From 4afadc73557079e896310d79177a456b7cd11fd8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= <bjorn.forsman@gmail.com>
Date: Tue, 17 Feb 2026 19:05:44 +0100
Subject: [PATCH] nixos/luks: allow empty passphrases in prompt

LUKS itself supports empty passphrases, and NixOS even has
boot.initrd.luks.devices.<name>.tryEmptyPassphrase option, but still the
NixOS interactive LUKS passphrase prompt rejects empty passphrases.

Fix it.

Implementation note. The "open" command line is changed due to details
in how empty passphrases and trailing newlines are handled when reading
from stdin. This code path is only for the interactive prompt, not when
using keyfiles, and the "reuse passphrase" logic already strips trailing
newlines, so that's nothing new.
---
 nixos/modules/system/boot/luksroot.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index 9ffc0df58d82..3769c46f64de 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -214,7 +214,7 @@ let
 
                       # and try reading it from /dev/console with a timeout
                       IFS= read -t 1 -r passphrase
-                      if [ -n "$passphrase" ]; then
+                      if [ $? = 0 ]; then
                          ${
                            if luks.reusePassphrases then
                              ''
@@ -232,7 +232,7 @@ let
                   fi
               done
               echo -n "Verifying passphrase for ${dev.device}..."
-              echo -n "$passphrase" | ${csopen} --key-file=-
+              echo "$passphrase" | ${csopen}
               if [ $? == 0 ]; then
                   echo " - success"
                   ${