Grub fails to install on Architect

Support
1

I am trying to install Grub on a UEFI system. I have /boot encrypted with Luks, / encrypted with Luks2, and /boot/efi is not encrypted.

When Architect goes to install Grub on /boot/efi, it asks for the encryption password to create a keyfile. I enter the password. Then I see a cryptsetup process using 100% of the CPU, but it does nothing. It will use 100% CPU for hours but never finish.

What is going on here and how do I make grub finish installing?

2

Curious, why are you encrypting /boot? For Manjaro, /boot/efi is typically a separate partition.

When you encrypt /, it also encrypts /boot already because it’s in the same partition.

Or did you for some reason made a separate partition for /boot that is separate from your / partition?

3

Yes, /boot is a separate partition because grub cannot open the luks2 container that holds / .

4

I’ve never used Architect, but what I understand is happening is:

  • When Architect installs grub on /boot/efi it detects /boot is encrypted
  • Does not detect that /boot/efi/EFI is not encrypted!
  • Tries to write an encrypted file to an unencrypted directory
  • Fails.

Now, I’m thinking a bit out of the box here, but can you:

  • mount /dev/sda1/EFI to let’s say /EFI and have Architect install grub on /EFI ?
    OR
  • have Architect not install grub but do the grub-install yourself manually to /EFI ?

:thinking:

5

I have actually come to the conclusion that what I’m trying to do is pointless. There’s nothing to gain from using Luks2 (argon2 specifically) if the key is stored on the weaker Luks1 container.

1 Like