microsoft · mayankfz · Aug 17, 2026 · Aug 17, 2026 · Sep 3, 2026
@@ -0,0 +1,25 @@
+From b5153c74f62233438a72710673c0e53e3e1af7de Mon Sep 17 00:00:00 2001
+From: Mayank Singh <mayansingh@microsoft.com>
+Date: Thu, 13 Aug 2026 00:00:00 +0000
+Subject: [PATCH] decrypt-root: order unlock before root-device wait
+
+Keep Ignition's disks stage ahead of root decryption because it can provision
+LUKS volumes, then decrypt ROOT before initramfs waits for the root device.
+---
+ dracut/31decrypt-root/decrypt-root.service | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/dracut/31decrypt-root/decrypt-root.service b/dracut/31decrypt-root/decrypt-root.service
+index 54f941a..226d3d3 100644
+--- a/dracut/31decrypt-root/decrypt-root.service
++++ b/dracut/31decrypt-root/decrypt-root.service
+@@ -4,5 +4,7 @@ Description=Generate and execute a systemd-cryptsetup service to decrypt the ROOT partition
+ DefaultDependencies=no
++# Decrypt ROOT before initramfs waits for it.
++Before=initrd-root-device.target
+ # If systemd-networkd.service is used in the initramfs, then we should run after it, since the ROOT partition
+ # might use network-bound encryption.
+ After=systemd-networkd.service dev-disk-by\x2dpartlabel-ROOT.device ignition-disks.service
+ Wants=dev-disk-by\x2dpartlabel-ROOT.device
+--
+2.43.0
@@ -2,7 +2,7 @@
 
 Name:           bootengine
 Version:        0.0.38
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        Flatcar bootengine dracut modules and helper utilities
 
 License:        BSD-2-Clause
@@ -12,6 +12,7 @@ URL:            https://github.com/flatcar/bootengine
 Source0:        https://github.com/flatcar/bootengine/archive/%{commit_hash}.tar.gz#/%{name}-%{version}.tar.gz
 Patch0:         0001-modify-tests.patch
 Patch1:         0002-delete-UKI-firstboot-addon-after-Ignition.patch
+Patch2:         0003-decrypt-root-fix-firstboot-ordering.patch
 BuildArch:      noarch
 BuildRequires:  dracut
 Requires:       util-linux
@@ -72,6 +73,10 @@ chmod +x \
 %{_sbindir}/update-bootengine
 
 %changelog
+* Thu Aug 13 2026 Mayank Singh <mayansingh@microsoft.com> - 0.0.38-3
+- decrypt-root: run after Ignition disk provisioning and before initramfs waits
+  for the encrypted root device.
+
 * Tue May 06 2026 Lanze Liu <lanzeliu@microsoft.com> - 0.0.38-2
 - Update firstboot addon removal to use glob pattern for UAPI UKI naming
 

@@ -34,6 +34,11 @@ install_items+=" /usr/sbin/dmsetup "
 # Cryptsetup libraries (required for veritysetup and crypt module)
 install_items+=" /usr/lib/libcryptsetup.so.12 /usr/lib64/libcryptsetup.so.12 "
 install_items+=" /usr/sbin/cryptsetup "
+# TPM2 libs for LUKS root auto-unlock. systemd-cryptsetup dlopen()s these at
+# runtime, so dracut's ldd scan misses them and so we are adding them.
+install_items+=" /usr/lib64/libtss2-esys.so.0 /usr/lib64/libtss2-sys.so.1 "
+install_items+=" /usr/lib64/libtss2-mu.so.0 /usr/lib64/libtss2-rc.so.0 "
+install_items+=" /usr/lib64/libtss2-tctildr.so.0 /usr/lib64/libtss2-tcti-device.so.0 "
 # dm-verity tool
 install_items+=" /usr/sbin/veritysetup "
 # systemd-veritysetup binary (dracut should include it via module, but be explicit)

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -euo pipefail
+
+config_dir="/run/chrony-azure/conf.d"
+config_file="${config_dir}/azure-ptp.conf"
+
+install -d -m 0755 "${config_dir}"
+
+if [[ -e /dev/ptp_hyperv ]]; then
+    printf '%s\n' \
+        'refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2 prefer' \
+        > "${config_file}"
+else
+    rm -f "${config_file}"
+fi
@@ -1,4 +1,6 @@
-# This should only be used when chronyd is configured to use the /dev/ptp_hyperv device
 [Unit]
-Wants=dev-ptp_hyperv.device
+# Order after the PTP device if present without waiting for it when unavailable.
 After=dev-ptp_hyperv.device
+
+[Service]
+ExecStartPre=-/usr/libexec/chrony-azure-ptp
@@ -5,26 +5,18 @@
 # Include configuration files found in /etc/chrony/conf.d.
 confdir /etc/chrony/conf.d
 
