cryptsetup-2.8.4-160000.1.1

- Update to 2.8.4: (jsc#PED-15889)
  * Fix integritysetup resize (grow) of the device if integrity bitmap
    mode is used. Increasing the integrity device in bitmap mode did
    not work as integritysetup incorrectly used journal settings that
    were not applicable.
  * Fix device size status reports in cryptsetup and integritysetup.
    If the device uses a sector size larger than 512 bytes, the newly
    reported byte sizes (introduced in 2.8.0) in the status report
    were incorrectly displayed.
  * BITLK: Fix unlocking BitLocker device with recovery passphrase.
    If the recovery passphrase was present in the first keyslot, the
    device failed to unlock. This bug was introduced in 2.8.2 with
    Clear Key support.

- Update to 2.8.3:
  * Stable bug-fix release with minor extensions.
- Update to 2.8.2:
  * BITLK: Fix for BitLocker metadata validation on big-endian systems.

- Update to 2.8.1:
  * Fix status and deactivation of TCRYPT (VeraCrypt compatible) devices that use chained ciphers.
  * Fix unlocking BITLK (BitLocker compatible) devices with multibyte UTF8 characters in the passphrase.
  * Do not allow activation of the LUKS2 device if the used keyslot is not encrypted (it uses a null cipher).
  - Such a configuration cannot be created by cryptsetup, but can be crafted outside of it.
  - Null cipher is sometimes used to create an empty container for later reencryption.
  - Only an empty passphrase can activate such a container (the same as in LUKS1).
  * Do not silently decrease PBKDF parallel cost (threads) if set by an option.
  - The maximum parallel cost is limited to 4 threads.
  * Fixes to configuration and installation scripts.
  - Meson and autoconf tools now properly support --prefix option for temporary directory installation.
  - Multiple fixes and cleanups to config.h for compatibility between Meson and autoconf.
  - Fix the luks2-external-tokens-path Meson option to work the same as in autoconf.
  - Fix Meson install for tool binaries, install fvault2Open man page and include test/fuzz/meson.build in release.
  * Major update to manual pages.
  - Try to explain the PBKDF hardcoded limits.
  - Add a better explanation for automatic integrity tag recalculation.
  - Mention crypt/verity/integritytab.
  - Remove or reformulate some misleading warnings present only with old and no longer supported kernels.
  - Clarify that some commands do not wipe data and unify OPAL reset wording.
  - Clarify the --label option.
  - There are also many other grammar and stylistic fixes to unify the man-page style.
  * Fixes for false-positive and annoying (optional) warnings added in recent compilers.

- Update to 2.8.0:
  * Full release notes in:
  - https://cdn.kernel.org/pub/linux/utils/cryptsetup/v2.8/v2.8.0-ReleaseNotes
  * Introduce support for inline mode (use HW sectors with additional hardware
    metadata space).
  * Finalize use of keyslot context API.
  * Make all keyslot context types fully self-contained.
  * Add --key-description and --new-key-description cryptsetup options.
  * Support more precise keyslot selection in reencryption initialization.
  * Allow reencryption to resume using token and volume keys.
  * Cryptsetup repair command now tries to check LUKS keyslot areas for corruption.
  * Opal2 SED: PSID keyfile is now expected to be 32 alphanumeric characters.
  * Opal2: Avoid the Erase method and use Secure Erase for locking range.
  * Opal2: Fix some error description (in debug only).
  * Opal2: Do not allow deferred deactivation.
  * Allow --reduce-device-size and --device-size combination for reencryption
    (encrypt) action.
  * Fix the userspace storage backend to support kernel "capi:" cipher specification format.
  * Disallow conversion from LUKS2 to LUKS1 if kernel "capi:" cipher specification is used.
  * Explicitly disallow kernel "capi:" cipher specification format for LUKS2
    keyslot encryption.
  * Do not allow conversion of LUKS2 to LUKS1 if an unbound keyslot is present.
  * cryptsetup: Adjust the XTS key size for kernel "capi:" cipher specification.
  * Remove keyslot warning about possible failure due to low memory.
  * Do not limit Argon2 KDF memory cost on systems with more than 4GB of available memory.
  * Properly report out of memory error for cryptographic backends implementing Argon2.
  * Avoid KDF2 memory cost overflow on 32-bit platforms.
  * Do not use page size as a fallback for device block size.
  * veritysetup: Check hash device size in advance.
  * Print a better error message for unsupported LUKS2 AEAD device resize.
  * Optimize LUKS2 metadata writes.
  * veritysetup: support --error-as-corruption option.
  * Report all sizes in status and dump command output in the correct units.
  * Add --integrity-key-size option to cryptsetup.
  * Support trusted & encrypted keyrings for plain devices.
  * Support plain format resize with a keyring key.
  * TCRYPT: Clear mapping of system-encrypted partitions.
  * TCRYPT: Print all information from the decrypted metadata header in
    the tcryptDump command.
  * Always lock the volume key structure in memory.
  * Do not run direct-io read check on block devices.
  * Fix a possible segfault in deferred deactivation.
  * Exclude cipher allocation time from the cryptsetup benchmark.
  * Add Mbed-TLS optional crypto backend.
  * Fix the wrong preprocessor use of #ifdef for config.h processed by Meson.
  * Reorganize license files. The license text files are now in docs/licenses.
    The COPYING file in the root directory is the default license.
  * Remove cc-by-sa-4.0.txt as already shipped now in docs/licenses
    and named as COPYING.CC-BY-SA-4.0.
  * Libcryptsetup API extensions. The libcryptsetup API is backward compatible
    with all existing symbols. Due to the self-contained memory allocation,
    these symbols have the new version:
  - crypt_keyslot_context_init_by_passphrase;
  - crypt_keyslot_context_init_by_keyfile;
  - crypt_keyslot_context_init_by_token;
  - crypt_keyslot_context_init_by_volume_key;
  - crypt_keyslot_context_init_by_signed_key;
  - crypt_keyslot_context_init_by_keyring;
  - crypt_keyslot_context_init_by_vk_in_keyring;
  * New symbols:
  - crypt_format_inline
  - crypt_get_old_volume_key_size
  - crypt_reencrypt_init_by_keyslot_context
  - crypt_safe_memcpy
  * New defines:
  - CRYPT_ACTIVATE_HIGH_PRIORITY
  - CRYPT_ACTIVATE_ERROR_AS_CORRUPTION
  - CRYPT_ACTIVATE_INLINE_MODE
  - CRYPT_REENCRYPT_CREATE_NEW_DIGEST
  * New requirement flag:
  - CRYPT_REQUIREMENT_INLINE_HW_TAGS

