feat: add LUKS TPM autounlock support

ublue-os / config

A layer to provide configuration files (udev rules, service units, etc)

https://universal-blue.org

Apache License 2.0

38 stars 26 forks source link

feat: add LUKS TPM autounlock support #265

Closed bsherman closed 2 months ago

bsherman commented 2 months ago

Adds a new RPM ublue-os-luks containing:

/usr/libexec/luks-disable-tpm2-autounlock
/usr/libexec/luks-enable-tpm2-autounlock

Adds ujust recipes to setup/remove LUKS autounlock using these scripts.

Adds depedency: ublue-os-just now requires ublue-os-luks

Downstreams will need to ensure install works correctly.

bsherman commented 2 months ago

For the record, I did test the scripts on both a main image with stock initramfs and a bluefin with customized initramfs. I also tested the RPM build and installing the RPMs on a system.

I visually verified that main should be fine installing the new RPM due to how we install other config RPMs here: https://github.com/ublue-os/main/blob/main/install.sh#L18-L19