Adding debian version 2:2.6.1-6.debian/2%2.6.1-6

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

42 files changed, 3570 insertions, 0 deletions

diff --git a/debian/tests/control b/debian/tests/control
new file mode 100644
index 0000000..52752a3
--- /dev/null
+++ b/debian/tests/control
@@ -0,0 +1,133 @@
+# Run the installed binaries and libraries through the full upstream test suite.
+Features: test-name=upstream-testsuite
+Test-Command: make -C ./tests -f Makefile.localtest -j tests CRYPTSETUP_PATH=/sbin TESTSUITE_NOSKIP=y
+Depends: cryptsetup-bin,
+# to compile tests/*.c
+  gcc,
+  libcryptsetup-dev,
+  libdevmapper-dev,
+#
+# for hexdump(1)
+  bsdextrautils,
+# for dmsetup(8)
+  dmsetup,
+# for expect(1)
+  expect,
+# for jq(1)
+  jq,
+# for keyctl(1)
+  keyutils,
+# for modprobe(8) and rmmod(8)
+  kmod,
+# for free(1)
+  procps,
+# for uuencode(1)
+  sharutils,
+# for xxd(1)
+  xxd
+#
+# Use machine-level isolation since some extra tests want to interact
+# with the kernel, load modules, and create/remove loop devices
+Restrictions: allow-stderr, needs-root, isolation-machine, rw-build-tree
+
+# Run ./tests/ssh-test-plugin on its own since it has its own dependency set.
+Features: test-name=ssh-test-plugin
+Test-Command: cd ./tests && CRYPTSETUP_PATH=/sbin TESTSUITE_NOSKIP=y RUN_SSH_PLUGIN_TEST=y ./ssh-test-plugin
+Depends: cryptsetup-bin,
+         cryptsetup-ssh,
+         netcat-openbsd,
+         openssh-client,
+         openssh-server,
+         openssl,
+         sshpass
+Restrictions: needs-root, isolation-machine
+
+
+Tests: cryptdisks, cryptdisks.init
+Depends: cryptsetup, xxd
+Restrictions: allow-stderr, needs-root, isolation-machine
+
+# This test doesn't replace the cryptroot-* tests below which mock a
+# complete system incl. unlocking at initramfs stage, but it's also
+# significantly faster so we use it for crude checks of our initramfs
+# hook and the initramfs image itself.
+Tests: initramfs-hook
+Depends: cryptsetup-initramfs, e2fsprogs, zstd
+Restrictions: allow-stderr, needs-root, isolation-machine
+
+Tests: cryptroot-lvm, cryptroot-legacy
+# Only dependencies required to set the VM here are listed here;
+# cryptsetup is not listed since we only install it in the VM.
+Depends: cryptsetup-bin,
+         dosfstools [arm64 armhf],
+         fdisk,
+         genext2fs,
+         initramfs-tools-core,
+         libjson-perl,
+         lvm2,
+         qemu-efi-aarch64 [arm64],
+         qemu-efi-arm [armhf],
+         qemu-system-arm [arm64 armhf] | qemu-system-x86 [amd64 i386] | qemu-system,
+         udev
+# We only need root to create /dev/kvm, really.  And while it works
+# locally and on debci, it doesn't work on salsa CI..
+Restrictions: allow-stderr, needs-root
+Architecture: amd64 i386
+
+Tests: cryptroot-md
+Depends: cryptsetup-bin,
+         dosfstools [arm64 armhf],
+         fdisk,
+         genext2fs,
+         initramfs-tools-core,
+         libjson-perl,
+         lvm2,
+         mdadm,
+         qemu-efi-aarch64 [arm64],
+         qemu-efi-arm [armhf],
+         qemu-system-arm [arm64 armhf] | qemu-system-x86 [amd64 i386] | qemu-system,
+         udev
+Restrictions: allow-stderr, needs-root
+Architecture: amd64 i386
+
+Tests: cryptroot-nested
+Depends: btrfs-progs,
+         cryptsetup-bin,
+         dosfstools [arm64 armhf],
+         fdisk,
+         genext2fs,
+         initramfs-tools-core,
+         libjson-perl,
+         lvm2,
+         mdadm,
+         qemu-efi-aarch64 [arm64],
+         qemu-efi-arm [armhf],
+         qemu-system-arm [arm64 armhf] | qemu-system-x86 [amd64 i386] | qemu-system,
+         udev
+Restrictions: allow-stderr, needs-root
+Architecture: amd64 i386
+
+Tests: cryptroot-sysvinit
+Depends: cryptsetup-bin,
+         dosfstools [arm64 armhf],
+         fdisk,
+         genext2fs,
+         initramfs-tools-core,
+         libjson-perl,
+         qemu-efi-aarch64 [arm64],
+         qemu-efi-arm [armhf],
+         qemu-system-arm [arm64 armhf] | qemu-system-x86 [amd64 i386] | qemu-system,
+         udev
+Restrictions: allow-stderr, needs-root
+Architecture: amd64 i386
+
+# Dummy test so that kernel updates trigger our other autopkgtests on debci
+Features: test-name=hint-testsuite-triggers
+Test-Command: false
+Depends: linux-image-generic,
+         linux-image-amd64 [amd64],
+         linux-image-arm64 [arm64],
+         linux-image-armmp-lpae [armhf],
+         linux-image-686-pae [i386]
+Restrictions: hint-testsuite-triggers
+Architecture: amd64 i386
diff --git a/debian/tests/cryptdisks b/debian/tests/cryptdisks
new file mode 100755
index 0000000..3d3223b
--- /dev/null
+++ b/debian/tests/cryptdisks
@@ -0,0 +1,764 @@
+#!/bin/bash
+
+set -eux
+PATH="/usr/bin:/bin:/usr/sbin:/sbin"
+export PATH
+
+TMPDIR="$AUTOPKGTEST_TMP"
+
+# wrappers
+luks1Format() {
+    cryptsetup luksFormat --batch-mode --type=luks1 \
+        --pbkdf-force-iterations=1000 \
+        "$@"
+}
+luks2Format() {
+    cryptsetup luksFormat --batch-mode --type=luks2 \
+        --pbkdf=argon2id --pbkdf-force-iterations=4 --pbkdf-memory=32 \
+        "$@"
+}
+diff() { command diff --color=auto --text "$@"; }
+
+# create disk image
+CRYPT_IMG="$TMPDIR/disk.img"
+CRYPT_DEV=""
+install -m0600 /dev/null "$TMPDIR/keyfile"
+disk_setup() {
+    local lo
+    for lo in $(losetup -j "$CRYPT_IMG" | cut -sd: -f1); do
+        losetup -d "$lo"
+    done
+    dd if="/dev/zero" of="$CRYPT_IMG" bs=1M count=64
+    CRYPT_DEV="$(losetup --find --show -- "$CRYPT_IMG")"
+}
+
+
+#######################################################################
+# make sure empty passphrases are NEVER accepted
+
+disk_setup
+! cryptsetup luksFormat "$CRYPT_DEV" </dev/null || exit 1
+! blkid -p "$CRYPT_DEV" || exit 1
+
+! echo -n "" | cryptsetup luksFormat "$CRYPT_DEV" - || exit 1
+! blkid -p "$CRYPT_DEV" || exit 1
+
+! cryptsetup luksFormat --batch-mode "$CRYPT_DEV" /dev/null || exit 1
+! blkid -p "$CRYPT_DEV" || exit 1
+
+! cryptsetup luksFormat --batch-mode "$CRYPT_DEV" </dev/null || exit 1
+! blkid -p "$CRYPT_DEV" || exit 1
+
+! echo -n "" | luks2Format "$CRYPT_DEV" - || exit 1
+! blkid -p "$CRYPT_DEV" || exit 1
+
+
+#######################################################################
+# LUKS
+
+# interactive
+disk_setup
+cat /proc/sys/kernel/random/uuid >"$TMPDIR/passphrase"
+luks2Format -- "$CRYPT_DEV" <"$TMPDIR/passphrase"
+t="$(blkid -s TYPE -o value -- "$CRYPT_DEV")"
+test "$t" = "crypto_LUKS"
+
+cat >/etc/crypttab <<-EOF
+	test0_crypt $CRYPT_DEV none
+EOF
+cryptdisks_start test0_crypt </dev/tty & pid=$!
+
+# check command line and environment
+until [ -p /lib/cryptsetup/passfifo ]; do sleep 1; done
+pid2="$(find /proc/[0-9]* -mindepth 1 -maxdepth 1 -name "exe" \
+    -execdir sh -euc 'diff -q -- "$0" /usr/lib/cryptsetup/askpass >/dev/null' {} \; \
+    -print 2>/dev/null | cut -sd/ -f3)"
+test -n "$pid2"
+printf '%s\0Please unlock disk %s: \0' /lib/cryptsetup/askpass test0_crypt >"$TMPDIR/cmdline"
+diff -u --label=a/cmdline --label=b/cmdline -- "$TMPDIR/cmdline" "/proc/$pid2/cmdline"
+tr '\n' '\0' >"$TMPDIR/environ" <<-EOF
+	CRYPTTAB_NAME=test0_crypt
+	CRYPTTAB_OPTIONS=
+	CRYPTTAB_SOURCE=$CRYPT_DEV
+	CRYPTTAB_TRIED=0
+	_CRYPTTAB_NAME=test0_crypt
+	_CRYPTTAB_OPTIONS=
+	_CRYPTTAB_SOURCE=$CRYPT_DEV
+EOF
+grep -Ez "^_?CRYPTTAB_" <"/proc/$pid2/environ" | sort -z | diff -u --label=a/environ --label=b/environ -- "$TMPDIR/environ" -
+
+# unlock device
+tr -d '\n' <"$TMPDIR/passphrase" >/lib/cryptsetup/passfifo # remove trailing newline
+wait $pid
+stty sane || true
+test -b /dev/mapper/test0_crypt
+
+# check default cipher (if it changes we probably want to update the doc and revise some scripts)
+cipher="$(dmsetup table --target=crypt test0_crypt | cut -d" " -f4)"
+test "$cipher" = "aes-xts-plain64"
+
+# make sure the kernel keyring is used by default for the encryption key
+key="$(dmsetup table --target=crypt test0_crypt | cut -d" " -f5)"
+test "${key:0:21}" = ":64:logon:cryptsetup:"
+
+cryptdisks_stop test0_crypt
+
+# remove trailing newline and unlock via key file
+tr -d '\n' <"$TMPDIR/passphrase" >"$TMPDIR/keyfile"
+cat >/etc/crypttab <<-EOF
+	test0_crypt $CRYPT_DEV $TMPDIR/keyfile
+EOF
+cryptdisks_start test0_crypt
+test -b /dev/mapper/test0_crypt
+cryptdisks_stop test0_crypt
+
+# special characters
+ln -sT -- keyfile "$TMPDIR/key fi:le"
+cat >/etc/crypttab <<-EOF
+	test0\\0045crypt $CRYPT_DEV $TMPDIR/key\\0040fi\\0072le
+EOF
+cryptdisks_start "test0%crypt"
+dmsetup table --target=crypt "test0%crypt" | cut -d" " -f5 | grep -F ":64:logon:cryptsetup:" # name in /dev/mapper is probably mangled
+cryptdisks_stop "test0%crypt"
+
+
+#######################################################################
+# cipher=, size= (plain)
+
+disk_setup
+head -c32 </dev/urandom >"$TMPDIR/keyfile"
+cat >/etc/crypttab <<-EOF
+	plain_crypt $CRYPT_DEV $TMPDIR/keyfile plain,cipher=twofish-cbc-essiv:sha256,size=256
+EOF
+
+cryptdisks_start plain_crypt
+test -b /dev/mapper/plain_crypt
+
+# check cipher
+cipher="$(dmsetup table --target=crypt plain_crypt | cut -d" " -f4)"
+test "$cipher" = "twofish-cbc-essiv:sha256"
+
+# check encryption key
+xxd -ps -c256 "$TMPDIR/keyfile" >"$TMPDIR/keyfile-hex"
+dmsetup table --target=crypt --showkeys plain_crypt | cut -d" " -f5 | \
+    diff --label=a/key --label=b/key "$TMPDIR/keyfile-hex" -
+
+cryptdisks_stop plain_crypt
+
+
+#######################################################################
+# sector-size=
+
+disk_setup
+cat >/etc/crypttab <<-EOF
+	sector_crypt $CRYPT_DEV /dev/urandom plain,cipher=aes-cbc-essiv:sha256,size=256,sector-size=4096
+EOF
+
+cryptdisks_start sector_crypt
+test -b /dev/mapper/sector_crypt
+
+dmsetup table --target=crypt sector_crypt | cut -d" " -f10- | grep -Fw "sector_size:4096"
+
+cryptdisks_stop sector_crypt
+
+
+#######################################################################
+# hash= (interactive, ignored with keyfile)
+
+disk_setup
+cat /proc/sys/kernel/random/uuid >"$TMPDIR/passphrase"
+cat >/etc/crypttab <<-EOF
+	hash_crypt $CRYPT_DEV none plain,cipher=aes-cbc-essiv:sha256,size=256,hash=sha256
+EOF
+
+cryptdisks_start hash_crypt </dev/tty & pid=$!
+until [ -p /lib/cryptsetup/passfifo ]; do sleep 1; done
+tr -d '\n' <"$TMPDIR/passphrase" >/lib/cryptsetup/passfifo # remove trailing newline
+wait $pid
+stty sane || true
+test -b /dev/mapper/hash_crypt
+
+# check encryption key
+tr -d '\n' <"$TMPDIR/passphrase" | sha256sum | cut -d" " -f1 >"$TMPDIR/passphrase-hash"
+dmsetup table --target=crypt --showkeys hash_crypt | cut -d" " -f5 | \
+    diff --label=a/key --label=b/key "$TMPDIR/passphrase-hash" -
+cryptdisks_stop hash_crypt
+
+
+#######################################################################
+# offset=, skip=
+
+offset=2048 # in 512 byte sectors
+skip=256    # in 512 byte sectors
+disk_setup
+cat >/etc/crypttab <<-EOF
+	offset_crypt $CRYPT_DEV /dev/urandom plain,cipher=aes-cbc-essiv:sha256,size=256,offset=$offset,skip=$skip
+EOF
+
+# having an existing file system before the offset has no effect (cf. #994056)
+dmsetup create hidden --table "0 $offset linear $CRYPT_DEV 0"
+mke2fs -t ext2 -m0 -Fq /dev/mapper/hidden
+u="$(blkid -p -s UUID -o value /dev/mapper/hidden)"
+dd if=/dev/mapper/hidden of="$TMPDIR/hidden.img" bs=512
+dmsetup remove hidden
+u2="$(blkid -p -s UUID -o value -- "$CRYPT_DEV")"
+test "$u" = "$u2"
+
+cryptdisks_start offset_crypt
+test -b /dev/mapper/offset_crypt
+
+# check offset and skip values
+offset2="$(dmsetup table --target=crypt offset_crypt | cut -d" " -f8)" && test $offset -eq $offset2
+skip2="$(  dmsetup table --target=crypt offset_crypt | cut -d" " -f6)" && test $skip   -eq $skip2
+
+# ensure that the first 2048 sectors (only) are left zeroed out
+dd if=/dev/zero of=/dev/mapper/offset_crypt bs=1M || true
+cryptdisks_stop offset_crypt
+
+dd if="$CRYPT_DEV" of="$TMPDIR/hidden2.img" bs=512 count="$offset"
+command diff -q -- "$TMPDIR/hidden.img" "$TMPDIR/hidden2.img" || exit 1
+! xxd -l32 -s$((offset*512)) -ps -c32 <"$CRYPT_DEV" | grep -Fxq 0000000000000000000000000000000000000000000000000000000000000000
+rm -f -- "$TMPDIR/hidden.img" "$TMPDIR/hidden2.img"
+
+
+#######################################################################
+# keyfile-offset=, keyfile-size=
+
+disk_setup
+head -c32 </dev/urandom >"$TMPDIR/keyfile"
+luks2Format -- "$CRYPT_DEV" "$TMPDIR/keyfile"
+install -m0600 /dev/null "$TMPDIR/keyfile2"
+
+# keyfile-offset=
+head -c1024 </dev/urandom >"$TMPDIR/keyfile2"
+cat "$TMPDIR/keyfile" >>"$TMPDIR/keyfile2"
+cat >/etc/crypttab <<-EOF
+	keyfile_crypt $CRYPT_DEV $TMPDIR/keyfile2 keyfile-offset=1024
+EOF
+cryptdisks_start keyfile_crypt
+test -b /dev/mapper/keyfile_crypt
+cryptdisks_stop keyfile_crypt
+
+# keyfile-size=
+cat "$TMPDIR/keyfile" >"$TMPDIR/keyfile2"
+head -c1024 </dev/urandom >>"$TMPDIR/keyfile2"
+cat >/etc/crypttab <<-EOF
+	keyfile_crypt $CRYPT_DEV $TMPDIR/keyfile2 keyfile-size=32
+EOF
+cryptdisks_start keyfile_crypt
+test -b /dev/mapper/keyfile_crypt
+cryptdisks_stop keyfile_crypt
+
+# keyfile-offset= + keyfile-size=
+head -c32 </dev/urandom >"$TMPDIR/keyfile2"
+cat "$TMPDIR/keyfile" >>"$TMPDIR/keyfile2"
+head -c32 </dev/urandom >>"$TMPDIR/keyfile2"
+cat >/etc/crypttab <<-EOF
+	keyfile_crypt $CRYPT_DEV $TMPDIR/keyfile2 keyfile-offset=32,keyfile-size=32
+EOF
+cryptdisks_start keyfile_crypt
+test -b /dev/mapper/keyfile_crypt
+cryptdisks_stop keyfile_crypt
+
+# make sure the key isn't valid without offset and size
+cat >/etc/crypttab <<-EOF
+	keyfile_crypt $CRYPT_DEV $TMPDIR/keyfile2
+EOF
+! cryptdisks_start keyfile_crypt
+test ! -b /dev/mapper/keyfile_crypt
+rm -vf -- "$TMPDIR/keyfile2"
+
+
+#######################################################################
+# key-slot=
+
+disk_setup
+head -c32 </dev/urandom >"$TMPDIR/keyfile"
+luks2Format --key-slot=0 -- "$CRYPT_DEV" "$TMPDIR/keyfile"
+
+install -m0600 /dev/null "$TMPDIR/keyfile2"
+head -c32 </dev/urandom >"$TMPDIR/keyfile2"
+cryptsetup luksAddKey --key-file="$TMPDIR/keyfile" \
+    --pbkdf=pbkdf2 --pbkdf-force-iterations=1000 \
+    --key-slot=1 -- "$CRYPT_DEV" "$TMPDIR/keyfile2"
+
+cryptsetup luksOpen --test-passphrase --key-file="$TMPDIR/keyfile"  --key-slot=0 -- "$CRYPT_DEV"
+cryptsetup luksOpen --test-passphrase --key-file="$TMPDIR/keyfile2" --key-slot=1 -- "$CRYPT_DEV"
+
+# use slot #1 after trying #0
+cat >/etc/crypttab <<-EOF
+	keyslot_crypt $CRYPT_DEV $TMPDIR/keyfile2
+EOF
+cryptdisks_start keyslot_crypt
+test -b /dev/mapper/keyslot_crypt
+cryptdisks_stop keyslot_crypt
+
+# use wrong slot #0
+cat >/etc/crypttab <<-EOF
+	keyslot_crypt $CRYPT_DEV $TMPDIR/keyfile2 key-slot=0
+EOF
+! cryptdisks_start keyslot_crypt
+test ! -b /dev/mapper/keyslot_crypt
+
+# use right slot #1
+cat >/etc/crypttab <<-EOF
+	keyslot_crypt $CRYPT_DEV $TMPDIR/keyfile2 key-slot=1
+EOF
+cryptdisks_start keyslot_crypt
+test -b /dev/mapper/keyslot_crypt
+cryptdisks_stop keyslot_crypt
+rm -f -- "$TMPDIR/keyfile2"
+
+
+#######################################################################
+# header=
+
+disk_setup
+head -c32 </dev/urandom >"$TMPDIR/keyfile"
+luks2Format --header="$TMPDIR/crypt_img.hdr" -- "$CRYPT_DEV" "$TMPDIR/keyfile"
+test -f "$TMPDIR/crypt_img.hdr"
+
+# make sure the signature is on the header only
+t="$(blkid -s TYPE -o value -- "$TMPDIR/crypt_img.hdr")"
+test "$t" = "crypto_LUKS"
+! blkid -p -- "$CRYPT_DEV"
+
+# make sure we can't unlock without the header
+cat >/etc/crypttab <<-EOF
+	header_crypt $CRYPT_DEV $TMPDIR/keyfile luks
+EOF
+! cryptdisks_start header_crypt
+test ! -b /dev/mapper/header_crypt
+
+# unlock using the header
+cat >/etc/crypttab <<-EOF
+	header_crypt $CRYPT_DEV $TMPDIR/keyfile header=$TMPDIR/crypt_img.hdr
+EOF
+cryptdisks_start header_crypt
+test -b /dev/mapper/header_crypt
+cryptdisks_stop header_crypt
+rm -f -- "$TMPDIR/crypt_img.hdr"
+
+
+#######################################################################
+# readonly
+
+disk_setup
+head -c32 </dev/urandom >"$TMPDIR/keyfile"
+luks2Format -- "$CRYPT_DEV" "$TMPDIR/keyfile"
+
+# unlock readonly from crypttab(5)
+cat >/etc/crypttab <<-EOF
+	readonly_crypt $CRYPT_DEV $TMPDIR/keyfile readonly
+EOF
+cryptdisks_start readonly_crypt
+test -b /dev/mapper/readonly_crypt
+dm="$(readlink -e "/dev/mapper/readonly_crypt")"
+ro="$(< "/sys/block/${dm##*/}/ro")"
+test "$ro" -eq 1
+cryptdisks_stop readonly_crypt
+
+# unlock readonly with --readonly
+cat >/etc/crypttab <<-EOF
+	readonly_crypt $CRYPT_DEV $TMPDIR/keyfile
+EOF
+cryptdisks_start --readonly readonly_crypt
+test -b /dev/mapper/readonly_crypt
+dm="$(readlink -e "/dev/mapper/readonly_crypt")"
+ro="$(< "/sys/block/${dm##*/}/ro")"
+test "$ro" -eq 1
+cryptdisks_stop readonly_crypt
+
+# double check that default is read-write
+cryptdisks_start readonly_crypt
+test -b /dev/mapper/readonly_crypt
+dm="$(readlink -e "/dev/mapper/readonly_crypt")"
+ro="$(< "/sys/block/${dm##*/}/ro")"
+test "$ro" -eq 0
+cryptdisks_stop readonly_crypt
+
+
+#######################################################################
+# tries=
+
+disk_setup
+head -c32 </dev/urandom >"$TMPDIR/keyfile"
+luks2Format -- "$CRYPT_DEV" "$TMPDIR/keyfile"
+
+# fail after 3 tries default
+cat >/etc/crypttab <<-EOF
+	tries_crypt $CRYPT_DEV none
+EOF
+
+cryptdisks_start tries_crypt </dev/tty & pid=$!
