Arch Linux User Repository

Please don't use sedutil-cli --scan in linuxpba-arch, it's problematic (it doesn't print all drives for some reason, even supported ones, which can be a not so pleasant surprise for someone booting): https://github.com/Drive-Trust-Alliance/sedutil/issues/520

Instead, you can use any method of listing possible block devices (even something as crude as for glob in 'sd[a-z]' 'nvme[0-9]n[0-9]' 'nvme[0-9][0-9]n[0-9][0-9]' ; do find /dev/ -name "$glob" done) and then check with: sedutil-cli --isValidSED $DRIVE >/dev/null 2>&1 and check if status is 0.

In that same file, NR==2 and NR==6 hardcoded to awk seem to be wrong for me (it's 1 and 5 for me), consider using this line instead (that's still not perfect for the latter line in case they shift the order/amount of variables printed, but still an improvement):

sedutil-cli --query $DRIVE | awk '/^\/dev\// {name=$3; serial=$5} /^ *Locked =/ {gsub(",","",$0);lock=$3; mbr=$12} END {print name,serial,lock,mbr}'

Further improvement would be listing the locking ranges instead of assuming that only range 0 exists and is enabled (wiki mentions setting up range 1 and 2 for root partition and ESP/boot respectively for encrypting the boot drive). Do I assume currently that the current mkinitcpio is for decrypting non-root drives? Or does it assume that the initramfs is on a separate just-for-booting drive alternatively?

/lib/initcpio/install/linuxpba wants to install /usr/lib/udev/rules.d/11-dm-initramfs.rules which no longer exists.

Please fix.

There is currently an issue with linuxpba.install, as 11-dm-initramfs.rules no longer exists.

See https://gitlab.archlinux.org/archlinux/packaging/packages/mkinitcpio-utils/-/issues/1 and https://gitlab.archlinux.org/archlinux/mkinitcpio/mkinitcpio/-/issues/293

I had a slight issue with overloads during build()

I created a small patch to resolve

https://gist.github.com/envolution/b56eb3686c188397c3935fb41151f33b

mkinitcpio, linux, and linux-lts probably should be listed as other optional dependencies, as these (well, one of the kernels, the point being that custom ones won't work) are needed in order to build own PBA image. Not sure what's the situation with AMD ucode either...

I'm going to disown this project at least for some time because I may have limited access to a computer at times.

Option --loadPBAimage is unfortunately broken on current version. It would be nice if you'd include a patch to fix it: https://patch-diff.githubusercontent.com/raw/Drive-Trust-Alliance/sedutil/pull/486.patch. Thanks!

@frazar0 Thanks! libnvme added as a regular dependency. It looks like your method of just using it as a make dependency is better but I'll wait until I feel better so I can think clearly. :)

It seems like the sedutil 1.49.4-1 package fails to build in a clean chroot with

linux/DtaLinux.cpp:42:10: fatal error: nvme/types.h: No such file or directory
   42 | #include <nvme/types.h>
      |          ^~~~~~~~~~~~~~

I've observed that the nvme/types.h file belongs to the libnvme package.

$ pacman -Qo /usr/include/nvme/types.h
/usr/include/nvme/types.h is owned by libnvme 1.10-1

Adding said package as a build-time dependency fixes the build:

--- PKGBUILD.bak    2024-09-14 10:21:28.000000000 +0200
+++ PKGBUILD    2024-09-14 15:17:06.379914241 +0200
@@ -8,6 +8,7 @@
 arch=('i686' 'x86_64')
 url="https://github.com/Drive-Trust-Alliance/sedutil"
 license=('GPL3')
+makedepends=('libnvme')
 optdepends=('syslinux: to create a bootable PBA disk image'
             'gptfdisk: to create a bootable PBA disk image'
             'parted: to create a bootable PBA disk image'

@otherego I went ahead and took over as maintainer at least for now. I'm currently in a bit of a COVID fog so let me know if problems exist. It looks like possibly some of the disk image creation scripts may need modification.