Vendor the command set the menu and shell depend on

bin/blob-drive-password

@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# blob:summary=Set a new encryption password for a drive selected.
+# blob:requires-sudo=true
+
+encrypted_drives=$(blkid -t TYPE=crypto_LUKS -o device)
+
+if [[ -n $encrypted_drives ]]; then
+  if (( $(wc -l <<<"$encrypted_drives") == 1 )); then
+    drive_to_change="$encrypted_drives"
+  else
+    drive_to_change="$(blob-drive-select "$encrypted_drives")"
+  fi
+
+  if [[ -n $drive_to_change ]]; then
+    new_password=$(gum input --password --header "New encryption password") || exit 1
+    [[ -n $new_password ]] || { echo "Password cannot be empty."; exit 1; }
+
+    confirmation=$(gum input --password --header "Confirm new encryption password") || exit 1
+    [[ $new_password == "$confirmation" ]] || { echo "Passwords do not match."; exit 1; }
+
+    echo "Changing full-disk encryption password for $drive_to_change"
+    # The new key travels over stdin and reaches cryptsetup as a keyfile via
+    # <(cat), leaving the tty free for the current-passphrase prompt.
+    printf "%s" "$new_password" | sudo bash -c 'exec cryptsetup luksChangeKey --pbkdf argon2id --iter-time 2000 "$1" <(cat) </dev/tty' bash "$drive_to_change"
+  else
+    echo "No drive selected."
+  fi
+else
+  echo "No encrypted drives available."
+  exit 1
+fi