anchor.diff:                          return
                       fi
                       luks_cleanup
  +                    # We allow booting to continue instead of aborting. Perhaps the error was temporary
  +                    # and the next loop iteration will succeed. If not, we'll return eventually and
  +                    # then the normal "no rootfs" handling takes over.
                       ;;
                     1) # not a LUKS volume, which might be a problem (attacker replaced encrypted rootfs with modified unencrypted one)
                       if [ "$bootparam_use_encryption" ] ; then
  
positive.code:                             fatal "Error locking NVRAM area with index ${REFKIT_DISK_ENCRYPTION_NVRAM_INDEX}"
                          fi
                      fi
                      if [ ! -s "$keyfile" ] &&
                         [ "${REFKIT_DISK_ENCRYPTION_PASSWORD}" ]; then
                          printf "%s" "${REFKIT_DISK_ENCRYPTION_PASSWORD}" >"$keyfile"
                          keyfile_offset=0
                      fi
                      if cryptsetup open --type luks "$bootparam_root" "${REFKIT_DEVICE_MAPPER_ROOTFS_NAME}" --key-file "$keyfile" --keyfile-offset "$keyfile_offset"; then
                          bootparam_root="/dev/mapper/${REFKIT_DEVICE_MAPPER_ROOTFS_NAME}"
  
negative.code:                     keyfile_offset=
                      tcsd_pid=
                      luks_cleanup () {
                          dd if=/dev/zero of="$keyfile" count="$(stat -c '%s' "$keyfile")" bs=1 >/dev/null
                          rm "$keyfile"
                          if [ "$tcsd_pid" ]; then
                              kill "$tcsd_pid"
  