Changing default verification algorithm: auto-verify-alg

FYI, this bit me in a PVE8 to PVE9 upgrade. After upgrading one node, the new PVE 7.0 kernel cannot configure resources from linstor:

root@virtual5:/home/brian# journalctl -eu linstor-satellite
...
Oct 08 03:21:08 virtual5 Satellite[2541]: 2026-10-08 03:21:08.717 [DeviceManager] INFO  LINSTOR/Satellite/479904 SYSTEM - DRBD regenerated resource file: /var/lib/linstor.d/linstor_db.res
...
Oct 08 03:21:08 virtual5 Satellite[2541]: 2026-10-08 03:21:08.807 [DeviceManager] ERROR LINSTOR/Satellite/479904 SYSTEM - Restoring resource file from backup: linstor_db
Oct 08 03:21:08 virtual5 Satellite[2541]: 2026-10-08 03:21:08.818 [DeviceManager] ERROR LINSTOR/Satellite/479904 SYSTEM - Failed to adjust DRBD resource linstor_db [Report number 6AC76E6D-B63BE-000000]
brian@virtual1:~$ linstor error-reports show 6AC76E6D-B63BE-000000
...
drbdsetup new-peer linstor_db 0 --_name=virtual1 --verify-alg=crct10dif --shared-secret=kEZ97aaMcMPv7Amb6reY --cram-hmac-alg=sha1


The external command sent the following error information:
 [ne] minor 1002 (vol:0) /dev/sata_ssd/linstor_db_00000 missing from kernel
linstor_db: Failure: (146) VERIFYAlgNotAvail
additional info from kernel:
failed to allocate crct10dif for verify

Command 'drbdsetup new-peer linstor_db 0 --_name=virtual1 --verify-alg=crct10dif --shared-secret=kEZ97aaMcMPv7Amb6reY --cram-hmac-alg=sha1' terminated with exit code 10
drbdadm: new-peer linstor_db: skipped due to earlier error
root@virtual5:/home/brian# grep verify /var/lib/linstor.d/linstor_db.res
        verify-alg "crct10dif";

So I’d strongly suggest fixing up the verify-alg before doing an upgrade. I’m going to have to try to sort it mid-upgrade :frowning:

Good news: linstor c sp DrbdOptions/auto-verify-algo-disable true was enough to bring all the drbd resources back to life. After this, verify-alg is no longer present in /var/lib/linstor.d/*.res. Then linstor c opt --verify-alg sha256 adds it back in again.

Bad news: DrbdOptions/auto-verify-algo-disable true also disables cram-hmac-alg and shared-secret in the network connection parameters. You can end up in a state where the resource has this enabled on one side but not the other (depending on when linstor satellites are restarted), so they refuse to connect until this is resolved.