New `boot.initrd.secrets` for existing initrd is not written to the ESP #103

New issue

Closed

opened 2023-02-12 16:00:09 +00:00 by nikstur · 2 comments

nikstur commented

2023-02-12 16:00:09 +00:00

(Migrated from github.com)

Currently, the secret is always added to the initrd in the tempdir but not actually copied over to the ESP because AFAIK the secret does not change the input hash (and thus path) of the initrd in the nix store and in the ESP.

blitz commented

2023-02-19 18:38:20 +00:00

(Migrated from github.com)

@nikstur Can you elaborate a bit? What secret?

nikstur commented

2023-02-19 19:23:10 +00:00

(Migrated from github.com)

If you change boot.initrd.secrets between two generations but the initrd itself does not change, the secrets do not actually end up in the initrd on the ESP.

If you change `boot.initrd.secrets` between two generations but the initrd itself does not change, the secrets do not actually end up in the initrd on the ESP.