Dear Maintainer,

when configuring this encrypted machine running debian stable with keyscript
"decryt_keyctl", the invocation of update-initramfs fails with the message:

| E: /usr/share/initramfs-tools/hooks/cryptkeyctl failed with return 1.
| update-initramfs: failed for /boot/initrd.img-4.19.0-5-amd64 with 1.

After some debugging, I found out, that this script copies the file
"/bin/keyctl" to the initramfs. But this file, belonging to the package
"keyutils", is not installed.

After installing "keyutils", update-initramfs runs successfully.

I would suggest at least suggesting or recommending "keyutils" (and other
packages being needed for the other keyscripts) or giving out a clearer
error message on failure, like 'File "/bin/keyctl" not found, please install
package "keyutils".' or something like that.


Regards

Sebastian

Hi,

FWIW this is documented in /usr/share/doc/cryptsetup/README.keyctl (or
/usr/share/doc/cryptsetup-run/README.keyctl for src:cryptsetup between
2:2.0.3-1 and 2:2.1.0-5).

Correct dependency declarations would introduce a lot of clutter here,
for ‘keyscript=decrypt_keyctl’ alone we would need two more binary
packages:

  Package: cryptsetup-keyscript-keyctl
  Depends: cryptsetup, keyctl
  [Ships /lib/cryptsetup/scripts/decrypt_keyctl.]

  Package: cryptsetup-initramfs-keyscript-keyctl
  Depends: cryptsetup-initramfs, cryptsetup-keyscript-keyctl
  [Ships /usr/share/initramfs-tools/hooks/cryptkeyctl.]

And similarily for other keyscripts.  Last time we talked about it we
decided that it was not worth the clutter.  We don't want the less
fine-grained dependency declaration via Recommends either (which should
be on ‘cryptsetup’ not ‘cryptsetup-initramfs’, by the way: keyscripts
can be used outside the initramfs stage too), because that would mean on
systems without --no-install-recommends (ie the default), installing
‘cryptsetup’ would clutter the system with the OpenSC daemon and other
tools that are likely not needed.

Instead we decided to document keyscript setup under
/usr/share/doc/cryptsetup/README.*.

I guess we could do that in hook files.  Won't help when the device is
opened outside initramfs stage though (for instance via `cryptdisks_start`
or sysvinit scripts).

Perhaps /usr/share/initramfs-tools/hook-functions:copy_exec() could give
a more helpful message mentioning the name of the file that couldn't be
copied to the initramfs.