Fresh install, encrypted LUKS root not decrypted via grub [SOLVED]

Help
1

Hello,

I am doing a fresh install on an old laptop, which has had NixOS installed in the past. (ThinkPad T450s). I am using the graphical installer downloaded today, and selecting the encrypted filesystem option.

I can unlock the partition from the livecd, e.g. from dolphin in the KDE desktop.

However, I cannot boot from it, due to “invalid passphrase” error.

A couple of the more obvious things I have checked, based on internet searches:

I am using the default US English keyboard

The LUKS config is not using Argon2, which grub apparently can’t abide.

Since I can unlock from the liveCD, it’s not a repeatedly-fatfingered passphrase, and in any case, I have re-installed a couple of times already.

Any suggestions?

2

OK, so I have fixed this, documenting here for whoever finds this issue next.

From a more general (not NixOS) search, I saw someone ask about the BIOS boot settings. Mine were supporting both the old DOS-style and UEFI, but defaulting to the former. (Like I said, old laptop).

I changed it to UEFI-only, and re(-re-re-re) installed. This worked the first time.

I suppose this does mean that the install process doesn’t necessarily work as well for old-school partitions.

3

I’ve looked into this before but haven’t found a solution. The issue isn’t the partitioning. It seems to be either the LUKS settings configured by the installer or potentially just a bug in grub itself, since on BIOS systems the graphical installer sets up disk encryption such that grub itself has to decrypt it. Doesn’t show up as a problem on UEFI because the graphical installer puts kernels / initrds on unencrypted storage (which systemd-boot requires (for good reason), which is used for UEFI).

1 Like
4

Good to know, thanks! Is this an issue that is documented somewhere? Short-term, I could see one of:

  • Documentation that people might find
  • Installer that detects BIOS / encryption combination, provides warning that this may not work yet
  • Someone finds the root cause, remediates it

It all likely has to start with an issue being flagged. Suggestions?