cvm-encrypt-image - Man Page

manual page for cvm-encrypt-image 0.3.2

Description

usage: python -m cvmutils.cvmencryptimage [-h] [-n NBDDEV] [-v]

[--no-cloud-init]

[--encryption-password ENCRYPTION_PASSWORD] [--encrypt-progress-json ENCRYPT_PROGRESS_JSON] [-g] [-s SRKPUB] [-u SRKUNIQUE] [-r RECOVERY_KEY] [--recovery-key-type {binary,text,both}] [--noswtpm] [--pcr4 PCR4] [--pcr7 PCR7] [--nosecureboot] [--pcrs-json PCRS_JSON] [--efivars-profile EFIVARS_PROFILE | --uefi-profile UEFI_PROFILE | --az-disk-profile AZ_DISK_PROFILE] [--efivars-profile-no-attrs] [--seal-type SEAL_TYPE] [--secureboot-cert SECUREBOOT_CERT] [--secureboot-key SECUREBOOT_KEY] [--volatile-overlay] {encrypt,encrypt-resume,deploy,makeverity} image

Prepare OS Image for Confidential Environments

positional arguments

{encrypt,encrypt-resume,deploy,makeverity}

Main action

image

image file (VHD, QCOW2) or a block device

options

-h, --help

show this help message and exit

-n, --nbddev NBDDEV

NBD device number, defaults to 0

-v, --verbose

Print additional info

--no-cloud-init

Do not create /cc_growpart_keydata and LUKS keyslot for root volume resize (encrypt only)

--encryption-password ENCRYPTION_PASSWORD

Use the specified temporary password for LUKS encryption instead of a randomly generated one (encrypt/deploy/encrypt-resume)

--encrypt-progress-json ENCRYPT_PROGRESS_JSON

Write encryption progress to a file or use "-" for stdout ("cryptsetup-reencrypt --progress-json", encrypt/encrypt-resume only)

-g, --growpart

Grow root partition to the size of the volume (encrypt only)

-s, --srkpub SRKPUB

SRK public part ('systemd-analyze srk', deploy only)

-u, --srkunique SRKUNIQUE

DEPRECATED

-r, --recovery-key RECOVERY_KEY

Recovery key file (deploy only, adds an additional passphrase to root volume)

--recovery-key-type {binary,text,both}

Recovery key type

--noswtpm

DEPRECATED

--pcr4 PCR4

Expected PCR4 sha256 value for root volume key sealing (deploy only, sha256 or "auto")

--pcr7 PCR7

Expected PCR7 sha256 value for root volume key sealing (deploy only, sha256 or "auto")

--nosecureboot

Do PCR prediction with SecureBoot disabled (deploy only)

--pcrs-json PCRS_JSON

DEPRECATED

--efivars-profile EFIVARS_PROFILE

UEFI profile (PK, KEK, db, dbx) efivars-format dir (e.g. /sys/firmware/efi/efivars)) for "--pcr7 auto" (deploy only)

--uefi-profile UEFI_PROFILE

UEFI profile (PK, KEK, db, dbx) JSON for "--pcr7 auto" (deploy only)

--az-disk-profile AZ_DISK_PROFILE

Azure disk profile JSON for "--pcr7 auto" (deploy only)

--efivars-profile-no-attrs

The UEFI profile efivars-format files do not include the 4-byte attribute header (--efivars-profile only)

--seal-type SEAL_TYPE

DEPRECATED

--secureboot-cert SECUREBOOT_CERT

SecureBoot certificate (PEM) to sign UKI addon (makeverity only)

--secureboot-key SECUREBOOT_KEY

SecureBoot key (PEM) to sign UKI addon (makeverity only)

--volatile-overlay

Add systemd.volatile=overlay to the UKI cmdline for read-write experience (makeverity only)

Author

Vitaly Kuznetsov <vkuznets@redhat.com>

Reporting Bugs

Report bugs to https://gitlab.com/vkuznets/cvmutils

Info

May 2026 cvm-encrypt-image 0.3.2