[deadp]

Added tests/fixtures/luks/make_fixtures.sh and README.md. cryptsetup isn't in the sandbox, so I didn't run the script or commit the images and expected.json; it needs a run elsewhere. Not run: sh -n and the repo tests. Findings | (a) engine/luks.py:363-365 area key_size treated as bits (bytes in real images; builder imagebuild_luks.py:28,88 uses bits) | (b) engine/luks.py:387-388 area IV starts at offset//512, cryptsetup starts at 0 (builder :150 same) | (c) engine/luks.py:409-410 data read passes start//ss without sector_size, so 512-byte decrypt units for 4096 sectors; no 4096 test | all three still present

Queued from the dashboard (item 150). The request:

Goal: step 1 of approved proposal switch-nz#18 (Strata: prove the LUKS2 + Argon2 reader against real cryptsetup images). Today all LUKS2 tests use images Strata builds itself (tests/imagebuild_luks.py), so reader and builder share assumptions.

1. On current main, read engine/luks.py, engine/crypto/argon2.py, tests/imagebuild_luks.py, tests/test_luks.py. Report which of these suspected bugs are still there, with file:line: (a) keyslot area key_size treated as bits (cryptsetup stores bytes, 64 for aes-xts-plain64); (b) keyslot area IV starting at area offset/512 (cryptsetup starts at 0); (c) data read passing start // sector_size as the IV sector without sector_size (dm-crypt counts IVs in 512-byte units unless iv_large_sectors).
2. Write tests/fixtures/luks/make_fixtures.sh (POSIX sh, no root if possible): build 2 small LUKS2 images (under 1 MiB) from a plain file whose every 512-byte sector says "STRATA-FIXTURE sector N": (A) argon2id, 4096-byte sectors; (B) argon2i, 512-byte sectors, plus a second pbkdf2 keyslot via luksAddKey. Use cryptsetup reencrypt --encrypt --type luks2 --disable-locks --force-offline-reencrypt --batch-mode --reduce-device-size, --luks2-metadata-size 16k, --pbkdf-force-iterations 4 --pbkdf-memory 64 --pbkdf-parallel 1, public passphrases strata-fixture-1/2 from --key-file (no newline). Write expected.json from luksDump --dump-json-metadata and --dump-volume-key plus cryptsetup --version; xz the images. Fallback note for a root run if rootless fails.
3. tests/fi

Opened by the queue runner on LXC 113. The runner squash-merges this once CI checks pass.

🤖 Generated with Claude Code