bugfix: Detached headers idempotence check

example/luks-detached-header.nix

@@ -0,0 +1,40 @@
+let
+  headerDevice = "/dev/disk/by-partlabel/disk-main-luks-header";
+in
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/vdb";
+        content = {
+          type = "gpt";
+          partitions = {
+            luks-header = {
+              size = "32M";
+              type = "8300";
+            };
+            crypt = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "crypted";
+                settings = {
+                  header = headerDevice;
+                  keyFile = "/tmp/secret.key";
+                };
+                extraFormatArgs = [ "--header=${headerDevice}" ];
+                extraOpenArgs = [ "--header=${headerDevice}" ];
+                content = {
+                  type = "filesystem";
+                  format = "ext4";
+                  mountpoint = "/";
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

lib/types/luks.nix

@@ -10,6 +10,11 @@
 let
   # These options will automatically generate a temporary password and remove it later on.
   autogeneratedPassword = config.enrollFido2;
+  luksProbeTarget =
+    if config.settings ? "header" && config.settings.header != null then
+      config.settings.header
+    else
+      config.device;
 
   keyFile =
     if config.settings ? "keyFile" then
@@ -199,7 +204,7 @@ in
     _create = diskoLib.mkCreateOption {
       inherit config options;
       default = ''
-        if ! blkid "${config.device}" >/dev/null || ! cryptsetup isLuks "${config.device}"; then
+        if ! cryptsetup isLuks "${luksProbeTarget}"; then
           ${lib.optionalString config.askPassword ''
             promptSecret() {
               prompt=$1

tests/luks-detached-header.nix

@@ -0,0 +1,17 @@
+{
+  pkgs ? import <nixpkgs> { },
+  diskoLib ? pkgs.callPackage ../lib { },
+}:
+diskoLib.testLib.makeDiskoTest {
+  inherit pkgs;
+  name = "luks-detached-header";
+  disko-config = ../example/luks-detached-header.nix;
+  testMode = "direct";
+  testBoot = false;
+  extraTestScript = ''
+    machine.succeed("${pkgs.cryptsetup}/bin/cryptsetup isLuks /dev/disk/by-partlabel/disk-main-luks-header");
+    machine.fail("${pkgs.cryptsetup}/bin/cryptsetup isLuks /dev/disk/by-partlabel/disk-main-crypt");
+    machine.succeed("mountpoint /mnt");
+    machine.succeed("test -e /mnt/home/testfile");
+  '';
+}