Bumpitybump.

Partitioning only, install doesn't work yet.

CMakeLists.txt

@@ -101,7 +101,7 @@ set( CALAMARES_TRANSLATION_LANGUAGES ar ast bg ca cs_CZ da de el en en_GB es_MX
 
 set( CALAMARES_VERSION_MAJOR 2 )
 set( CALAMARES_VERSION_MINOR 2 )
-set( CALAMARES_VERSION_PATCH 2 )
+set( CALAMARES_VERSION_PATCH 90 )
 set( CALAMARES_VERSION_RC 0 )
 
 set( CALAMARES_VERSION ${CALAMARES_VERSION_MAJOR}.${CALAMARES_VERSION_MINOR}.${CALAMARES_VERSION_PATCH} )

src/modules/bootloader/main.py

@@ -89,12 +89,31 @@ def create_systemd_boot_conf(uuid, conf_path, kernel_line):
     distribution = get_bootloader_entry_name()
     kernel = libcalamares.job.configuration["kernel"]
     img = libcalamares.job.configuration["img"]
+    kernel_params = ["quiet"]
+
     partitions = libcalamares.globalstorage.value("partitions")
-    swap = ""
+    swap_uuid = ""
+
+    cryptdevice_params = []
 
     for partition in partitions:
         if partition["fs"] == "linuxswap":
-            swap = partition["uuid"]
+            swap_uuid = partition["uuid"]
+
+        if partition["mountPoint"] == "/" and "luksMapperName" in partition:
+            cryptdevice_params = [
+                "cryptdevice=UUID={!s}:{!s}".format(partition["luksUuid"],
+                                                    partition["luksMapperName"]),
+                "root=/dev/mapper/{!s}".format(partition["luksMapperName"])
+            ]
+
+    if cryptdevice_params:
+        kernel_params.extend(cryptdevice_params)
+    else:
+        kernel_params.append("root=UUID={!s}".format(uuid))
+
+    if swap_uuid:
+        kernel_params.append("resume=UUID={!s}".format(swap_uuid))
 
     lines = [
         '## This is just an example config file.\n',
@@ -103,12 +122,12 @@ def create_systemd_boot_conf(uuid, conf_path, kernel_line):
         "title   {!s}{!s}\n".format(distribution, kernel_line),
         "linux   {!s}\n".format(kernel),
         "initrd  {!s}\n".format(img),
-        "options root=UUID={!s} quiet resume=UUID={!s} rw\n".format(uuid, swap),
+        "options {!s} rw\n".format(" ".join(kernel_params)),
     ]
 
-    with open(conf_path, 'w') as f:
-        for l in lines:
-            f.write(l)
+    with open(conf_path, 'w') as conf_file:
+        for line in lines:
+            conf_file.write(line)
 
 
 def create_loader(loader_path):
@@ -125,9 +144,9 @@ def create_loader(loader_path):
         "default {!s}\n".format(distribution_translated),
     ]
 
-    with open(loader_path, 'w') as f:
-        for l in lines:
-            f.write(l)
+    with open(loader_path, 'w') as loader_file:
+        for line in lines:
+            loader_file.write(line)
 
 
 def install_systemd_boot(efi_directory):
@@ -138,17 +157,24 @@ def install_systemd_boot(efi_directory):
     print("Bootloader: systemd-boot")
     install_path = libcalamares.globalstorage.value("rootMountPoint")
     install_efi_directory = install_path + efi_directory
-    fallback_kernel_line = libcalamares.job.configuration["fallbackKernelLine"]
     uuid = get_uuid()
     distribution = get_bootloader_entry_name()
     file_name_sanitizer = str.maketrans(" /", "_-")
     distribution_translated = distribution.translate(file_name_sanitizer)
-    conf_path = os.path.join(install_efi_directory, "loader", "entries",
+    conf_path = os.path.join(install_efi_directory,
+                             "loader",
+                             "entries",
                              "{!s}.conf".format(distribution_translated))
-    fallback_path = os.path.join(install_efi_directory, "loader", "entries",
+    fallback_path = os.path.join(install_efi_directory,
+                                 "loader",
+                                 "entries",
                                  "{!s}-fallback.conf".format(distribution_translated))
-    loader_path = os.path.join(install_efi_directory, "loader", "loader.conf")
-    subprocess.call(["bootctl", "--path={!s}".format(install_efi_directory), "install"])
+    loader_path = os.path.join(install_efi_directory,
+                               "loader",
+                               "loader.conf")
+    subprocess.call(["bootctl",
+                     "--path={!s}".format(install_efi_directory),
+                     "install"])
     kernel_line = get_kernel_line("default")
     print("Configure: \"{!s}\"".format(kernel_line))
     create_systemd_boot_conf(uuid, conf_path, kernel_line)
@@ -178,29 +204,37 @@ def install_grub(efi_directory, fw_type):
             efi_bootloader_id = distribution.translate(file_name_sanitizer)
         # get bitness of the underlying UEFI
         try:
-            f = open("/sys/firmware/efi/fw_platform_size", "r")
-            efi_bitness = f.read(2)
-        except:
-            # if the kernel is older than 4.0, the UEFI bitness likely isn't exposed to the userspace
-            # so we assume a 64 bit UEFI here
+            sysfile = open("/sys/firmware/efi/fw_platform_size", "r")
+            efi_bitness = sysfile.read(2)
+        except Exception:
+            # if the kernel is older than 4.0, the UEFI bitness likely isn't
+            # exposed to the userspace so we assume a 64 bit UEFI here
             efi_bitness = "64"
         bitness_translate = {"32": "--target=i386-efi", "64": "--target=x86_64-efi"}
-        check_target_env_call([libcalamares.job.configuration["grubInstall"], bitness_translate[efi_bitness],
-                           "--efi-directory={!s}".format(efi_directory),
-                           "--bootloader-id={!s}".format(efi_bootloader_id),
-                           "--force"])
+        check_target_env_call([libcalamares.job.configuration["grubInstall"],
+                               bitness_translate[efi_bitness],
+                               "--efi-directory={!s}".format(efi_directory),
+                               "--bootloader-id={!s}".format(efi_bootloader_id),
+                               "--force"])
         # Workaround for some UEFI firmwares
         check_target_env_call(["mkdir", "-p", "{!s}/boot".format(efi_directory_firmware)])
-        check_target_env_call(["cp", "{!s}/{!s}/grubx64.efi".format(efi_directory_firmware, efi_bootloader_id),
-                           "{!s}/boot/bootx64.efi".format(efi_directory_firmware)])
+        check_target_env_call(["cp", "{!s}/{!s}/grubx64.efi".format(efi_directory_firmware,
+                                                                    efi_bootloader_id),
+                               "{!s}/boot/bootx64.efi".format(efi_directory_firmware)])
     else:
         print("Bootloader: grub (bios)")
         boot_loader = libcalamares.globalstorage.value("bootLoader")
-        check_target_env_call([libcalamares.job.configuration["grubInstall"], "--target=i386-pc",
-                           "--recheck", "--force", boot_loader["installPath"]])
+        check_target_env_call([libcalamares.job.configuration["grubInstall"],
+                               "--target=i386-pc",
+                               "--recheck",
+                               "--force",
+                               boot_loader["installPath"]])
 