+echo -n bad1 >/lib/cryptsetup/passfifo
+sleep 1
+echo -n bad2 >/lib/cryptsetup/passfifo
+sleep 1
+echo -n bad3 >/lib/cryptsetup/passfifo
+! wait $pid
+stty sane || true
+test ! -b /dev/mapper/tries_crypt
+
+# success on the 3rd try
+cryptdisks_start tries_crypt </dev/tty & pid=$!
+echo -n bad1 >/lib/cryptsetup/passfifo
+sleep 1
+echo -n bad2 >/lib/cryptsetup/passfifo
+sleep 1
+cat <"$TMPDIR/keyfile" >/lib/cryptsetup/passfifo
+wait $pid
+stty sane || true
+test -b /dev/mapper/tries_crypt
+cryptdisks_stop tries_crypt
+
+# force single try
+cat >/etc/crypttab <<-EOF
+	tries_crypt $CRYPT_DEV none tries=1
+EOF
+
+cryptdisks_start tries_crypt </dev/tty & pid=$!
+echo -n bad1 >/lib/cryptsetup/passfifo
+! wait $pid
+stty sane || true
+test ! -b /dev/mapper/tries_crypt
+
+cryptdisks_start tries_crypt </dev/tty & pid=$!
+cat <"$TMPDIR/keyfile" >/lib/cryptsetup/passfifo
+wait $pid
+stty sane || true
+test -b /dev/mapper/tries_crypt
+cryptdisks_stop tries_crypt
+
+
+#######################################################################
+# discard
+
+disk_setup
+head -c32 </dev/urandom >"$TMPDIR/keyfile"
+luks2Format -- "$CRYPT_DEV" "$TMPDIR/keyfile"
+
+cat >/etc/crypttab <<-EOF
+	flagopt_crypt $CRYPT_DEV $TMPDIR/keyfile discard
+EOF
+
+cryptdisks_start flagopt_crypt
+dmsetup table --target=crypt flagopt_crypt | cut -d" " -f10- | grep -Fw "allow_discards"
+cryptdisks_stop flagopt_crypt
+
+
+#######################################################################
+# same-cpu-crypt
+
+cat >/etc/crypttab <<-EOF
+	flagopt_crypt $CRYPT_DEV $TMPDIR/keyfile same-cpu-crypt
+EOF
+
+cryptdisks_start flagopt_crypt
+dmsetup table --target=crypt flagopt_crypt | cut -d" " -f10- | grep -Fw "same_cpu_crypt"
+cryptdisks_stop flagopt_crypt
+
+
+#######################################################################
+# submit-from-crypt-cpus
+
+cat >/etc/crypttab <<-EOF
+	flagopt_crypt $CRYPT_DEV $TMPDIR/keyfile submit-from-crypt-cpus
+EOF
+
+cryptdisks_start flagopt_crypt
+dmsetup table --target=crypt flagopt_crypt | cut -d" " -f10- | grep -Fw "submit_from_crypt_cpus"
+cryptdisks_stop flagopt_crypt
+
+
+#######################################################################
+# no-read-workqueue
+
+cat >/etc/crypttab <<-EOF
+	flagopt_crypt $CRYPT_DEV $TMPDIR/keyfile no-read-workqueue
+EOF
+
+cryptdisks_start flagopt_crypt
+dmsetup table --target=crypt flagopt_crypt | cut -d" " -f10- | grep -Fw "no_read_workqueue"
+cryptdisks_stop flagopt_crypt
+
+
+#######################################################################
+# no-write-workqueue
+
+cat >/etc/crypttab <<-EOF
+	flagopt_crypt $CRYPT_DEV $TMPDIR/keyfile no-write-workqueue
+EOF
+
+cryptdisks_start flagopt_crypt
+dmsetup table --target=crypt flagopt_crypt | cut -d" " -f10- | grep -Fw "no_write_workqueue"
+cryptdisks_stop flagopt_crypt
+
+
+#######################################################################
+# swap
+
+disk_setup
+cat >/etc/crypttab <<-EOF
+	swap_crypt $CRYPT_DEV /dev/urandom plain,cipher=aes-xts-plain64,size=256,swap
+EOF
+
+cryptdisks_start swap_crypt
+test -b /dev/mapper/swap_crypt
+
+t="$(blkid -s TYPE -o value /dev/mapper/swap_crypt)"
+test "$t" = "swap"
+cryptdisks_stop swap_crypt
+
+# refuse to proceed if the target contains a file system...
+head -c32 </dev/urandom >"$TMPDIR/keyfile"
+luks2Format -- "$CRYPT_DEV" "$TMPDIR/keyfile"
+
+cat >/etc/crypttab <<-EOF
+	swap_crypt  $CRYPT_DEV $TMPDIR/keyfile swap
+	swap_crypt2 $CRYPT_DEV $TMPDIR/keyfile
+EOF
+cryptdisks_start swap_crypt2
+mke2fs -t ext4 -m0 -Fq /dev/mapper/swap_crypt2
+t="$(blkid -s TYPE -o value /dev/mapper/swap_crypt2)"
+test "$t" = "ext4"
+cryptdisks_stop swap_crypt2
+
+! cryptdisks_start swap_crypt
+test ! -b /dev/mapper/swap_crypt
+
+# ... unless that's already a swap device
+cryptdisks_start swap_crypt2
+mkswap -f /dev/mapper/swap_crypt2
+t="$(blkid -s TYPE -o value /dev/mapper/swap_crypt2)"
+test "$t" = "swap"
+u="$(blkid -s UUID -o value /dev/mapper/swap_crypt2)"
+cryptdisks_stop swap_crypt2
+
+cryptdisks_start swap_crypt
+test -b /dev/mapper/swap_crypt
+t="$(blkid -s TYPE -o value /dev/mapper/swap_crypt)"
+test "$t" = "swap"
+u2="$(blkid -s UUID -o value /dev/mapper/swap_crypt)"
+test "$u" != "$u2"
+cryptdisks_stop swap_crypt
+
+
+#######################################################################
+# tmp=
+
+disk_setup
+cat >/etc/crypttab <<-EOF
+	tmp_crypt $CRYPT_DEV /dev/urandom plain,cipher=aes-xts-plain64,size=256,tmp=ext2
+EOF
+
+# run mkfs.ext2
+cryptdisks_start tmp_crypt
+test -b /dev/mapper/tmp_crypt
+
+t="$(blkid -s TYPE -o value /dev/mapper/tmp_crypt)"
+test "$t" = "ext2"
+cryptdisks_stop tmp_crypt
+
+# default type is ext4
+cat >/etc/crypttab <<-EOF
+	tmp_crypt $CRYPT_DEV /dev/urandom plain,cipher=aes-xts-plain64,size=256,tmp
+EOF
+cryptdisks_start tmp_crypt
+t="$(blkid -s TYPE -o value /dev/mapper/tmp_crypt)"
+test "$t" = "ext4"
+cryptdisks_stop tmp_crypt
+
+
+#######################################################################
+# check=
+
+disk_setup
+cat >/etc/crypttab <<-EOF
+	check_crypt $CRYPT_DEV /dev/urandom plain,cipher=aes-xts-plain64,size=256
+EOF
+
+# precheck failed: $CRYPT_DEV contains a filesystem
+mke2fs -t ext4 -m0 -Fq -- "$CRYPT_DEV"
+t="$(blkid -s TYPE -o value -- "$CRYPT_DEV")"
+test "$t" = "ext4"
+! cryptdisks_start check_crypt
+test ! -b /dev/mapper/check_crypt
+
+# precheck failed: $CRYPT_DEV contains a filesystem at the given offset (cf. #994056)
+offset=2048
+disk_setup
+cat >/etc/crypttab <<-EOF
+	check_crypt $CRYPT_DEV /dev/urandom plain,cipher=aes-xts-plain64,size=256,offset=$offset
+EOF
+
+dmsetup create hidden --table "0 4096 linear $CRYPT_DEV $offset"
+mke2fs -t ext2 -m0 -Fq /dev/mapper/hidden
+u="$(blkid -p -s UUID -o value /dev/mapper/hidden)"
+dmsetup remove hidden
+u2="$(blkid -p -O$((offset*512)) -s UUID -o value -- "$CRYPT_DEV")"
+test "$u" = "$u2"
+t="$(blkid  -p -O$((offset*512)) -s TYPE -o value -- "$CRYPT_DEV")"
+test "$t" = "ext2"
+
+! cryptdisks_start check_crypt
+test ! -b /dev/mapper/check_crypt
+
+# check failed: mapped device does not contain a known file system
+disk_setup
+head -c32 </dev/urandom >"$TMPDIR/keyfile"
+cat >/etc/crypttab <<-EOF
+	check_crypt  $CRYPT_DEV $TMPDIR/keyfile plain,cipher=aes-xts-plain64,size=256,check
+	check_crypt2 $CRYPT_DEV $TMPDIR/keyfile plain,cipher=aes-xts-plain64,size=256
+EOF
+
+! cryptdisks_start check_crypt
+test ! -b /dev/mapper/check_crypt
+
+# success
+cryptdisks_start check_crypt2
+mke2fs -t ext4 -m0 -Fq /dev/mapper/check_crypt2
+u="$(blkid -s UUID -o value /dev/mapper/check_crypt2)"
+cryptdisks_stop check_crypt2
+cryptdisks_start check_crypt
+test -b /dev/mapper/check_crypt
+u2="$(blkid -s UUID -o value /dev/mapper/check_crypt)"
+test "$u" = "$u2"
+cryptdisks_stop check_crypt
+
+# custom check
+install -m0755 -- /dev/null "$TMPDIR/check"
+cat >"$TMPDIR/check" <<-EOF
+	#!/bin/bash
+	printf '%s\\0' "\$0" >"$TMPDIR/cmdline"
+	while [ \$# -gt 0 ]; do
+	    printf '%s\\0' "\$1"
+	    shift
+	done >>"$TMPDIR/cmdline"
+	exit 0
+EOF
+
+cat >/etc/crypttab <<-EOF
+	check_crypt $CRYPT_DEV $TMPDIR/keyfile plain,cipher=aes-xts-plain64,size=256,check=$TMPDIR/check
+EOF
+cryptdisks_start check_crypt
+dm="$(readlink -e "/dev/mapper/check_crypt")"
+cryptdisks_stop check_crypt
+printf '%s\0%s\0' "$TMPDIR/check" "$dm" >"$TMPDIR/cmdline2"
+diff -u --label=a/cmdline --label=b/cmdline -- "$TMPDIR/cmdline2" "$TMPDIR/cmdline"
+
+
+#######################################################################
+# checkargs=
+
+disk_setup
+head -c32 </dev/urandom >"$TMPDIR/keyfile"
+cat >/etc/crypttab <<-EOF
+	checkargs_crypt  $CRYPT_DEV $TMPDIR/keyfile plain,cipher=aes-xts-plain64,size=256,check,checkargs=ext4
+	checkargs_crypt2 $CRYPT_DEV $TMPDIR/keyfile plain,cipher=aes-xts-plain64,size=256
+EOF
+
+# check failed: mapped device does not contain a known file system
+! cryptdisks_start checkargs_crypt
+test ! -b /dev/mapper/checkargs_crypt
+
+# check failed: mapped device is not ext4
+cryptdisks_start checkargs_crypt2
+mke2fs -t ext2 -m0 -Fq /dev/mapper/checkargs_crypt2
+cryptdisks_stop checkargs_crypt2
+! cryptdisks_start checkargs_crypt
+test ! -b /dev/mapper/checkargs_crypt
+
+# success
+cryptdisks_start checkargs_crypt2
+mke2fs -t ext4 -m0 -Fq /dev/mapper/checkargs_crypt2
+u="$(blkid -s UUID -o value /dev/mapper/checkargs_crypt2)"
+cryptdisks_stop checkargs_crypt2
+cryptdisks_start checkargs_crypt
+u2="$(blkid -s UUID -o value /dev/mapper/checkargs_crypt)"
+test "$u" = "$u2"
+test -b /dev/mapper/checkargs_crypt
+cryptdisks_stop checkargs_crypt
+
+# check failed: mapped device is not ext2
+sed -i "s/checkargs=ext4/checkargs=ext2/" /etc/crypttab
+! cryptdisks_start checkargs_crypt
+test ! -b /dev/mapper/checkargs_crypt
+
+# custom check
+cat >/etc/crypttab <<-EOF
+	checkargs_crypt $CRYPT_DEV $TMPDIR/keyfile plain,cipher=aes-xts-plain64,size=256,check=$TMPDIR/check,checkargs=foo\\0012b\\0011a\\0054r\\0040
+EOF
+cryptdisks_start checkargs_crypt
+dm="$(readlink -e "/dev/mapper/checkargs_crypt")"
+cryptdisks_stop checkargs_crypt
+printf '%s\0%s\0foo\nb\ta,r \0' "$TMPDIR/check" "$dm" >"$TMPDIR/cmdline2"
+diff -u --label=a/cmdline --label=b/cmdline -- "$TMPDIR/cmdline2" "$TMPDIR/cmdline"
+
+
+#######################################################################
+# noauto
+
+disk_setup
+head -c32 </dev/urandom >"$TMPDIR/keyfile"
+luks2Format -- "$CRYPT_DEV" "$TMPDIR/keyfile"
+
+cat >/etc/crypttab <<-EOF
+	noauto_crypt $CRYPT_DEV $TMPDIR/keyfile noauto
+EOF
+cryptdisks_start noauto_crypt
+test -b /dev/mapper/noauto_crypt
+cryptdisks_stop noauto_crypt
+
+
+#######################################################################
+# (custom) keyscript
+
+disk_setup
+head -c32 </dev/urandom >"$TMPDIR/keyfile"
+luks2Format -- "$CRYPT_DEV" "$TMPDIR/keyfile"
+
+KEYSCRIPT="$TMPDIR/decrypt_foo,bar
+b a z"
+
+# make sure we export CRYPTTAB_* as documented
+install -m0755 -- /dev/null "$KEYSCRIPT"
+cat >"$KEYSCRIPT" <<-EOF
+	#!/bin/bash
+	printf '%s\\0' "\$0" >"$TMPDIR/cmdline"
+	while [ \$# -gt 0 ]; do
+	    printf '%s\\0' "\$1"
+	    shift
+	done >>"$TMPDIR/cmdline"
+	install -m0600 "/proc/\$\$/environ" "$TMPDIR/environ"
+	cat <"$TMPDIR/keyfile"
+EOF
+
+# add extra unknown option (visible in $CRYPTTAB_OPTIONS but there is no $CRYPTTAB_OPTION_*)
+cat >/etc/crypttab <<-EOF
+	keyscript\\0045crypt $CRYPT_IMG foo\\0011bar\\0040baz nonexistent,keyscript=$TMPDIR/decrypt_foo\\0054bar\\0012b\\0040a\\0040z,luks
+EOF
+
+cryptdisks_start "keyscript%crypt"
+dmsetup table --target=crypt "keyscript%crypt" | cut -d" " -f5 | grep -F ":64:logon:cryptsetup:" # name in /dev/mapper is probably mangled
+cryptdisks_stop "keyscript%crypt"
+
+# compare command line
+printf '%s\0foo\tbar baz\0' "$KEYSCRIPT" >"$TMPDIR/cmdline2"
+diff -u --label=a/cmdline --label=b/cmdline -- "$TMPDIR/cmdline2" "$TMPDIR/cmdline"
+
+# compare environment
+tr '\n' '\0' <<-EOF | sed -rz "s|@@DECRYPT_FOOBAR@@|${KEYSCRIPT//$'\n'/"\\n"}|" >"$TMPDIR/environ2"
+	CRYPTTAB_KEY=foo	bar baz
+	CRYPTTAB_NAME=keyscript%crypt
+	CRYPTTAB_OPTIONS=nonexistent,keyscript=@@DECRYPT_FOOBAR@@,luks
+	CRYPTTAB_OPTION_keyscript=@@DECRYPT_FOOBAR@@
+	CRYPTTAB_OPTION_luks=yes
+	CRYPTTAB_SOURCE=$CRYPT_IMG
+	CRYPTTAB_TRIED=0
+	_CRYPTTAB_KEY=foo\\0011bar\\0040baz
+	_CRYPTTAB_NAME=keyscript\\0045crypt
+	_CRYPTTAB_OPTIONS=nonexistent,keyscript=$TMPDIR/decrypt_foo\\0054bar\\0012b\\0040a\\0040z,luks
+	_CRYPTTAB_SOURCE=$CRYPT_IMG
+EOF
+grep -Ez "^_?CRYPTTAB_" <"$TMPDIR/environ" | sort -z | diff -u --label=a/environ --label=b/environ -- "$TMPDIR/environ2" -
diff --git a/debian/tests/cryptdisks.init b/debian/tests/cryptdisks.init
new file mode 100755
index 0000000..408c325
--- /dev/null
+++ b/debian/tests/cryptdisks.init
@@ -0,0 +1,84 @@
+#!/bin/bash
+
+set -eu
+PATH="/usr/bin:/bin:/usr/sbin:/sbin"
+export PATH
+
+if [ -d /run/systemd/system ]; then
+    export SYSTEMCTL_SKIP_REDIRECT="y"
+    # systemd masks cryptdisks.service and we can't unmask it because /etc/init.d is the only source
+    rm -f -- $(systemctl show -p FragmentPath --value cryptdisks.service)
+    systemctl daemon-reload
+fi
+
+# create 64M zero devices
+dmsetup create disk0 --table "0 $(( 64 * 2*1024)) zero"
+dmsetup create disk1 --table "0 $(( 64 * 2*1024)) zero"
+dmsetup create disk2 --table "0 $(( 64 * 2*1024)) zero"
+dmsetup create disk3 --table "0 $((128 * 2*1024)) zero"
+
+# join disk #1 and #2
+dmsetup create disk12 <<-EOF
+	0 $((64 * 2*1024)) linear /dev/mapper/disk1 0
+	$((64 * 2*1024)) $((64 * 2*1024)) linear /dev/mapper/disk2 0
+EOF
+
+cipher="aes-cbc-essiv:sha256"
+size=32 # bytes
+cat >/etc/crypttab <<-EOF
+	crypt_disk0   /dev/mapper/disk0        /dev/urandom plain,cipher=$cipher,size=$((8*size))
+	crypt_disk0a  /dev/mapper/crypt_disk0  /dev/urandom plain,cipher=$cipher,size=$((8*size))
+	crypt_disk12  /dev/mapper/disk12       /dev/urandom plain,cipher=$cipher,size=$((8*size))
+	crypt_disk3   /dev/mapper/disk3        /dev/urandom plain,cipher=$cipher,size=$((8*size))
+	crypt_disk3b  /dev/mapper/crypt_disk3  /dev/urandom plain,cipher=$cipher,size=$((8*size)),offset=$(( 64 * 2*1024))
+	crypt_disk3b0 /dev/mapper/crypt_disk3b /dev/urandom plain,cipher=$cipher,size=$((8*size))
+EOF
+
+/etc/init.d/cryptdisks start
+
+# now add crypt_disk3a (preceeding crypt_disk3b) with a size limit (can't do that via crypttab but dmsetup allows it)
+dmsetup create crypt_disk3a --uuid "CRYPT-PLAIN-crypt_disk3a" --addnodeoncreate <<-EOF
+    0 $((64 * 2*1024)) crypt $cipher $(xxd -l$size -ps -c256 </dev/urandom) 0 /dev/mapper/crypt_disk3 0
+EOF
+
+lsblk
+# disk0               253:0    0   64M  0 dm
+# └─crypt_disk0       253:5    0   64M  0 crypt
+#   └─crypt_disk0a    253:6    0   64M  0 crypt
+# disk1               253:1    0   64M  0 dm
+# └─disk12            253:4    0  128M  0 dm
+#   └─crypt_disk12    253:7    0  128M  0 crypt
+# disk2               253:2    0   64M  0 dm
+# └─disk12            253:4    0  128M  0 dm
+#   └─crypt_disk12    253:7    0  128M  0 crypt
+#disk3               253:3    0  128M  0 dm
+#└─crypt_disk3       253:8    0  128M  0 crypt
+#  ├─crypt_disk3b    253:9    0   64M  0 crypt
+#  │ └─crypt_disk3b0 253:10   0   64M  0 crypt
+#  └─crypt_disk3a    253:11   0   64M  0 dm
+
+# check device-mapper table (crypt target only)
+# https://gitlab.com/cryptsetup/cryptsetup/-/wikis/DMCrypt
+# <start_sector> <size> "crypt" <target mapping table> <cipher> <key> <iv_offset> <device path> <offset> [<#opt_params> <opt_params>]
+dmsetup table --target="crypt" >"$AUTOPKGTEST_TMP/table"
+sed -ri "s/\\s+0{$((2*size))}(\\s+[0-9]+)\\s+[0-9]+:[0-9]+(\s|$)/\\1\\2/" -- "$AUTOPKGTEST_TMP/table"
+LC_ALL=C sort -t: -k1,1 <"$AUTOPKGTEST_TMP/table" >"$AUTOPKGTEST_TMP/table2"
+
+diff -u --color=auto --label="a/table" --label="b/table" -- - "$AUTOPKGTEST_TMP/table2" <<-EOF
+	crypt_disk0: 0 $((64 * 2*1024)) crypt $cipher 0 0
+	crypt_disk0a: 0 $((64 * 2*1024)) crypt $cipher 0 0
+	crypt_disk12: 0 $((2*64 * 2*1024)) crypt $cipher 0 0
+	crypt_disk3: 0 $((128 * 2*1024)) crypt $cipher 0 0
+	crypt_disk3a: 0 $((64 * 2*1024)) crypt $cipher 0 0
+	crypt_disk3b: 0 $((64 * 2*1024)) crypt $cipher 0 $((64 * 2*1024))
+	crypt_disk3b0: 0 $((64 * 2*1024)) crypt $cipher 0 0
+EOF
+
+# close disks and ensure there no leftover devices
+/etc/init.d/cryptdisks stop
+dmsetup table --target="crypt" >"$AUTOPKGTEST_TMP/table"
+if [ -s "$AUTOPKGTEST_TMP/table" ]; then
+    echo "ERROR: leftover crypt devices" >&2
+    cat <"$AUTOPKGTEST_TMP/table"
+    exit 1
+fi
diff --git a/debian/tests/cryptroot-legacy b/debian/tests/cryptroot-legacy
new file mode 120000
index 0000000..2e34c2d
--- /dev/null
+++ b/debian/tests/cryptroot-legacy
@@ -0,0 +1 @@
+utils/cryptroot-common
\ No newline at end of file
diff --git a/debian/tests/cryptroot-legacy.d/bottom b/debian/tests/cryptroot-legacy.d/bottom
new file mode 100644
index 0000000..8bf492f
--- /dev/null
+++ b/debian/tests/cryptroot-legacy.d/bottom
@@ -0,0 +1,9 @@
+umount "$ROOT/boot"
+umount "$ROOT"
+
+swapoff /dev/cryptvg/swap
+lvm vgchange -an "cryptvg"
+
+cryptsetup close "vda3_crypt"
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-legacy.d/config b/debian/tests/cryptroot-legacy.d/config
new file mode 100644
index 0000000..cff461c
--- /dev/null
+++ b/debian/tests/cryptroot-legacy.d/config
@@ -0,0 +1,14 @@
+PKGS_EXTRA+=( e2fsprogs ) # for fsck.ext4
+PKGS_EXTRA+=( lvm2 )
+PKGS_EXTRA+=( cryptsetup-initramfs )
+
+# disable AES and SHA instructions
+if [[ "$QEMU_CPU_MODEL" =~ ^(.*),\+aes(,.*)?$ ]]; then
+    QEMU_CPU_MODEL="${BASH_REMATCH[1]}${BASH_REMATCH[2]}"
+fi
+if [[ "$QEMU_CPU_MODEL" =~ ^(.*),\+sha-ni(,.*)?$ ]]; then
+    QEMU_CPU_MODEL="${BASH_REMATCH[1]}${BASH_REMATCH[2]}"
+fi
+QEMU_CPU_MODEL="$QEMU_CPU_MODEL,-aes,-sha-ni"
+
+# vim: set filetype=bash :
diff --git a/debian/tests/cryptroot-legacy.d/mock b/debian/tests/cryptroot-legacy.d/mock
new file mode 100755
index 0000000..b3b7d26
--- /dev/null
+++ b/debian/tests/cryptroot-legacy.d/mock
@@ -0,0 +1,32 @@
+#!/usr/bin/perl -T
+
+BEGIN {
+    require "./debian/tests/utils/mock.pm";
+    CryptrootTest::Mock::->import();
+}
+
+unlock_disk("topsecret");
+login("root");
+
+# make sure the root FS and swap are help by dm-crypt devices
+shell(q{cryptsetup luksOpen --test-passphrase /dev/vda3 <<<topsecret}, rv => 0);
+my $out = shell(q{lsblk -in -oNAME,TYPE,MOUNTPOINT /dev/vda3});
+die unless $out =~ m#^`-vda3_crypt\s+crypt\s*$#m;
+die unless $out =~ m#^\s{2}[`|]-cryptvg-root\s+lvm\s+/\s*$#m;
+die unless $out =~ m#^\s{2}[`|]-cryptvg-swap\s+lvm\s+\[SWAP\]\s*$#m;
+
+# assume MODULES=dep won't add too many modules
+# XXX lsinitramfs doesn't work on /initrd.img with COMPRESS=zstd, cf. #1015954
+$out = shell(q{lsinitramfs /boot/initrd.img-`uname -r` | grep -Ec "^(usr/)?lib/modules/.*\.ko(\.[a-z]+)?$"});
+die "$out == 0 or $out > 50" unless $out =~ s/\r?\n\z// and $out =~ /\A([0-9]+)\z/ and $out > 0 and $out <= 50;
+
+# check cipher and key size
+$out = shell(q{dmsetup table --target crypt --showkeys vda3_crypt});
+die unless $out =~ m#\A0\s+\d+\s+crypt\s+aes-cbc-essiv:sha256\s+[0-9a-f]{64}\s#;
+
+# make sure hardware acceleration for AES isn't available
+$out = shell(q{cat /proc/crypto});
+die unless $out =~ m#^name\s*:.*\baes\b#mi;
+die if $out =~ m#^(?:name|driver)\s*:.*\b__(?:.*\b)?aes\b#mi;
+
+QMP::quit();
diff --git a/debian/tests/cryptroot-legacy.d/preinst b/debian/tests/cryptroot-legacy.d/preinst
new file mode 100644
index 0000000..ee76481
--- /dev/null
+++ b/debian/tests/cryptroot-legacy.d/preinst
@@ -0,0 +1,14 @@
+cat >/etc/crypttab <<-EOF
+	vda3_crypt UUID=$(blkid -s UUID -o value /dev/vda3) none luks,discard
+EOF
+
+cat >/etc/fstab <<-EOF
+	/dev/cryptvg/root /    auto errors=remount-ro 0 1
+	/dev/cryptvg/swap none swap sw                0 0
+	UUID=$(blkid -s UUID -o value /dev/vda2) /boot auto defaults 0 2
+EOF
+
+# explicitely set MODULES=dep (yes it's the default, but doesn't hurt)
+echo "MODULES=dep" >/etc/initramfs-tools/conf.d/modules
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-legacy.d/setup b/debian/tests/cryptroot-legacy.d/setup
new file mode 100644
index 0000000..c7ab31f
--- /dev/null
+++ b/debian/tests/cryptroot-legacy.d/setup
@@ -0,0 +1,46 @@
+# LVM-on-LUKS2 layout from an old system: pre-2013 cryptsetup defaults,
+# no AES hardware acceleration (and MODULES=dep)
+
+sfdisk --append /dev/vda <<-EOF
+	unit: sectors
+
+	start=$((64*1024*2)), size=$((128*1024*2)), type=${GUID_TYPE_Linux_FS}
+	start=$(((64+128)*1024*2)), type=${GUID_TYPE_LUKS}
+EOF
+udevadm settle
+
+# Use pre-2013 (<1.6.0) defaults: LUKS1, aes-cbc-essiv:sha256 cipher, 256bits key
+# <1.6.0 default hash was sha1 but we use legacy hash ripemd160 here to test OpenSSL's
+# legacy.so
+echo -n "topsecret" >/rootfs.key
+cryptsetup luksFormat --batch-mode \
+    --key-file=/rootfs.key \
+    --type=luks1 \
+    --pbkdf-force-iterations=1000 \
+    --cipher="aes-cbc-essiv:sha256" \
+    --hash="ripemd160" \
+    --key-size=256 \
+    -- /dev/vda3
+cryptsetup luksOpen --key-file=/rootfs.key --allow-discards \
+    -- /dev/vda3 "vda3_crypt"
+udevadm settle
+
+lvm pvcreate /dev/mapper/vda3_crypt
+lvm vgcreate "cryptvg" /dev/mapper/vda3_crypt
+lvm lvcreate -Zn --size 64m --name "swap" "cryptvg"
+lvm lvcreate -Zn -l100%FREE --name "root" "cryptvg"
+lvm vgchange -ay "cryptvg"
+lvm vgmknodes
+udevadm settle
+
+mke2fs -Ft ext4 /dev/cryptvg/root
+mount -t ext4 /dev/cryptvg/root "$ROOT"
+
+mkdir "$ROOT/boot"
+mke2fs -Ft ext2 -m0 /dev/vda2
+mount -t ext2 /dev/vda2 "$ROOT/boot"
+
+mkswap /dev/cryptvg/swap
+swapon /dev/cryptvg/swap
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-lvm b/debian/tests/cryptroot-lvm
new file mode 120000
index 0000000..2e34c2d
--- /dev/null
+++ b/debian/tests/cryptroot-lvm
@@ -0,0 +1 @@
+utils/cryptroot-common
\ No newline at end of file
diff --git a/debian/tests/cryptroot-lvm.d/bottom b/debian/tests/cryptroot-lvm.d/bottom
new file mode 100644
index 0000000..8bf492f
--- /dev/null
+++ b/debian/tests/cryptroot-lvm.d/bottom
@@ -0,0 +1,9 @@
+umount "$ROOT/boot"
+umount "$ROOT"
+
+swapoff /dev/cryptvg/swap
+lvm vgchange -an "cryptvg"
+
+cryptsetup close "vda3_crypt"
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-lvm.d/config b/debian/tests/cryptroot-lvm.d/config
new file mode 100644
index 0000000..ac595b0
--- /dev/null
+++ b/debian/tests/cryptroot-lvm.d/config
@@ -0,0 +1,10 @@
+PKGS_EXTRA+=( e2fsprogs ) # for fsck.ext4
+PKGS_EXTRA+=( dbus ) # for systemctl(1)
+PKGS_EXTRA+=( lvm2 )
+PKGS_EXTRA+=( cryptsetup-initramfs cryptsetup-suspend )
+
+QEMU_MEMORY="size=512M"
+GUEST_POWERCYCLE=1 # boot again after hibernation
+DRIVE_SIZES=( "3G" ) # need a big enough swap to accomodate the memory
+
+# vim: set filetype=bash :
diff --git a/debian/tests/cryptroot-lvm.d/mock b/debian/tests/cryptroot-lvm.d/mock
new file mode 100755
index 0000000..f57e42f
--- /dev/null
+++ b/debian/tests/cryptroot-lvm.d/mock
@@ -0,0 +1,49 @@
+#!/usr/bin/perl -T
+
+BEGIN {
+    require "./debian/tests/utils/mock.pm";
+    CryptrootTest::Mock::->import();
+}
+
+my $POWERCYCLE_COUNT = $ARGV[0];
+
+unlock_disk("topsecret");
+
+if ($POWERCYCLE_COUNT == 0) {
+    login("root");
+
+    # make sure the root FS and swap are help by dm-crypt devices
+    shell(q{cryptsetup luksOpen --test-passphrase /dev/vda3 <<<topsecret}, rv => 0);
+    my $out = shell(q{lsblk -in -oNAME,TYPE,MOUNTPOINT /dev/vda3});
+    die unless $out =~ m#^`-vda3_crypt\s+crypt\s*$#m;
+    die unless $out =~ m#^\s{2}[`|]-cryptvg-root\s+lvm\s+/\s*$#m;
+    die unless $out =~ m#^\s{2}[`|]-cryptvg-swap\s+lvm\s+\[SWAP\]\s*$#m;
+
+    # create a stamp in memory, hibernate (suspend on disk) and thaw
+    shell(q{echo hello >/dev/shm/foo.stamp});
+    hibernate();
+}
+else {
+    expect($SERIAL => qr/(?:^|\s)?PM: (?:hibernation: )?hibernation exit\r\n/m);
+    # no need to relogin, we get the shell as we left it
+    shell(q{grep -Fx hello </dev/shm/foo.stamp}, rv => 0);
+
+    # briefly suspend
+    suspend();
+
+    # make sure wakeup yields a cryptsetup prompt
+    wakeup();
+    expect($SERIAL => qr/(?:^|\s)?PM: suspend exit\r\n/m);
+    unlock_disk("topsecret");
+
+    # consume PS1 to make sure we're at a shell prompt
+    expect($CONSOLE => qr/\A $PS1 \z/aamsx);
+    my $out = shell(q{dmsetup info -c --noheadings -omangled_name,suspended --separator ' '});
+    die if grep !/[:[:blank:]]Active$/i, split(/\r?\n/, $out);
+
+    # test I/O on the root file system
+    shell(q{cp -vT /dev/shm/foo.stamp /cryptroot.stamp});
+    shell(q{grep -Fx hello </cryptroot.stamp}, rv => 0);
+
+    QMP::quit();
+}
diff --git a/debian/tests/cryptroot-lvm.d/postinst b/debian/tests/cryptroot-lvm.d/postinst
new file mode 100644
index 0000000..b9ffe35
--- /dev/null
+++ b/debian/tests/cryptroot-lvm.d/postinst
@@ -0,0 +1,17 @@
+mkdir /etc/systemd/system/systemd-suspend.service.d
+cat >/etc/systemd/system/systemd-suspend.service.d/zz-cryptsetup-suspend-mock.conf <<-EOF
+	# override the command and don't call openvt(1) here since VT8 isn't
+	# available from the mocking logic -- we use /dev/console instead
+
+	[Service]
+	StandardInput=tty
+	StandardOutput=inherit
+	StandardError=inherit
+	TTYPath=/dev/console
+	TTYReset=yes
+
+	ExecStart=
+	ExecStart=/lib/cryptsetup/scripts/suspend/cryptsetup-suspend-wrapper
+EOF
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-lvm.d/preinst b/debian/tests/cryptroot-lvm.d/preinst
new file mode 100644
index 0000000..650b9b6
--- /dev/null
+++ b/debian/tests/cryptroot-lvm.d/preinst
@@ -0,0 +1,14 @@
+cat >/etc/crypttab <<-EOF
+	vda3_crypt PARTUUID=$(blkid -s PARTUUID -o value /dev/vda3) none luks,discard
+EOF
+
+cat >/etc/fstab <<-EOF
+	/dev/cryptvg/root /    auto errors=remount-ro 0 1
+	/dev/cryptvg/swap none swap sw                0 0
+	UUID=$(blkid -s UUID -o value /dev/vda2) /boot auto defaults 0 2
+EOF
+
+mkdir -p /etc/initramfs-tools/conf.d
+echo "RESUME=/dev/cryptvg/swap" >/etc/initramfs-tools/conf.d/resume
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-lvm.d/setup b/debian/tests/cryptroot-lvm.d/setup
new file mode 100644
index 0000000..890bbb6
--- /dev/null
+++ b/debian/tests/cryptroot-lvm.d/setup
@@ -0,0 +1,45 @@
+# Simple LVM-on-LUKS2 layout -- more or less emulates what one gets out
+# of d-i with the "encrypted LVM" partioning method.
