mirror of
https://github.com/systemd/systemd.git
synced 2026-08-13 17:08:14 +00:00
4d704f56af
When systemd-cryptenroll --tpm2-device=auto is called on a system where a tpm2-pcr-public-key.pem exists it automatically creates tokens with a signed PCR policy. Unlocking such a token via --unlock-tpm2-device=auto requires a tpm2-pcr-signature.json file, which is not present. This creates a race with systemd-tpm2-setup.service at boot: if the service completes before the test, the key exists and the subsequent --unlock-tpm2-device=auto calls fail, which I believe is the cause of the test flakiness. This also seems to mesh with the fact that this only flakes on Debian CI, since that's built with ukify which installs a public key. Let's hopefully fix this by passing --tpm2-public-key= to all --tpm2-device= enrollment calls that aren't explicitly intended to test signed PCR policy behaviour. (cherry picked from commitcd18656d47) (cherry picked from commit94e8cac341)