-    check_target_env_call([libcalamares.job.configuration["grubMkconfig"], "-o",
-                       libcalamares.job.configuration["grubCfg"]])
+    # The file specified in grubCfg should already be filled out
+    # by the grubcfg job module.
+    check_target_env_call([libcalamares.job.configuration["grubMkconfig"],
+                           "-o",
+                           libcalamares.job.configuration["grubCfg"]])
 
 
 def prepare_bootloader(fw_type):

src/modules/grubcfg/main.py

@@ -44,12 +44,24 @@ def modify_grub_default(partitions, root_mount_point, distributor):
     if plymouth_bin == 0:
         use_splash = "splash"
 
+    cryptdevice_params = []
+
     for partition in partitions:
         if partition["fs"] == "linuxswap":
             swap_uuid = partition["uuid"]
 
+        if partition["mountPoint"] == "/" and "luksMapperName" in partition:
+            cryptdevice_params = [
+                "cryptdevice=UUID={!s}:{!s}".format(partition["luksUuid"],
+                                                    partition["luksMapperName"]),
+                "root=/dev/mapper/{!s}".format(partition["luksMapperName"])
+            ]
+
     kernel_params = ["quiet"]
 
+    if cryptdevice_params:
+        kernel_params.extend(cryptdevice_params)
+
     if use_splash:
         kernel_params.append(use_splash)
 
@@ -123,6 +135,9 @@ def modify_grub_default(partitions, root_mount_point, distributor):
     if not have_distributor_line:
         lines.append(distributor_line)
 
+    if cryptdevice_params:
+        lines.append("GRUB_ENABLE_CRYPTODISK=y")
+
     with open(default_grub, 'w') as grub_file:
         grub_file.write("\n".join(lines) + "\n")
 

src/modules/initcpiocfg/main.py

@@ -22,7 +22,6 @@
 import libcalamares
 import os
 from collections import OrderedDict
-from libcalamares.utils import check_target_env_call
 
 
 def cpuinfo():
@@ -36,8 +35,8 @@ def cpuinfo():
 
     nprocs = 0
 
-    with open('/proc/cpuinfo') as f:
-        for line in f:
+    with open('/proc/cpuinfo') as cpuinfo_file:
+        for line in cpuinfo_file:
             if not line.strip():
                 # end of one processor
                 cpu_info["proc{!s}".format(nprocs)] = procinfo
@@ -53,11 +52,12 @@ def cpuinfo():
     return cpu_info
 
 
-def set_mkinitcpio_hooks_and_modules(hooks, modules, root_mount_point):
+def write_mkinitcpio_lines(hooks, modules, files, root_mount_point):
     """ Set up mkinitcpio.conf.
 
