sync with my merged debian cryptsetup upstream version