update TODO

diff --git a/TODO b/TODO
index 16a91fa02366eb5ff2f4d016a5c3d9dd624dfcb8..de27269d84b27de073c7c93ad49b937a5a967db1 100644 (file)
--- a/TODO
+++ b/TODO
@@ -83,6 +83,15 @@ Janitorial Clean-ups:
 
 Features:
 
+* tpm2: figure out if we need to do anything for TPM2 parameter encryption? And
+  if so, what precisely?
+
+* insert pkcs7 signature for verity gpt
+
+* when mounting disk images: if IMAGE_ID/IMAGE_VERSION is set in os-release
+  data in the image, make sure the image filename actually matches this, so
+  that images cannot be misused.
+
 * use credentials logic/TPM2 logic to store homed signing key
 
 * New udev block device symlink names: