I’m a happy new user of a Librem15v4 which comes with a swap partition, and after little reading and investigation I saw that hibernating couldn’t work at resume stage because of the swap encryption setting: the line of my /etc/crypttab for swap encryption used to read
luks-7f1003b8-e5a0-4fae-9b4d-f8a1428b5255 /dev/disk/by-id/wwn-0x5002538e700e9681-part3 /dev/urandom swap,cipher=aes-cbc-essiv:sha256,size=256
This means the key for swap encryption was regenerated with a different value at each boot! I can understand security concerns, e.g. making it extremely hard to access memory pages stored on swap after a brutal shutdown; however, I have a decent amount of RAM with respect to my common usage, so I use very little swap except for hibernating.
So I went for setting swap using standard LUKS with passphrase prompt.
I detail below the steps I followed on pre-installed PureOS to get hibernation working, with an encrypted root partition as /dev/dm-0, and an encrypted swap as described above, which can also be reached as /dev/dm-1.
I first did in a terminal
sudo swapoff /dev/dm-1
then opened gnome-disks to reset the partition hosting the encrypted device (UUID=7f1003b8-e5a0-4fae-9b4d-f8a1428b5255, meaning /dev/sda3 in my case), created on it a standard LUKS device containing a swap partition, and enabled it. Then I edited the line of crypttab regarding swap so it now reads
luks-de5ef9e9-e265-4b74-9316-2856129af62b UUID=de5ef9e9-e265-4b74-9316-2856129af62b none luks,initramfs
If you reproduce my setup, put the correct value for the two occurences of the UUID of the disk partition that supports the LUKS device used for swap. Then, I updated the line in /etc/fstab regarding the new swap device, and finally I did in a terminal
sudo update-initramfs -u -k 4.19.0-2-amd64
Note that I deliberately chose not to update init ramdisks of all kernels at once: in case something went wrong, I could with higher probability still boot with another installed kernel by simply editing GRUB command-line at boot time removing “resume=” setting and run a kernel with an unchanged init ramdisk (I also noticed recovery mode in GRUB menu, but did’t want to risk needing it!). You may need to put another kernel release name in update-initramfs invocation (autocompletion of kernel releases worked for me there!).
With this setup, I still have to type the passphrase for opening encrypted root partition when resuming, whereas it should not be necessary IMHO: ideally, the initramfs stage should be self-contained enough to prompt for the passphrase used to open swap, and try to resume from it before looking for a root partition. When I get too tired of typing two passphrases at each boot, I may look further into this.