     :param hooks:
     :param modules:
+    :param files:
     :param root_mount_point:
     """
     with open("/etc/mkinitcpio.conf", "r") as mkinitcpio_file:
@@ -70,6 +70,9 @@ def set_mkinitcpio_hooks_and_modules(hooks, modules, root_mount_point):
         elif mklins[i].startswith("MODULES"):
             joined_modules = ' '.join(modules)
             mklins[i] = "MODULES=\"{!s}\"".format(joined_modules)
+        elif mklins[i].startswith("FILES"):
+            joined_files = ' '.join(files)
+            mklins[i] = "FILES=\"{!s}\"".format(joined_files)
 
     path = os.path.join(root_mount_point, "etc/mkinitcpio.conf")
 
@@ -88,6 +91,8 @@ def modify_mkinitcpio_conf(partitions, root_mount_point):
     btrfs = ""
     hooks = ["base", "udev", "autodetect", "modconf", "block", "keyboard", "keymap"]
     modules = []
+    files = []
+    encrypt_hook = False
 
     # It is important that the plymouth hook comes before any encrypt hook
     plymouth_bin = os.path.join(root_mount_point, "usr/bin/plymouth")
@@ -101,6 +106,14 @@ def modify_mkinitcpio_conf(partitions, root_mount_point):
         if partition["fs"] == "btrfs":
             btrfs = "yes"
 
+        if partition["mountPoint"] == "/" and partition["luksMapperName"]:
+            encrypt_hook = True
+
+    if encrypt_hook:
+        hooks.append("encrypt")
+        if os.path.isfile(os.path.join(root_mount_point, "crypto_keyfile.bin")):
+            files.append("/crypto_keyfile.bin")
+
     if swap_uuid is not "":
         hooks.extend(["resume", "filesystems"])
     else:
@@ -113,7 +126,7 @@ def modify_mkinitcpio_conf(partitions, root_mount_point):
     else:
         hooks.append("fsck")
 
-    set_mkinitcpio_hooks_and_modules(hooks, modules, root_mount_point)
+    write_mkinitcpio_lines(hooks, modules, files, root_mount_point)
 
 
 def run():

src/modules/luksbootkeyfile/main.py

@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#
+# === This file is part of Calamares - <http://github.com/calamares> ===
+#
+#   Copyright 2016, Teo Mrnjavac <teo@kde.org>
+#
+#   Calamares is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   Calamares is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+#   GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with Calamares. If not, see <http://www.gnu.org/licenses/>.
+
+import libcalamares
+
+from libcalamares.utils import check_target_env_call
+
+
+def run():
+    """
+    This module sets up a file crypto_keyfile.bin on the rootfs, assuming the rootfs
+    is LUKS encrypted and a passphrase is provided. This file is then included in the
+    initramfs and used for unlocking the rootfs from a previously unlocked GRUB2
+    session.
+    :return:
+    """
+
+    partitions = libcalamares.globalstorage.value("partitions")
+
+    luks_device = ""
+    luks_passphrase = ""
+
+    for partition in partitions:
+        if partition["mountPoint"] == "/" and "luksMapperName" in partition:
+            luks_device = partition["device"]
+            luks_passphrase = partition["luksPassphrase"]
+
+    if not luks_device:
+        return None
+
+    if not luks_passphrase:
+        return ("Encrypted rootfs setup error",
+                "Rootfs partition {!s} is LUKS but no passphrase found.".format(luks_device))
+
+    # Generate random keyfile
+    check_target_env_call(["dd",
+                           "bs=512",
+                           "count=4",
+                           "if=/dev/urandom",
+                           "of=/crypto_keyfile.bin"])
+    check_target_env_call(["cryptsetup",
+                           "luksAddKey",
+                           luks_device,
+                           "/crypto_keyfile.bin"],
+                          luks_passphrase)
+    check_target_env_call(["chmod",
+                           "g-rwx,o-rwx",
+                           "/crypto_keyfile.bin"])
+
+    return None

src/modules/luksbootkeyfile/module.desc

@@ -0,0 +1,5 @@
+---
+type:       "job"
+name:       "luksbootkeyfile"
+interface:  "python"
+script:     "main.py"

src/modules/mount/main.py

@@ -30,7 +30,7 @@ def mount_partitions(root_mount_point, partitions):
     :param partitions:
     """
     for partition in partitions:
-        if not partition["mountPoint"]:
+        if "mountPoint" not in partition or not partition["mountPoint"]:
             continue
         # Create mount point with `+` rather than `os.path.join()` because
         # `partition["mountPoint"]` starts with a '/'.
@@ -40,11 +40,20 @@ def mount_partitions(root_mount_point, partitions):
         if fstype == "fat16" or fstype == "fat32":
             fstype = "vfat"
 
-        libcalamares.utils.mount(partition["device"],
-                                 mount_point,
-                                 fstype,
-                                 partition.get("options", ""),
-                                 )
+        if "luksMapperName" in partition:
+            libcalamares.utils.debug("about to mount {!s}".format(partition["luksMapperName"]))
+            libcalamares.utils.mount("/dev/mapper/{!s}".format(partition["luksMapperName"]),
+                                     mount_point,
+                                     fstype,
+                                     partition.get("options", ""),
+                                     )
+
+        else:
+            libcalamares.utils.mount(partition["device"],
+                                     mount_point,
+                                     fstype,
+                                     partition.get("options", ""),
+                                     )
 
 
 def run():

