How to add EFI partition to full LUKS encrypted drive?

Hello,

i am preparing to work with MBR (converting to GPT), creating EFI partition and installing EFI boot because my computer does not support legacy boot.
I never did this and i expect i will mess it and end up with non bootable drive, so is important for me to read your feedback.

I have already researched on how to chroot and do the things. These are my notes (i would welcome feedback, but no need to read, priority question is below):

Fails to boot? Try MJ Live boot, create EFI partition using gparted after decrypting LUKS drive in gparted (partition: FAT32 300MB+ boot & esp flags)
pamac install efibootmgr dosfstools grub;sudo modprobe efivarfs
lsblk;mkdir /mnt;mount /dev/sdX(X=EFI partition letter) /mnt;
sudo mount --bind /dev /mnt/dev;sudo mount --bind /sys /mnt/sys;sudo mount --bind /proc /mnt/proc;
sudo mount --bind /sys/firmware/efi/efivars /mnt/sys/firmware/efi/efivars
sudo chroot /mnt
sudo modprobe efivarfs 2>/dev/null;ls /boot/grub && echo “Continue only if there is bunch of files”
Mount EFI partition (sdXY is this partition name)?: sudo mkdir /boot/efi;sudo mount /dev/sdXY /boot/efi
Now grub command, maybe:
sudo grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=manjaro --recheck
ls /etc/mkinitcpio.d;mkinitcpio -p linuxXY
sudo update-grub
(based on UEFI - Install Guide - Manjaro )
EFI variables issue? sudo modprobe efivarfs
exit && sudo umount /mnt/*
line with .efi should be visible: efibootmgr -v
after reboot i had to enter the passphrase 2 times

chroot sources: https://askubuntu.com/questions/1262733/install-grub-on-mounted-filesystem ; https://askubuntu.com/questions/145241/how-do-i-run-update-grub-from-a-livecd/145253#145253

the on-topic thread regarding these tasks is rather this one

For getting into LUKS from live-USB and to chroot + grub-updte i used following:

sudo cryptsetup luksOpen /dev/nvme0n1p2 c;sudo mount /dev/mapper/c /mnt
mkdir /mnt/boot/efi 2>/dev/null;sudo mount /dev/nvme0n1p1 /mnt/boot/efi
for i in /dev /dev/pts /proc /sys; do sudo mount -B $i /mnt$i; done;sudo chroot /mnt
update-grub;exit;cd;for i in /dev /dev/pts /proc /sys; do sudo umount /mnt$i; done;sudo cryptsetup luksClose c

(only possibly replace nvme0n1p by sda for example)

QUESTION:

  • How do i make that EFI partition (possibly using gparted or similar?), while after decrypting LUKS in gparted, it does not seem to have any boot partition, only ext4 and it always complains: Cant have a partition outside the disk! (it happen also when i have tried to backup the drive using CloneZilla & failed).
    fdisk -l /dev/sda* shows only one part.:

Disklabel type: dos
Disk identifier: 0xc75ac368

Device Boot Start End Sectors Size Id Type
/dev/sda1 * 2048 234436544 234434497 111,8G 83 Linux

$ gdisk -l /dev/sda shows:

GPT fdisk (gdisk) version 1.0.6

Warning: Partition table header claims that the size of partition table
entries is 1153912944 bytes, but this program supports only 128-byte entries.
Adjusting accordingly, but partition table may be garbage.
Warning: Partition table header claims that the size of partition table
entries is 0 bytes, but this program supports only 128-byte entries.
Adjusting accordingly, but partition table may be garbage.
Partition table scan:
MBR: MBR only
BSD: not present
APM: not present
GPT: not present

Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 234441614
Partitions will be aligned on 2048-sector boundaries
Total free space is 7084 sectors (3.5 MiB)

Number Start (sector) End (sector) Size Code Name
1 2048 234436544 111.8 GiB 8300 Linux filesystem

On live-USB i am unable to resize luks partition, screenshots here
“cryptsetup luksOpen /dev/sda1 abc” may help to decrypt, but how to then resize using resize2fs? Update: in above described case where gparted does not help, the resizing is risky and complicated, so i ended up installing new system and then copying the data via network (following may be important to run on old running system (not on live USB))

sudo mount --bind / /mnt
sudo rsync -av --progress --sparse --links --hard-links /mnt/ sshuser@sshserver:/

and then updating grub (as described above). Other options in some cases are to clone the drive or copy just /home directory and reinstall the apps:
Old PC: pacman -Qqen > pkglist.txt;pacman -Qqem > pkglist_aur.txt
New PC: pacman -S --needed - < pkglist.txt; for p in $(cat pkglist_aur.txt);do pamac build $p --no-confirm;done

https://www.google.com/search?q=bd+crypto_luks+open+blob+called+but+not+implemented
:alien:
looks upstream