Package Details: grub-improved-luks2-git 2.12.r10.g04d2a50f3-1

Git Clone URL: https://aur.archlinux.org/grub-improved-luks2-git.git (read-only, click to copy)
Package Base: grub-improved-luks2-git
Description: GNU GRand Unified Bootloader (2) with Argon2 support. Patch made by Patrick Steinhardt
Upstream URL: https://www.gnu.org/software/grub/
Licenses: GPL3, CC0
Conflicts: grub
Provides: grub
Submitter: Ax333l
Maintainer: Ax333l
Last Packager: Ax333l
Votes: 24
Popularity: 2.48
First Submitted: 2022-01-02 14:06 (UTC)
Last Updated: 2024-03-09 00:19 (UTC)

Dependencies (18)

Required by (309)

Sources (12)

Pinned Comments

Ax333l commented on 2022-02-17 18:58 (UTC) (edited on 2023-06-16 14:24 (UTC) by Ax333l)

I have disabled translations because they have been the cause of build failures in both this package and grub-git. If you want to re-enable them, check the PKGBUILD.

Also, make sure you have installed base-devel.

Argon2 might not work on some devices due to issues with the memory allocator

Latest Comments

« First ‹ Previous 1 2 3 4 5 6 7 8 Next › Last »

1001 commented on 2023-06-03 15:04 (UTC)

:(

Ax333l commented on 2023-06-02 15:54 (UTC)

hotcapy, I think you have to either sign all the generated grub modules or embed more of them.

decepticlown are you sure you are using --target="x86_64-efi"? It is required. I'll have to test with the latest version of grub myself but if I cannot reproduce it myself then I am not sure how to help.

decepticlown commented on 2023-05-31 17:25 (UTC) (edited on 2023-05-31 17:31 (UTC) by decepticlown)

Hello, I had installed grub with: ~# grub-install --disable-shim-lock --modules=" part_gpt part_msdos luks2 argon2 tpm gcry_sha512 and more"

My simplified /etc/default/grub:

cmdline=" loglevel=3 cryptdevice=UUID=xxx:cryptroot cryptkey=rootfs:/crypt/key.bin root=/dev/mapper/cryptroot rootflags=subvol=@/0/snapshot" cryptodisk=y

Then config with:

grub-mkconfig -o /boot/grub/grub.cfg

I'm having black screen when I select GRUB from efi entries. No error, no grub command line, no grub password prompts nothing. Just black screen. No input works. I have to hard reboot.

I can boot perfectly fine with same kernel options with bundled efi from sbctl.

My disk layout:

/dev/nvme0n1 >
    /dev/nvme0n1p1 - fat32 EFI mounted /boot/efi
    /dev/nvmen1p2 - linux root, crypt with luks2, key size sha512, aes-xts-plain64 , iterations 3000
        btrfs system >
            @ - /.snapshots
            @/0/snapshot - /
            @home,@root,... - /home, /root, ...

1001 commented on 2023-05-31 05:40 (UTC)

Hello. How to add font to grubx64.efi for early boot?

hotcapy commented on 2023-05-17 16:35 (UTC) (edited on 2023-05-19 05:13 (UTC) by hotcapy)

Hello!

I have an old laptop "Samsung NP350V5C-S1ERU" (2013). It originally came with just BIOS, which was then replaced with UEFI by firmware update. UEFI is "Aptio Setup Utility" by "American Megatrends". Firmware version is latest available - "P09ABE".

I use Secure Boot with my own custom keys, signing GRUB core image and kernel's vmlinuz-* files.

  1. # grub-install --target=x86_64-efi --efi-directory=/boot/efi --modules="luks2 part_gpt part_msdos cryptodisk gcry_serpent argon2 pbkdf2 gcry_whirlpool btrfs tpm" --disable-shim-lock --removable --recheck

  2. # sbsign --key db.key --cert db.crt --output /boot/efi/EFI/BOOT/BOOTX64.EFI /boot/efi/EFI/BOOT/BOOTX64.EFI

Core generated this way by package version "2.06.r460.gf7564844f-1" works with both enabled and disabled UEFI Secure Boot.

Latest version "2.06.r499.ge67a551a4-1" successfully handles encryption, but stuck at some internal Secure Boot verification step (fails to insmod normal):

error: verification requested but nobody cares: (cryptouuid/*UUID*)/@/boot/grub/x86_64-efi/normal.mod.
Entering rescue mode...

If Secure Boot is disabled in UEFI, GRUB loads and system successfully boots.

Same latest package version works with enabled Secure Boot on my another desktop computer w/o any errors.

Since issue not seem to be related to encryption at all, I assume it could be upstream GRUB bug with just certain hardware affected? If there is any hope for ready-to-use fix, I'll be happy to test it.

P.S. Thank you Ax333l for maintaining this package. I believe it is important for many people who consider pbkdf2 insecure for full disk encryption nowadays to have argon2id support. It is great that Arch users have this opportunity.

Ax333l commented on 2023-04-24 19:23 (UTC)

jroovy, I believe I have the same issue on one of my laptops. I did not really have a reason to fix it at the time, but I have one idea which might fix it. Not entirely sure though. If I cannot fix it myself, then I will have to report it to the grub bug tracker.

jroovy commented on 2023-04-24 06:52 (UTC)

Ax333l, I'm using a Dell Inspiron 3180

andre.vmatos commented on 2023-04-23 18:53 (UTC)

A little OT, but since Arch and NixOS share a lot of knowledge and people often come here for inspiration, I thought it may be of interest to someone my working NixOS overlay for grub2-git with these patches, proposed to someone else's repo for visibility: https://github.com/AtaraxiaSjel/nixos-config/pull/1

duffydack commented on 2023-04-23 18:17 (UTC) (edited on 2023-04-23 18:54 (UTC) by duffydack)

Working fine for months here, just rebuilt recently too, no issues at all. I use sd-encrypt also btw

GRUB_CMDLINE_LINUX="rd.luks.uuid=My-UUID rd.luks.key=My-UUID=/crypt.key"

Ax333l commented on 2023-04-23 18:00 (UTC)

jroovy, I was also having problems on my laptop with this patch, but I was never able to figure out the cause. What device are you running it on?

« First ‹ Previous 1 2 3 4 5 6 7 8 Next › Last »