src/modules/partition/CMakeLists.txt

@@ -31,11 +31,12 @@ calamares_add_plugin( partition
         core/PartitionIterator.cpp
         core/PartitionModel.cpp
         core/PartUtils.cpp
+        gui/BootInfoWidget.cpp
         gui/ChoicePage.cpp
         gui/CreatePartitionDialog.cpp
-        gui/EditExistingPartitionDialog.cpp
-        gui/BootInfoWidget.cpp
         gui/DeviceInfoWidget.cpp
+        gui/EditExistingPartitionDialog.cpp
+        gui/EncryptWidget.cpp
         gui/PartitionPage.cpp
         gui/PartitionBarsView.cpp
         gui/PartitionLabelsView.cpp
@@ -62,6 +63,7 @@ calamares_add_plugin( partition
         gui/CreatePartitionDialog.ui
         gui/CreatePartitionTableDialog.ui
         gui/EditExistingPartitionDialog.ui
+        gui/EncryptWidget.ui
         gui/PartitionPage.ui
         gui/ReplaceWidget.ui
     LINK_LIBRARIES

src/modules/partition/core/KPMHelpers.cpp

@@ -26,6 +26,7 @@
 #include <kpmcore/core/partition.h>
 #include <kpmcore/fs/filesystemfactory.h>
 #include <kpmcore/backend/corebackendmanager.h>
+#include <kpmcore/fs/luks.h>
 
 #include <QDebug>
 
@@ -132,6 +133,40 @@ createNewPartition( PartitionNode* parent,
 }
 
 
+Partition*
+createNewEncryptedPartition( PartitionNode* parent,
+                             const Device& device,
+                             const PartitionRole& role,
+                             FileSystem::Type fsType,
+                             qint64 firstSector,
+                             qint64 lastSector,
+                             const QString& passphrase,
+                             PartitionTable::Flags flags )
+{
+    PartitionRole::Roles newRoles = role.roles();
+    if ( !role.has( PartitionRole::Luks ) )
+        newRoles |= PartitionRole::Luks;
+
+    FS::luks* fs = dynamic_cast< FS::luks* >(
+                           FileSystemFactory::create( FileSystem::Luks,
+                                                      firstSector,
+                                                      lastSector ) );
+    fs->createInnerFileSystem( fsType );
+    fs->setPassphrase( passphrase );
+    Partition* p = new Partition( parent,
+                                  device,
+                                  PartitionRole( newRoles ),
+                                  fs, fs->firstSector(), fs->lastSector(),
+                                  QString() /* path */,
+                                  PartitionTable::FlagNone /* availableFlags */,
+                                  QString() /* mountPoint */,
+                                  false /* mounted */,
+                                  flags /* activeFlags */,
+                                  Partition::StateNew );
+    return p;
+}
+
+
 Partition*
 clonePartition( Device* device, Partition* partition )
 {
@@ -163,7 +198,7 @@ prettyNameForFileSystemType( FileSystem::Type t )
     case FileSystem::Unformatted:
         return QObject::tr( "unformatted" );
     case FileSystem::LinuxSwap:
-        return "swap";
+        return QObject::tr( "swap" );
     case FileSystem::Fat16:
     case FileSystem::Fat32:
     case FileSystem::Ntfs:

src/modules/partition/core/KPMHelpers.h

@@ -91,6 +91,15 @@ Partition* createNewPartition( PartitionNode* parent,
                                qint64 lastSector,
                                PartitionTable::Flags flags = PartitionTable::FlagNone );
 
+Partition* createNewEncryptedPartition( PartitionNode* parent,
+                                        const Device& device,
+                                        const PartitionRole& role,
+                                        FileSystem::Type fsType,
+                                        qint64 firstSector,
+                                        qint64 lastSector,
+                                        const QString& passphrase,
+                                        PartitionTable::Flags flags = PartitionTable::FlagNone );
+
 Partition* clonePartition( Device* device, Partition* partition );
 
 QString prettyNameForFileSystemType( FileSystem::Type t );

src/modules/partition/core/PartitionActions.cpp

@@ -98,7 +98,7 @@ swapSuggestion( const qint64 availableSpaceB )
 
 
 void
-doAutopartition( PartitionCoreModule* core, Device* dev )
+doAutopartition( PartitionCoreModule* core, Device* dev, const QString& luksPassphrase )
 {
     bool isEfi = false;
     if ( QDir( "/sys/firmware/efi/efivars" ).exists() )
@@ -167,28 +167,60 @@ doAutopartition( PartitionCoreModule* core, Device* dev )
         lastSectorForRoot -= suggestedSwapSizeB / dev->logicalSectorSize() + 1;
     }
 
-    Partition* rootPartition = KPMHelpers::createNewPartition(
-        dev->partitionTable(),
-        *dev,
-        PartitionRole( PartitionRole::Primary ),
-        FileSystem::Ext4,
-        firstFreeSector,
-        lastSectorForRoot
-    );
+    Partition* rootPartition = nullptr;
+    if ( luksPassphrase.isEmpty() )
+    {
+        rootPartition = KPMHelpers::createNewPartition(
+            dev->partitionTable(),
+            *dev,
+            PartitionRole( PartitionRole::Primary ),
+            FileSystem::Ext4,
+            firstFreeSector,
+            lastSectorForRoot
+        );
+    }
+    else
+    {
+        rootPartition = KPMHelpers::createNewEncryptedPartition(
+            dev->partitionTable(),
+            *dev,
+            PartitionRole( PartitionRole::Primary ),
+            FileSystem::Ext4,
+            firstFreeSector,
+            lastSectorForRoot,
+            luksPassphrase
+       );
+    }
     PartitionInfo::setFormat( rootPartition, true );
     PartitionInfo::setMountPoint( rootPartition, "/" );
     core->createPartition( dev, rootPartition );
 
