[pkg-cryptsetup-devel] Bug#1027299: closed by Guilhem Moulin <guilhem at debian.org>

[Łukasz Stelmach]

Guilhem Moulin <guilhem at debian.org> writes:
> On Fri, 30 Dec 2022 at 00:30:32 +0100, Łukasz Stelmach wrote:
>> The version of cryptsetup-initramfs in buster is affected by
>> #959423[1]. Although it works with the default 4.19 kernel[2] it fails with
>> 5.10 which is available from the main suite and NOT from
>> buster-backports.
>
> No, buster, buster-security, buster-backports respectively have linux
> 4.19.249-2, 4.19.269-1, and 5.10.127-2~bpo10+1. Debian doesn't support
> a mix and match between oldstable and stable, so if you install the
> kernel from stable you need to install cryptsetup-initramfs from
> stable as well.
>

The 5.10 kernel is from oldstable.

--8<---------------cut here---------------start------------->8---
$ lsb_release  -a
Distributor ID: Debian
Description:    Debian GNU/Linux 10 (buster)
Release:        10
Codename:       buster
$ apt policy linux-image-5.10-686-pae
linux-image-5.10-686-pae:
  Installed: 5.10.158-2~deb10u1
  Candidate: 5.10.158-2~deb10u1
  Version table:
 *** 5.10.158-2~deb10u1 500
        500 tor://security.debian.org buster/updates/main i386 Packages
        100 /var/lib/dpkg/status
$ apt-cache show linux-image-5.10-686-pae | grep Depends:
Depends: linux-image-5.10.0-0.deb10.20-686-pae (= 5.10.158-2~deb10u1)
$ apt policy linux-image-5.10.0-0.deb10.20-686-pae
linux-image-5.10.0-0.deb10.20-686-pae:
  Installed: 5.10.158-2~deb10u1
  Candidate: 5.10.158-2~deb10u1
  Version table:
 *** 5.10.158-2~deb10u1 500
        500 tor://security.debian.org buster/updates/main i386 Packages
        100 /var/lib/dpkg/status
--8<---------------cut here---------------end--------------->8---

> OTOH mixing buster and buster-backports *is* supported (that's the
> reason why backport exist in the first place), so this bug is valid.
> But unfortunately buster had its final point release last summer and
> IMHO the fix #959423 doesn't qualify for an upload to buster-security,
> so I'm closing this.

I am not familiar with Debian policies but I belive this is a regression
(see below) that deserves a fix. Do reconsider. Or at least a note in
the Release Notes, which I followed.

>> IMHO the version of cryptsetup-initramfs in buster or buster-updates
>> should support 5.10 kernels.
>
> It does with the default MODULES=dep, and arguably does too in most
> situations (these days most systems do support AES-NI,

Bad luck, I am upgrading an old Eee PC 901.

> and this has been the case since the default LUKS cipher mode was
> changed to XTS during the jessie release cycle).  In other situations,
> workarounds include rebuilding the initramfs with MODULES=most, or
> after adding ‘ecb’ to /etc/initramfs-tools/modules, or installing
> cryptsetup-initramfs from buster-backports.

Yes there are workarounds and I've found them, and I won't stay with
buster longer than necessary, but I am reporting a serious IMHO
regression.

1. I upgraded to from stretch to buster with
   linux-image-4.19.0-23-686-pae.
2. I rebooted — successfully. 
2. I installed linux-image-5.10-686-pae from buster/updates (see above).
3. 5.10 didn't boot.

>> I am upgrading from jessie to bullseye and need 5.10 kernel before the
>> last upgrade.
>
> Upgrades are only supported from n to n+1.  A supported upgrade path
> would be to dist-upgrade to stretch first and reboot (into the stretch
> kernel 4.9), then to buster and reboot (into the buster kernel 4.19)
> before finally dist-upgrading to bullseye.  Following that upgrade path
> you shouldn't stumble onto #959423.

I didn't write it explicitly, but I am actually doing n+1. And I #959423
hit me when I tried to boot buster with 5.10 from updates (see above).

-- 
Kind regards,
Łukasz Stelmach
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 617 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-cryptsetup-devel/attachments/20221230/5001543f/attachment.sig>