]> git.ipfire.org Git - thirdparty/systemd.git/commit
test: suppress PCR public key auto-loading in TEST-70-TPM2 dditest
authorLuca Boccassi <luca.boccassi@gmail.com>
Mon, 4 May 2026 13:42:03 +0000 (14:42 +0100)
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Mon, 4 May 2026 18:45:10 +0000 (20:45 +0200)
commit74338c0bb000cd805a87ce355478c5a0eae113b9
treedad6b24496e10833ab7f9c3d485ddf4c5b137de1
parenta1d0c58220896e483adbca7386b47f29d30dd09b
test: suppress PCR public key auto-loading in TEST-70-TPM2 dditest

The dditest block calls systemd-repart with Encrypt=tpm2 but without
--tpm2-public-key-pcrs=. Since systemd-stub drops
/run/systemd/tpm2-pcr-public-key.pem when booting from a signed UKI
systemd-repart auto-loads it and enrolls a signed PCR policy, and
then systemd-cryptsetup tpm2-device=auto has no matching signature file,
so unlock fails.

--tpm2-public-key= is not enough as the default kicks in then.

Follow-up for cd18656d47710c251a44a8f5f9d616151a909152
test/units/TEST-70-TPM2.cryptsetup.sh