--- Begin Message ---
Subject: |
[PATCH 0/4] gnu: Add fscrypt. |
Date: |
Sun, 23 Mar 2025 15:51:37 +0530 |
Hi Guix,
The following patch series adds support for Linux native filesystem encryption
to Guix, via the `fscrypt` kernel interface and associated userspace tools
`fscrypt` and `fscryptctl`.
Patch 1/4 enables the relevant kernel configuration option,
CONFIG_FS_ENCRYPTION. This is the same patch as #77202 [1].
Patch 2/4 and 3/4 add the high-level `fscrypt` command-line utility (which is
implemented in Go); these are the same patches as #77174 [2].
Patch 4/4 adds `fscryptctl`, a lower-level tool written in C; this is the same
patch as #77175 [3].
I thought it would be good to group all these patches in a single series, so
I'll close #77202, #77174 and #77175 in favor of this one.
Further reference:
https://docs.kernel.org/filesystems/fscrypt.html
https://github.com/google/fscrypt?tab=readme-ov-file#runtime-dependencies
https://github.com/google/fscryptctl
[1]
https://yhetil.org/guix/4a6e1c443ee07929cd582395bdcc5865610569f2.1742723412.git.45mg.writes@gmail.com/
[2] https://yhetil.org/guix/cover.1742646222.git.45mg.writes@gmail.com/
[3]
https://yhetil.org/guix/933a717801203ce2e23173a8cebb957c153cdbd8.1742648529.git.45mg.writes@gmail.com/
45mg (4):
gnu: linux-libre: Enable CONFIG_FS_ENCRYPTION.
gnu: Add go-github-com-wadey-gocovmerge.
gnu: Add fscrypt.
gnu: Add fscryptctl.
gnu/packages/crypto.scm | 33 +++++++++++++++
gnu/packages/golang-crypto.scm | 74 +++++++++++++++++++++++++++++++++-
gnu/packages/golang-xyz.scm | 26 ++++++++++++
gnu/packages/linux.scm | 2 +
4 files changed, 134 insertions(+), 1 deletion(-)
base-commit: fbfd2b93831978aadbb96f32cafdab997b04c6c6
--
2.49.0
--- End Message ---
--- Begin Message ---
Subject: |
Re: [PATCH v2 0/4] Linux native filesystem encryption (fscrypt). |
Date: |
Tue, 8 Apr 2025 20:28:58 -0400 |
On Mon, Apr 07, 2025 at 06:44:40AM +0000, 45mg wrote:
> From that page and from the test I described above, it looks like
> CONFIG_FS_ENCRYPTION is the only option that's strictly necessary for
> the default encryption mode.
>
> The other options mentioned in the docs seem to be either (1) for using
> other encryption modes, or (2) for hardware acceleration, which is
> platform-specific. I don't have any need for (1) so I probably won't
> look into it in the near future. Once this patch series is merged and I
> start relying on fscrypt, I should get an idea of the performance
> situation; at that point I might look into (2) if I feel that the
> un-accelerated performance isn't good enough.
>
> (In the meantime, of course, anyone else is welcome to look into it.)
Sounds good! I pushed the patches as
bf6736bd878a14e0520a550bf8fbf8edb69876df
Thanks for working on this!
--- End Message ---