iot/base-images
0
0
Fork 0
mirror of https://gitlab.com/fedora/bootc/base-images.git synced 2026-08-30 21:10:44 +00:00
Code Issues Projects Releases Packages Wiki Activity

standard: Move clevis-pin-tpm2 to arch-specific packages

Browse source 
TPM2 hardware is only on x86_64 and aarch64. Move clevis-pin-tpm2 from
the generic packages list to packages-x86_64 and packages-aarch64.
Make the dracut config conditional on the binary being present.

Ref: https://redhat.atlassian.net/browse/RHEL-138232
Signed-off-by: Joseph Marrero Corchado <jmarrero@redhat.com>
This commit is contained in:
Joseph Marrero 2026-07-28 13:17:17 -04:00
commit 752441c3fa
2 changed files with 16 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
standard/initramfs-full.yaml
View file

@ -7,7 +7,15 @@ postprocess:
cat > /usr/lib/dracut/dracut.conf.d/30-bootc-standard.conf << 'EOF'
add_dracutmodules+=" lvm crypt fips "
EOF
cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
# Clevis in initramfs for TPM2-bound LUKS (needs clevis-dracut, clevis-pin-tpm2)
add_dracutmodules+=" clevis clevis-pin-tpm2 "
# Clevis in initramfs for LUKS auto-unlock.
# clevis-pin-tpm2 is added conditionally as it may not be available on all arches
# in all downstream distros (e.g. not on ppc64le/s390x in CentOS Stream 9).
if test -x /usr/bin/clevis-pin-tpm2; then
cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
add_dracutmodules+=" clevis clevis-pin-tpm2 "
EOF
else
cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
add_dracutmodules+=" clevis "
EOF
fi

7
standard/manifest.yaml
View file

@ -43,9 +43,8 @@ packages:
- sos
# Make Ansible "package_facts" builtin work by default
- python3-rpm
# Initramfs Clevis + TPM2 pin for LUKS auto-unlock (dracut modules wired in initramfs-full.yaml)
# Initramfs Clevis for LUKS auto-unlock (dracut modules wired in initramfs-full.yaml)
- clevis-dracut
- clevis-pin-tpm2
# Used by admins interactively
- man-db
@ -53,6 +52,8 @@ packages:
packages-x86_64:
- irqbalance
- WALinuxAgent-udev
# TPM2 pin for Clevis LUKS auto-unlock
- clevis-pin-tpm2
packages-ppc64le:
- irqbalance
- librtas
@ -61,6 +62,8 @@ packages-ppc64le:
packages-aarch64:
- irqbalance
- WALinuxAgent-udev
# TPM2 pin for Clevis LUKS auto-unlock
- clevis-pin-tpm2
# Things we don't expect to ship on the host. We currently
# have recommends: false so these could only come in via