grubCryptodiskLegacyBios covers boot.loader.grub.enableCryptodisk on legacy
BIOS: GRUB itself decrypts /boot, entering the LUKS passphrase interactively,
and stage 1 then unlocks the root device with a keyfile embedded via
boot.initrd.secrets. Using a keyfile avoids a second, interactive passphrase
prompt in the initrd, whose wording differs between the scripted and systemd
stage 1 implementations, so the test passes under both (installer and
installer-systemd-stage-1).
fullDiskEncryption was marked broken. On the target boot GRUB's EFI
keyboard input appears to drop characters when the passphrase is typed at
the default speed, producing an "Invalid passphrase" error, so the disk
never unlocked. Type the passphrase more slowly and unbreak the test.
Assisted-by: Claude Opus 4.8
Move nixos/tests/grub.nix to nixos/tests/grub/basic.nix unchanged, and add
new GRUB boot tests under nixos/tests/grub/:
- hashed-password: GRUB user authentication with a
users.<name>.hashedPasswordFile (a grub-mkpasswd-pbkdf2 hash). The hash is
generated in a derivation and passed by store path (via toString) rather
than read at evaluation time, to avoid import-from-derivation. Kept separate
from basic so each login is exercised on its own VM boot rather than
multiplexed onto one menu.
- efi: boot through GRUB's EFI support.
- graphical: verify GRUB renders its menu in graphical (gfxterm) mode. A
marker string is baked into the splash image (which GRUB only draws in
gfxterm) and read back via OCR, so a silent fallback to text mode would
fail the test rather than pass it.
- mirrored-boots: verify GRUB is installed and configured on every path
in boot.loader.grub.mirroredBoots.
Assisted-by: Claude Opus 4.8
Motivation for change: I needed to use runtype as a dependency for
another package and noticed it wasn't in nixpkgs. Runtype is a
python module containing utilities for run-time type validation and
multiple dispatch.
Release notes: https://github.com/erezsh/runtype/releases/tag/0.5.3
Jonas Heinrich