]> git.ipfire.org Git - thirdparty/systemd.git/commit
cryptsetup: measure via the pcrextend varlink service 43109/head
authorPaul Meyer <katexochen0@gmail.com>
Wed, 22 Jul 2026 06:28:53 +0000 (08:28 +0200)
committerPaul Meyer <katexochen0@gmail.com>
Tue, 28 Jul 2026 12:59:02 +0000 (14:59 +0200)
commit1bdf2db6f7761bb3ac3fbcf0ea6872abc64fa390
treeaf591de6999a37bc9349d5416b373521c2acab67
parent1812d8792f03d5f0aab1d9f14ba085421a652b84
cryptsetup: measure via the pcrextend varlink service

Measure the volume key and unlock keyslot through io.systemd.PCRExtend
instead of driving the TPM directly via tpm2-util, matching how the
verity and imds measurements already work.

Bank selection and the TPM context now live entirely in
systemd-pcrextend. As a result the tpm2-measure-bank= crypttab option
can no longer be honored per volume and is now a deprecated no-op.

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
NEWS
man/crypttab.xml
src/cryptsetup/cryptsetup.c
src/shared/pcrextend-util.c
src/shared/pcrextend-util.h
test/units/TEST-70-TPM2.cryptsetup-measure.sh [new file with mode: 0755]