Butterbian XFCE 0.5.0: optional full-disk encryption

What’s new

  • Optional full-disk encryption. The installer’s partition page has an “Encrypt system” checkbox. Tick it, set a passphrase, and the root filesystem goes into a LUKS2 container. You type the passphrase once at boot, and that’s it. Leave the box unticked and you get the same install as before, no encryption. Timeshift snapshots and rollback from the GRUB menu work the same either way.

  • Same layout as butterknife. /boot sits on its own small unencrypted partition so GRUB never has to unlock anything. No second passphrase prompt, no slow unlock in the boot menu.

  • /boot is now separate on every install, encrypted or not. The installer can only apply one layout, and this is the one that makes encryption clean. What that means for you: kernels live outside your snapshots. If you roll back past a kernel upgrade, pick the matching older kernel from the GRUB snapshot menu. Debian keeps the previous kernel around until apt autoremove.

  • Installed systems no longer carry the live-session packages. live-boot, live-config and live-tools were dead weight on an installed system, and live-tools was quietly stopping the installer from rebuilding the initramfs. Gone.

Fixes

  • The branded login screen stays branded. It was swapping in your desktop wallpaper after the first login.

Not changed

Still btrfs only. Butterknife is the one with ext4 and xfs on the menu. This project’s whole reason to exist is the snapshot stack, and ext4 doesn’t do snapshots, so offering it here would just be a way to switch off the main feature.

Download: https://get.butterbian.org
Release notes: Making sure you're not a bot!

2 Likes

I just did an install using the new 0.5.0 and it’s why RTFM has always been one of my flaws.:grinning_face:

I did the install and missed the encrypt checkbox. Then I was surprised by the new /boot partition. So I went back to read your original post completely.

Oh well, I’ll just redo it. I have nothing important to do today anyway.