From 6c963fd952faad2071820ab3d665f841c09ed4e5 Mon Sep 17 00:00:00 2001 From: "Gary T. Giesen" Date: Wed, 24 Jun 2026 09:35:38 -0400 Subject: [PATCH] installer: Rebuild the initramfs for LUKS so the encrypted root boots A UEFI lvm-on-luks install completes but cannot boot: it drops to an initramfs rescue shell with "ALERT! /dev/mapper/lvmmint-root does not exist", because the crypttab never reaches the initramfs. The target is copied from the live squashfs, so it inherits live-boot's diverted update-initramfs -- a wrapper that no-ops unless the live medium is mounted at /run/live/medium inside the chroot. The engine bind-mounts /run non-recursively, so that submount is absent and the update-initramfs call is silently skipped; the crypttab is never baked in. On BIOS the copied live initrd happens to unlock and boot from the kernel cmdline, so the failure is firmware-dependent -- UEFI is broken. For LUKS, remove live-boot's initramfs hook (it references a live-only path and fails on the installed system) and run the real, un-diverted update-initramfs so the crypttab is baked in. No-ops cleanly where there is no diversion or hook. --- usr/lib/live-installer/installer.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/usr/lib/live-installer/installer.py b/usr/lib/live-installer/installer.py index f90a8a49..2fc392d1 100644 --- a/usr/lib/live-installer/installer.py +++ b/usr/lib/live-installer/installer.py @@ -717,6 +717,24 @@ def finish_installation(self): # recreate initramfs (needed in case of skip_mount also, to include things like mdadm/dm-crypt/etc in case its needed to boot a custom install) print(" --> Configuring Initramfs") self.do_run_in_chroot("/usr/sbin/update-initramfs -t -u -k all") + if self.setup.luks: + # The target is copied from the live squashfs, so it carries + # live-boot's diverted update-initramfs: a wrapper that no-ops + # unless the live medium is mounted at /run/live/medium inside + # the chroot. /run is bind-mounted non-recursively, so that + # submount is absent and the call above is silently skipped -- + # the crypttab never reaches the initramfs and the encrypted + # root can't be unlocked at boot (the system drops to an + # initramfs shell). Plain and LVM installs boot the stock + # initramfs and are unaffected; only LUKS needs the rebuild. + # + # Remove live-boot's initramfs hook (it references a live-only + # path, /usr/lib/live/boot, and fails on the installed system) + # and run the real, un-diverted update-initramfs so the crypttab + # is baked in. + self.do_run_in_chroot("rm -f /usr/share/initramfs-tools/hooks/live") + real_update_initramfs = subprocess.getoutput("chroot /target/ /bin/sh -c 'dpkg-divert --truename /usr/sbin/update-initramfs'").strip() or "/usr/sbin/update-initramfs" + self.do_run_in_chroot("%s -u -k all" % real_update_initramfs) self.do_run_in_chroot(self.grub_adjustment_script) kernelversion= subprocess.getoutput("uname -r") self.do_run_in_chroot("/usr/bin/sha1sum /boot/initrd.img-%s > /var/lib/initramfs-tools/%s" % (kernelversion,kernelversion))