<< "$keyslots_section") ++ ++ cipher=$( grep "Cipher:" <<< "$luks2_section" | sed -r 's/^.+:\s*(.+)$/\1/' ) ++ pbkdf=$( grep "PBKDF:" <<< "$luks2_section" | sed -r 's/^.+:\s*(.+)$/\1/' ) ++ if [ -z "$pbkdf" ]; then ++ LogPrintError "Warning: no PBKDF found in luks2 keyslot of '$luksDump_cmd' output, will use defaults during recovery" ++ else ++ pbkdf_option="pbkdf=$pbkdf" ++ fi ++ + # Depending on the version the "cryptsetup luksDump" command outputs the key_size value + # as a line like + # Key: 512 bits + # and/or as a line like + # Cipher key: 512 bits + # cf. https://github.com/rear/rear/pull/2504#issuecomment-718729198 and subsequent comments +- # so we grep for both lines but use only the first match from the first slot: +- key_size=$( egrep -m 1 "Key:|Cipher key:" $TMP_DIR/cryptsetup.luksDump | sed -r 's/^.+:\s*(.+) bits$/\1/' ) +- hash=$( grep "Hash" $TMP_DIR/cryptsetup.luksDump | sed -r 's/^.+:\s*(.+)$/\1/' ) ++ key_size=$( grep -E "Key:|Cipher key:" <<< "$luks2_section" | sed -r 's/^.+:\s*(.+) bits$/\1/' | sort -u ) ++ if [ -z "$key_size" ]; then ++ LogPrintError "Error: No key size found in luks2 keyslot of '$luksDump_cmd' output" ++ elif [ $( wc -w <<< "$key_size" ) -gt 1 ]; then ++ LogPrintError "Error: Too many key sizes found in luks2 keyslot of '$luksDump_cmd' output" ++ key_size="" ++ fi ++ ++ hash=$( grep "AF hash:" <<< "$luks2_section" | sed -r 's/^.+:\s*(.+)$/\1/' ) ++ if [ -z "$hash" ]; then ++ # Fallback to using Hash field found in Digests section ++ digests_section=$( awk '/^Digests:/ {include=1;next} /^[[:upper:]]/ && include {exit} include' $TMP_DIR/cryptsetup.luksDump ) ++ hash=$( grep "Hash:" <<< "$digests_section" | sed -r 's/^.+:\s*(.+)$/\1/' | sort -u ) ++ if [ -z "$hash" ]; then ++ LogPrintError "Warning: No Hash found in Digests section of '$luksDump_cmd' output, will use default type during recovery" ++ elif [ $( wc -w <<< "$hash" ) -gt 1 ]; then ++ hash=$( head -1 <<< "$hash" ) ++ LogPrintError "Warning: Too many Hash found in Digests section of '$luksDump_cmd' output, will use '$hash' during recovery" ++ fi ++ fi ++ + fi + + # Basic checks that the cipher key_size hash uuid values exist +@@ -87,9 +129,9 @@ while read target_name junk ; do + # and it seems cryptsetup fails when options with empty values are specified + # cf. https://github.com/rear/rear/pull/2504#issuecomment-719479724 + # For example a LUKS1 crypt entry in disklayout.conf looks like +- # crypt /dev/mapper/luks1test /dev/sda7 type=luks1 cipher=aes-xts-plain64 key_size=256 hash=sha256 uuid=1b4198c9-d9b0-4c57-b9a3-3433e391e706 +- # and a LUKS1 crypt entry in disklayout.conf looks like +- # crypt /dev/mapper/luks2test /dev/sda8 type=luks2 cipher=aes-xts-plain64 key_size=256 hash=sha256 uuid=3e874a28-7415-4f8c-9757-b3f28a96c4d2 ++ # crypt /dev/mapper/luks1test /dev/sda7 type=luks1 cipher=aes-xts-plain64 key_size=256 hash=sha256 uuid=1b4198c9-d9b0-4c57-b9a3-3433e391e706 ++ # and a LUKS2 crypt entry in disklayout.conf looks like ++ # crypt /dev/mapper/luks2test /dev/sda8 type=luks2 cipher=aes-xts-plain64 key_size=256 hash=sha256 uuid=3e874a28-7415-4f8c-9757-b3f28a96c4d2 pbkdf=argon2id + # Only the keyfile_option value is optional and the luks_type value is already tested above. + # Using plain test to ensure a value is a single non empty and non blank word + # without quoting because test " " would return zero exit code +@@ -119,7 +161,12 @@ while read target_name junk ; do + LogPrintError "Error: No 'uuid' value for LUKS$version volume $target_name in $source_device (mounting it or booting the recreated system may fail)" + fi + +- echo "crypt /dev/mapper/$target_name $source_device type=$luks_type cipher=$cipher key_size=$key_size hash=$hash uuid=$uuid $keyfile_option" >> $DISKLAYOUT_FILE ++ { ++ echo -n "crypt /dev/mapper/$target_name $source_device type=$luks_type cipher=$cipher key_size=$key_size hash=$hash uuid=$uuid" ++ [ -n "$keyfile_option" ] && echo -n " $keyfile_option" ++ [ -n "$pbkdf_option" ] && echo -n " $pbkdf_option" ++ echo ++ } >> $DISKLAYOUT_FILE + + done < <( dmsetup ls --target crypt ) + +-- +2.39.5 + diff --git a/SPECS/rear.spec b/SPECS/rear.spec index 2e6bbfb..102a8cf 100644 --- a/SPECS/rear.spec +++ b/SPECS/rear.spec @@ -3,7 +3,7 @@ Name: rear Version: 2.6 -Release: 26%{?dist} +Release: 27%{?dist} Summary: Relax-and-Recover is a Linux disaster recovery and system migration tool URL: http://relax-and-recover.org/ License: GPLv3 @@ -91,6 +91,30 @@ Patch119: rear-multipath-bios-grub.patch # https://github.com/rear/rear/pull/3125 Patch121: rear-improve-layout-guide.patch +# skip longhorn iscsi devices in disklayout.conf +# https://github.com/rear/rear/commit/d765abff976a8346ce6afa432c9a09d67ed63482 +Patch122: rear-skip-longhorn-iscsi-RHEL-83551.patch + +# fix PPC PReP Boot detection on GPT layouts +# https://github.com/rear/rear/commit/1ca518c2a0e675ace956ef71bc79d67e4990562b +Patch123: rear-detect-prep-boot-on-gpt-RHEL-82098.patch + +# fix recovery of LUKS encrypted systems with multiple keyslots +# https://github.com/rear/rear/commit/e9ce93f096e505968cc728a7eb5a06e25dc8d88b +Patch124: rear-support-multi-keyslot-luks-RHEL-83776.patch + +# support generation of ed25519 SSH host keys in the rescue image +# https://github.com/rear/rear/commit/62d9a744ff710de34035ce15bd1b1bf810b6934a +Patch125: rear-rescue-ed25519-hostkey-support-RHEL-83479.patch + +# enhance the 300_map_disks.sh script to also print the disk sizes +# https://github.com/rear/rear/commit/43d62fdfcac50b35be4f99d45bac3b5340525a7a +Patch126: rear-print-disk-mapping-with-sizes-RHEL-83241.patch + +# add initial support for arm/aarch64 machines with UEFI +# https://github.com/rear/rear/commit/9b28f14fad26ff00a6f90b13c3e4906d85f3ae3c +Patch127: rear-support-aarch64-uefi-RHEL-56045.patch + ###################### # downstream patches # ###################### @@ -101,20 +125,29 @@ Patch206: rear-nbu-RHEL-17390-RHEL-17393.patch # support "export TMPDIR" again, temporarily, with a warning. Patch207: rear-support-export-TMPDIR.patch +# error out if any unsupported OUTPUT used on s390 +Patch208: rear-error-output-s390x-RHEL-99362.patch + # rear contains only bash scripts plus documentation so that on first glance it could be "BuildArch: noarch" # but actually it is not "noarch" because it only works on those architectures that are explicitly supported. # Of course the rear bash scripts can be installed on any architecture just as any binaries can be installed on any architecture. # But the meaning of architecture dependent packages should be on what architectures they will work. # Therefore only those architectures that are actually supported are explicitly listed. -# This avoids that rear can be "just installed" on architectures that are actually not supported (e.g. ARM): -ExclusiveArch: %ix86 x86_64 ppc ppc64 ppc64le ia64 s390x +# This avoids that rear can be "just installed" on architectures that are actually not supported: +ExclusiveArch: %ix86 x86_64 ppc ppc64 ppc64le ia64 s390x %arm aarch64 # Furthermore for some architectures it requires architecture dependent packages (like syslinux for x86 and x86_64) # so that rear must be architecture dependent because ifarch conditions never match in case of "BuildArch: noarch" # see the GitHub issue https://github.com/rear/rear/issues/629 %ifarch %ix86 x86_64 -Requires: syslinux +Requires: syslinux-extlinux +%endif +# See https://github.com/rhboot/efi-rpm-macros/blob/main/README +%ifarch %{efi} # We need mkfs.vfat for recreating EFI System Partition Recommends: dosfstools +# Needed for ISO image creation +Recommends: grub2-efi-%{efi_arch}-modules +Recommends: grub2-tools-extra %endif %ifarch ppc ppc64 ppc64le # Called by grub2-install (except on PowerNV) @@ -132,6 +165,7 @@ Requires: s390utils-core # (in addition to the default installed bootloader grub2) while on ppc ppc64 the # default installed bootloader yaboot is also useed to make the bootable ISO image. +BuildRequires: efi-srpm-macros # Required for HTML user guide BuildRequires: make BuildRequires: asciidoctor @@ -225,6 +259,18 @@ install -m 0644 %{SOURCE3} %{buildroot}%{_docdir}/%{name}/ #-- CHANGELOG -----------------------------------------------------------------# %changelog +* Thu Aug 14 2025 Pavel Cahyna - 2.6-27 +- add dependency on grub2-tools-extra and GRUB EFI modules on EFI machines +- add dependency on syslinux-extlinux on x86 +- add initial support for aarch64 machines with UEFI +- enhance the 300_map_disks.sh script to also print the disk sizes +- support generation of ed25519 SSH host keys in the rescue image +- create sshd home directory in the rescue image on systems upgraded from EL8 +- fix recovery of LUKS encrypted systems with multiple keyslots +- fix PPC PReP Boot detection on GPT layouts +- skip longhorn iscsi devices in disklayout.conf +- error out if any unsupported OUTPUT used on s390x + * Tue Feb 11 2025 Pavel Cahyna - 2.6-26 - Install GRUB on multipath disks, PR 3334 - Improve docs of layout configuration in user guide, PR 3125