From ec6e1e0363a51afdb9ef80fd805a3ab57366a19b Mon Sep 17 00:00:00 2001
From: Yasmin de Souza <ydesouza@redhat.com>
Date: Tue, 14 Apr 2026 15:51:40 -0300
Subject: [PATCH] Add clevis-dracut and clevis-pin-tpm2 on manifest.yaml and
 initramfs.yaml

---
 minimal/initramfs.yaml | 4 ++++
 minimal/manifest.yaml  | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/minimal/initramfs.yaml b/minimal/initramfs.yaml
index 0256d9c..2c42256 100644
--- a/minimal/initramfs.yaml
+++ b/minimal/initramfs.yaml
@@ -20,6 +20,10 @@ postprocess:
     # We want this for systemd-cryptsetup tpm2 locking
     add_dracutmodules+=" tpm2-tss "
     EOF
+    cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
+    # Clevis in initramfs for TPM2-bound LUKS (needs clevis-dracut, clevis-pin-tpm2)
+    add_dracutmodules+=" clevis clevis-pin-tpm2 "
+    EOF
     cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF'
     # https://issues.redhat.com/browse/RHEL-49590
     # On image mode systems we use nss-altfiles for passwd and group,
diff --git a/minimal/manifest.yaml b/minimal/manifest.yaml
index 443353e..b4fbb86 100644
--- a/minimal/manifest.yaml
+++ b/minimal/manifest.yaml
@@ -43,3 +43,6 @@ packages:
   - container-selinux
   # Needed for tpm2 bound luks
   - tpm2-tools
+  # Initramfs Clevis + TPM2 pin for LUKS auto-unlock (dracut modules wired in initramfs.yaml)
+  - clevis-dracut
+  - clevis-pin-tpm2