+
+# create two new partitions for /boot and LUKS respectively (the first
+# one is always used for BIOS/EFI and never exceeds sector 64*1024*2)
+sfdisk --append /dev/vda <<-EOF
+	unit: sectors
+
+	start=$((64*1024*2)), size=$((128*1024*2)), type=${GUID_TYPE_Linux_FS}
+	start=$(((64+128)*1024*2)), type=${GUID_TYPE_LUKS}
+EOF
+udevadm settle
+
+# initialize a new LUKS partition and open it
+echo -n "topsecret" >/rootfs.key
+cryptsetup luksFormat --batch-mode \
+    --key-file=/rootfs.key \
+    --type=luks2 \
+    --pbkdf=argon2id \
+    --pbkdf-force-iterations=4 \
+    --pbkdf-memory=32 \
+    -- /dev/vda3
+cryptsetup luksOpen --key-file=/rootfs.key --allow-discards \
+    -- /dev/vda3 "vda3_crypt"
+udevadm settle
+
+lvm pvcreate /dev/mapper/vda3_crypt
+lvm vgcreate "cryptvg" /dev/mapper/vda3_crypt
+lvm lvcreate -Zn --size 1024m --name "swap" "cryptvg"
+lvm lvcreate -Zn -l100%FREE --name "root" "cryptvg"
+lvm vgchange -ay "cryptvg"
+lvm vgmknodes
+udevadm settle
+
+mke2fs -Ft ext4 /dev/cryptvg/root
+mount -t ext4 /dev/cryptvg/root "$ROOT"
+
+mkdir "$ROOT/boot"
+mke2fs -Ft ext2 -m0 /dev/vda2
+mount -t ext2 /dev/vda2 "$ROOT/boot"
+
+mkswap /dev/cryptvg/swap
+swapon /dev/cryptvg/swap
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-md b/debian/tests/cryptroot-md
new file mode 120000
index 0000000..2e34c2d
--- /dev/null
+++ b/debian/tests/cryptroot-md
@@ -0,0 +1 @@
+utils/cryptroot-common
\ No newline at end of file
diff --git a/debian/tests/cryptroot-md.d/bottom b/debian/tests/cryptroot-md.d/bottom
new file mode 100644
index 0000000..a771c91
--- /dev/null
+++ b/debian/tests/cryptroot-md.d/bottom
@@ -0,0 +1,15 @@
+umount "$ROOT/boot"
+umount "$ROOT"
+
+swapoff /dev/md1
+mdadm --stop /dev/md1
+cryptsetup close "vda3_crypt"
+cryptsetup close "vdb3_crypt"
+
+swapoff /dev/cryptvg/swap
+lvm vgchange -an "cryptvg"
+mdadm --stop /dev/md2
+cryptsetup close "vda4_crypt"
+cryptsetup close "vdb4_crypt"
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-md.d/config b/debian/tests/cryptroot-md.d/config
new file mode 100644
index 0000000..0c9e5ff
--- /dev/null
+++ b/debian/tests/cryptroot-md.d/config
@@ -0,0 +1,7 @@
+PKGS_EXTRA+=( e2fsprogs ) # for fsck.ext4
+PKGS_EXTRA+=( lvm2 mdadm )
+PKGS_EXTRA+=( cryptsetup-initramfs )
+
+DRIVE_SIZES=( "1536M" "1536M" )
+
+# vim: set filetype=bash :
diff --git a/debian/tests/cryptroot-md.d/mock b/debian/tests/cryptroot-md.d/mock
new file mode 100755
index 0000000..51f8c9c
--- /dev/null
+++ b/debian/tests/cryptroot-md.d/mock
@@ -0,0 +1,41 @@
+#!/usr/bin/perl -T
+
+BEGIN {
+    require "./debian/tests/utils/mock.pm";
+    CryptrootTest::Mock::->import();
+}
+
+my %passphrases;
+$passphrases{$_} = $_ foreach qw/vda3_crypt vda4_crypt vdb3_crypt vdb4_crypt/;
+unlock_disk(\%passphrases) for 1 .. scalar(%passphrases);
+
+# check that the above was done at initramfs stage
+expect($SERIAL => qr#\bRunning /scripts/init-bottom\s*\.\.\. #);
+
+login("root");
+
+# make sure the root FS and swap are help by dm-crypt devices
+shell(q{cryptsetup luksOpen --test-passphrase /dev/vda3 <<<vda3_crypt}, rv => 0);
+shell(q{cryptsetup luksOpen --test-passphrase /dev/vda4 <<<vda4_crypt}, rv => 0);
+shell(q{cryptsetup luksOpen --test-passphrase /dev/vdb3 <<<vdb3_crypt}, rv => 0);
+shell(q{cryptsetup luksOpen --test-passphrase /dev/vdb4 <<<vdb4_crypt}, rv => 0);
+
+my $out = shell(q{lsblk -in -oNAME,TYPE,MOUNTPOINT /dev/vda3});
+die unless $out =~ m#^`-vda3_crypt\s+crypt\s*$#m;
+die unless $out =~ m#^  `-md1\s+raid0\s+\[SWAP\]\s*$#m;
+
+$out = shell(q{lsblk -in -oNAME,TYPE,MOUNTPOINT /dev/vdb3});
+die unless $out =~ m#^`-vdb3_crypt\s+crypt\s*$#m;
+die unless $out =~ m#^  `-md1\s+raid0\s+\[SWAP\]\s*$#m;
+
+$out = shell(q{lsblk -in -oNAME,TYPE,MOUNTPOINT /dev/vda4});
+die unless $out =~ m#^`-vda4_crypt\s+crypt\s*$#m;
+die unless $out =~ m#^    [`|]-cryptvg-swap\s+lvm\s+\[SWAP\]\s*$#m;
+die unless $out =~ m#^    [`|]-cryptvg-root\s+lvm\s+/\s*$#m;
+
+$out = shell(q{lsblk -in -oNAME,TYPE,MOUNTPOINT /dev/vdb4});
+die unless $out =~ m#^`-vdb4_crypt\s+crypt\s*$#m;
+die unless $out =~ m#^    [`|]-cryptvg-swap\s+lvm\s+\[SWAP\]\s*$#m;
+die unless $out =~ m#^    [`|]-cryptvg-root\s+lvm\s+/\s*$#m;
+
+QMP::quit();
diff --git a/debian/tests/cryptroot-md.d/preinst b/debian/tests/cryptroot-md.d/preinst
new file mode 100644
index 0000000..84bfa7a
--- /dev/null
+++ b/debian/tests/cryptroot-md.d/preinst
@@ -0,0 +1,20 @@
+# intentionally mix UUID= and /dev
+cat >/etc/crypttab <<-EOF
+	vda3_crypt UUID=$(blkid -s UUID -o value /dev/vda3) none discard
+	vda4_crypt UUID=$(blkid -s UUID -o value /dev/vda4) none discard
+	vdb3_crypt /dev/vdb3 none discard
+	vdb4_crypt /dev/vdb4 none discard
+EOF
+
+cat >/etc/fstab <<-EOF
+	/dev/cryptvg/root /    auto errors=remount-ro 0 1
+	/dev/cryptvg/swap none swap sw                0 0
+	/dev/md1          none swap sw                0 0
+	UUID=$(blkid -s UUID -o value /dev/md0) /boot auto defaults 0 2
+EOF
+
+# force unlocking /dev/md1 holders (/dev/vd[ab]3) at initramfs stage
+mkdir -p /etc/initramfs-tools/conf.d
+echo "RESUME=/dev/md1" >/etc/initramfs-tools/conf.d/resume
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-md.d/setup b/debian/tests/cryptroot-md.d/setup
new file mode 100644
index 0000000..a8f49ed
--- /dev/null
+++ b/debian/tests/cryptroot-md.d/setup
@@ -0,0 +1,84 @@
+# Rather convoluted LVM-on-MD-on-LUKS2 layout with 2 swap areas, /boot
+# on RAID1, SWAP0 on RAID0, LVM on RAID1 and 4 independently encrypted
+# partitions decrypt at early boot stage:
+
+#    NAME                 TYPE  MOUNTPOINTS
+#    vda                  disk
+#    ├─vda1               part
+#    ├─vda2               part
+#    │ └─md0              raid1 /boot
+#    ├─vda3               part
+#    │ └─vda3_crypt       crypt
+#    │   └─md1            raid0 [SWAP]
+#    └─vda4               part
+#      └─vda4_crypt       crypt
+#        └─md2            raid1
+#          ├─cryptvg-swap lvm   [SWAP]
+#          └─cryptvg-root lvm   /
+#    vdb                  disk
+#    ├─vdb1               part
+#    ├─vdb2               part
+#    │ └─md0              raid1 /boot
+#    ├─vdb3               part
+#    │ └─vdb3_crypt       crypt
+#    │   └─md1            raid0 [SWAP]
+#    └─vdb4               part
+#      └─vdb4_crypt       crypt
+#        └─md2            raid1
+#          ├─cryptvg-swap lvm   [SWAP]
+#          └─cryptvg-root lvm   /
+
+sfdisk --append /dev/vda <<-EOF
+	unit: sectors
+
+	start=$((64*1024*2)), size=$((128*1024*2)), type=${GUID_TYPE_Linux_FS}
+	start=$(((64+128)*1024*2)), size=$((64*1024*2)), type=${GUID_TYPE_LUKS}
+	start=$(((64+128+64)*1024*2)), type=${GUID_TYPE_LUKS}
+EOF
+udevadm settle
+
+# copy vda's partition table onto vdb
+sfdisk -d /dev/vda | sfdisk /dev/vdb
+udevadm settle
+
+for d in vda3 vda4 vdb3 vdb4; do
+  echo -n "${d}_crypt" >/keyfile
+    cryptsetup luksFormat --batch-mode \
+        --key-file=/keyfile \
+        --type=luks2 \
+        --pbkdf=argon2id \
+        --pbkdf-force-iterations=4 \
+        --pbkdf-memory=32 \
+        -- "/dev/$d"
+    cryptsetup luksOpen --key-file=/keyfile --allow-discards \
+        -- "/dev/$d" "${d}_crypt"
+    udevadm settle
+done
+
+mdadm --create /dev/md0 --metadata=default --level=1 --raid-devices=2 /dev/vda2 /dev/vdb2
+mdadm --create /dev/md1 --metadata=default --level=0 --raid-devices=2 /dev/mapper/vda3_crypt /dev/mapper/vdb3_crypt
+mdadm --create /dev/md2 --metadata=default --level=1 --raid-devices=2 /dev/mapper/vda4_crypt /dev/mapper/vdb4_crypt
+udevadm settle
+
+lvm pvcreate /dev/md2
+lvm vgcreate "cryptvg" /dev/md2
+lvm lvcreate -Zn --size 64m --name "swap" "cryptvg"
+lvm lvcreate -Zn -l100%FREE --name "root" "cryptvg"
+lvm vgchange -ay "cryptvg"
+lvm vgmknodes
+udevadm settle
+
+
+mke2fs -Ft ext4 /dev/cryptvg/root
+mount -t ext4 /dev/cryptvg/root "$ROOT"
+
+mkdir "$ROOT/boot"
+mke2fs -Ft ext2 -m0 /dev/md0
+mount -t ext2 /dev/md0 "$ROOT/boot"
+
+mkswap /dev/cryptvg/swap
+swapon /dev/cryptvg/swap
+mkswap /dev/md1
+swapon /dev/md1
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-nested b/debian/tests/cryptroot-nested
new file mode 120000
index 0000000..2e34c2d
--- /dev/null
+++ b/debian/tests/cryptroot-nested
@@ -0,0 +1 @@
+utils/cryptroot-common
\ No newline at end of file
diff --git a/debian/tests/cryptroot-nested.d/bottom b/debian/tests/cryptroot-nested.d/bottom
new file mode 100644
index 0000000..9c2e07a
--- /dev/null
+++ b/debian/tests/cryptroot-nested.d/bottom
@@ -0,0 +1,17 @@
+umount "$ROOT/boot"
+umount "$ROOT/home"
+umount "$ROOT/usr"
+umount "$ROOT/var"
+umount "$ROOT"
+
+swapoff /dev/mapper/testvg-lv0_crypt
+cryptsetup close "testvg-lv0_crypt"
+cryptsetup close "vdd_crypt"
+
+cryptsetup close "md0_crypt"
+mdadm --stop /dev/md0
+
+cryptsetup close "testvg-lv1_crypt"
+lvm vgchange -an "testvg"
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-nested.d/config b/debian/tests/cryptroot-nested.d/config
new file mode 100644
index 0000000..995200c
--- /dev/null
+++ b/debian/tests/cryptroot-nested.d/config
@@ -0,0 +1,7 @@
+PKGS_EXTRA+=( btrfs-progs lvm2 mdadm )
+PKGS_EXTRA+=( cryptsetup-initramfs )
+
+# /dev/mapper/testvg-lv1_crypt and /dev/vdc are both 1G and used in RAID1 mode
+DRIVE_SIZES=( "1G" "264M" "1G" "512M" )
+
+# vim: set filetype=bash :
diff --git a/debian/tests/cryptroot-nested.d/mock b/debian/tests/cryptroot-nested.d/mock
new file mode 100755
index 0000000..cccb35f
--- /dev/null
+++ b/debian/tests/cryptroot-nested.d/mock
@@ -0,0 +1,44 @@
+#!/usr/bin/perl -T
+
+BEGIN {
+    require "./debian/tests/utils/mock.pm";
+    CryptrootTest::Mock::->import();
+}
+
+my %passphrases;
+$passphrases{$_} = $_ foreach qw/testvg-lv0_crypt testvg-lv1_crypt md0_crypt vdd_crypt/;
+unlock_disk(\%passphrases) for 1 .. scalar(%passphrases);
+
+# check that the above was done at initramfs stage
+expect($SERIAL => qr#\bRunning /scripts/init-bottom\s*\.\.\. #);
+
+login("root");
+
+# make sure the root FS and swap are help by dm-crypt devices
+shell(q{cryptsetup luksOpen --test-passphrase /dev/md0 <<<md0_crypt}, rv => 0);
+shell(q{cryptsetup luksOpen --test-passphrase /dev/vdd <<<vdd_crypt}, rv => 0);
+shell(q{cryptsetup luksOpen --test-passphrase /dev/testvg/lv1 <<<testvg-lv1_crypt}, rv => 0);
+
+my $out = shell(q{lsblk -in -oNAME,TYPE,MOUNTPOINT /dev/vda3});
+die unless $out =~ m#^[`|]-testvg-lv0\s+lvm\s*$#m;
+die unless $out =~ m#^[| ] `-testvg-lv0_crypt\s+crypt\s+\[SWAP\]\s*$#m;
+die unless $out =~ m#^[`|]-testvg-lv1\s+lvm\s*$#m;
+die unless $out =~ m#^[| ] `-testvg-lv1_crypt\s+crypt\s*$#m;
+die unless $out =~ m#^[| ]   `-md0\s+raid1\s*$#m;
+die unless $out =~ m#^[| ]     `-md0_crypt\s+crypt(?:\s+/(?:home|usr|var)?)?\s*$#m;
+
+$out = shell(q{lsblk -in -oNAME,TYPE,MOUNTPOINT /dev/vdb});
+die unless $out =~ m#^`-testvg-lv1\s+lvm\s*$#m;
+die unless $out =~ m#^  `-testvg-lv1_crypt\s+crypt\s*$#m;
+die unless $out =~ m#^    `-md0\s+raid1\s*$#m;
+die unless $out =~ m#^      `-md0_crypt\s+crypt(?:\s+/(?:home|usr|var)?)?\s*$#m;
+
+$out = shell(q{lsblk -in -oNAME,TYPE,MOUNTPOINT /dev/vdc});
+die unless $out =~ m#^`-md0\s+raid1\s*$#m;
+die unless $out =~ m#^  `-md0_crypt\s+crypt(?:\s+/(?:home|usr|var)?)?\s*$#m;
+
+$out = shell(q{btrfs filesystem show /});
+die unless $out =~ m#^\s*devid\s+1\s.*\s/dev/mapper/vdd_crypt\s*$#m;
+die unless $out =~ m#^\s*devid\s+2\s.*\s/dev/mapper/md0_crypt\s*$#m;
+
+QMP::quit();
diff --git a/debian/tests/cryptroot-nested.d/preinst b/debian/tests/cryptroot-nested.d/preinst
new file mode 100644
index 0000000..c5f576b
--- /dev/null
+++ b/debian/tests/cryptroot-nested.d/preinst
@@ -0,0 +1,21 @@
+# check both UUID= and /dev/mapper/NAME sources for testvg-*_crypt to test for regressions a la #902943
+cat >/etc/crypttab <<-EOF
+	md0_crypt UUID=$(blkid -s UUID -o value /dev/md0) none
+	vdd_crypt UUID=$(blkid -s UUID -o value /dev/vdd) none
+	testvg-lv0_crypt /dev/mapper/testvg-lv0 none plain,cipher=aes-cbc-essiv:sha256,size=256,hash=ripemd160
+	testvg-lv1_crypt UUID=$(blkid -s UUID -o value /dev/testvg/lv1) none
+EOF
+
+cat >/etc/fstab <<-EOF
+	/dev/mapper/vdd_crypt /     btrfs compress=lzo,subvol=@     0 1
+	/dev/mapper/vdd_crypt /home btrfs compress=lzo,subvol=@home 0 2
+	/dev/mapper/vdd_crypt /usr  btrfs compress=lzo,subvol=@usr  0 2
+	/dev/mapper/vdd_crypt /var  btrfs compress=lzo,subvol=@var  0 2
+	UUID=$(blkid -s UUID -o value /dev/vda2) /boot ext2 defaults 0 2
+	/dev/mapper/testvg-lv0_crypt none swap sw 0 0
+EOF
+
+mkdir -p /etc/initramfs-tools/conf.d
+echo "RESUME=/dev/mapper/testvg-lv0_crypt" >/etc/initramfs-tools/conf.d/resume
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-nested.d/setup b/debian/tests/cryptroot-nested.d/setup
new file mode 100644
index 0000000..6fb6ccd
--- /dev/null
+++ b/debian/tests/cryptroot-nested.d/setup
@@ -0,0 +1,107 @@
+# Unrealistic (and frankly stupid) layout with a complex block device
+# stack involving multi-device btrfs and btrfs subvolumes, LUKS-on-MD,
+# MD-on-LUKS and LUKS-on-LVM incl. nested dm-crypt volumes:
+
+#    NAME                   TYPE  MOUNTPOINTS
+#    vda                    disk
+#    ├─vda1                 part
+#    ├─vda2                 part  /boot
+#    └─vda3                 part
+#      ├─testvg-lv0         lvm
+#      │ └─testvg-lv0_crypt crypt [SWAP]
+#      └─testvg-lv1         lvm
+#        └─testvg-lv1_crypt crypt
+#          └─md0            raid1
+#            └─md0_crypt    crypt /, /home, /usr, /var
+#    vdb                    disk
+#    └─testvg-lv1           lvm
+#      └─testvg-lv1_crypt   crypt
+#        └─md0              raid1
+#          └─md0_crypt      crypt /, /home, /usr, /var
+#    vdc                    disk
+#    └─md0                  raid1
+#      └─md0_crypt          crypt /, /home, /usr, /var
+#    vdd                    disk
+#    └─vdd_crypt            crypt /, /home, /usr, /var
+
+sfdisk --append /dev/vda <<-EOF
+	unit: sectors
+
+	start=$((64*1024*2)), size=$((128*1024*2)), type=${GUID_TYPE_Linux_FS}
+	start=$(((64+128)*1024*2)), type=${GUID_TYPE_LUKS}
+EOF
+udevadm settle
+
+lvm pvcreate /dev/vda3
+lvm pvcreate /dev/vdb
+lvm vgcreate "testvg" /dev/vda3 /dev/vdb
+lvm lvcreate -Zn --size 64m --name "lv0" "testvg"
+lvm lvcreate -Zn --size 1024m --name "lv1" "testvg"
+lvm vgchange -ay "testvg"
+lvm vgmknodes
+udevadm settle
+
+echo -n "testvg-lv0_crypt" >/keyfile
+cryptsetup open --batch-mode \
+    --type=plain \
+    --cipher="aes-cbc-essiv:sha256" \
+    --key-size=256 \
+    --hash="ripemd160" \
+    -- "/dev/testvg/lv0" "testvg-lv0_crypt" </keyfile
+udevadm settle
+
+echo -n "testvg-lv1_crypt" >/keyfile
+cryptsetup luksFormat --batch-mode \
+    --key-file=/keyfile \
+    --type=luks1 \
+    --pbkdf-force-iterations=1000 \
+    -- "/dev/testvg/lv1"
+cryptsetup luksOpen --key-file=/keyfile --allow-discards \
+    -- "/dev/testvg/lv1" "testvg-lv1_crypt"
+udevadm settle
+
+mdadm --create /dev/md0 --metadata=default --level=1 --raid-devices=2 \
+    /dev/mapper/testvg-lv1_crypt /dev/vdc
+udevadm settle
+
+for d in md0 vdd; do
+    echo -n "${d}_crypt" >/keyfile
+    cryptsetup luksFormat --batch-mode \
+        --key-file=/keyfile \
+        --type=luks2 \
+        --pbkdf=argon2id \
+        --pbkdf-force-iterations=4 \
+        --pbkdf-memory=32 \
+        -- "/dev/$d"
+    cryptsetup luksOpen --key-file=/keyfile --allow-discards \
+        -- "/dev/${d}" "${d}_crypt"
+    udevadm settle
+done
+
+# create multi-device btrfs filesystem for the root FS; we list /dev/mapper/vdd_crypt
+# first since it's smaller and we want data to span across both devices
+mkfs.btrfs -d single /dev/mapper/vdd_crypt /dev/mapper/md0_crypt
+
+# create subvolumes
+mount -t btrfs -o compress=lzo,device=/dev/mapper/md0_crypt /dev/mapper/vdd_crypt "$ROOT"
+btrfs subvol create "$ROOT/@"
+btrfs subvol create "$ROOT/@usr"
+btrfs subvol create "$ROOT/@var"
+btrfs subvol create "$ROOT/@home"
+umount "$ROOT"
+
+# now mount the subvolumes
+mount -t btrfs -o compress=lzo,device=/dev/mapper/md0_crypt,subvol="@" /dev/mapper/vdd_crypt "$ROOT"
+for s in home usr var; do
+    mkdir -m0755 "$ROOT/$s"
+    mount -t btrfs -o compress=lzo,device=/dev/mapper/md0_crypt,subvol="@$s" /dev/mapper/vdd_crypt "$ROOT/$s"
+done
+
+mkdir "$ROOT/boot"
+mke2fs -Ft ext2 -m0 /dev/vda2
+mount -t ext2 /dev/vda2 "$ROOT/boot"
+
+mkswap /dev/mapper/testvg-lv0_crypt
+swapon /dev/mapper/testvg-lv0_crypt
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-run b/debian/tests/cryptroot-run
new file mode 100755
index 0000000..6656bca
--- /dev/null
+++ b/debian/tests/cryptroot-run
@@ -0,0 +1,135 @@
+#!/bin/bash
+
+# Wrapper for cryptroot-* DEP-8 tests (outside autopkgtest harness)
+# This is mostly useful for local tests on the maintainers' machine,
+# such as expensive tests we don't want to overload debci with.
+#
+#   Usage: d/t/cryptroot-run [TESTNAME ..]
+#
+# Copyright © 2022 Guilhem Moulin <guilhem@debian.org>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+set -ue
+PATH="/usr/bin:/bin"
+export PATH
+
+if [ -n "${AUTOPKGTEST_TMP+x}" ]; then
+    echo "ERROR: This script is a test wrapper not an autopkgtest" >&2
+    exit 1
+fi
+
+# git-buildpackages's 'export-dir' option (XXX hardcoding this is not ideal)
+EXPORT_DIR="${XDG_CACHE_HOME:-"$HOME/.cache"}/build-area"
+
+RV=0
+TESTDIR="$(dirname -- "$0")"
+declare -a TESTNAMES=() TIME=() CODE=()
+
+# determine path to the .changes file and extract .deb file list from it
+DEB_VERSION="$(dpkg-parsechangelog -SVersion)"
+DEB_SOURCE="$(dpkg-parsechangelog -SSource)"
+DEB_BUILD_ARCHITECTURE="$(dpkg-architecture -qDEB_BUILD_ARCH)"
+if [[ "$DEB_VERSION" =~ ^[0-9]+:(.+)$ ]]; then
+    DEB_VERSION_NOEPOCH="${BASH_REMATCH[1]}"
+else
+    DEB_VERSION_NOEPOCH="$DEB_VERSION"
+fi
+
+CHANGES_FILE="${DEB_SOURCE}_${DEB_VERSION_NOEPOCH}_${DEB_BUILD_ARCHITECTURE}.changes"
+PKG_DIR="$(mktemp --tmpdir --directory "$DEB_SOURCE.XXXXXXXXXX")"
+trap "rm -rf -- \"$PKG_DIR\"" EXIT INT TERM
+
+if [ ! -f "$EXPORT_DIR/$CHANGES_FILE" ]; then
+    echo "ERROR: $EXPORT_DIR/$CHANGES_FILE: No such file" >&2
+    exit 1
+elif grep -qFxe "-----BEGIN PGP SIGNED MESSAGE-----" <"$EXPORT_DIR/$CHANGES_FILE"; then
+    gpgv --keyring=/dev/null --output="$PKG_DIR/$CHANGES_FILE" <"$EXPORT_DIR/$CHANGES_FILE" 2>/dev/null || true
+else
+    cp -T -- "$EXPORT_DIR/$CHANGES_FILE" "$PKG_DIR/$CHANGES_FILE"
+fi
+
+declare -a EXTRA_PKGS
+EXTRA_PKGS=( $(sed -nr '/^Files:/I {:l;n; /^\S/q; s/^\s.*\s(\S+\.deb)$/\1/p; b l }' "$PKG_DIR/$CHANGES_FILE") )
+if [ ${#EXTRA_PKGS[@]} -eq 0 ]; then
+    echo "ERROR: Couldn't extract .deb list from $CHANGES_FILE" >&2
+    exit 1
+fi
+
+# create temporary repository to expose locally-built .deb to cryptroot-* tests
+for deb in "${EXTRA_PKGS[@]}"; do
+    ln -st "$PKG_DIR" -- "$EXPORT_DIR/$deb" || exit 1
+done
+
+( cd "$PKG_DIR" && apt-ftparchive packages . >./Packages && apt-ftparchive release . >./Release )
+EXTRA_REPO="deb file:$PKG_DIR /"
+
+runtest() {
+    local rv=0 ts_start ts_stop
+    if [ -f "$t" ] && [ -d "$t.d" ]; then
+        t="${t#"$TESTDIR/"}"
+        echo ">>> Running $t..."
+        ts_start="$(printf "%(%s)T")"
+        "$TESTDIR/$t" "$EXTRA_REPO" </dev/null || rv=$?
+        ts_stop="$(printf "%(%s)T")"
+
+        if [ $rv -ne 0 ] && [ $RV -eq 0 -o $rv -lt $RV ]; then
+            RV=$rv
+        fi
+
+        TESTNAMES+=( "$t" )
+        TIME+=( $((ts_stop - ts_start)) )
+        CODE+=( $rv )
+    fi
+}
+
+
+if [ $# -eq 0 ]; then
+    for t in "$TESTDIR"/cryptroot-*; do
+        runtest "$t"
+    done
+else
+    for t in "$@"; do
+        if [ "${t#*/}" = "$t" ]; then
+            t="$TESTDIR/cryptroot-${t#cryptroot-}"
+        fi
+        runtest "$t"
+    done
+fi
+
+# show summary with test exit codes and elapsed time
+echo ==============================================================================
+print_sgr() {
+    local n="$1" msg="$2" fmt
+    [ -t 1 ] && fmt="\\x1B[${n}m%s\\x1B[0m" || fmt="%s"
+    printf " $fmt" "$msg"
+}
+for (( i = 0; i < ${#TESTNAMES[@]}; i++ )); do
+    printf "%s" "${TESTNAMES[i]}"
+    if [ ${CODE[i]} -eq 0 ]; then
+        print_sgr "1;32" "PASSED"
+    elif [ ${CODE[i]} -eq 77 ]; then
+        print_sgr "1;36" "SKIPPED"
+    elif [ ${CODE[i]} -eq 124 ]; then
+        print_sgr "1;31" "FAILED"
+        printf " (timeout)"
+    else
+        print_sgr "1;31" "FAILED"
+        printf " (with status %d)" ${CODE[i]}
+    fi
+    printf " after %d seconds\\n" ${TIME[i]}
+done
+echo ==============================================================================
+
+exit $RV
diff --git a/debian/tests/cryptroot-sysvinit b/debian/tests/cryptroot-sysvinit
new file mode 120000
index 0000000..2e34c2d
--- /dev/null
+++ b/debian/tests/cryptroot-sysvinit
@@ -0,0 +1 @@
+utils/cryptroot-common
\ No newline at end of file
diff --git a/debian/tests/cryptroot-sysvinit.d/bottom b/debian/tests/cryptroot-sysvinit.d/bottom
new file mode 100644
index 0000000..13d5190
--- /dev/null
+++ b/debian/tests/cryptroot-sysvinit.d/bottom
@@ -0,0 +1,9 @@
+umount "$ROOT/boot"
+umount "$ROOT"
+
+swapoff /dev/mapper/vda4_crypt
+
+cryptsetup close "vda4_crypt"
+cryptsetup close "vda5_crypt"
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-sysvinit.d/config b/debian/tests/cryptroot-sysvinit.d/config
new file mode 100644
index 0000000..f6b7392
--- /dev/null
+++ b/debian/tests/cryptroot-sysvinit.d/config
@@ -0,0 +1,5 @@
+PKGS_EXTRA+=( e2fsprogs ) # for fsck.ext4
+PKGS_EXTRA+=( cryptsetup-initramfs cryptsetup )
+PKG_INIT="sysvinit-core"
+
+# vim: set filetype=bash :
diff --git a/debian/tests/cryptroot-sysvinit.d/mock b/debian/tests/cryptroot-sysvinit.d/mock
new file mode 100755
index 0000000..b729022
--- /dev/null
+++ b/debian/tests/cryptroot-sysvinit.d/mock
@@ -0,0 +1,31 @@
+#!/usr/bin/perl -T
+
+BEGIN {
+    require "./debian/tests/utils/mock.pm";
+    CryptrootTest::Mock::->import();
+}
+
+unlock_disk("topsecret");
+login("root");
+
+# make sure the root FS, swap, and /home are help by dm-crypt devices
+shell(q{cryptsetup luksOpen --test-passphrase /dev/vda5 <<<topsecret}, rv => 0);
+my $out = shell(q{lsblk -in -oNAME,TYPE,MOUNTPOINT /dev/vda3});
+die unless $out =~ m#\Avda3\s.*\r?\n^`-vda3_crypt\s+crypt\s+/home\s*\r?\n\z#m;
+
+$out = shell(q{lsblk -in -oNAME,TYPE,MOUNTPOINT /dev/vda4});
+die unless $out =~ m#\Avda4\s.*\r?\n^`-vda4_crypt\s+crypt\s+\[SWAP\]\s*\r?\n\z#m;
+
+$out = shell(q{lsblk -in -oNAME,TYPE,MOUNTPOINT /dev/vda5});
+die unless $out =~ m#\Avda5\s.*\r?\n^`-vda5_crypt\s+crypt\s+/\s*\r?\n\z#m;
+
+# make sure only vda5 is processed at initramfs stage
+# XXX unmkinitramfs doesn't work on /initrd.img with COMPRESS=zstd, cf. #1015954
+shell(q{unmkinitramfs /boot/initrd.img-`uname -r` /tmp/initramfs});
+shell(q{grep -E '^vd\S+_crypt\s' </tmp/initramfs/cryptroot/crypttab >/tmp/out});
+shell(q{grep -E  '^vda5_crypt\s' </tmp/out}, rv => 0);
+shell(q{grep -Ev '^vda5_crypt\s' </tmp/out}, rv => 1);
+
+# don't use QMP::quit() here since we want to run our init scripts in
+# shutdown phase
+poweroff();
diff --git a/debian/tests/cryptroot-sysvinit.d/postinst b/debian/tests/cryptroot-sysvinit.d/postinst
new file mode 100644
index 0000000..d65e21d
--- /dev/null
+++ b/debian/tests/cryptroot-sysvinit.d/postinst
@@ -0,0 +1,15 @@
+install -m0600 /dev/null /etc/homefs.key
+head -c512 /dev/urandom >/etc/homefs.key
+cryptsetup luksFormat --batch-mode \
+    --key-file=/etc/homefs.key \
+    --type=luks2 \
+    --pbkdf=argon2id \
+    --pbkdf-force-iterations=4 \
+    --pbkdf-memory=32 \
+    -- /dev/vda3
+cryptsetup luksOpen --key-file=/etc/homefs.key --allow-discards \
+    -- /dev/vda3 "vda3_crypt"
+mke2fs -Ft ext4 /dev/mapper/vda3_crypt
+cryptsetup close "vda3_crypt"
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-sysvinit.d/preinst b/debian/tests/cryptroot-sysvinit.d/preinst
new file mode 100644
index 0000000..05157ca
--- /dev/null
+++ b/debian/tests/cryptroot-sysvinit.d/preinst
@@ -0,0 +1,16 @@
+cat >/etc/crypttab <<-EOF
+	vda3_crypt /dev/vda3 /etc/homefs.key luks,discard
+	vda4_crypt /dev/vda4 /dev/urandom plain,cipher=aes-xts-plain64,size=256,discard,swap
+	vda5_crypt UUID=$(blkid -s UUID -o value /dev/vda5) none luks,discard
+EOF
+
+cat >/etc/fstab <<-EOF
+	/dev/mapper/vda3_crypt /home auto defaults          0 2
+	/dev/mapper/vda4_crypt none  swap sw                0 0
+	/dev/mapper/vda5_crypt /     auto errors=remount-ro 0 1
+	UUID=$(blkid -s UUID -o value /dev/vda2) /boot auto defaults 0 2
+EOF
+
+echo "RESUME=none" >/etc/initramfs-tools/conf.d/resume
+
+# vim: set filetype=sh :
diff --git a/debian/tests/cryptroot-sysvinit.d/setup b/debian/tests/cryptroot-sysvinit.d/setup
new file mode 100644
index 0000000..f8598a6
--- /dev/null
+++ b/debian/tests/cryptroot-sysvinit.d/setup
@@ -0,0 +1,43 @@
+# Separate encrypted root FS and /home partitions, and transient swap --
+# the latter two are not unlocked at initramfs stage but later in the
+# boot process.  This environment also uses sysvinit as PID1 so we can
+# test our init scripts.
+
+sfdisk --append /dev/vda <<-EOF
+	unit: sectors
+
+	start=$((64*1024*2)), size=$((128*1024*2)), type=${GUID_TYPE_Linux_FS}
+	start=$(((64+128)*1024*2)), size=$((64*1024*2)), type=${GUID_TYPE_LUKS}
+	start=$(((64+128+64)*1024*2)), size=$((64*1024*2)), type=${GUID_TYPE_DMCRYPT}
+	start=$(((64+128+64+64)*1024*2)), type=${GUID_TYPE_LUKS}
+EOF
+udevadm settle
+
+# initialize a new LUKS partition and open it
+echo -n "topsecret" >/rootfs.key
+cryptsetup luksFormat --batch-mode \
+    --key-file=/rootfs.key \
+    --type=luks2 \
+    --pbkdf=argon2id \
+    --pbkdf-force-iterations=4 \
+    --pbkdf-memory=32 \
+    -- /dev/vda5
+cryptsetup luksOpen --key-file=/rootfs.key --allow-discards \
+    -- /dev/vda5 "vda5_crypt"
+udevadm settle
+
+cryptsetup open --type=plain --key-file=/dev/urandom --allow-discards \
+    -- /dev/vda4 "vda4_crypt"
+udevadm settle
+
+mke2fs -Ft ext4 /dev/mapper/vda5_crypt
+mount -t ext4 /dev/mapper/vda5_crypt "$ROOT"
+
+mkdir "$ROOT/boot"
+mke2fs -Ft ext2 -m0 /dev/vda2
+mount -t ext2 /dev/vda2 "$ROOT/boot"
+
+mkswap /dev/mapper/vda4_crypt
+swapon /dev/mapper/vda4_crypt
+
+# vim: set filetype=sh :
diff --git a/debian/tests/initramfs-hook b/debian/tests/initramfs-hook
new file mode 100755
index 0000000..4171102
--- /dev/null
+++ b/debian/tests/initramfs-hook
@@ -0,0 +1,267 @@
+#!/bin/bash
+
+set -eux
+PATH="/usr/bin:/bin:/usr/sbin:/sbin"
+export PATH
+
+TMPDIR="$AUTOPKGTEST_TMP"
+
+# wrappers
+luks1Format() {
+    cryptsetup luksFormat --batch-mode --type=luks1 \
+        --pbkdf-force-iterations=1000 \
+        "$@"
+}
+luks2Format() {
+    cryptsetup luksFormat --batch-mode --type=luks2 \
+        --pbkdf=argon2id --pbkdf-force-iterations=4 --pbkdf-memory=32 \
+        "$@"
+}
+diff() { command diff --color=auto --text "$@"; }
+
+# create disk image
+CRYPT_IMG="$TMPDIR/disk.img"
+CRYPT_DEV=""
+install -m0600 /dev/null "$TMPDIR/keyfile"
+disk_setup() {
+    local lo
+    for lo in $(losetup -j "$CRYPT_IMG" | cut -sd: -f1); do
+        losetup -d "$lo"
+    done
+    dd if="/dev/zero" of="$CRYPT_IMG" bs=1M count=64
+    CRYPT_DEV="$(losetup --find --show -- "$CRYPT_IMG")"
+}
+
+# custom initramfs-tools configuration (to speed things up -- we use
+# COMPRESS=zstd since it's reasonably fast and COMPRESS=none is not
+# supported)
+mkdir "$TMPDIR/initramfs-tools"
+mkdir "$TMPDIR/initramfs-tools/conf.d" \
+      "$TMPDIR/initramfs-tools/scripts" \
+      "$TMPDIR/initramfs-tools/hooks"
+cat >"$TMPDIR/initramfs-tools/initramfs.conf" <<-EOF
+	COMPRESS=zstd
+	MODULES=list
+	RESUME=none
+	UMASK=0077
+EOF
+
+INITRD_IMG="$TMPDIR/initrd.img"
+INITRD_DIR="$TMPDIR/initrd"
+cleanup_initrd_dir() {
+    local d
+    for d in dev proc sys; do
+        mountpoint -q "$INITRD_DIR/$d" && umount "$INITRD_DIR/$d" || true
+    done
+    rm -rf --one-file-system -- "$INITRD_DIR"
+}
+trap cleanup_initrd_dir EXIT INT TERM
+
+mkinitramfs() {
+    local d
+    command mkinitramfs -d "$TMPDIR/initramfs-tools" -o "$INITRD_IMG"
+    # `mkinitramfs -k` would be better but we can't set $DESTDIR in advance
+    cleanup_initrd_dir
+    command unmkinitramfs "$INITRD_IMG" "$INITRD_DIR"
+    for d in dev proc sys; do
+        mkdir -p "$INITRD_DIR/$d"
+        mount --bind "/$d" "$INITRD_DIR/$d"
+    done
+}
+check_initrd_crypttab() {
+    local rv=0 err="${1+": $1"}"
+    diff --label=a/cryptroot/crypttab --label=b/cryptroot/crypttab \
+        --unified --ignore-space-change \
+        -- - "$INITRD_DIR/cryptroot/crypttab" || rv=$?
+    if [ $rv -ne 0 ]; then
+        printf "ERROR$err in file %s line %d\\n" "${BASH_SOURCE[0]}" ${BASH_LINENO[0]} >&2
+        exit 1
+    fi
+}
+
+
+#######################################################################
+# make sure /cryptroot/crypttab is empty when nothing needs to be unclocked early
+
+disk_setup
+cat /proc/sys/kernel/random/uuid >"$TMPDIR/passphrase"
+luks2Format -- "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup luksOpen "$CRYPT_DEV" test0_crypt <"$TMPDIR/passphrase"
+cat >/etc/crypttab <<-EOF
+	test0_crypt $CRYPT_DEV none
+EOF
+
+mkinitramfs
+# make sure cryptsetup exists and doesn't crash (for instance due to missing libraries) in initrd
+chroot "$INITRD_DIR" cryptsetup --version
+test -f "$INITRD_DIR/lib/cryptsetup/askpass" || exit 1
+check_initrd_crypttab </dev/null
+
+
+#######################################################################
+# 'initramfs' crypttab option
+
+cat >/etc/crypttab <<-EOF
+	test0_crypt $CRYPT_DEV none initramfs
+EOF
+
+mkinitramfs
+chroot "$INITRD_DIR" cryptsetup luksOpen --test-passphrase "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup close test0_crypt
+check_initrd_crypttab <<-EOF
+	test0_crypt UUID=$(blkid -s UUID -o value "$CRYPT_DEV") none initramfs
+EOF
+
+
+#######################################################################
+# KEYFILE_PATTERN
+
+disk_setup
+cat /proc/sys/kernel/random/uuid >"$TMPDIR/passphrase"
+luks2Format -- "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup luksOpen "$CRYPT_DEV" test1_crypt <"$TMPDIR/passphrase"
+cat >/etc/crypttab <<-EOF
+	test1_crypt $CRYPT_DEV $TMPDIR/keyfile initramfs
+EOF
+
+echo KEYFILE_PATTERN="$TMPDIR/keyfile" >>/etc/cryptsetup-initramfs/conf-hook
+tr -d '\n' <"$TMPDIR/passphrase" >"$TMPDIR/keyfile"
+mkinitramfs
+check_initrd_crypttab <<-EOF
+	test1_crypt UUID=$(blkid -s UUID -o value "$CRYPT_DEV") /cryptroot/keyfiles/test1_crypt.key initramfs
+EOF
+test -f "$INITRD_DIR/cryptroot/keyfiles/test1_crypt.key" || exit 1
+chroot "$INITRD_DIR" cryptsetup luksOpen --test-passphrase --key-file="/cryptroot/keyfiles/test1_crypt.key" "$CRYPT_DEV"
+cryptsetup close test1_crypt
+
+
+#######################################################################
+# ASKPASS
+
+disk_setup
+cat /proc/sys/kernel/random/uuid >"$TMPDIR/passphrase"
+luks2Format -- "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup luksOpen "$CRYPT_DEV" test2_crypt <"$TMPDIR/passphrase"
+cat >/etc/crypttab <<-EOF
+	test2_crypt $CRYPT_DEV none initramfs
+EOF
+
+# interactive unlocking forces ASKPASS=y
+echo ASKPASS=n >/etc/cryptsetup-initramfs/conf-hook
+mkinitramfs
+test -f "$INITRD_DIR/lib/cryptsetup/askpass" || exit 1
+
+# check that unlocking via keyscript doesn't copy askpass
+cat >/etc/crypttab <<-EOF
+	test2_crypt $CRYPT_DEV foobar initramfs,keyscript=passdev
+EOF
+mkinitramfs
+! test -f "$INITRD_DIR/lib/cryptsetup/askpass" || exit 1
+test -f "$INITRD_DIR/lib/cryptsetup/scripts/passdev" || exit 1
+
+# check that unlocking via keyfile doesn't copy askpass
+echo KEYFILE_PATTERN="$TMPDIR/keyfile" >>/etc/cryptsetup-initramfs/conf-hook
+tr -d '\n' <"$TMPDIR/passphrase" >"$TMPDIR/keyfile"
+cat >/etc/crypttab <<-EOF
+	test2_crypt $CRYPT_DEV $TMPDIR/keyfile initramfs
+EOF
+mkinitramfs
+! test -f "$INITRD_DIR/lib/cryptsetup/askpass" || exit 1
+chroot "$INITRD_DIR" cryptsetup luksOpen --test-passphrase --key-file="/cryptroot/keyfiles/test2_crypt.key" "$CRYPT_DEV"
+cryptsetup close test2_crypt
+
+
+#######################################################################
+# legacy ciphers and hashes
+# see https://salsa.debian.org/cryptsetup-team/cryptsetup/-/merge_requests/31
+
+# LUKS2, blowfish
+disk_setup
+cat /proc/sys/kernel/random/uuid >"$TMPDIR/passphrase"
+luks2Format --cipher="blowfish" -- "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup luksOpen "$CRYPT_DEV" test3_crypt <"$TMPDIR/passphrase"
+echo "test3_crypt UUID=$(blkid -s UUID -o value "$CRYPT_DEV") none initramfs" >/etc/crypttab
+mkinitramfs
+legacy_so="$(find "$INITRD_DIR" -xdev -type f -path "*/ossl-modules/legacy.so")"
+test -z "$legacy_so" || exit 1 # legacy ciphers don't need legacy.so
+chroot "$INITRD_DIR" cryptsetup luksOpen --test-passphrase "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup close test3_crypt
+
+# plain, blowfish + ripemd160 (ignored due to keyfile)
+disk_setup
+head -c32 /dev/urandom >"$TMPDIR/keyfile"
+cryptsetup open --type=plain --cipher="blowfish" --key-file="$TMPDIR/keyfile" --size=256 --hash="ripemd160" "$CRYPT_DEV" test3_crypt
+mkfs.ext2 -m0 /dev/mapper/test3_crypt
+echo "test3_crypt $CRYPT_DEV $TMPDIR/keyfile plain,cipher=blowfish,hash=ripemd160,size=256,initramfs" >/etc/crypttab
+mkinitramfs
+legacy_so="$(find "$INITRD_DIR" -xdev -type f -path "*/ossl-modules/legacy.so")"
+test -z "$legacy_so" || exit 1 # don't need legacy.so here
+volume_key="$(dmsetup table --target crypt --showkeys -- test3_crypt | cut -s -d' ' -f5)"
+test -n "$volume_key" || exit 1
+cryptsetup close test3_crypt
+chroot "$INITRD_DIR" /scripts/local-top/cryptroot
+test -b /dev/mapper/test3_crypt || exit 1
+volume_key2="$(dmsetup table --target crypt --showkeys -- test3_crypt | cut -s -d' ' -f5)"
+test "$volume_key" = "$volume_key2" || exit 1
+cryptsetup close test3_crypt
+
+# plain, ripemd160
+disk_setup
+cat /proc/sys/kernel/random/uuid >"$TMPDIR/passphrase"
+cryptsetup open --type=plain --cipher="aes-cbc-essiv:sha256" --size=256 --hash="ripemd160" "$CRYPT_DEV" test3_crypt <"$TMPDIR/passphrase"
+echo "test3_crypt $CRYPT_DEV none plain,cipher=aes-cbc-essiv:sha256,hash=ripemd160,size=256,initramfs" >/etc/crypttab
+mkinitramfs
+legacy_so="$(find "$INITRD_DIR" -xdev -type f -path "*/ossl-modules/legacy.so")"
+test -n "$legacy_so" || exit 1 # checks that we have legacy.so (positive check for the above)
+volume_key="$(dmsetup table --target crypt --showkeys -- test3_crypt | cut -s -d' ' -f5)"
+test -n "$volume_key" || exit 1
+cryptsetup close test3_crypt
+chroot "$INITRD_DIR" cryptsetup open --type=plain --cipher="aes-cbc-essiv:sha256" --size=256 --hash="ripemd160" "$CRYPT_DEV" test3_crypt <"$TMPDIR/passphrase"
+test -b /dev/mapper/test3_crypt || exit 1
+volume_key2="$(dmsetup table --target crypt --showkeys -- test3_crypt | cut -s -d' ' -f5)"
+test "$volume_key" = "$volume_key2" || exit 1
+cryptsetup close test3_crypt
+
+# LUKS1, whirlpool
+disk_setup
+cat /proc/sys/kernel/random/uuid >"$TMPDIR/passphrase"
+luks1Format --hash="whirlpool" -- "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup luksOpen "$CRYPT_DEV" test3_crypt <"$TMPDIR/passphrase"
+echo "test3_crypt $CRYPT_DEV none initramfs" >/etc/crypttab
+mkinitramfs
+chroot "$INITRD_DIR" cryptsetup luksOpen --test-passphrase "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup close test3_crypt
+
+# LUKS2, ripemd160
+disk_setup
+cat /proc/sys/kernel/random/uuid >"$TMPDIR/passphrase"
+luks2Format --hash="ripemd160" -- "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup luksOpen "$CRYPT_DEV" test3_crypt <"$TMPDIR/passphrase"
+echo "test3_crypt $CRYPT_DEV none initramfs" >/etc/crypttab
+mkinitramfs
+chroot "$INITRD_DIR" cryptsetup luksOpen --test-passphrase "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup close test3_crypt
+
+# LUKS2 (detached header), ripemd160
+disk_setup
+cat /proc/sys/kernel/random/uuid >"$TMPDIR/passphrase"
+luks2Format --hash="ripemd160" --header="$TMPDIR/header.img" -- "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup luksOpen --header="$TMPDIR/header.img" "$CRYPT_DEV" test3_crypt <"$TMPDIR/passphrase"
+echo "test3_crypt $CRYPT_DEV none header=$TMPDIR/header.img,initramfs" >/etc/crypttab
+mkinitramfs
+cp -T "$TMPDIR/header.img" "$INITRD_DIR/cryptroot/header.img"
+chroot "$INITRD_DIR" cryptsetup luksOpen --header="/cryptroot/header.img" --test-passphrase "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup close test3_crypt
+rm -f "$TMPDIR/header.img"
+
+# LUKS2 (detached header, missing), ripemd160
+disk_setup
+cat /proc/sys/kernel/random/uuid >"$TMPDIR/passphrase"
+luks2Format --hash="ripemd160" --header="$TMPDIR/header.img" -- "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup luksOpen --header="$TMPDIR/header.img" "$CRYPT_DEV" test3_crypt <"$TMPDIR/passphrase"
+echo "test3_crypt $CRYPT_DEV none header=/nonexistent,initramfs" >/etc/crypttab
+mkinitramfs
+cp -T "$TMPDIR/header.img" "$INITRD_DIR/cryptroot/header.img"
+chroot "$INITRD_DIR" cryptsetup luksOpen --header="/cryptroot/header.img" --test-passphrase "$CRYPT_DEV" <"$TMPDIR/passphrase"
+cryptsetup close test3_crypt
+rm -f "$TMPDIR/header.img"
diff --git a/debian/tests/utils/cryptroot-common b/debian/tests/utils/cryptroot-common
new file mode 100755
index 0000000..a7df37f
--- /dev/null
+++ b/debian/tests/utils/cryptroot-common
@@ -0,0 +1,537 @@
+#!/bin/bash
+
+# Base test file for cryptroot testing in KVM guests
+#
+# Copyright © 2021-2022 Guilhem Moulin <guilhem@debian.org>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+set -eu
+
+TESTNAME="$(basename -- "$0")"
+TESTDIR="$(dirname -- "$0")"
+INTERACTIVE="n" # set to "y" to interact with the guest instead of mocking the session
+export TESTNAME TESTDIR
+
+declare -a EXTRA_REPOS=( "$@" ) # blindly append any extra arguments to sources.list
+START_TIME="$(printf "%(%s)T")"
+
+# Try to create /dev/kvm if missing, for instance in a chroot where /dev isn't managed by udev.
