From 752441c3fa6dc3a88fc910443f3c4571cf6bfd24 Mon Sep 17 00:00:00 2001
From: Joseph Marrero Corchado <jmarrero@redhat.com>
Date: Tue, 28 Jul 2026 13:17:17 -0400
Subject: [PATCH] standard: Move clevis-pin-tpm2 to arch-specific packages

TPM2 hardware is only on x86_64 and aarch64. Move clevis-pin-tpm2 from
the generic packages list to packages-x86_64 and packages-aarch64.
Make the dracut config conditional on the binary being present.

Ref: https://redhat.atlassian.net/browse/RHEL-138232
Signed-off-by: Joseph Marrero Corchado <jmarrero@redhat.com>
---
 standard/initramfs-full.yaml | 14 +++++++++++---
 standard/manifest.yaml       |  7 +++++--
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/standard/initramfs-full.yaml b/standard/initramfs-full.yaml
index 381fe32..22ac878 100644
--- a/standard/initramfs-full.yaml
+++ b/standard/initramfs-full.yaml
@@ -7,7 +7,15 @@ postprocess:
     cat > /usr/lib/dracut/dracut.conf.d/30-bootc-standard.conf << 'EOF'
     add_dracutmodules+=" lvm crypt fips "
     EOF
-    cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
-    # Clevis in initramfs for TPM2-bound LUKS (needs clevis-dracut, clevis-pin-tpm2)
-    add_dracutmodules+=" clevis clevis-pin-tpm2 "
+    # Clevis in initramfs for LUKS auto-unlock.
+    # clevis-pin-tpm2 is added conditionally as it may not be available on all arches
+    # in all downstream distros (e.g. not on ppc64le/s390x in CentOS Stream 9).
+    if test -x /usr/bin/clevis-pin-tpm2; then
+      cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
+      add_dracutmodules+=" clevis clevis-pin-tpm2 "
     EOF
+    else
+      cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
+      add_dracutmodules+=" clevis "
+    EOF
+    fi
diff --git a/standard/manifest.yaml b/standard/manifest.yaml
index da2a7cb..3cea76c 100644
--- a/standard/manifest.yaml
+++ b/standard/manifest.yaml
@@ -43,9 +43,8 @@ packages:
   - sos
   # Make Ansible "package_facts" builtin work by default
   - python3-rpm
-  # Initramfs Clevis + TPM2 pin for LUKS auto-unlock (dracut modules wired in initramfs-full.yaml)
+  # Initramfs Clevis for LUKS auto-unlock (dracut modules wired in initramfs-full.yaml)
   - clevis-dracut
-  - clevis-pin-tpm2
   # Used by admins interactively
   - man-db
 
@@ -53,6 +52,8 @@ packages:
 packages-x86_64:
   - irqbalance
   - WALinuxAgent-udev
+  # TPM2 pin for Clevis LUKS auto-unlock
+  - clevis-pin-tpm2
 packages-ppc64le:
   - irqbalance
   - librtas
@@ -61,6 +62,8 @@ packages-ppc64le:
 packages-aarch64:
   - irqbalance
   - WALinuxAgent-udev
+  # TPM2 pin for Clevis LUKS auto-unlock
+  - clevis-pin-tpm2
 
 # Things we don't expect to ship on the host.  We currently
 # have recommends: false so these could only come in via