Skip to content

fix: clevis-luks-list didn't show all configured bindings#570

Open
Cornelicorn wants to merge 1 commit into
latchset:masterfrom
Cornelicorn:fix-clevis-luks-list-nested-sss
Open

fix: clevis-luks-list didn't show all configured bindings#570
Cornelicorn wants to merge 1 commit into
latchset:masterfrom
Cornelicorn:fix-clevis-luks-list-nested-sss

Conversation

@Cornelicorn

@Cornelicorn Cornelicorn commented Jul 17, 2026

Copy link
Copy Markdown

Previously, the value of sss was overwritten every time, so only the last entry for sss pins was displayed. Fix this by saving them all and instead of manually processing the sss pin, reuse clevis_luks_join_sss_cfg as it is used in the other functions

Fixes #505.

The test adjustments are needed since previously the command always
listed an object for sss instead of a list. This is not the way
it works for other pins, for example tang does always give you a list.

So if you apply this patch:

diff --git a/src/luks/tests/list-sss-tang-luks2 b/src/luks/tests/list-sss-tang-luks2
index 5f05696..a9dad34 100755
--- a/src/luks/tests/list-sss-tang-luks2
+++ b/src/luks/tests/list-sss-tang-luks2
@@ -36,15 +36,9 @@ PIN="sss"
 PINS="sss tang"
 CFG=$(printf '
 {
-   "t": 2,
+   "t": 1,
    "pins": {
-     "tang": [
-       {"url":"ADDR1","adv":"%s"},
-       {"url":"ADDR2","adv":"%s"},
-       {"url":"ADDR3","adv":"%s"},
-       {"url":"ADDR4","adv":"%s"},
-       {"url":"ADDR5","adv":"%s"}
-     ]
+     "tang": {"url":"ADDR1","adv":"%s"}
    }
 }
 ' "${ADV}" "${ADV}" "${ADV}" "${ADV}" "${ADV}")

to only have one tang config and not have it in a list, the test
list-sss-tang-luks2 will also fail with non-matching configs even
outside of this branch. So while both formats are equivalent, we can't
reasonably determine which format was used on encryption and we should
use one format everywhere. It makes sense to adapt the more general
format that is already used for tang and tpm.

@Cornelicorn
Cornelicorn force-pushed the fix-clevis-luks-list-nested-sss branch 2 times, most recently from 1d218fd to 1513887 Compare July 17, 2026 13:41
Previously, the value of sss was overwritten every time, so only the last entry for sss pins was displayed. Fix this by saving them all and instead of manually processing the sss pin, reuse clevis_luks_join_sss_cfg as it is used in the other functions

Fixes latchset#505.

The test adjustments are needed since previously the command always
listed an object for sss instead of a list. This is not the way
it works for other pins, for example tang does always give you a list.

So if you apply this patch:
```diff
diff --git a/src/luks/tests/list-sss-tang-luks2 b/src/luks/tests/list-sss-tang-luks2
index 5f05696..a9dad34 100755
--- a/src/luks/tests/list-sss-tang-luks2
+++ b/src/luks/tests/list-sss-tang-luks2
@@ -36,15 +36,9 @@ PIN="sss"
 PINS="sss tang"
 CFG=$(printf '
 {
-   "t": 2,
+   "t": 1,
    "pins": {
-     "tang": [
-       {"url":"ADDR1","adv":"%s"},
-       {"url":"ADDR2","adv":"%s"},
-       {"url":"ADDR3","adv":"%s"},
-       {"url":"ADDR4","adv":"%s"},
-       {"url":"ADDR5","adv":"%s"}
-     ]
+     "tang": {"url":"ADDR1","adv":"%s"}
    }
 }
 ' "${ADV}" "${ADV}" "${ADV}" "${ADV}" "${ADV}")
```

to only have one tang config and not have it in a list, the test
`list-sss-tang-luks2` will also fail with non-matching configs even
outside of this branch. So while both formats are equivalent, we can't
reasonably determine which format was used on encryption and we should
use one format everywhere. It makes sense to adapt the more general
format that is already used for tang and tpm.
@Cornelicorn
Cornelicorn force-pushed the fix-clevis-luks-list-nested-sss branch from 1513887 to 8c8f357 Compare July 17, 2026 15:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SSS recursive won't work

1 participant