+# Then we can drop root privileges and run the rest of the script as a normal user
+if uid="$(id -u)" && [ $uid -eq 0 ]; then
+    if [ ! -c /dev/kvm ] && mknod -m0600 /dev/kvm c 10 232; then
+        echo "INFO: Created character special file /dev/kvm" >&2
+    fi
+    if [ -z "${AUTOPKGTEST_NORMAL_USER-}" ]; then
+        echo "WARN: \$AUTOPKGTEST_NORMAL_USER is empty or unset, preserving root privileges!" >&2
+    else
+        chown --from="root" -- "$AUTOPKGTEST_NORMAL_USER:" "$AUTOPKGTEST_TMP"
+        if [ -c /dev/kvm ]; then
+            if getent group kvm >/dev/null && chgrp -c kvm /dev/kvm; then
+                # kvm group is created by udev.postinst
+                chmod -c 0660 /dev/kvm
+                usermod -a -G kvm -- "$AUTOPKGTEST_NORMAL_USER"
+            else
+                chown -c -- "$AUTOPKGTEST_NORMAL_USER" "/dev/kvm"
+            fi
+        fi
+        echo "INFO: Dropping root privileges: re-executing as user '$AUTOPKGTEST_NORMAL_USER'" >&2
+        exec runuser -u "$AUTOPKGTEST_NORMAL_USER" -- "$0" "$@"
+        exit 1
+    fi
+fi
+
+set -x
+PATH="/usr/bin:/bin"
+export PATH
+
+if [ -t 1 ]; then
+    # set VT100 autowrap mode (DECAWM)
+    printf '\033[?7h'
+fi
+
+# get src:cryptsetup current version and distribution
+DEB_VERSION="$(dpkg-parsechangelog -SVERSION)"
+DEB_DISTRIBUTION="$(dpkg-parsechangelog -SDistribution)"
+DEB_BUILD_ARCHITECTURE="$(dpkg-architecture -qDEB_BUILD_ARCH)"
+DEB_BUILD_ARCH_BITS="$(dpkg-architecture -qDEB_BUILD_ARCH_BITS)"
+if [ "$DEB_DISTRIBUTION" = "UNRELEASED" ]; then
+    # take Distribution from the previous entry instead
+    DEB_DISTRIBUTION="$(dpkg-parsechangelog -o1 -c1 -SDistribution)" || DEB_DISTRIBUTION="unstable"
+    echo "WARN: Using Distribution: $DEB_DISTRIBUTION instead of UNRELEASED" >&2
+fi
+
+# determine suitable values for the APT repository Origin (for
+# autopkgtests) and URI (used outside autopkgtests) fields
+load_os_release() {
+    local os_release # see os-release(5)
+    [ -e "/etc/os-release" ] && os_release="/etc/os-release" || os_release="/usr/lib/os-release"
+    . "$os_release"
+}
+case "${DISTRIBUTOR_ID:="$(load_os_release && printf "%s" "${ID,,[A-Z]}")"}" in
+    debian) APT_REPO_ORIGIN="Debian"; APT_REPO_URI="http://deb.debian.org/debian";;
+    # suitable values for derivative can be added here
+    *) echo "ERROR: Unknown distributor ID '$DISTRIBUTOR_ID', can't extract APT origin" >&2;
+       exit 1;;
+esac
+
+# QEMU command and default options
+unset QEMU_MACHINE_TYPE QEMU_ACCEL QEMU_CPU_MODEL QEMU_SMP QEMU_MEMORY BOOT
+if [ -c /dev/kvm ] && dd if=/dev/kvm count=0 status=none; then
+    QEMU_ACCEL="kvm"
+else
+    echo "WARN: KVM is not available, guests will be slow!" >&2
+fi
+case "$DEB_BUILD_ARCHITECTURE" in
+    # see `kvm -machine help` and `kvm -cpu help`
+    amd64|i386)
+        BOOT="bios"
+        if [ "$DEB_BUILD_ARCHITECTURE" = "amd64" ]; then
+            QEMU_SYSTEM_CMD="qemu-system-x86_64"
+        else
+            QEMU_SYSTEM_CMD="qemu-system-$DEB_BUILD_ARCHITECTURE"
+        fi
+        QEMU_MACHINE_TYPE="q35"
+        if [ "${QEMU_ACCEL-}" = "kvm" ]; then
+            QEMU_CPU_MODEL="kvm$DEB_BUILD_ARCH_BITS,+aes,+sha-ni"
+        else
+            QEMU_CPU_MODEL="qemu$DEB_BUILD_ARCH_BITS,-svm,-vmx"
+        fi
+    ;;
+    arm64)
+        BOOT="efi"
+        QEMU_SYSTEM_CMD="qemu-system-aarch64"
+        QEMU_MACHINE_TYPE="virt"
+        QEMU_CPU_MODEL="cortex-a72"
+    ;;
+    armhf)
+        BOOT="efi"
+        QEMU_SYSTEM_CMD="qemu-system-arm"
+        QEMU_MACHINE_TYPE="virt"
+        QEMU_CPU_MODEL="cortex-a15"
+    ;;
+    *) echo "ERROR: Unknown architecture $DEB_BUILD_ARCHITECTURE" >&2; exit 1;;
+esac
+
+if ! command -v "$QEMU_SYSTEM_CMD" >/dev/null; then
+    echo "ERROR: Couldn't find $QEMU_SYSTEM_CMD in PATH" >&2
+    exit 1
+fi
+
+CPU_COUNT="$(getconf _NPROCESSORS_ONLN)" && [ -n "$CPU_COUNT" ] || CPU_COUNT=0
+if [ $CPU_COUNT -ge 8 ]; then
+    QEMU_SMP="cpus=4"
+elif [ $CPU_COUNT -ge 4 ]; then
+    QEMU_SMP="cpus=2"
+else
+    QEMU_SMP="cpus=1"
+fi
+
+MEM_AVAIL="$(awk '/MemAvailable/ { printf "%.0f \n", $2/1024^2 }' </proc/meminfo)" && [ -n "$MEM_AVAIL" ] || MEM_AVAIL=0
+if [ $MEM_AVAIL -gt 2 ] && [ $DEB_BUILD_ARCH_BITS -gt 32 ]; then
+    QEMU_MEMORY="size=2G"
+else
+    QEMU_MEMORY="size=1G"
+fi
+
+# number of times to powercycle the guest
+GUEST_POWERCYCLE=0
+
+# kernel flavor
+case "$DEB_BUILD_ARCHITECTURE" in
+    # see `ssh $porterbox.debian.org uname -r`
+    amd64) KERNEL_ARCH="amd64";;
+    arm64) KERNEL_ARCH="arm64";;
+    armhf) KERNEL_ARCH="armmp-lpae";;
+    i386) KERNEL_ARCH="686-pae";;
+    *) echo "ERROR: Unknown architecture $DEB_BUILD_ARCHITECTURE" >&2; exit 1;;
+esac
+
+# at the very least we need a boot loader, a kernel, and an init system
+case "$BOOT" in
+    bios) PKG_BOOTLOADER="grub-pc";;
+    efi) PKG_BOOTLOADER="grub-efi";;
+    *) echo "ERROR unknown boot method '$BOOT'" >&2; exit 1;;
+esac
+PKG_KERNEL="linux-image-$KERNEL_ARCH"
+PKG_INIT="systemd-sysv" # default pid1
+MERGED_USR="" # use default layout for the target version
+declare -a PKGS_EXTRA=() DRIVE_SIZES=( "2G" )
+PKGS_EXTRA+=( "zstd" ) # default initrd compression, see #976054
+
+if [ -f "$TESTDIR/$TESTNAME.d/config" ]; then
+    . "$TESTDIR/$TESTNAME.d/config" || exit 1
+fi
+
+if [ -n "${AUTOPKGTEST_TMP+x}" ] || [ ! -t 0 ] || [ ! -t 1 ]; then
+    INTERACTIVE="n"
+fi
+
+unset EFI_CODE EFI_VARS
+if [ "$BOOT" = "efi" ]; then
+    case "$DEB_BUILD_ARCHITECTURE" in
+        amd64|i386)
+            efi_fw_pkg="ovmf"
+            EFI_CODE="/usr/share/OVMF/OVMF_CODE.fd"
+            EFI_VARS="/usr/share/OVMF/OVMF_VARS.fd"
+        ;;
+        arm64)
+            efi_fw_pkg="qemu-efi-aarch64"
+            EFI_CODE="/usr/share/AAVMF/AAVMF_CODE.fd"
+            EFI_VARS="/usr/share/AAVMF/AAVMF_VARS.fd"
+        ;;
+        armhf)
+            efi_fw_pkg="qemu-efi-arm"
+            EFI_CODE="/usr/share/AAVMF/AAVMF32_CODE.fd"
+            EFI_VARS="/usr/share/AAVMF/AAVMF32_VARS.fd"
+        ;;
+        *) echo "ERROR: Unknown architecture $DEB_BUILD_ARCHITECTURE for EFI boot" >&2; exit 1;;
+    esac
+    for p in "$EFI_CODE" "$EFI_VARS"; do
+        if [ ! -f "$p" ]; then
+            echo "Couldn't find $p, is the '$efi_fw_pkg' package installed?" >&2
+            exit 1
+        fi
+    done
+fi
+
+case "${DEB_DISTRIBUTION%%-*}" in
+    etch|lenny|squeeze|wheezy|jessie|stretch|buster|bullseye)
+        if [ -z "$MERGED_USR" ]; then
+            MERGED_USR="no"
+        fi
+        ;;
+    *)  if [ -z "$MERGED_USR" ]; then
+            MERGED_USR="yes"
+        elif [ "$MERGED_USR" = "no" ]; then
+            # #978636: Debian 12 (codename Bookworm) should only support merged-/usr layout
+            echo "WARN: this system is not supported! (unmerged-/usr)" >&2
+        fi
+        ;;
+esac
+
+# pin versions for all packages in PKGS_EXTRA that are part of this source package
+declare -a MYPKGS
+MYPKGS=( $(sed -nr 's/^Package:\s*//Ip' debian/control) )
+for i in "${!PKGS_EXTRA[@]}"; do
+    [ "${PKGS_EXTRA[i]%[=/]*}" = "${PKGS_EXTRA[i]}" ] || continue
+    for mypkg in "${MYPKGS[@]}"; do
+        if [ "${PKGS_EXTRA[i]}" = "$mypkg" ]; then
+            PKGS_EXTRA[i]="${PKGS_EXTRA[i]}=$DEB_VERSION"
+        fi
+    done
+done
+
+unset QEMU_PID
+TEMPDIR="$(mktemp --tmpdir="${AUTOPKGTEST_TMP:-"${TMPDIR:-/tmp}"}" --directory "$TESTNAME.XXXXXXXXXX")"
+teardown() {
+    local rv=$? ts
+    if [ -n "${QEMU_PID+x}" ]; then
+        kill $QEMU_PID || true
+    fi
+    rm -rf -- "$TEMPDIR"
+    trap - EXIT
+
+    # try to fix terminal
+    [ ! -t 1 ] || printf '\033[?7h'
+
+    ts="$(printf "%(%s)T")"
+    rv=${1-$rv}
+    printf "Result for test '%s': exit status %s, runtime %d seconds\\n" "$TESTNAME" $rv $((ts - START_TIME))
+
+    exit $rv
+}
+trap "teardown" EXIT
+trap "teardown 1" INT TERM
+
+# set up APT for the testbed
+setup_apt() {
+    # we need a new cache to reliably determine essential and extra packages
+    APT_CACHE="$TEMPDIR/apt/cache"
+    APT_LISTS="$TEMPDIR/apt/lists"
+    mkdir -- "$TEMPDIR/apt" "$APT_CACHE" "$APT_LISTS"
+    ln -s "cache/archives" "$TEMPDIR/apt/pool"
+    touch "$TEMPDIR/apt/status"
+
+    if [ -n "${AUTOPKGTEST_TMP-}" ]; then
+        # reuse existing sources.list
+        apt-get indextargets \
+            --format "\$(TARGET_OF) \$(REPO_URI) \$(RELEASE) \$(COMPONENT)" \
+            "Target-Of: deb" "Identifier: Packages" "Origin: $APT_REPO_ORIGIN" \
+            >"$TEMPDIR/apt/sources.list"
+        # local autopkgtest repo has Repo-URI: file:/tmp/autopkgtest.XXXXXX/binaries/ ,
+        # Release: (empty) and no Component:
+        apt-get indextargets \
+            --format "\$(TARGET_OF) \$(REPO_URI) /" \
+            "Target-Of: deb" "Identifier: Packages" "Trusted: Yes" "Release: " \
+            >>"$TEMPDIR/apt/sources.list"
+    else
+        # generate new sources.list
+        case "$DEB_DISTRIBUTION" in
+            experimental) cat <<-EOF
+				deb $APT_REPO_URI unstable main
+				deb $APT_REPO_URI experimental main
+			EOF
+            ;;
+            *-security) cat <<-EOF
+				deb $APT_REPO_URI ${DEB_DISTRIBUTION%-security} main
+				deb $APT_REPO_URI-security $DEB_DISTRIBUTION main
+			EOF
+            ;;
+            *-*) cat <<-EOF
+				deb $APT_REPO_URI ${DEB_DISTRIBUTION%%-*} main
+				deb $APT_REPO_URI $DEB_DISTRIBUTION main
+			EOF
+            ;;
+            *) cat <<-EOF
+				deb $APT_REPO_URI $DEB_DISTRIBUTION main
+			EOF
+            ;;
+        esac >"$TEMPDIR/apt/sources.list"
+    fi
+
+    local apt_repo
+    for apt_repo in "${EXTRA_REPOS[@]}"; do
+        printf "%s\\n" "$apt_repo" >>"$TEMPDIR/apt/sources.list"
+    done
+
+    # replace file: URIs with copy: as we rely on --download-only copying .deb files to APT's cache
+    sed -ri 's/^(deb\S*)\s+\[([^]]+)\]\s+file:/\1 [\2,trusted=yes] copy:/;
+             s/^(deb\S*)\s+file:/\1 [trusted=yes] copy:/' \
+        -- "$TEMPDIR/apt/sources.list"
+
+    apt-update
+}
+
+# wrapper arround `apt-get install --download-only`
+# (we don't use `--print-uris` since it doesn't include what's been
+# included already)
+apt-download() {
+    _apt get install --download-only "$@"
+}
+apt-update() {
+    _apt get -o Acquire::Languages="none" update
+}
+apt-show() {
+    _apt cache show "$@"
+}
+_apt() {
+    local cmd="$1"
+    shift
+    env -i DEBIAN_FRONTEND="noninteractive" \
+    "apt-$cmd" \
+            -o APT::Architecture="$DEB_BUILD_ARCHITECTURE" \
+            -o APT::Architectures="$DEB_BUILD_ARCHITECTURE" \
+            -o APT::Get::Assume-Yes=true \
+            -o APT::Install-Recommends=false \
+            -o Dir::Cache="$APT_CACHE" \
+            -o Dir::Etc::SourceList="$TEMPDIR/apt/sources.list" \
+            -o Dir::Etc::SourceParts="" \
+            -o Dir::State::Lists="$APT_LISTS" \
+            -o Dir::State::Status="$TEMPDIR/apt/status" \
+            ${AUTOPKGTEST_TMP+-o Dir::Etc::Preferences="/etc/apt/preferences" -o Dir::Etc::PreferencesParts="/etc/apt/preferences.d/"} \
+            "$@"
+}
+
+
+# create a disk image with essential and extra packages
+create_debian_img() {
+    local img="$1" dir size deb usr_is_merged
+
+    dir="$(mktemp --tmpdir="$TEMPDIR" --directory debian.XXXXXXXXXX)"
+    mkdir -- "$dir/dists" "$dir/pool"
+
+    # TODO remove this once Bookworm is released, assuming
+    # init-system-helpers no longer has "Depends: usrmerge | usr-is-merged"
+    [ "$MERGED_USR" = "yes" ] && usr_is_merged="usr-is-merged" || usr_is_merged=""
+
+    # apt considers itself essential so we explicitely exclude it for stage1
+    mkdir -- "$dir/__stage1__"
+    apt-download -- "?and(?essential, ?not(?exact-name(apt)))" ${usr_is_merged:+"$usr_is_merged"}
+    for deb in "$APT_CACHE"/archives/*.deb; do
+        ln -sT "../pool/${deb##*/}" "$dir/__stage1__/${deb##*/}"
+    done
+
+    # useless for stage1
+    rm -f "$dir"/__stage1__/usr-is-merged_*.deb "$dir"/__stage1__/usrmerge_*.deb
+
+    mkdir -- "$dir/__essential__"
+    apt-download -- "?essential" "apt" ${usr_is_merged:+"$usr_is_merged"}
+    for deb in "$APT_CACHE"/archives/*.deb; do
+        ln -sT "../pool/${deb##*/}" "$dir/__essential__/${deb##*/}"
+    done
+
+    makedist "$dir"
+    extract_kernel "$TEMPDIR/linux-image"
+
+    # for `dpkg --update-avail`
+    ( cd "$dir/__essential__" && dpkg-scanpackages . >./Packages )
+
+    size="$(du -sb -- "$dir")"
+    size=$(( ${size%%[!0-9]*} / 1000 )) # approx 97% (1000/1024) full
+    genext2fs -qm0 -B 1024 -b "$size" -d "$dir" -L "debian_dist" "$img"
+    rm -rf -- "$dir"
+}
+makedist() {
+    local basedir="$1"
+    local distdir="$basedir/dists"
+    apt-download -- "?essential" "apt" ${usr_is_merged:+"$usr_is_merged"} \
+        "$PKG_BOOTLOADER" "$PKG_KERNEL" "$PKG_INIT" \
+        "${PKGS_EXTRA[@]}"
+    rm -f -- "$APT_CACHE/archives/$PKG_KERNEL"_*.deb # remove the generic .deb (only keep its dependency with versioned ABI)
+    for deb in "$APT_CACHE"/archives/*.deb; do
+        # assume no file conflicts and override existing .debs
+        ln -ft "$basedir/pool" -- "$deb"
+    done
+    ( cd "$APT_CACHE" && dpkg-scanpackages ../pool >"$distdir/Packages" )
+}
+
+# extract kernel to $TEMPDIR/linux-image and sets KERNEL_VERSION
+extract_kernel() {
+    local destdir="$1" deb_version_regex kernel_deb_regex
+    deb_version_regex="[0-9][A-Za-z0-9.+:~-]*" # per deb-version(7)
+    # we use may a kernel version other than what we're running, however the arch much be the same
+    kernel_deb_regex="linux-image-[0-9][a-z0-9.+-]*-${KERNEL_ARCH}_${deb_version_regex}_${DEB_BUILD_ARCHITECTURE}.deb"
+    KERNEL_DEB="$(find -P "$APT_CACHE/archives" -mindepth 1 -maxdepth 1 \
+        -regextype egrep -regex ".*/$kernel_deb_regex" -type f -printf "%P\\n" | \
+        sort -Vt_ -k2 | tail -n1)"
+    KERNEL_VERSION="${KERNEL_DEB#linux-image-*}"
+    KERNEL_VERSION="${KERNEL_VERSION%%_*}"
+
+    # extract the kernel of the .deb we downloaded
+    if [ ! -f "$APT_CACHE/archives/$KERNEL_DEB" ]; then
+        echo "ERROR: Couldn't find .deb for target kernel $KERNEL_VERSION" >&2
+        exit 1
+    fi
+
+    mkdir "$destdir"
+    dpkg-deb --fsys-tarfile "$APT_CACHE/archives/$KERNEL_DEB" | tar -C "$destdir" -xf- \
+        "./boot/vmlinuz-$KERNEL_VERSION" \
+        "./lib/modules/$KERNEL_VERSION"
+    ln -T -- "$destdir/boot/vmlinuz-$KERNEL_VERSION" "$TEMPDIR/vmlinuz-$KERNEL_VERSION"
+}
+
+# make sure the desired version of the package is available in the testbed
+setup_apt
+if ! apt-show "cryptsetup-bin=$DEB_VERSION" >"$TEMPDIR/out" || [ ! -s "$TEMPDIR/out" ]; then
+    apt-show -a "cryptsetup-bin" || true
+    echo "ERROR: Cannot find version $DEB_VERSION of package cryptsetup-bin" >&2
+    exit 1
+fi
+
+DEBIAN_IMG="$TEMPDIR/$DEB_DISTRIBUTION-$DEB_BUILD_ARCHITECTURE.img"
+create_debian_img "$DEBIAN_IMG"
+
+case "$DEB_BUILD_ARCHITECTURE" in
+    arm64|armhf) CONSOLE="ttyAMA0";;
+    *) CONSOLE="ttyS0";;
+esac
+
+env PACKAGES="$PKG_BOOTLOADER linux-image-$KERNEL_VERSION $PKG_INIT ${PKGS_EXTRA[*]}" \
+    BOOT="$BOOT" \
+    CONSOLE="$CONSOLE" \
+    ARCH="$DEB_BUILD_ARCHITECTURE" \
+    MERGED_USR="$MERGED_USR" \
+    "$TESTDIR/utils/mkinitramfs" "$TEMPDIR/linux-image" "$KERNEL_VERSION" "$TEMPDIR/initrd.img-$KERNEL_VERSION"
+rm -rf -- "$TEMPDIR/apt" "$TEMPDIR/linux-image" # don't need that anymore
+
+declare -a QEMU_COMMON_ARGS=(
+    -no-user-config
+    -nodefaults
+    -name "autopkgtest-cryptsetup-$TESTNAME"
+    -machine "${QEMU_MACHINE_TYPE:+"type=$QEMU_MACHINE_TYPE,"}${QEMU_ACCEL:+"accel=$QEMU_ACCEL,"}graphics=off"
+    ${QEMU_CPU_MODEL:+-cpu "$QEMU_CPU_MODEL"}
+    ${QEMU_SMP:+-smp "$QEMU_SMP"}
+    ${QEMU_MEMORY:+-m "$QEMU_MEMORY"}
+    -vga none
+    -display none
+    -object "rng-random,id=rng0,filename=/dev/urandom" -device "virtio-rng-pci,rng=rng0"
+    -boot "order=c,strict=on"
+)
+
+for ((i=0; i < ${#DRIVE_SIZES[@]}; i++)); do
+    drive_img="$TEMPDIR/drive$i.img"
+    fallocate -l "${DRIVE_SIZES[i]}" "$drive_img"
+    QEMU_COMMON_ARGS+=(
+        -drive "file=$drive_img,format=raw,cache=unsafe,if=virtio,index=$i,media=disk"
+    )
+done
+
+if [ "$BOOT" = "efi" ]; then
+    # $EFI_VARS needs to be writable so guests can update their variables
+    install -Tm0644 -- "$EFI_VARS" "$TEMPDIR/efivars.fd"
+    QEMU_COMMON_ARGS+=(
+        -drive "file=$EFI_CODE,format=raw,if=pflash,unit=0,read-only=on"
+        -drive "file=$TEMPDIR/efivars.fd,format=raw,if=pflash,unit=1"
+    )
+fi
+
+LOGDIR="$TEMPDIR"
+SOCKETDIR="$TEMPDIR"
+if [ "$INTERACTIVE" != "y" ]; then
+    QEMU_COMMON_ARGS+=(
+        -device "virtio-serial"
+        -chardev "socket,id=hvc0,path=$SOCKETDIR/hvc0,server=on,wait=off,logfile=$LOGDIR/hvc0.log,logappend=on"
+        -device "virtconsole,chardev=hvc0"
+    )
+fi
+
+declare QEMU_STDIO_ARGS=(
+    # setup is always fully unattended
+    -chardev "stdio,id=char0,mux=on,logfile=$LOGDIR/qemu.log,logappend=on"
+    -serial "chardev:char0"
+    -mon "chardev=char0,mode=readline"
+)
+if [ "$INTERACTIVE" != "y" ] || [ -n "${AUTOPKGTEST_TMP+x}" ]; then
+    # XXX if KVM is detected we could reduce the timeout to 300s or so
+    QEMU_TIMEOUT="y"
+    exec </dev/null
+else
+    QEMU_TIMEOUT=""
+fi
+
+QEMU_DEBIANIMG_DRIVE="file=$DEBIAN_IMG,format=raw,if=virtio,readonly=on,media=cdrom"
+${QEMU_TIMEOUT:+timeout 3600s} "$QEMU_SYSTEM_CMD" \
+    "${QEMU_COMMON_ARGS[@]}" "${QEMU_STDIO_ARGS[@]}" \
+    -drive "$QEMU_DEBIANIMG_DRIVE" \
+    -kernel "$TEMPDIR/vmlinuz-$KERNEL_VERSION" \
+    -append "console=$CONSOLE,115200n8" \
+    -initrd "$TEMPDIR/initrd.img-$KERNEL_VERSION" \
+    || exit $?