     if ( shouldCreateSwap )
     {
-        Partition* swapPartition = KPMHelpers::createNewPartition(
-            dev->partitionTable(),
-            *dev,
-            PartitionRole( PartitionRole::Primary ),
-            FileSystem::LinuxSwap,
-            lastSectorForRoot + 1,
-            dev->totalSectors() - 1
-        );
+        Partition* swapPartition = nullptr;
+        if ( luksPassphrase.isEmpty() )
+        {
+            swapPartition = KPMHelpers::createNewPartition(
+                dev->partitionTable(),
+                *dev,
+                PartitionRole( PartitionRole::Primary ),
+                FileSystem::LinuxSwap,
+                lastSectorForRoot + 1,
+                dev->totalSectors() - 1
+            );
+        }
+        else
+        {
+            swapPartition = KPMHelpers::createNewEncryptedPartition(
+                dev->partitionTable(),
+                *dev,
+                PartitionRole( PartitionRole::Primary ),
+                FileSystem::LinuxSwap,
+                lastSectorForRoot + 1,
+                dev->totalSectors() - 1,
+                luksPassphrase
+            );
+        }
         PartitionInfo::setFormat( swapPartition, true );
         core->createPartition( dev, swapPartition );
     }

src/modules/partition/core/PartitionActions.h

@@ -19,14 +19,21 @@
 #ifndef PARTITIONACTIONS_H
 #define PARTITIONACTIONS_H
 
+#include <QString>
+
 class PartitionCoreModule;
 class Device;
 class Partition;
 
 namespace PartitionActions
 {
-void doAutopartition( PartitionCoreModule* core, Device* dev );
-void doReplacePartition( PartitionCoreModule* core, Device* dev, Partition* partition );
+void doAutopartition( PartitionCoreModule* core,
+                      Device* dev,
+                      const QString& luksPassphrase = QString() );
+
+void doReplacePartition( PartitionCoreModule* core,
+                         Device* dev,
+                         Partition* partition );
 }
 
 #endif // PARTITIONACTIONS_H

src/modules/partition/gui/ChoicePage.cpp

@@ -121,6 +121,7 @@ ChoicePage::ChoicePage( QWidget* parent )
     m_previewAfterFrame->setSizePolicy( QSizePolicy::Preferred, QSizePolicy::Expanding );
     m_previewAfterLabel->hide();
     m_previewAfterFrame->hide();
+    m_encryptWidget->hide();
     // end
 }
 
@@ -157,6 +158,9 @@ ChoicePage::init( PartitionCoreModule* core )
              static_cast< void ( QComboBox::* )( int ) >( &QComboBox::currentIndexChanged ),
              this, &ChoicePage::applyDeviceChoice );
 
+    connect( m_encryptWidget, &EncryptWidget::stateChanged,
+             this, &ChoicePage::onEncryptWidgetStateChanged );
+
     ChoicePage::applyDeviceChoice();
 }
 
@@ -238,14 +242,8 @@ ChoicePage::setupChoices()
         if ( checked )  // An action was picked.
         {
             m_choice = static_cast< Choice >( id );
-            if ( m_choice == Replace )
-            {
-                setNextEnabled( false );
-            }
-            else
-            {
-                setNextEnabled( true );
-            }
+            updateNextEnabled();
+
             emit actionChosen();
         }
         else    // An action was unpicked, either on its own or because of another selection.
@@ -253,7 +251,8 @@ ChoicePage::setupChoices()
             if ( m_grp->checkedButton() == nullptr )  // If no other action is chosen, we must
             {                                         // set m_choice to NoChoice and reset previews.
                 m_choice = NoChoice;
-                setNextEnabled( false );
+                updateNextEnabled();
+
                 emit actionChosen();
             }
         }
@@ -369,14 +368,14 @@ ChoicePage::applyActionChoice( ChoicePage::Choice choice )
             } ),
             [ = ]
             {
-                PartitionActions::doAutopartition( m_core, selectedDevice() );
+                PartitionActions::doAutopartition( m_core, selectedDevice(), m_encryptWidget->passphrase() );
                 emit deviceChosen();
             },
             this );
         }
         else
         {
-            PartitionActions::doAutopartition( m_core, selectedDevice() );
+            PartitionActions::doAutopartition( m_core, selectedDevice(), m_encryptWidget->passphrase() );
             emit deviceChosen();
         }
 
