Since we're going for systemd compatibility, we're going to need to change the
key syntax. It seems like there are two supported syntaxes which are handled a
little bit differently by the encrypt hook and initscripts.
1) <dev>:<fstype>:<file>
I want to support this by adding a keydev= option. What remains is what to
do when a key is not available and there is no keydev=. For a first go I
think such a setup doesn't need to be supported, but eventually deriving a
default will be good.
The primary target here is to support having a keyfile for an encrypted /usr
stored on root. This is a little tricky in the initcpio because it would be
pretty undesirable from my perspective to tell the user such keys need to be
/new_root/...
One way to do this would be keydev=/dev/mapper/root, but this might mean
mounting root to some temporary location, unmounting it, and then having
initcpio pick up as normal after the hooks. Among other things, this would
mount root before fsck.
2) <dev>:<offset>:<length>
I want to drop support for this. The length field is supported by
cryptsetup's --keyfile-size option.
I don't see <offset> being widely used as its not even documented. Coupled
with systemd not supporting anything like this, I'd like to cowardly refuse
to implement it.
I looked into adding a --keyfile-offset option to cryptsetup directly. It
doesn't look too bad but does require and API change to libcryptsetup. We'll
not worry about this now.
So this means no more generating keyfiles with dd and piping them into
cryptsetup, they can all just be passed via the --key-file=