refactor: encrypt EMWP with native Go XTS instead of cryptsetup

[milesdai]

Replace the cryptsetup/device-mapper EMWP encryption path with a pure-Go AES-XTS-plain64 implementation (new crypt package) that streams the ciphertext directly into the GPT image.

Encrypting in userspace lets the packer drop:

• the --privileged container (no loop device or device-mapper at pack time)
• the derived volume key written to a temp file in the output dir
• the global /dev/mapper name and its cleanup/collision races

VerifyEMWP now decrypts in Go and runs veritysetup verify over the plaintext.

To maintain parity with the kernel, we keep a golden test vector and add a kernel round-trip test that ensures the encrypted volume can be opened with dmcrypt.

---

Summary by cubic

Encrypt EMWP with a native Go AES-XTS-plain64 implementation that streams directly into the GPT image, replacing cryptsetup/device-mapper. Pack and verify now run unprivileged, avoid loop/dev-mapper and on-disk keys, and remain byte-identical to dm-crypt.

• Refactors

  • Added crypt package: pure-Go AES-XTS-plain64 (4096-byte sectors) with streaming Encrypt/Decrypt using golang.org/x/crypto/xts; pads trailing partial sector on encrypt and enforces alignment on decrypt.
  • wrap.encryptEMWP streams ciphertext into the payload partition; VerifyEMWP decrypts in Go to a temp file and runs verity over plaintext.
  • Removed device-mapper path: no /dev/mapper, no temp volume key file, and no --privileged in launcher/CLI/e2e; tests assert this.
  • Tests: dm-crypt golden vector and streaming parity; kernel round-trip opens Go-encrypted volumes with cryptsetup, compares plaintext bytes, and verifies dm-verity.

• Migration

  • If running the packer in Docker, remove --privileged. No loop devices or device-mapper are required at pack time.

^{Written for commit 407e961. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 13 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>