@@ -392,7 +391,7 @@ ChoicePage::applyActionChoice( ChoicePage::Choice choice )
             []{},
             this );
         }
-        setNextEnabled( !m_beforePartitionBarsView->selectionModel()->selectedRows().isEmpty() );
+        updateNextEnabled();
 
         connect( m_beforePartitionBarsView->selectionModel(), SIGNAL( currentRowChanged( QModelIndex, QModelIndex ) ),
                  this, SLOT( doReplaceSelectedPartition( QModelIndex, QModelIndex ) ),
@@ -415,7 +414,7 @@ ChoicePage::applyActionChoice( ChoicePage::Choice choice )
             },
             this );
         }
-        setNextEnabled( !m_beforePartitionBarsView->selectionModel()->selectedRows().isEmpty() );
+        updateNextEnabled();
 
         connect( m_beforePartitionBarsView->selectionModel(), SIGNAL( currentRowChanged( QModelIndex, QModelIndex ) ),
                  this, SLOT( doAlongsideSetupSplitter( QModelIndex, QModelIndex ) ),
@@ -466,7 +465,7 @@ ChoicePage::doAlongsideSetupSplitter( const QModelIndex& current,
                 Calamares::Branding::instance()->
                     string( Calamares::Branding::ProductName ) );
 
-    setNextEnabled( m_beforePartitionBarsView->selectionModel()->currentIndex().isValid() );
+    updateNextEnabled();
 
     if ( m_isEfi )
         setupEfiSystemPartitionSelector();
@@ -475,6 +474,20 @@ ChoicePage::doAlongsideSetupSplitter( const QModelIndex& current,
 }
 
 
+void
+ChoicePage::onEncryptWidgetStateChanged()
+{
+    EncryptWidget::State state = m_encryptWidget->state();
+    if ( m_choice == Erase )
+    {
+        if ( state == EncryptWidget::EncryptionConfirmed ||
+             state == EncryptWidget::EncryptionDisabled )
+            applyActionChoice( m_choice );
+    }
+    updateNextEnabled();
+}
+
+
 void
 ChoicePage::onLeave()
 {
@@ -628,7 +641,7 @@ ChoicePage::doReplaceSelectedPartition( const QModelIndex& current,
         if ( m_isEfi )
             setupEfiSystemPartitionSelector();
 
-        setNextEnabled( !m_beforePartitionBarsView->selectionModel()->selectedRows().isEmpty() );
+        updateNextEnabled();
         if ( !m_bootloaderComboBox.isNull() &&
              m_bootloaderComboBox->currentIndex() < 0 )
             m_bootloaderComboBox->setCurrentIndex( m_lastSelectedDeviceIndex );
@@ -770,10 +783,12 @@ ChoicePage::updateActionChoicePreview( ChoicePage::Choice choice )
             };
             m_beforePartitionBarsView->setSelectionFilter( filter );
             m_beforePartitionLabelsView->setSelectionFilter( filter );
+            m_encryptWidget->hide();
 
             break;
         }
     case Erase:
+        m_encryptWidget->show();
     case Replace:
         {
             m_previewBeforeLabel->setText( tr( "Current:" ) );
@@ -854,6 +869,7 @@ ChoicePage::updateActionChoicePreview( ChoicePage::Choice choice )
         m_previewAfterFrame->hide();
         m_previewBeforeLabel->setText( tr( "Current:" ) );
         m_previewAfterLabel->hide();
+        m_encryptWidget->hide();
         break;
     }
 
@@ -903,7 +919,7 @@ ChoicePage::setupEfiSystemPartitionSelector()
                         "partitioning to set up %1." )
                     .arg( Calamares::Branding::instance()->
                           string( Calamares::Branding::ShortProductName ) ) );
-        setNextEnabled( false );
+        updateNextEnabled();
     }
     else if ( efiSystemPartitions.count() == 1 ) //probably most usual situation
     {
@@ -1193,8 +1209,42 @@ ChoicePage::currentChoice() const
 
 
 void
-ChoicePage::setNextEnabled( bool enabled )
+ChoicePage::updateNextEnabled()
 {
+    bool enabled = false;
+
+    switch ( m_choice )
+    {
+    case NoChoice:
+        enabled = false;
+        break;
+    case Replace:
+        enabled = !m_beforePartitionBarsView->selectionModel()->
+                  selectedRows().isEmpty();
+        break;
+    case Alongside:
+        enabled = !m_beforePartitionBarsView->selectionModel()->
+                  selectedRows().isEmpty() &&
+                  m_beforePartitionBarsView->selectionModel()->
+                  currentIndex().isValid();
+        break;
+    case Erase:
+    case Manual:
+        enabled = true;
+    }
+
+    if ( m_isEfi &&
+         ( m_choice == Alongside ||
+           m_choice == Replace ) )
+    {
+        if ( m_core->efiSystemPartitions().count() == 0 )
+            enabled = false;
+    }
+
+    if ( m_encryptWidget->isVisible() &&
+         m_encryptWidget->state() == EncryptWidget::EncryptionUnconfirmed )
+        enabled = false;
+
     if ( enabled == m_nextEnabled )
         return;
 

src/modules/partition/gui/ChoicePage.h

@@ -74,9 +74,10 @@ signals:
 private slots:
     void doReplaceSelectedPartition( const QModelIndex& current, const QModelIndex& previous );
     void doAlongsideSetupSplitter( const QModelIndex& current, const QModelIndex& previous );
+    void onEncryptWidgetStateChanged();
 
 private:
-    void setNextEnabled( bool enabled );
+    void updateNextEnabled();
     void setupChoices();
     QComboBox* createBootloaderComboBox( QWidget* parentButton );
     Device* selectedDevice();

