# RFC: mender-convert LUKS support

**URL:** <https://hub.mender.io/t/rfc-mender-convert-luks-support/4158>\
**Category:** General Discussions\
**Created:** [October 7, 2021, 12:53pm UTC](https://hub.mender.io/t/rfc-mender-convert-luks-support/4158 "2021-10-07T12:53:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![MarekBelisko](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/marekbelisko/32/33_2.png) [@MarekBelisko](https://hub.mender.io/u/MarekBelisko)\
**Post date:** [October 7, 2021, 12:53pm UTC](https://hub.mender.io/t/rfc-mender-convert-luks-support/4158/1 "2021-10-07T12:53:31Z")

</div>

Hello,

I would like to share wip for adding LUKS support for mender-convert.  
I used image build by mkosi with LUKS partition and added mender-support here: [GitHub - nandra/mender-conversion-tools at LUKS](https://github.com/nandra/mender-conversion-tools/tree/LUKS)

Basically added LUKS handling for opening rootfs + adding formatting back. For that purpose I also used forked grubenv: [GitHub - nandra/grub-mender-grubenv at nandra-luks](https://github.com/nandra/grub-mender-grubenv/tree/nandra-luks)

Also add custom config with following content:  
` MENDER_GRUBENV_VERSION="718442304646df570b25bd5e5bd1968f285c2d22" MENDER_GRUBENV_URL="https://github.com/nandra/grub-mender-grubenv/archive/${MENDER_GRUBENV_VERSION}.tar.gz" LUKS_PWD="%PWD%"`

where `LUKS_PWD` is password for LUKS encryption/decryption.

There are still few things missing:  
for booting encrypted rootfs kernel argument needs to be provided in format `luks.name=UUID=rootfs root=/dev/mapper/rootfs`. Fetching UUID from luks encrypted filesystem doesn’t work (also filesystem is reported as unknown → needs to be checked). It must be manually updated by finding UUID of rootfs partition and then updateting grub.cfg. Other thing is that user is asked for pwd 2x. Once when grub would like to load kernel + initrd then second time when initrd want to mount rootfs. Later one can be resolved by hadrcoding key to existing initrs. This is more RFC or proff of concept. Ideas and comments are welcomed. Thanks.

---

<div class="post-metadata">

**Author:** ![Alan](https://avatars.discourse-cdn.com/v4/letter/a/a87d85/32.png) [@Alan](https://hub.mender.io/u/Alan)\
**Post date:** [October 7, 2021, 2:35pm UTC](https://hub.mender.io/t/rfc-mender-convert-luks-support/4158/2 "2021-10-07T14:35:21Z")

</div>

Hey Marek,  
this looks pretty cool.  
How about making a draft PR into mender-convert already.  
It will be simpler to track the changes and discuss.

Cheers