Merge branch 'clevis-pin-tpm2-arch-specific' into 'main'

standard: Move clevis-pin-tpm2 to distro-specific treefiles

See merge request fedora/bootc/base-images!654

standard/initramfs-full.yaml

@@ -7,7 +7,14 @@ postprocess:
     cat > /usr/lib/dracut/dracut.conf.d/30-bootc-standard.conf << 'EOF'
     add_dracutmodules+=" lvm crypt fips "
     EOF
-    cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
-    # Clevis in initramfs for TPM2-bound LUKS (needs clevis-dracut, clevis-pin-tpm2)
-    add_dracutmodules+=" clevis clevis-pin-tpm2 "
+    # Clevis in initramfs for LUKS auto-unlock.
+    # clevis-pin-tpm2 is only on x86_64/aarch64 (TPM2 hardware arches).
+    if test -x /usr/bin/clevis-pin-tpm2; then
+      cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
+      add_dracutmodules+=" clevis clevis-pin-tpm2 "
     EOF
+    else
+      cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
+      add_dracutmodules+=" clevis "
+    EOF
+    fi

standard/manifest.yaml

@@ -43,9 +43,8 @@ packages:
   - sos
   # Make Ansible "package_facts" builtin work by default
   - python3-rpm
-  # Initramfs Clevis + TPM2 pin for LUKS auto-unlock (dracut modules wired in initramfs-full.yaml)
+  # Initramfs Clevis for LUKS auto-unlock (dracut modules wired in initramfs-full.yaml)
   - clevis-dracut
-  - clevis-pin-tpm2
   # Used by admins interactively
   - man-db
 
@@ -53,6 +52,8 @@ packages:
 packages-x86_64:
   - irqbalance
   - WALinuxAgent-udev
+  # TPM2 pin for Clevis LUKS auto-unlock
+  - clevis-pin-tpm2
 packages-ppc64le:
   - irqbalance
   - librtas
@@ -61,6 +62,8 @@ packages-ppc64le:
 packages-aarch64:
   - irqbalance
   - WALinuxAgent-udev
+  # TPM2 pin for Clevis LUKS auto-unlock
+  - clevis-pin-tpm2
 
 # Things we don't expect to ship on the host.  We currently
 # have recommends: false so these could only come in via