Bug 2353335

I use a LUKS1-encrypted /boot partition. As expected, GRUB prompts for the LUKS password to unlock /boot, and I can then successfully boot.

However, if I press [e] to edit a GRUB entry, I'm prompted again to enter the LUKS password for the /boot partition.

This behavior is new in Fedora 42. Downgrading the grub2* packages to the ones from Fedora 41 (2.12-20.fc41) brings back the old behavior (no need to enter the password again when editing a GRUB entry because the /boot partition is already unlocked at this time).

Reproducible: Always

Steps to Reproduce:
1. Install Fedora 42 Server on a UEFI host with GPT partitioning. Use automatic partitioning. No need to encrypt anything during the setup to keep the reproducer simple.


2. After the installation use the following commands to encrypt /boot and adjust the GRUB configuration accordingly (vda2 is /boot):

dnf -y update grub2*
umount /boot/efi/
cp /boot/ /boot.bak -rp 
umount /boot 
cryptsetup luksFormat /dev/vda2 --type luks1  # interactive command    
cryptsetup luksOpen /dev/vda2 crypt_boot      # interactive command      
mkfs.xfs /dev/mapper/crypt_boot
mount /dev/mapper/crypt_boot /boot
rm /boot/lost+found/ -rf
mv /boot.bak/* /boot/
mv /boot.bak/.vmlinuz* /boot/
mount /boot/efi/    
restorecon -Rv /boot/
rm /boot.bak/ -rf
sed -i -e 's/^UUID=.*\( \/boot \)/UUID='$(blkid -s UUID -o value /dev/mapper/crypt_boot)'\1/' /etc/fstab               # Update UUID for /boot in fstab
echo "luks-$(blkid -s UUID -o value /dev/vda2) UUID=$(blkid -s UUID -o value /dev/vda2) none discard" >> /etc/crypttab # Add cryptab entry for vda2 (/boot)
echo GRUB_ENABLE_CRYPTODISK=y >> /etc/default/grub
dracut -vf --regenerate-all
grub2-mkconfig > /boot/grub2/grub.cfg
dnf -y reinstall grub2-efi-x64 grub2-tools-extra shim-x64  
sed -i 's/^search.*$/insmod cryptodisk\ninsmod luks\ncryptomount -u '$(blkid -s UUID -o value /dev/vda2|sed -e 's/-//g')'\nsearch --no-floppy --fs-uuid --set=dev '$(blkid -s UUID -o value /dev/mapper/crypt_boot)'\n/' /boot/efi/EFI/fedora/grub.cfg  # Update /boot UUID, unlock LUKS /boot before loading /boot/grub2/grub.cfg


3. Reboot

4. Enter the LUKS password for /boot.

5. As soon as the GRUB menu appears, press [e] to edit an entry.
Actual Results:  
GRUB prompts again for the LUKS password of the /boot partition, even if it was already unlocked before (otherwise, the GRUB menu wouldn't be visible)

Expected Results:  
GRUB should not prompt again for the LUKS password when a user wants to edit a menu entry because the /boot partition was already unlocked before.

* In Fedora 41 and earlier, GRUB never prompted for the LUKS password again when I wanted to edit an entry.
* I compared /boot/grub2/grub.cfg and /boot/efi/EFI/fedora/grub.cfg from Fedora 41 and 42. They are the same (only different UUIDs, of course).
* Manually downgrading the grub2* packages on Fedora 42 to the packages from Fedora 41 (2.12-20.fc41) brings back the old behavior.