src/modules/partition/gui/ChoicePage.ui

@@ -32,7 +32,7 @@
     </layout>
    </item>
    <item>
-    <layout class="QVBoxLayout" name="m_rightLayout" stretch="0,1,0,0,0">
+    <layout class="QVBoxLayout" name="m_rightLayout" stretch="0,1,0,0,0,0">
      <item>
       <widget class="QLabel" name="m_messageLabel">
        <property name="toolTip">
@@ -63,7 +63,7 @@
           <x>0</x>
           <y>0</y>
           <width>729</width>
-          <height>327</height>
+          <height>276</height>
          </rect>
         </property>
         <layout class="QVBoxLayout" name="m_itemsLayout">
@@ -93,6 +93,9 @@
        </property>
       </widget>
      </item>
+     <item>
+      <widget class="EncryptWidget" name="m_encryptWidget" native="true"/>
+     </item>
      <item>
       <widget class="QLabel" name="m_selectLabel">
        <property name="text">
@@ -197,6 +200,14 @@
    </item>
   </layout>
  </widget>
+ <customwidgets>
+  <customwidget>
+   <class>EncryptWidget</class>
+   <extends>QWidget</extends>
+   <header>gui/EncryptWidget.h</header>
+   <container>1</container>
+  </customwidget>
+ </customwidgets>
  <resources/>
  <connections/>
 </ui>

src/modules/partition/gui/EncryptWidget.cpp

@@ -0,0 +1,150 @@
+/* === This file is part of Calamares - <http://github.com/calamares> ===
+ *
+ *   Copyright 2016, Teo Mrnjavac <teo@kde.org>
+ *
+ *   Calamares is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 3 of the License, or
+ *   (at your option) any later version.
+ *
+ *   Calamares is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with Calamares. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+
+#include "EncryptWidget.h"
+
+#include <utils/CalamaresUtilsGui.h>
+
+EncryptWidget::EncryptWidget( QWidget* parent )
+    : QWidget( parent )
+{
+    setupUi( this );
+
+    m_iconLabel->setFixedWidth( m_iconLabel->height() );
+    m_passphraseLineEdit->hide();
+    m_confirmLineEdit->hide();
+    m_iconLabel->hide();
+
+    connect( m_encryptCheckBox, &QCheckBox::stateChanged,
+             this, &EncryptWidget::onCheckBoxStateChanged );
+    connect( m_passphraseLineEdit, &QLineEdit::textEdited,
+             this, &EncryptWidget::onPassphraseEdited );
+    connect( m_confirmLineEdit, &QLineEdit::textEdited,
+             this, &EncryptWidget::onPassphraseEdited );
+
+    updateState();
+}
+
+
+EncryptWidget::State
+EncryptWidget::state() const
+{
+    return m_state;
+}
+
+
+QString
+EncryptWidget::passphrase() const
+{
+    if ( m_state == EncryptionConfirmed )
+        return m_passphraseLineEdit->text();
+    return QString();
+}
+
+
+void
+EncryptWidget::changeEvent( QEvent* e )
+{
+    QWidget::changeEvent( e );
+    switch ( e->type() )
+    {
+    case QEvent::LanguageChange:
+        retranslateUi( this );
+        break;
+    default:
+        break;
+    }
+}
+
+
+void
+EncryptWidget::updateState()
+{
+    State newState;
+    if ( m_encryptCheckBox->isChecked() )
+    {
+        if ( !m_passphraseLineEdit->text().isEmpty() &&
+             m_passphraseLineEdit->text() == m_confirmLineEdit->text() )
+        {
+            newState = EncryptionConfirmed;
+        }
+        else
+        {
+            newState = EncryptionUnconfirmed;
+        }
+    }
+    else
+    {
+        newState = EncryptionDisabled;
+    }
+
+    if ( newState != m_state )
+    {
+        m_state = newState;
+        emit stateChanged( m_state );
+    }
+}
+
+
+void
+EncryptWidget::onPassphraseEdited()
+{
+    if ( !m_iconLabel->isVisible() )
+        m_iconLabel->show();
+
+    QString p1 = m_passphraseLineEdit->text();
+    QString p2 = m_confirmLineEdit->text();
+
+    m_iconLabel->setToolTip( QString() );
+    if ( p1.isEmpty() && p2.isEmpty() )
+    {
+        m_iconLabel->clear();
+    }
+    else if ( p1 == p2 )
+    {
+        m_iconLabel->setFixedWidth( m_iconLabel->height() );
+        m_iconLabel->setPixmap( CalamaresUtils::defaultPixmap( CalamaresUtils::Yes,
+                                                               CalamaresUtils::Original,
+                                                               m_iconLabel->size() ) );
+    }
+    else
+    {
+        m_iconLabel->setFixedWidth( m_iconLabel->height() );
+        m_iconLabel->setPixmap( CalamaresUtils::defaultPixmap( CalamaresUtils::No,
+                                                               CalamaresUtils::Original,
+                                                               m_iconLabel->size() ) );
+        m_iconLabel->setToolTip( "Please enter the same passphrase in both boxes." );
+    }
+
+    updateState();
+}
+
+
+void
+EncryptWidget::onCheckBoxStateChanged( int state )
+{
+    m_passphraseLineEdit->setVisible( state );
+    m_confirmLineEdit->setVisible( state );
+    m_iconLabel->setVisible( state );
+    m_passphraseLineEdit->clear();
+    m_confirmLineEdit->clear();
+    m_iconLabel->clear();
+
+    updateState();
+}