- Add a dependency on device-mapper to libcryptsetup12 to install
  the required device-mapper udev rules. [bsc#1241612]

- Set pbkdf2 as the default PBKDF algorithm in LUKS2 format.
  [bsc#1236375, bsc#1236164]
  * The default PBKDF algorithm in the LUKS2 format is now Argon2id
    but its not FIPS compliant. A system would be unbootable if using
    Argon2id or Argon2i for disk encryption and then switching to
    kernel FIPS mode. This can be avoided by setting pbkdf2 as default.
  * Build using the configure option --with-luks2-pbkdf=pbkdf2.
  * Remove the dependency on libargon2 as is now provided by openssl.

- Update to 2.7.5:
  * Fix possible online reencryption data corruption (only in 2.7.x).
    In some situations (initializing a suspended device-mapper device),
    cryptsetup disabled direct-io device access. This caused unsafe
    online reencryption operations that could lead to data corruption.
    The code now adds strict checks (and aborts the operation) and
    changes direct-io detection code to prevent data corruption.
  * Fix a clang compilation error in SSH token plugin.
    As clang linker treats missing symbols as errors, the linker phase
    for the SSH token failed as the optional cryptsetup_token_buffer_free
    was not defined.
  * Fix crypto backend initialization in crypt_format_luks2_opal API call.

- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
  to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)

- Update to 2.7.4:
  * Detect device busy failure for device-mapper table-referenced
    devices.
  * Fix shared activation for dm-verity devices.
  * Add --shared option for veritysetup open action.
  * Do not use exclusive flag for the allocated backing loop files.
  * Fixes for problems found by static analyzers and Valgrind.
  * Fixes to tests and CI scripts.
- Use fdupes to link identical man pages.

- Update to 2.7.3:
  * Do not allow formatting LUKS2 with Opal SED (hardware encryption)
    if the reported logical sector size for the block device and Opal
    encryption logical block differs.
  * Fixes to wiping LUKS2 headers after Opal locking area erase.
  * Mention the need for possible PSID revert before Opal format for some
    drives (man page).
  * Fix Bitlocker-compatible code to ignore newly seen metadata entries.
  * Fix interactive query retry if LUKS2 unbound keyslot is present.
  * Detect unsupported zoned devices for LUKS header devices.
  * Allow "capi" cipher format for benchmark command and fix parsing
    of plain IV in "capi" format.
  * Add support for HCTR2 encryption mode.
  * Source code now uses SPDX license identifiers instead of full
    license preambles.
  * Fix missing includes for cryptographic backend that could cause
    compilation errors for some systems.
  * Fix tests to work correctly in FIPS mode with recent OpenSSL 3.2.
  * Fix various (mostly false positive) issues detected by Coverity.