Don't load passwords unless a build is needed

This change allows setting password files to be readable only by root
for added security.  Additionally, if encryption is requested and no
passphrase file exists, the user will not be prompted to enter a
passphrase unless the mkosi invocation results in an image build.

diff --git a/mkosi/__init__.py b/mkosi/__init__.py
index 62757b7d39567cb397740958379160a82411a7a1..8d9229ee3aeab11bf85025cf4e5db487ed7c2fb1 100644 (file)
--- a/mkosi/__init__.py
+++ b/mkosi/__init__.py
@@ -6201,7 +6201,7 @@ def require_private_file(name: str, description: str) -> None:
 
 
 def find_passphrase(args: argparse.Namespace) -> None:
-    if args.encrypt is None:
+    if not needs_build(args) or args.encrypt is None:
         args.passphrase = None
         return
 
@@ -6222,7 +6222,7 @@ def find_passphrase(args: argparse.Namespace) -> None:
 
 
 def find_password(args: argparse.Namespace) -> None:
-    if args.password is not None:
+    if not needs_build(args) or args.password is not None:
         return
 
     try:
@@ -6338,8 +6338,6 @@ def load_args(args: argparse.Namespace) -> MkosiArgs:
 
     find_extra(args)
     find_skeleton(args)
-    find_password(args)
-    find_passphrase(args)
     find_secure_boot(args)
     find_image_version(args)
 
@@ -6611,6 +6609,10 @@ def load_args(args: argparse.Namespace) -> MkosiArgs:
                 "UEFI SecureBoot or signed Verity enabled, but couldn't find certificate. (Consider placing it in mkosi.secure-boot.crt?)"
             )  # NOQA: E501
 
+    # Resolve passwords late so we can accurately determine whether a build is needed
+    find_password(args)
+    find_passphrase(args)
+
     if args.verb in (Verb.shell, Verb.boot):
         opname = "acquire shell" if args.verb == Verb.shell else "boot"
         if args.output_format in (OutputFormat.tar, OutputFormat.cpio):