src/modules/partition/gui/EncryptWidget.h

@@ -0,0 +1,57 @@
+/* === This file is part of Calamares - <http://github.com/calamares> ===
+ *
+ *   Copyright 2016, Teo Mrnjavac <teo@kde.org>
+ *
+ *   Calamares is free software: you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation, either version 3 of the License, or
+ *   (at your option) any later version.
+ *
+ *   Calamares is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with Calamares. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+
+#ifndef ENCRYPTWIDGET_H
+#define ENCRYPTWIDGET_H
+
+#include "ui_EncryptWidget.h"
+
+class EncryptWidget : public QWidget, private Ui::EncryptWidget
+{
+    Q_OBJECT
+
+public:
+    enum State : unsigned short
+    {
+        EncryptionDisabled = 0,
+        EncryptionUnconfirmed,
+        EncryptionConfirmed
+    };
+
+    explicit EncryptWidget( QWidget* parent = nullptr );
+
+    State state() const;
+
+    QString passphrase() const;
+
+signals:
+    void stateChanged( State );
+
+protected:
+    void changeEvent( QEvent* e );
+
+private:
+    void updateState();
+    void onPassphraseEdited();
+    void onCheckBoxStateChanged( int state );
+
+    State m_state;
+};
+
+#endif // ENCRYPTWIDGET_H

src/modules/partition/gui/EncryptWidget.ui

@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<ui version="4.0">
+ <class>EncryptWidget</class>
+ <widget class="QWidget" name="EncryptWidget">
+  <property name="geometry">
+   <rect>
+    <x>0</x>
+    <y>0</y>
+    <width>822</width>
+    <height>59</height>
+   </rect>
+  </property>
+  <property name="windowTitle">
+   <string>Form</string>
+  </property>
+  <layout class="QHBoxLayout" name="horizontalLayout">
+   <item>
+    <widget class="QCheckBox" name="m_encryptCheckBox">
+     <property name="text">
+      <string>En&amp;crypt system</string>
+     </property>
+    </widget>
+   </item>
+   <item>
+    <widget class="QLineEdit" name="m_passphraseLineEdit">
+     <property name="echoMode">
+      <enum>QLineEdit::Password</enum>
+     </property>
+     <property name="placeholderText">
+      <string>Passphrase</string>
+     </property>
+    </widget>
+   </item>
+   <item>
+    <widget class="QLineEdit" name="m_confirmLineEdit">
+     <property name="echoMode">
+      <enum>QLineEdit::Password</enum>
+     </property>
+     <property name="placeholderText">
+      <string>Confirm passphrase</string>
+     </property>
+    </widget>
+   </item>
+   <item>
+    <widget class="QLabel" name="m_iconLabel">
+     <property name="text">
+      <string/>
+     </property>
+     <property name="alignment">
+      <set>Qt::AlignCenter</set>
+     </property>
+    </widget>
+   </item>
+  </layout>
+ </widget>
+ <resources/>
+ <connections/>
+</ui>

src/modules/partition/jobs/FillGlobalStorageJob.cpp

@@ -31,11 +31,13 @@
 #include <kpmcore/core/device.h>
 #include <kpmcore/core/partition.h>
 #include <kpmcore/fs/filesystem.h>
+#include <kpmcore/fs/luks.h>
 
 // Qt
 #include <QDebug>
 #include <QDir>
 #include <QFileInfo>
+#include <QProcess>
 
 typedef QHash<QString, QString> UuidForPartitionHash;
 
@@ -61,6 +63,22 @@ findPartitionUuids( QList < Device* > devices )
     return hash;
 }
 
+
+static QString
+getLuksUuid( const QString& path )
+{
+    QProcess process;
+    process.setProgram( "cryptsetup" );
+    process.setArguments( { "luksUUID", path } );
+    process.start();
+    process.waitForFinished();
+    if ( process.exitStatus() != QProcess::NormalExit || process.exitCode() )
+        return QString();
+    QString uuid = QString::fromLocal8Bit( process.readAllStandardOutput() ).trimmed();
+    return uuid;
+}
+
+
 static QVariant
 mapForPartition( Partition* partition, const QString& uuid )
 {
@@ -73,6 +91,20 @@ mapForPartition( Partition* partition, const QString& uuid )
              << "mtpoint:" << PartitionInfo::mountPoint( partition )
              << "fs:" << partition->fileSystem().name()
              << uuid;
+
+    if ( partition->roles().has( PartitionRole::Luks ) )
+    {
+        const FileSystem& fsRef = partition->fileSystem();
+        const FS::luks* luksFs = dynamic_cast< const FS::luks* >( &fsRef );
+        if ( luksFs )
+        {
+            map[ "luksMapperName" ] = luksFs->mapperName( partition->partitionPath() ).split( "/" ).last();
+            map[ "luksUuid" ] = getLuksUuid( partition->partitionPath() );
+            map[ "luksPassphrase" ] = luksFs->passphrase();
+            cDebug() << "luksMapperName:" << map[ "luksMapperName" ];
+        }
+    }
+
     return map;
 }