Show/hide "Boot partition not encrypted" warning

src/modules/partition/Config.cpp

@@ -412,6 +412,7 @@ Config::setConfigurationMap( const QVariantMap& configurationMap )
     m_allowZfsEncryption = CalamaresUtils::getBool( configurationMap, "allowZfsEncryption", true );
 
     m_allowManualPartitioning = CalamaresUtils::getBool( configurationMap, "allowManualPartitioning", true );
+    m_showNotEncryptedBootMessage = CalamaresUtils::getBool( configurationMap, "showNotEncryptedBootMessage", true );
     m_requiredPartitionTableType = CalamaresUtils::getStringList( configurationMap, "requiredPartitionTableType" );
 
     Calamares::GlobalStorage* gs = Calamares::JobQueue::instance()->globalStorage();

src/modules/partition/Config.h

@@ -36,6 +36,8 @@ class Config : public QObject
 
     Q_PROPERTY( bool allowManualPartitioning READ allowManualPartitioning CONSTANT FINAL )
 
+    Q_PROPERTY( bool showNotEncryptedBootMessage READ showNotEncryptedBootMessage CONSTANT FINAL )
+
 public:
     Config( QObject* parent );
     ~Config() override = default;
@@ -146,6 +148,9 @@ public:
     /// @brief Is manual partitioning allowed (not explicitly disabled in the config file)?
     bool allowManualPartitioning() const { return m_allowManualPartitioning; }
 
+    /// @brief Show "Boot partition not encrypted" warning (not explicitly disabled in the config file)?
+    bool showNotEncryptedBootMessage() const { return m_showNotEncryptedBootMessage; }
+
     /** @brief Will @p tableType be ok?
      *
      * If no required types are specified, it's ok, otherwise the
@@ -194,6 +199,7 @@ private:
     QStringList m_requiredPartitionTableType;
     bool m_allowZfsEncryption = true;
     bool m_allowManualPartitioning = true;
+    bool m_showNotEncryptedBootMessage = true;
 };
 
 /** @brief Given a set of swap choices, return a sensible value from it.

src/modules/partition/PartitionViewStep.cpp

@@ -615,27 +615,32 @@ PartitionViewStep::onLeave()
 
             // If the root partition is encrypted, and there's a separate boot
             // partition which is not encrypted
-            if ( ( root_p->fileSystem().type() == FileSystem::Luks && boot_p->fileSystem().type() != FileSystem::Luks )
+            if ( m_config->showNotEncryptedBootMessage() )
-                 || ( root_p->fileSystem().type() == FileSystem::Luks2
-                      && boot_p->fileSystem().type() != FileSystem::Luks2 ) )
             {
-                message = tr( "Boot partition not encrypted" );
+                if ( ( root_p->fileSystem().type() == FileSystem::Luks
-                description = tr( "A separate boot partition was set up together with "
+                       && boot_p->fileSystem().type() != FileSystem::Luks )
-                                  "an encrypted root partition, but the boot partition "
+                     || ( root_p->fileSystem().type() == FileSystem::Luks2
-                                  "is not encrypted."
+                          && boot_p->fileSystem().type() != FileSystem::Luks2 ) )
-                                  "<br/><br/>"
+                {
-                                  "There are security concerns with this kind of "
+                    message = tr( "Boot partition not encrypted" );
-                                  "setup, because important system files are kept "
+                    description = tr( "A separate boot partition was set up together with "
-                                  "on an unencrypted partition.<br/>"
+                                      "an encrypted root partition, but the boot partition "
-                                  "You may continue if you wish, but filesystem "
+                                      "is not encrypted."
-                                  "unlocking will happen later during system startup."
+                                      "<br/><br/>"
-                                  "<br/>To encrypt the boot partition, go back and "
+                                      "There are security concerns with this kind of "
-                                  "recreate it, selecting <strong>Encrypt</strong> "
+                                      "setup, because important system files are kept "
-                                  "in the partition creation window." );
+                                      "on an unencrypted partition.<br/>"
+                                      "You may continue if you wish, but filesystem "
+                                      "unlocking will happen later during system startup."
+                                      "<br/>To encrypt the boot partition, go back and "
+                                      "recreate it, selecting <strong>Encrypt</strong> "
+                                      "in the partition creation window." );
 
-                QMessageBox mb( QMessageBox::Warning, message, description, QMessageBox::Ok, m_manualPartitionPage );
+                    QMessageBox mb(
-                Calamares::fixButtonLabels( &mb );
+                        QMessageBox::Warning, message, description, QMessageBox::Ok, m_manualPartitionPage );
-                mb.exec();
+                    Calamares::fixButtonLabels( &mb );
+                    mb.exec();
+                }
             }
         }
     }

src/modules/partition/partition.conf

@@ -104,6 +104,15 @@ alwaysShowPartitionLabels: true
 # If nothing is specified, manual partitioning is enabled.
 #allowManualPartitioning:   true
 
+# Show not encrypted boot partition warning.
+#
+# When set to false, this option does not show the
+# "Boot partition not encrypted" warning when encrypting the
+# root partition but not /boot partition.
+#
+# If nothing is specified, the warning is shown.
+#showNotEncryptedBootMessage:   true
+
 # Initial selection on the Choice page
 #
 # There are four radio buttons (in principle: erase, replace, alongside, manual),

src/modules/partition/partition.schema.yaml

@@ -26,6 +26,7 @@ properties:
     enableLuksAutomatedPartitioning: { type: boolean, default: false }
 
     allowManualPartitioning: { type: boolean, default: true }
+    showNotEncryptedBootMessage: { type: boolean, default: true }
     partitionLayout: { type: array }  # TODO: specify items
     initialPartitioningChoice: { type: string, enum: [ none, erase, replace, alongside, manual ] }
     initialSwapChoice: { type: string, enum: [ none, small, suspend, reuse, file ] }