From e99be577735f7fe89d0036470f97a24c04f6bf41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
Date: Thu, 18 Jun 2026 10:53:59 +0200
Subject: [PATCH 1/3] dracut/tang: Order clevis-luks-askpass after
 network-online.target

When Tang bindings are present, rd.neednet=1 is set to bring up the
network in the initramfs, but clevis-luks-askpass.path has no ordering
dependency on network-online.target. This means systemd can activate
the askpass path unit before the network is ready, causing curl to fail
when contacting the Tang server.

Install a systemd drop-in for clevis-luks-askpass.path that adds
After=network-online.target and Wants=network-online.target, ensuring
the network is online before clevis attempts to decrypt via Tang.
---
 src/luks/dracut/clevis-pin-tang/module-setup.sh.in | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
index 364f866f..2368cb1e 100755
--- a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
+++ b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
@@ -37,6 +37,16 @@ have_tang_bindings() {
 install() {
     if [ "${hostonly_cmdline}" = "yes" ] && have_tang_bindings; then
         echo "rd.neednet=1" > "${initdir}/etc/cmdline.d/99clevis-pin-tang.conf"
+
+        if dracut_module_included "systemd"; then
+            # shellcheck disable=SC2154 # $systemdsystemunitdir is a dracut variable
+            mkdir -p "${initdir}/${systemdsystemunitdir}/clevis-luks-askpass.path.d"
+            cat > "${initdir}/${systemdsystemunitdir}/clevis-luks-askpass.path.d/network-online.conf" <<EOF
+[Unit]
+After=network-online.target
+Wants=network-online.target
+EOF
+        fi
     fi
 
     inst_multiple \

From 36e0c57b981134c6b42b4c7648865b459915e42d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
Date: Thu, 18 Jun 2026 15:09:08 +0200
Subject: [PATCH 2/3] dracut/tang: Harden the search for "tang" bounded devices

Let's say in the future that we have another PIN and we can write something
like "tango" in its configuration, we don't want it to match there.
---
 src/luks/dracut/clevis-pin-tang/module-setup.sh.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
index 2368cb1e..5bed4bed 100755
--- a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
+++ b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
@@ -27,7 +27,7 @@ have_tang_bindings() {
     . clevis-luks-common-functions
     local dev
     for dev in $(clevis_devices_to_unlock "list-open-devices"); do
-        if clevis luks list -d "${dev}" -p | grep -q tang; then
+        if clevis luks list -d "${dev}" -p | grep -qw tang; then
             return 0
         fi
     done

From 3c996caa0a4963bcb26c001705cc6104db74ab6b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
Date: Thu, 18 Jun 2026 15:51:40 +0200
Subject: [PATCH 3/3] dracut/tang: Fix have_tang_bindings failure with multiple
 tang slots

Dracut sets 'set -o pipefail'. When have_tang_bindings runs
'clevis luks list -d DEV -p | grep -qw tang' on a device with
multiple tang slots, grep -q exits after matching the first slot,
closing the pipe. The still-running clevis luks list then gets
SIGPIPE when writing the second slot, exiting with code 141.
With pipefail, the pipeline returns 141 instead of 0, causing
have_tang_bindings to return 1 even though tang bindings exist.

This means rd.neednet=1 is never written to the initramfs, so
NetworkManager is never started, and clevis cannot reach the
Tang server to unlock the LUKS volume.

Fix by capturing the output in a variable first, then grepping
on the variable, avoiding the pipeline and SIGPIPE entirely.
---
 src/luks/dracut/clevis-pin-tang/module-setup.sh.in | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
index 5bed4bed..431ac684 100755
--- a/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
+++ b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in
@@ -25,9 +25,10 @@ depends() {
 
 have_tang_bindings() {
     . clevis-luks-common-functions
-    local dev
+    local dev bindings
     for dev in $(clevis_devices_to_unlock "list-open-devices"); do
-        if clevis luks list -d "${dev}" -p | grep -qw tang; then
+        bindings="$(clevis luks list -d "${dev}" -p 2>/dev/null)" || :
+        if echo "${bindings}" | grep -qw tang; then
             return 0
         fi
     done