-# This will use (up to):
-# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
-# - 1 source from [013].ubuntu.pool.ntp.org each (ipv4 only atm)
-# This means by default, up to 2 dual-stack and up to 3 additional IPv4-only
-# sources will be used.
-# At the same time it retains some protection against one of the entries being
-# down (compare to just using one of the lines).
-#
-# See http://www.pool.ntp.org/join.html for more information.
-#pool 0.flatcar.pool.ntp.org iburst maxsources 1
-#pool 1.flatcar.pool.ntp.org iburst maxsources 1
-#pool 2.flatcar.pool.ntp.org iburst maxsources 2
-#pool 3.flatcar.pool.ntp.org iburst maxsources 1
+# Include runtime configuration generated for Azure platform devices.
+confdir /run/chrony-azure/conf.d
 
 # Use time sources from DHCP.
 sourcedir /run/chrony-dhcp
 
 # Use NTP sources found in /etc/chrony/sources.d.
 sourcedir /etc/chrony/sources.d
 
+# Retain the Azure Linux 3.0 public fallback.
+server time.windows.com iburst
+
 # This directive specify the location of the file containing ID/key pairs for
 # NTP authentication.
 #keyfile /etc/chrony/chrony.keys
@@ -58,8 +50,5 @@ makestep 1.0 -1
 # leap-smeared time.
 leapsectz right/UTC
 
-# Azure hosts are synchronized to internal Microsoft time servers
-# that take their time from Microsoft-owned Stratum 1 devices.
-# The Hyper-V drivers surface this time source as a PTP-based
-# time source in the guest. This configures chrony to use it.
-refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2
+# /run/chrony-azure/conf.d/azure-ptp.conf is generated before chronyd starts when
+# the Hyper-V PTP device is available.
@@ -55,23 +55,44 @@ if [[ -f "${rootfs}/usr/lib/systemd/system/chronyd.service" ]]; then
     sed -i \
         's|^ExecStart=/usr/sbin/chronyd $OPTIONS$|ExecStart=/usr/sbin/chronyd -f /usr/lib/chrony/chrony.conf $OPTIONS|' \
         "${rootfs}/usr/lib/systemd/system/chronyd.service"
+
+    # Azure Linux adds this command, but its chrony-helper does not implement it,
+    # leaving chronyd failed after a clean stop.
+    if ! grep -qE '^ExecStopPost=.*/chrony-helper remove-daemon-state$' \
+        "${rootfs}/usr/lib/systemd/system/chronyd.service"; then
+        echo "ERROR: expected chrony-helper remove-daemon-state line not found" >&2
+        exit 1
+    fi
+    sed -i \
+        '\|^ExecStopPost=.*/chrony-helper remove-daemon-state$|d' \
+        "${rootfs}/usr/lib/systemd/system/chronyd.service"
 fi
 
 # Copy Azure-optimized chrony.conf from this directory.
 # Overwrites the RPM default that manglefs already moved from /etc.
-# Key differences: makestep 1.0 -1 (always-step), PTP refclock for Hyper-V clock.
+# Key differences: always-step, network fallback, and optional Hyper-V PTP.
 
 # Copy Azure-optimized chrony.conf to /usr/lib/chrony/chrony.conf
 if [[ -f "${script_dir}/chrony.conf" ]]; then
     cp "${script_dir}/chrony.conf" "${rootfs}/usr/lib/chrony/chrony.conf"
 fi
 
-# chronyd.service drop-in (Wants/After dev-ptp_hyperv.device)
-if [[ -f "${script_dir}/chrony-hyperv.conf" ]]; then
-    mkdir -p "${rootfs}/usr/lib/systemd/system/chronyd.service.d"
-    cp "${script_dir}/chrony-hyperv.conf" \
-       "${rootfs}/usr/lib/systemd/system/chronyd.service.d/"
+# Generate the optional Hyper-V PTP source before chronyd starts.
+if [[ ! -f "${script_dir}/chrony-azure-ptp" ]]; then
+    echo "ERROR: missing ${script_dir}/chrony-azure-ptp" >&2
+    exit 1
+fi
+install -D -m 0755 "${script_dir}/chrony-azure-ptp" \
+    "${rootfs}/usr/libexec/chrony-azure-ptp"
+
+# chronyd.service drop-in for optional Hyper-V PTP configuration.
+if [[ ! -f "${script_dir}/chrony-hyperv.conf" ]]; then
+    echo "ERROR: missing ${script_dir}/chrony-hyperv.conf" >&2
+    exit 1
 fi
+mkdir -p "${rootfs}/usr/lib/systemd/system/chronyd.service.d"
+cp "${script_dir}/chrony-hyperv.conf" \
+   "${rootfs}/usr/lib/systemd/system/chronyd.service.d/"
 
 # Chrony tmpfiles: /var/lib/chrony dir + /etc/chrony.keys copy-on-boot
 if [[ -f "${script_dir}/var-chrony.conf" ]]; then