+
+if [ "$INTERACTIVE" = "y" ]; then
+    for ((i=0; i <= GUEST_POWERCYCLE; i++)); do
+        "$QEMU_SYSTEM_CMD" \
+            "${QEMU_COMMON_ARGS[@]}" "${QEMU_STDIO_ARGS[@]}" \
+            -netdev "user,id=net0" -device "virtio-net-pci,netdev=net0"
+    done
+else
+    for ((i=0; i <= GUEST_POWERCYCLE; i++)); do
+        ${QEMU_TIMEOUT:+timeout 900s} "$QEMU_SYSTEM_CMD" \
+            "${QEMU_COMMON_ARGS[@]}" \
+            -chardev "socket,id=mon0,path=$SOCKETDIR/mon0,server=on,wait=off,logfile=$LOGDIR/mon0.log,logappend=on" \
+            -mon "chardev=mon0,mode=control" \
+            -chardev "socket,id=ttyS0,path=$SOCKETDIR/ttyS0,server=on,wait=on,logfile=$LOGDIR/ttyS0.log,logappend=on" \
+            -serial "chardev:ttyS0" \
+            &
+        QEMU_PID=$!
+        "$TESTDIR/$TESTNAME.d/mock" "$i" "$SOCKETDIR" || exit 1
+        wait $QEMU_PID && rv=0 || rv=$?
+        unset QEMU_PID
+        [ $rv -eq 0 ] || exit $rv
+    done
+fi
+
+echo "PASSED"
+exit 0
diff --git a/debian/tests/utils/debootstrap b/debian/tests/utils/debootstrap
new file mode 100755
index 0000000..258be5a
--- /dev/null
+++ b/debian/tests/utils/debootstrap
@@ -0,0 +1,125 @@
+#!/bin/sh
+
+# Debootstrap a target system
+#
+# Copyright © 2021-2022 Guilhem Moulin <guilhem@debian.org>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+set -eu
+PATH="/usr/sbin:/usr/bin:/sbin:/bin"
+export PATH
+
+ESSENTIAL="/media/__essential__"
+TEMPDIR="$(mktemp --tmpdir --directory "debootstrap.XXXXXXXXXX")"
+trap "rm -rf -- \"$TEMPDIR\"" EXIT INT TERM
+
+sed -rn "/^Package:\\s*/I {s///;s/$/ install/p}" "$ESSENTIAL/Packages" >"$TEMPDIR/Packages.sel"
+
+install -m0644 /dev/null "/var/lib/dpkg/status"
+dpkg --update-avail "$ESSENTIAL/Packages"
+dpkg --set-selections <"$TEMPDIR/Packages.sel"
+
+mkdir -- "$TEMPDIR/dpkg"
+mkdir -- "$TEMPDIR/dpkg/files" "$TEMPDIR/dpkg/depends" "$TEMPDIR/dpkg/pre-depends"
+
+# extract metadata (package names, file names, Depends and Pre-Depends
+# for easier processing)
+for deb in "$ESSENTIAL"/*.deb; do
+    pkg=$(dpkg-deb --show --showformat="\${Package}" "$deb")
+    case "$pkg" in
+        # special case: base-files Pre-Depends on awk but we only have mawk (or gawk)
+        mawk|gawk) pkg="awk";;
+    esac
+    printf "%s\\n" "$pkg" >>"$TEMPDIR/dpkg/avail"
+    printf "%s\\n" "$deb" >"$TEMPDIR/dpkg/files/$pkg"
+    dpkg-deb --show --showformat="\${Pre-Depends}\\n" "$deb" >"$TEMPDIR/predeps"
+    dpkg-deb --show --showformat="\${Depends}\\n" "$deb" >"$TEMPDIR/deps"
+    sed -ri "s/,\\s*/\\n/g" -- "$TEMPDIR/predeps" "$TEMPDIR/deps"
+    sed -i "s/[[:blank:]:].*//; /^[[:blank:]]*$/d" -- "$TEMPDIR/predeps" "$TEMPDIR/deps"
+    mv -T -- "$TEMPDIR/predeps" "$TEMPDIR/dpkg/pre-depends/$pkg"
+    mv -T -- "$TEMPDIR/deps" "$TEMPDIR/dpkg/depends/$pkg"
+done
+
+if [ -L /bin ] && [ -L /sbin ] && [ -L /lib ]; then
+    # TODO remove this once Bookworm is released, assuming
+    # init-system-helpers no longer has "Depends: usrmerge | usr-is-merged"
+    sed -i "s/^usrmerge$/usr-is-merged/" -- "$TEMPDIR/dpkg/depends/init-system-helpers"
+fi
+
+# recursively append dependencies to $OUT; abort and return 1 if one of
+# the (recursive) dependency has an unsatisfied Pre-Depends
+resolve_deps() {
+    local pkg="$1" dep
+    while read -r dep; do
+        if grep -Fxq -e "$dep" <"$TEMPDIR/dpkg/avail"; then
+            # $pkg has an unsatisfied Pre-Depends, can't proceed further
+            return 1
+        fi
+    done <"$TEMPDIR/dpkg/pre-depends/$pkg"
+    while read -r dep; do
+        if grep -Fxq -e "$dep" <"$TEMPDIR/dpkg/avail" && ! grep -Fxq -e "$dep" <"$OUT"; then # break cycles
+            printf "%s\\n" "$dep" >>"$OUT"
+            resolve_deps "$dep" || return $?
+        fi
+    done <"$TEMPDIR/dpkg/depends/$pkg"
+    return 0
+}
+
+# dump to $OUT a list of packages that can be installed (only packages
+# without unsatisfied pre-dependencies, and typically packages that are
+# pre-dependencies of other packages) -- using `dpkg --predep-package`
+# would be convenient but it doesn't work with recursive dependencies,
+# cf. #539133
+can_install_next() {
+    local pkg
+    while read -r pkg; do
+        printf "%s\\n" "$pkg" >"$OUT"
+        if resolve_deps "$pkg"; then
+            return 0
+        fi
+    done <"$TEMPDIR/dpkg/avail"
+
+    echo "PANIC: No remaining dependencies are satisfiable!" >&2
+    cat <"$TEMPDIR/dpkg/avail" >&2
+    exit 1
+}
+
+# keep going until all available packages are installed
+OUT="$TEMPDIR/pkg.list"
+XARGS_IN="$TEMPDIR/deb.list"
+while [ -s "$TEMPDIR/dpkg/avail" ]; do
+    can_install_next || exit 1
+
+    echo -n ">>> Installing: " >&2
+    paste -sd" " <"$OUT" >&2
+
+    while read -r pkg; do
+        cat "$TEMPDIR/dpkg/files/$pkg"
+    done <"$OUT" >"$XARGS_IN"
+    xargs -a"$XARGS_IN" -d"\\n" dpkg -i
+
+    grep -Fx -vf "$OUT" <"$TEMPDIR/dpkg/avail" >"$TEMPDIR/dpkg/avail.new" || true
+    mv -T -- "$TEMPDIR/dpkg/avail.new" "$TEMPDIR/dpkg/avail"
+done
+
+echo apt apt >/var/lib/dpkg/cmethopt
+echo "deb [trusted=yes] file:/media/dists /" >/etc/apt/sources.list
+cat >/etc/apt/apt.conf.d/99debootstrap <<-EOF
+	Acquire::Languages "none";
+	APT::Install-Recommends "false";
+	APT::Install-Suggests "false";
+EOF
+
+apt-get -oAcquire::Languages="none" -oAPT::Sandbox::User="root" -qq update
diff --git a/debian/tests/utils/init b/debian/tests/utils/init
new file mode 100755
index 0000000..242a0c5
--- /dev/null
+++ b/debian/tests/utils/init
@@ -0,0 +1,273 @@
+#!/bin/sh
+
+# PID1 at initramfs stage
+#
+# Copyright © 2021-2022 Guilhem Moulin <guilhem@debian.org>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+set -eux
+PATH="/usr/sbin:/usr/bin:/sbin:/bin"
+export PATH
+
+trap "echo \"ALERT!  Couldn't setup system, dropping to a shell.\" >&2; sh -i" 0
+
+# set VT100 autowrap mode again (QEMU might mess the terminal up)
+printf '\033[?7h'
+
+mount -t devtmpfs -o noexec,nosuid,mode=0755 udev /dev
+
+mkdir /dev/pts /proc /run /sys
+mount -t devpts -o noexec,nosuid,gid=5,mode=0620 devpts /dev/pts
+mount -t proc -o nodev,noexec,nosuid proc /proc
+mount -t tmpfs -o nodev,noexec,nosuid,size=5%,mode=0755 tmpfs /run
+mount -t sysfs -o nodev,noexec,nosuid sysfs /sys
+
+modprobe virtio_rng # /dev/hwrng (avoid entropy starvation)
+modprobe virtio_pci
+modprobe virtio_blk # /dev/vd[a-z]
+modprobe virtio_console # /dev/hvc[0-7]
+
+# start udevd
+/lib/systemd/systemd-udevd --daemon
+udevadm trigger --type=subsystems --action=add
+udevadm trigger --type=devices --action=add
+udevadm settle
+
+. /init.conf
+
+# https://en.wikipedia.org/wiki/GUID_Partition_Table#Partition_type_GUIDs
+GUID_TYPE_MBR="024DEE41-33E7-11D3-9D69-0008C781F39F"       # MBR partition scheme
+GUID_TYPE_EFI="C12A7328-F81F-11D2-BA4B-00A0C93EC93B"       # EFI boot partition
+GUID_TYPE_BIOS_boot="21686148-6449-6E6F-744E-656564454649" # BIOS boot partition
+GUID_TYPE_Linux_FS="0FC63DAF-8483-4772-8E79-3D69D8477DE4"  # Linux filesystem data
+GUID_TYPE_LUKS="CA7D7CCB-63ED-4C53-861C-1742536059CC"      # LUKS partition
+GUID_TYPE_DMCRYPT="7FFEC5C9-2D00-49B7-8941-3EA10A5586B7"   # Plain dm-crypt partition
+GUID_TYPE_LVM="E6D6D379-F507-44C2-A23C-238F2A3DF928"       # Logical Volume Manager partition
+GUID_TYPE_RAID="A19D880F-05FC-4D3B-A006-743F0F84911E"      # RAID partition
+
+if [ "$BOOT" = "bios" ]; then
+    BOOT_PARTITION_SIZE=2
+    BOOT_PARTITION_TYPE="$GUID_TYPE_BIOS_boot"
+elif [ "$BOOT" = "efi" ]; then
+    BOOT_PARTITION_SIZE=63
+    BOOT_PARTITION_TYPE="$GUID_TYPE_EFI"
+else
+    echo "ERROR unknown boot method '$BOOT'" >&2
+    exit 1
+fi
+
+# format the target disk and create a BIOS/EFI partition
+sfdisk /dev/vda <<-EOF
+	label: gpt
+	unit: sectors
+
+	start=$((1024*2)), size=$((BOOT_PARTITION_SIZE*1024*2)), type=$BOOT_PARTITION_TYPE
+EOF
+udevadm settle
+
+ROOT="/target"
+mkdir -m0755 "$ROOT"
+# /init.setup is expected to create the root filesystem of the target
+# system and mount it (alongside other filesystems) on $ROOT
+. /init.setup
+udevadm settle
+
+# inspired by debootstrap's /usr/share/debootstrap/functions
+if [ "$MERGED_USR" = "yes" ]; then
+    case "$ARCH" in
+        amd64) libdir="lib32 lib64 libx32";;
+        i386) libdir="lib64 libx32";;
+        mips|mipsel) libdir="lib32 lib64";;
+        mips64*|mipsn32*) libdir="lib32 lib64 libo32";;
+        loongarch64*) libdir="lib32 lib64";;
+        powerpc) libdir="lib64";;
+        ppc64) libdir="lib32 lib64";;
+        ppc64el) libdir="lib64";;
+        s390x) libdir="lib32";;
+        sparc) libdir="lib64";;
+        sparc64) libdir="lib32 lib64";;
+        x32) libdir="lib32 lib64 libx32";;
+        *) libdir="";;
+    esac
+    for dir in bin sbin lib $libdir; do
+        ln -s "usr/$dir" "$ROOT/$dir"
+        mkdir -p "$ROOT/usr/$dir"
+    done
+fi
+
+mkdir /media
+DEBIAN_DIST="$(blkid -l -t LABEL="debian_dist" -o device)"
+mount -t ext2 -o ro "$DEBIAN_DIST" /media
+for pkg in /media/__stage1__/*.deb; do
+    dpkg-deb --fsys-tarfile "$pkg" | tar -C "$ROOT" -xf - --keep-directory-symlink
+done
+
+# setup hosts(5) and hostname(5)
+echo "$HOSTNAME" >"$ROOT/etc/hostname"
+echo "127.0.0.1 localhost $HOSTNAME" >"$ROOT/etc/hosts"
+
+# EFI
+if [ "$BOOT" = "efi" ]; then
+    modprobe efivarfs
+    mount -t efivarfs efivarfs /sys/firmware/efi/efivars
+
+    mkfs.vfat -F 32 /dev/vda1
+    mkdir "$ROOT/boot/efi"
+    mount -t vfat /dev/vda1 "$ROOT/boot/efi"
+
+    cat >>"$ROOT/etc/fstab" <<-EOF
+		UUID=$(blkid -s UUID -o value /dev/vda1) /boot/efi auto defaults 0 2
+	EOF
+fi
+
+# bind mount pseudo and temporary filesystems to "$ROOT"
+mount -no bind /dev "$ROOT/dev"
+mount -no bind /proc "$ROOT/proc"
+mount -no bind /sys "$ROOT/sys"
+mount -t tmpfs -o nodev,noexec,nosuid,size=5%,mode=0755 tmpfs "$ROOT/run"
+
+# prevent any services from starting during package installation, taken
+# from debootstrap(8)
+cat >"$ROOT/usr/sbin/policy-rc.d" <<-EOF
+	#!/bin/sh
+	exit 101
+EOF
+chmod +x "$ROOT/usr/sbin/policy-rc.d"
+
+mv "$ROOT/sbin/start-stop-daemon" "$ROOT/sbin/start-stop-daemon.REAL"
+cat >"$ROOT/sbin/start-stop-daemon" <<-EOF
+	#!/bin/sh
+	echo
+	echo "Warning: Fake start-stop-daemon called, doing nothing"
+EOF
+chmod +x "$ROOT/usr/sbin/policy-rc.d" "$ROOT/sbin/start-stop-daemon"
+
+DEBIAN_FRONTEND="noninteractive"
+DEBCONF_NONINTERACTIVE_SEEN="true"
+export DEBIAN_FRONTEND DEBCONF_NONINTERACTIVE_SEEN
+
+# debootstrap the target system
+mkdir "$ROOT/media"
+mount -no move /media "$ROOT/media"
+cp -p /debootstrap "$ROOT/debootstrap"
+chroot "$ROOT" /debootstrap
+rm -f "$ROOT/debootstrap"
+
+# use MODULES=dep (if it works with fewer modules then it also works
+# with the default MODULES=most)
+mkdir -p "$ROOT/etc/initramfs-tools/conf.d"
+echo "MODULES=dep" >"$ROOT/etc/initramfs-tools/conf.d/modules"
+
+cp /init.preinst "$ROOT/init.preinst"
+chroot "$ROOT" /bin/sh -eux /init.preinst
+rm -f "$ROOT/init.preinst"
+udevadm settle
+
+# install extra packages
+chroot "$ROOT" apt-get -oAPT::Sandbox::User="root" install --yes $PACKAGES
+rm -f "$ROOT/etc/apt/sources.list"
+
+# configure and install GRUB
+cat >"$ROOT/etc/default/grub" <<-EOF
+	GRUB_DEFAULT=0
+	GRUB_TIMEOUT=0
+	GRUB_CMDLINE_LINUX_DEFAULT=""
+	GRUB_CMDLINE_LINUX="console=$CONSOLE,115200n8"
+	GRUB_DISABLE_RECOVERY=true
+	GRUB_TERMINAL="console serial"
+	GRUB_SERIAL_COMMAND="serial --speed=115200"
+EOF
+chroot "$ROOT" grub-install --no-floppy --modules=part_gpt /dev/vda
+chroot "$ROOT" update-grub
+
+chroot "$ROOT" busybox passwd -d root # make root account passwordless
+
+# show some system info right after login to ease troubleshooting
+cat >"$ROOT/root/.profile" <<-EOF
+	run_verbose() {
+	    printf "\\\`%s\\\` output:\\\\n" "\$*"
+	    "\$@"
+	}
+	stty cols 150
+	run_verbose dmsetup table
+	run_verbose lsblk
+	run_verbose df -h
+EOF
+
+cat >"$ROOT/root/.inputrc" <<-EOF
+	# disabled bracketed paste mode
+	set enable-bracketed-paste off
+EOF
+
+if [ -d "$ROOT/etc/systemd/system" ]; then
+    # systemd
+    if [ -c "$ROOT/dev/hvc0" ]; then
+        # serial-getty@ttyS0.service is automatically enabled due to the console= kernel parameter
+        ln -s "/dev/null" "$ROOT/etc/systemd/system/serial-getty@ttyS0.service"
+        ln -s "/lib/systemd/system/serial-getty@.service" \
+            "$ROOT/etc/systemd/system/getty.target.wants/serial-getty@hvc0.service"
+    fi
+
+    # mask all timer units
+    for t in "$ROOT"/lib/systemd/system/*.timer; do
+        test -f "$t" || continue
+        ln -s "/dev/null" "$ROOT/etc/systemd/system/${t##*/}"
+    done
+
+    # mask systemd-firstboot.service
+    ln -s "/dev/null" "/root/etc/systemd/system/systemd-firstboot.service"
+fi
+
+if [ -f "$ROOT/etc/inittab" ]; then
+    # sysvinit
+    if [ -c "$ROOT/dev/hvc0" ]; then
+        echo "h0:2345:respawn:/sbin/agetty -8 -L 115200 hvc0 linux"
+    else
+        echo "S0:23:respawn:/sbin/getty -8 -L 115200 $CONSOLE linux"
+    fi >>"$ROOT/etc/inittab"
+fi
+
+if [ -f /init.postinst ]; then
+    cp /init.postinst "$ROOT/init.postinst"
+    chroot "$ROOT" /bin/sh -eux /init.postinst
+    rm -f "$ROOT/init.postinst"
+fi
+
+# allow service startup again
+mv "$ROOT/sbin/start-stop-daemon.REAL" "$ROOT/sbin/start-stop-daemon"
+rm "$ROOT/usr/sbin/policy-rc.d"
+
+# unmount pseudo filesystems from the target system
+umount "$ROOT/dev"
+umount "$ROOT/proc"
+umount "$ROOT/sys"
+
+if [ "$BOOT" = "efi" ]; then
+    umount "$ROOT/boot/efi"
+fi
+umount "$ROOT/media"
+umount "$ROOT/run"
+
+# /init.bottom is expected to umount $ROOT and its submounts
+ROOT="$ROOT" sh -eux /init.bottom
+
+# stop udevd
+udevadm control --exit
+
+# exiting this script yields "Kernel panic - not syncing: Attempted to
+# kill init!", so give the asyncronous SysRq trigger a chance to power
+# off (sending a racy C-d would still trigger a panic but we don't care)
+echo o >/proc/sysrq-trigger
+exec cat >/dev/null
diff --git a/debian/tests/utils/mkinitramfs b/debian/tests/utils/mkinitramfs
new file mode 100755
index 0000000..6bc70f4
--- /dev/null
+++ b/debian/tests/utils/mkinitramfs
@@ -0,0 +1,159 @@
+#!/bin/sh
+
+# Generate an initramfs image, much like mkinitramfs(8) but simpler
+#
+# Copyright © 2021-2022 Guilhem Moulin <guilhem@debian.org>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+set -eu
+PATH="/usr/sbin:/usr/bin:/sbin:/bin"
+export PATH
+
+unset DEBUG
+EXTRACT_DIR="$1"
+KERNEL_VERSION="$2"
+INITRD="$3"
+
+UTILS="$(dirname -- "$0")"
+DESTDIR="$(mktemp --directory -- "$INITRD.XXXXXXXXXX")"
+trap "rm -r${DEBUG:+v}f -- \"$DESTDIR\"" EXIT INT TERM
+
+# from /usr/sbin/mkinitramfs: create usr-merged filesystem layout, to
+# avoid duplicates if the host filesystem is usr-merged
+for d in /bin /lib* /sbin; do
+    [ -d "$d" ] || continue
+    mkdir -p "$DESTDIR/usr$d"
+    ln -sT "usr$d" "$DESTDIR$d"
+done
+
+install -m0755 "$UTILS/init" "$DESTDIR/init"
+install -m0755 "$UTILS/debootstrap" "$DESTDIR/debootstrap"
+cat >"$DESTDIR/init.conf" <<- EOF
+	HOSTNAME="$TESTNAME"
