← Back to Arch Linux: Recent news updates
Mkinitcpio >=42 requires manual intervention for TPM2-based unlocking of LUKS devices
Starting with package version 42-1, the mkinitcpio systemd hook now includes systemd-pcrosseparator.service (as intended by systemd v261).
This affects the measurements of PCR values 0-7, 9 and 12-14.
If you configured the systemd hook and unlock LUKS partitions, that depend on these values, you need to re-enroll the TPM2 in use.
For guidance, please refer to systemd-cryptenroll(1), or the ArchWiki article on systemd-cryptenroll, when using pinned values.
Refer to systemd-pcrlock(8), when relying on custom policies and a disabled systemd-pcrlock-make-policy.service.
Comments (1)
Read the news before -Syu, as ever. This one only bites if you unlock LUKS with TPM2, but it bites hard. Bookmarked the news page: Arch Linux - News