fix: clevis-luks-list didn't show all configured bindings#570
Open
Cornelicorn wants to merge 1 commit into
Open
fix: clevis-luks-list didn't show all configured bindings#570Cornelicorn wants to merge 1 commit into
Cornelicorn wants to merge 1 commit into
Conversation
Cornelicorn
force-pushed
the
fix-clevis-luks-list-nested-sss
branch
2 times, most recently
from
July 17, 2026 13:41
1d218fd to
1513887
Compare
Previously, the value of sss was overwritten every time, so only the last entry for sss pins was displayed. Fix this by saving them all and instead of manually processing the sss pin, reuse clevis_luks_join_sss_cfg as it is used in the other functions Fixes latchset#505. The test adjustments are needed since previously the command always listed an object for sss instead of a list. This is not the way it works for other pins, for example tang does always give you a list. So if you apply this patch: ```diff diff --git a/src/luks/tests/list-sss-tang-luks2 b/src/luks/tests/list-sss-tang-luks2 index 5f05696..a9dad34 100755 --- a/src/luks/tests/list-sss-tang-luks2 +++ b/src/luks/tests/list-sss-tang-luks2 @@ -36,15 +36,9 @@ PIN="sss" PINS="sss tang" CFG=$(printf ' { - "t": 2, + "t": 1, "pins": { - "tang": [ - {"url":"ADDR1","adv":"%s"}, - {"url":"ADDR2","adv":"%s"}, - {"url":"ADDR3","adv":"%s"}, - {"url":"ADDR4","adv":"%s"}, - {"url":"ADDR5","adv":"%s"} - ] + "tang": {"url":"ADDR1","adv":"%s"} } } ' "${ADV}" "${ADV}" "${ADV}" "${ADV}" "${ADV}") ``` to only have one tang config and not have it in a list, the test `list-sss-tang-luks2` will also fail with non-matching configs even outside of this branch. So while both formats are equivalent, we can't reasonably determine which format was used on encryption and we should use one format everywhere. It makes sense to adapt the more general format that is already used for tang and tpm.
Cornelicorn
force-pushed
the
fix-clevis-luks-list-nested-sss
branch
from
July 17, 2026 15:53
1513887 to
8c8f357
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously, the value of sss was overwritten every time, so only the last entry for sss pins was displayed. Fix this by saving them all and instead of manually processing the sss pin, reuse clevis_luks_join_sss_cfg as it is used in the other functions
Fixes #505.
The test adjustments are needed since previously the command always
listed an object for sss instead of a list. This is not the way
it works for other pins, for example tang does always give you a list.
So if you apply this patch:
to only have one tang config and not have it in a list, the test
list-sss-tang-luks2will also fail with non-matching configs evenoutside of this branch. So while both formats are equivalent, we can't
reasonably determine which format was used on encryption and we should
use one format everywhere. It makes sense to adapt the more general
format that is already used for tang and tpm.