+	export HOSTNAME
+	PACKAGES="$PACKAGES"
+	BOOT="$BOOT"
+	CONSOLE="$CONSOLE"
+	ARCH="$ARCH"
+	MERGED_USR="$MERGED_USR"
+EOF
+
+for p in setup preinst postinst bottom; do
+    # setup: sourced after creating the BIOS or EFI boot partition
+    # preinst: run in chroot after debootstrap, but before installing extra packages
+    # postinst: optionally run in chroot after installing extra packages
+    # bottom: last thing to run before shutdown
+    if [ -f "$TESTDIR/$TESTNAME.d/$p" ]; then
+        install -m0755 "$TESTDIR/$TESTNAME.d/$p" "$DESTDIR/init.$p"
+    fi
+done
+
+MODULES="dm_crypt ext4 btrfs raid0 raid1"
+if [ "$BOOT" = "efi" ]; then
+    MODULES="$MODULES efivarfs nls_ascii nls_cp437 vfat"
+fi
+
+depmod -ab "$EXTRACT_DIR" "$KERNEL_VERSION"
+for kmod in virtio_console virtio_blk virtio_pci virtio_rng \
+        "$EXTRACT_DIR/lib/modules/$KERNEL_VERSION"/kernel/arch/*/crypto/*.ko* \
+        "$EXTRACT_DIR/lib/modules/$KERNEL_VERSION"/kernel/crypto/*.ko* \
+        $MODULES; do
+    kmod="${kmod##*/}"
+    modprobe -aid "$EXTRACT_DIR" -S "$KERNEL_VERSION" --show-depends "${kmod%%.*}"
+done | while read -r insmod kmod _; do
+    [ "$insmod" = "insmod" ] || continue
+    kmod_rel="${kmod#"$EXTRACT_DIR/lib/modules/$KERNEL_VERSION/"}"
+    if [ ! -f "$kmod" ] || [ "${kmod_rel#kernel/}" = "$kmod_rel" ]; then
+        echo "Error: Unexpected modprobe output: $insmod $kmod" >&2
+        exit 1
+    fi
+    mkdir -p "$DESTDIR/lib/modules/$KERNEL_VERSION/${kmod_rel%/*}"
+    ln -f${DEBUG:+v}T -- "$kmod" "$DESTDIR/lib/modules/$KERNEL_VERSION/$kmod_rel"
+done
+
+ln -t "$DESTDIR/lib/modules/$KERNEL_VERSION" -- \
+    "$EXTRACT_DIR/lib/modules/$KERNEL_VERSION/modules.order" \
+    "$EXTRACT_DIR/lib/modules/$KERNEL_VERSION/modules.builtin"
+depmod -wab "$DESTDIR" "$KERNEL_VERSION"
+
+verbose="${DEBUG-}"
+. /usr/share/initramfs-tools/hook-functions # for copy_exec()
+if [ -f "$TESTDIR/$TESTNAME.d/mkinitramfs" ]; then
+    . "$TESTDIR/$TESTNAME.d/mkinitramfs"
+fi
+
+copy_exec /bin/cp
+copy_exec /bin/rm
+copy_exec /bin/chmod
+
+copy_exec /sbin/modprobe
+copy_exec /sbin/blkid
+copy_exec /sbin/sfdisk
+copy_exec /sbin/mkswap
+copy_exec /sbin/swapon
+copy_exec /sbin/swapoff
+copy_exec /sbin/cryptsetup
+copy_exec /sbin/dmsetup
+copy_exec /usr/bin/dpkg-deb
+copy_exec /bin/tar
+
+# assume ossl-modules/legacy.so and libgcc_s.so are relative to the linked libcryptsetup.so
+libdir="$(env --unset=LD_PRELOAD ldd /sbin/cryptsetup | sed -nr '/.*=>\s*(\S+)\/libcryptsetup\.so\..*/ {s//\1/p;q}')"
+copy_exec "$libdir/ossl-modules/legacy.so" || true
+copy_libgcc "$libdir"
+
+for p in /sbin/cryptsetup /sbin/lvm /sbin/mdadm /sbin/mke2fs /sbin/mkfs.btrfs /bin/btrfs; do
+    if [ -x "$p" ]; then
+        copy_exec "$p"
+    fi
+done
+
+if [ "$BOOT" = "efi" ]; then
+    if [ ! -x "/sbin/mkfs.vfat" ]; then
+        echo "Couldn't find mkfs.vfat, is the 'dosfstools' package installed?" >&2
+        exit 1
+    fi
+    copy_exec /sbin/mkfs.vfat
+fi
+
+cp -pLt "$DESTDIR/lib" /lib/klibc-*.so
+for cmd in cat chroot ln ls mkdir mount mv sh umount uname; do
+    exe="/usr/lib/klibc/bin/$cmd"
+    if [ ! -f "$exe" ] || [ ! -x "$exe" ]; then
+        echo "No such executable: $exe" >&2
+        exit 1
+    fi
+    copy_exec "$exe" /bin
+done
+
+# copy udevd and (some of) its rules
+copy_exec /lib/systemd/systemd-udevd
+copy_exec /bin/udevadm
+
+mkdir -p -- "$DESTDIR/etc/udev" "$DESTDIR/lib/udev/rules.d"
+cat >"$DESTDIR/etc/udev/udev.conf" <<-EOF
+	udev_log=info
+	resolve_names=never
+EOF
+for rules in 50-udev-default.rules 55-dm.rules 60-block.rules \
+        60-persistent-storage.rules 60-persistent-storage-dm.rules \
+        63-md-raid-arrays.rules 95-dm-notify.rules; do
+    if [ -e "/lib/udev/rules.d/$rules" ]; then
+        cp -T "/lib/udev/rules.d/$rules" "$DESTDIR/lib/udev/rules.d/$rules"
+    fi
+done
+
+cd "$DESTDIR"
+find . -print0 | cpio -o0 -R 0:0 -H newc --quiet ${DEBUG:+--verbose} >"$INITRD"
diff --git a/debian/tests/utils/mock.pm b/debian/tests/utils/mock.pm
new file mode 100644
index 0000000..10db3e6
--- /dev/null
+++ b/debian/tests/utils/mock.pm
@@ -0,0 +1,347 @@
+# Mock terminal interaction on a guest system
+#
+# Copyright © 2021-2022 Guilhem Moulin <guilhem@debian.org>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use v5.14.2;
+use warnings;
+use strict;
+
+our ($SERIAL, $CONSOLE, $MONITOR);
+our $PS1 = qr/root\@[\-\.0-9A-Z_a-z]+ : [~\/][\-\.\/0-9A-Z_a-z]* [\#\$]\ /aax;
+
+package CryptrootTest::Utils;
+
+use Socket qw/PF_UNIX SOCK_STREAM SOCK_CLOEXEC SOCK_NONBLOCK SHUT_RD SHUT_WR/;
+use Errno qw/EINTR ENOENT ECONNREFUSED/;
+use Time::HiRes ();
+
+my (%SOCKET, %BUFFER, $WBITS, $RBITS);
+
+BEGIN {
+    ($SERIAL, $CONSOLE, $MONITOR) = qw/ttyS0 hvc0 mon0/;
+    my $dir = $ARGV[1] =~ m#\A(/\p{Print}+)\z# ? $1 : die "Invalid base directory\n"; # untaint
+    my $epoch = Time::HiRes::time();
+    foreach my $id ($SERIAL, $CONSOLE, $MONITOR) {
+        my $path = $dir . "/" . $id;
+        my $sockaddr = Socket::pack_sockaddr_un($path) // die;
+        socket(my $socket, PF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) or die "socket: $!";
+
+        until (connect($socket, $sockaddr)) {
+            if ($! == EINTR) {
+                # try again immediatly if connect(2) was interrupted by a signal
+            } elsif (($! == ENOENT or $! == ECONNREFUSED) and Time::HiRes::time() - $epoch < 30) {
+                # wait a bit to give QEMU time to create the socket and mark it at listening
+                Time::HiRes::usleep(100_000);
+            } else {
+                die "connect($path): $!";
+            }
+        }
+
+        my $fd = fileno($socket) // die;
+        vec($WBITS, $fd, 1) = 1;
+        vec($RBITS, $fd, 1) = 1;
+        $SOCKET{$id} = $socket;
+        $BUFFER{$id} = "";
+    }
+}
+
+sub read_data($) {
+    my $bits = shift;
+    while (my ($chan, $fh) = each %SOCKET) {
+        next unless vec($bits, fileno($fh), 1); # nothing to read here
+        my $n = sysread($fh, my $buf, 4096) // die "read: $!";
+        if ($n > 0) {
+            STDOUT->printflush($buf);
+            $BUFFER{$chan} .= $buf;
+        } else {
+            #print STDERR "INFO done reading from $chan\n";
+            shutdown($fh, SHUT_RD) or die "shutdown: $!";
+            vec($RBITS, fileno($fh), 1) = 0;
+        }
+    }
+}
+
+sub expect(;$$) {
+    my ($chan, $prompt) = @_;
+
+    my $buffer = defined $chan ? \$BUFFER{$chan} : undef;
+    if (defined $buffer and $$buffer =~ $prompt) {
+        $$buffer = $' // die;
+        return %+;
+    }
+
+    while(unpack("b*", $RBITS) != 0) {
+        my $rout = $RBITS;
+        while (select($rout, undef, undef, undef) == -1) {
+            die "select: $!" unless $! == EINTR; # try again immediately if select(2) was interrupted
+        }
+        read_data($rout);
+        if (defined $buffer and $$buffer =~ $prompt) {
+            $$buffer = $' // die;
+            return %+;
+        }
+    }
+    #print STDERR "INFO done reading\n";
+}
+
+sub write_data($$%) {
+    my $chan = shift;
+    my $data = shift;
+
+    my %options = @_;
+    $options{echo} //= 1;
+    $options{eol} //= "\r";
+    $options{reol} //= "\r\n";
+    my $wdata = $data . $options{eol};
+
+    my $wfh = $SOCKET{$chan} // die;
+    my $wfd = fileno($wfh) // die;
+    vec(my $win, $wfd, 1) = 1;
+
+    for (my $offset = 0, my $length = length($wdata); $offset < $length;) {
+        my $wout = $win;
+        while (select(undef, $wout, undef, undef) == -1) {
+            die "select: $!" unless $! == EINTR; # try again immediately if select(2) was interrupted
+        }
+        if (vec($wout, $wfd, 1)) {
+            my $n = syswrite($wfh, $wdata, $length - $offset, $offset) // die "write: $!";
+            $offset += $n;
+        }
+    }
+
+    my $rdata = $options{echo} ? $data : "";
+    $rdata .= $options{reol};
+
+    if ($rdata ne "") {
+        my $buf = \$BUFFER{$chan};
+        my $rfh = $SOCKET{$chan} // die;
+        my $rfd = fileno($rfh) // die;
+        vec(my $rin, $rfd, 1) = 1;
+
+        my $rlen = length($rdata);
+        while($rlen > 0) {
+            my $rout = $rin;
+            while (select($rout, undef, undef, undef) == -1) {
+                die "select: $!" unless $! == EINTR; # try again immediately if select(2) was interrupted
+            }
+            read_data($rout);
+
+            my $got = substr($$buf, 0, $rlen);
+            my $n = length($got);
+            if ($got eq substr($rdata, -$rlen, $n)) {
+                $$buf = substr($$buf, $n); # consume the command
+                $rlen -= $n;
+            } else {
+                my $a = substr($rdata, 0, -$rlen) . substr($rdata, -$rlen, $n);
+                my $b = substr($rdata, 0, -$rlen) . $got;
+                s/[^\p{Graph} ]/"\\x".unpack("H*",$&)/ge foreach ($a, $b);
+                die "Wanted \"$a\", got \"$b\"";
+            }
+        }
+    }
+}
+
+package CryptrootTest::Mock;
+
+use Exporter qw/import/;
+BEGIN {
+    our @EXPORT = qw/
+        unlock_disk
+        login
+        shell
+        suspend
+        wakeup
+        hibernate
+        poweroff
+        expect
+    /;
+}
+
+*expect     = \&CryptrootTest::Utils::expect;
+*write_data = \&CryptrootTest::Utils::write_data;
+
+sub unlock_disk($) {
+    my $passphrase = shift;
+    my %r = expect($SERIAL => qr/\A(?:.*(?:\r\n|\.\.\. ))?Please unlock disk (?<name>\p{Graph}+): \z/aams);
+    if ((my $ref = ref($passphrase)) ne "") {
+        my $name = $r{name};
+        unless (defined $name) {
+            undef $passphrase;
+        } elsif ($ref eq "CODE") {
+            $passphrase = $passphrase->($name);
+        } elsif ($ref eq "HASH") {
+            $passphrase = $passphrase->{$name};
+        } else {
+            die "Unsupported reference $ref";
+        }
+    }
+    die "Unable to unlock, aborting.\n" unless defined $passphrase;
+    write_data($SERIAL => $passphrase, echo => 0, reol => "\r");
+}
+
+sub login($;$) {
+    my ($username, $password) = @_;
+    expect($CONSOLE => qr/\r\ncryptroot-[[:alnum:]._-]+ login: \z/aams);
+    write_data($CONSOLE => $username, reol => "\r");
+
+    if (defined $password) {
+        expect($CONSOLE => qr/\A[\r\n]*Password: \z/aams);
+        write_data($CONSOLE => $username, echo => 0, reol => "\r");
+    }
+
+    # consume motd(5) or similar
+    expect($CONSOLE => qr/\r\n $PS1 \z/aamsx);
+}
+
+sub shell($%);
+sub shell($%) {
+    my $command = shift;
+    my %options = @_;
+
+    write_data($CONSOLE => $command);
+    my %r = expect($CONSOLE => qr/\A (?<out>.*) $PS1 \z/aamsx);
+    my $out = $r{out};
+
+    if (exists $options{rv}) {
+        my $rv = shell(q{echo $?});
+        unless ($rv =~ s/\r?\n\z// and $rv =~ /\A[0-9]+\z/ and $rv == $options{rv}) {
+            my @loc = caller;
+            die "ERROR: Command \`$command\` exited with status $rv != $options{rv}",
+                " at line $loc[2] in $loc[1]\n";
+        }
+    }
+    return $out;
+}
+
+# enter S3 sleep state (suspend to ram aka standby)
+sub suspend() {
+    write_data($CONSOLE => q{systemctl suspend});
+    # while the command is asynchronous the system might suspend before
+    # we have a chance to read the next $PS1
+
+    # wait for the SUSPEND event
+    QMP::wait_for_event("SUSPEND");
+
+    # double check that the guest is indeed suspended
+    my $resp = QMP::command(q{query-status});
+    die unless defined $resp->{status} and  $resp->{status} eq "suspended" and
+        defined $resp->{running} and $resp->{running} == JSON::false();
+}
+
+sub wakeup() {
+    my $r = QMP::command(q{system_wakeup});
+    die if %$r;
+
+    # wait for the WAKEUP event
+    QMP::wait_for_event("WAKEUP");
+
+    # double check that the guest is indeed running
+    my $resp = QMP::command(q{query-status});
+    die unless defined $resp->{status} and  $resp->{status} eq "running" and
+        defined $resp->{running} and $resp->{running} == JSON::true();
+}
+
+# enter S4 sleep state (suspend to disk aka hibernate)
+sub hibernate() {
+    # an alternative is to send {"execute":"guest-suspend-disk"} on the
+    # guest agent socket, but we don't want to require qemu-guest-agent
+    # on the guest so this will have to do
+    write_data($CONSOLE => q{systemctl hibernate});
+    # while the command is asynchronous the system might hibernate
+    # before we have a chance to read the next $PS1
+    QMP::wait_for_event("SUSPEND_DISK");
+    expect();# wait for QEMU to terminate
+}
+
+sub poweroff() {
+    # XXX would be nice to use the QEMU monitor here but the guest
+    # doesn't seem to respond to system_powerdown QMP commands
+    write_data($CONSOLE => q{poweroff});
+    # while the command is asynchronous the system might shutdown
+    # before we have a chance to read the next $PS1
+    QMP::wait_for_event("SHUTDOWN");
+    expect(); # wait for QEMU to terminate
+}
+
+
+package QMP;
+
+# QMP protocol
+# https://qemu.readthedocs.io/en/latest/interop/qemu-qmp-ref.html
+
+use JSON ();
+
+# read and decode a QMP server line
+sub getline() {
+    my %r = CryptrootTest::Utils::expect($MONITOR => qr/\A(?<str>.+?)\r\n/m);
+    my $str = $r{str} // die;
+    return JSON::->new->decode($str);
+}
+
+# send a QMP command and optional arguments
+sub command($;$) {
+    my ($command, $arguments) = @_;
+    my $cmd = { execute => $command };
+    $cmd->{arguments} = $arguments if defined $arguments;
+
+    $cmd = JSON::->new->encode($cmd);
+    STDOUT->printflush($cmd . "\n");
+    CryptrootTest::Utils::write_data($MONITOR => $cmd, eol => "\r\n", echo => 0, reol => "");
+
+    while(1) {
+        my $resp = QMP::getline() // next;
+        # ignore unsolicited server responses (such as events)
+        return $resp->{return} if exists $resp->{return};
+    }
+}
+
+# wait for the QMP greeting line
+my @CAPABILITIES;
+sub greeting() {
+    my $greeting = QMP::getline() // die;
+    $greeting = $greeting->{QMP} // die;
+    @CAPABILITIES = @{$greeting->{capabilities}} if defined $greeting->{capabilities};
+}
+
+# negotiate QMP capabilities
+sub capabilities(@) {
+    my $r = QMP::command(qmp_capabilities => {enable => \@_});
+    die if %$r;
+}
+
+BEGIN {
+    # https://gitlab.com/qemu-project/qemu/-/blob/master/docs/interop/qmp-spec.txt sec 4
+    QMP::greeting();
+    QMP::capabilities();
+}
+
+sub wait_for_event($) {
+    my $event_name = shift;
+    while(1) {
+        my $resp = QMP::getline() // next;
+        return if exists $resp->{event} and $resp->{event} eq $event_name;
+    }
+}
+
+sub quit() {
+    # don't use QMP::command() here since we might never receive a response
+    my $cmd = JSON::->new->encode({ execute => "quit" });
+    STDOUT->printflush($cmd . "\n");
+    CryptrootTest::Utils::write_data($MONITOR => $cmd, eol => "\r\n", echo => 0, reol => "");
+    CryptrootTest::Utils::expect(); # wait for QEMU to terminate
+}
+
+1;