initramfs-crypt-hook patch

As Claudius left denx, I took over this series and addressed remaining issues.

Changes in v9:
- stub-out initial key persistence on buster (tpm2-tools 3.x)
- replace open-coded random key with pwgen
- Link to v9: https://lore.kernel.org/cip-dev/20250626-initramfs-crypt-hook-patches-2-v8-0-46f000788686@denx.de/

Changes in v8:
- Rebased on next
- Added documentation about the power fail scenarios and the LUKS header
example.
- Link to v7: https://lore.kernel.org/r/20250616-initramfs-crypt-hook-patches-2-v7-0-82dc9d0dbbcf@denx.de

Changes in v7:
- readded tpm2_createpolicy for clevis
- Link to v6: https://lore.kernel.org/r/20250320-initramfs-crypt-hook-patches-2-v6-0-ef10c11cad94@denx.de

Changes in v6:
- luks formatting of format-if-empty will now be redone when if it is a
luks partition without a TPM2 token, this makes it a bit more
power-fail save
- Link to v5: https://lore.kernel.org/r/20250313-initramfs-crypt-hook-patches-2-v5-0-fc62d4a2ad29@denx.de

Changes in v5:
- Switch to use TPM2 protected password instead of static initial
password for encryption
- Link to v4: https://lore.kernel.org/r/20250305-initramfs-crypt-hook-patches-2-v4-0-4170912e5261@denx.de

Changes in v4:
- improve documentation and commit messages
- reorder commits, to put re-encryption recovery up front
- extract static temporary encryption key patch into its own
- switch from lsblk to blkid

Changes in v3:
- Rebase on current next
- Extended 'noencrypt' documentation
- support clevis tokens for re-encryption recovery

Changes in v2:
- Added more descriptive commit message
- Added more descriptive documentation about noencrypt option
- Fixed typos in documentation
- removed unnecessary setting of /conf/param.conf in initramfs-crypt-hook
- added re-encryption recovery patch

Claudius Heine (4):
initramfs-crypt-hook: store initial encryption key in TPM2
initramfs-crypt-hook: add re-encryption recovery
initramfs-crypt-hook: implement 'noencrypt' option
initramfs-crypt-hook: add 'format-if-empty' feature

Jan Kiszka (4):
initramfs-crypt-hook: Use pwgen instead of openssl for initial
passphrase
initramfs-crypt-hook: Drop redundant copy-execs for
systemd-cryptenroll
initramfs-crypt-hook: Only use resource-managed TPM instances
initramfs-crypt-hook: Factor out tpm2_functions script

 doc/README.tpm2.encryption.md                 |  57 ++++++++--
 .../initramfs-crypt-hook/files/hook           |   3 +-
 .../files/local-top-complete                  | 103 +++++++++++++-----
 .../initramfs-crypt-hook/files/tpm2_functions |  66 +++++++++++
 .../files/tpm2_functions.buster               |  24 ++++
 ...ook_0.8.bb => initramfs-crypt-hook_0.9.bb} |  22 ++--
 6 files changed, 229 insertions(+), 46 deletions(-)
 create mode 100644 recipes-initramfs/initramfs-crypt-hook/files/tpm2_functions
 create mode 100644 recipes-initramfs/initramfs-crypt-hook/files/tpm2_functions.buster
 rename recipes-initramfs/initramfs-crypt-hook/{initramfs-crypt-hook_0.8.bb => initramfs-crypt-hook_0.9.bb} (85%)

2.43.0