Stop measuring for SHA1 TPM bank

Let's avoid having to deal with openssl configuration to re-enable
SHA1 support by not measuring for the SHA1 TPM bank.

diff --git a/mkosi/__init__.py b/mkosi/__init__.py
index d5472c93d68661f741f734c07beef826f8b26a31..75dd77701af6ca40dfdfadb799d4fd13279f68c0 100644 (file)
--- a/mkosi/__init__.py
+++ b/mkosi/__init__.py
@@ -1981,6 +1981,9 @@ def build_uki(
         "--output", output,
         "--efi-arch", arch,
         "--uname", kver,
+        # SHA1 might be disabled in OpenSSL depending on the distro so we opt to not sign for SHA1 to avoid having to
+        # manage a bunch of configuration to re-enable SHA1.
+        "--pcr-banks", "sha256,sha384,sha512",
     ]
 
     mounts = [