[vm-repair] Fix unlock failure on Ubuntu 24.04 ADE-encrypted VMs

[msaenzbosupport]

Description

Fix az vm repair create --unlock-encrypted-vm failing on Ubuntu 24.04 ADE-encrypted VMs.

Problem

The data_os_lvm_check function in linux-mount-encrypted-disk.sh identifies the root partition by filtering partitions larger than 600MB:

export root_part=lsblk ${data_disk} -l -n -p -b 2>&1 | grep -w -v ${data_disk} | awk '$4 > 600000000{print $1}'`

Ubuntu 24.04 introduced a ~913MB /boot partition (partition 16, ext4, LABEL=BOOT). This partition exceeds the 600MB threshold, causing root_part to capture two values instead of one:

root_part=/dev/sdb1\n/dev/sdb16

When unlock_root passes this to cryptsetup, the command becomes:

cryptsetup luksOpen --key-file ... --header ... /dev/sdb1 /dev/sdb16 osencrypt

Where /dev/sdb16 is interpreted as the mapper name instead of osencrypt, producing:

Device sdb16 not found
Cannot use device /dev/sdb16, name is invalid or still in use.

Partition layout comparison

Ubuntu version	Boot partition	Size	Exceeds 600MB?
20.04	sdX2 (ext2)	~248MB	No
22.04	sdX2 (ext2)	~248MB	No
24.04	sdX16 (ext4)	~913MB	Yes

Fix

Replace the fixed-threshold filter with a sort-by-size approach that selects only the largest partition (always root):

export root_part=lsblk ${data_disk} -l -n -p -b 2>&1 | grep -w -v ${data_disk} | sort -k4 -rn | awk 'NR==1{print $1}'`

This is future-proof against boot partition size changes in newer distro versions.

Testing

• Ubuntu 24.04 Gen 1 + ADE: unlock now succeeds (was failing before)
• Ubuntu 22.04 Gen 1/Gen 2 + ADE: no regression (verified)
• Ubuntu 20.04 Gen 1/Gen 2 + ADE: no regression (verified)
• RHEL 7/8/9 LVM + ADE: not affected (uses LVM branch, not this code path)

Affected file

src/vm-repair/azext_vm_repair/scripts/linux-mount-encrypted-disk.sh

[azure-client-tools-bot-prd]

Validation for Breaking Change Starting...

Thanks for your contribution!

[azure-client-tools-bot-prd]

Hi @msaenzbosupport,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in setup.py as well.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Linux encrypted disk mounting helper to more reliably detect the OS/root partition on distros where /boot may exceed the previous size threshold.

Changes:

• Replace a fixed size threshold partition selection with “largest partition wins”.
• Add clarifying comments explaining why the selection logic changed.

[msaenzbosupport]

Re: Copilot review comments

Thanks for the review. Both observations about 2>&1 inside the command substitution and the unquoted variables with >> ${logpath}/${logfile} at the end are pre-existing patterns in the original code — every line in this function uses the same style:

# Original line (before this PR):
export root_part=lsblk ${data_disk} -l -n -p -b 2>&1 | grep -w -v ${data_disk} |awk '$4 > 600000000{print $1}'` >> ${logpath}/${logfile}

The scope of this PR is intentionally limited to fixing the partition selection logic (threshold → largest partition) to unblock Ubuntu 24.04 ADE unlock. Refactoring the logging/quoting patterns across the entire script would be a separate effort.

Re: HISTORY.rst / setup.py

This change only affects a shell script that runs inside the repair VM via az vm run-command invoke. It does not change any Python code, CLI parameters, or extension behavior beyond fixing the broken Ubuntu 24.04 unlock path. Happy to add a HISTORY.rst entry if the maintainers prefer it — please advise.

[yonzhan]

vm-repair