Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package fde-tools for openSUSE:Factory checked in at 2026-08-04 21:27:51 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/fde-tools (Old) and /work/SRC/openSUSE:Factory/.fde-tools.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "fde-tools" Tue Aug 4 21:27:51 2026 rev:36 rq:1369172 version:0.7.6 Changes: -------- --- /work/SRC/openSUSE:Factory/fde-tools/fde-tools.changes 2026-02-03 21:29:52.404536921 +0100 +++ /work/SRC/openSUSE:Factory/.fde-tools.new.16738/fde-tools.changes 2026-08-04 21:28:28.995744012 +0200 @@ -1,0 +2,26 @@ +Mon Aug 3 06:40:07 UTC 2026 - Gary Ching-Pang Lin <[email protected]> + +- Update to 0.7.6 + + More tpm inspect fixes + + Change the default SRK setting + + uefi: use the default boot path if no EFI FILE path + (bsc#1246464) + + tpm: Use authorized policy in tpm_test + + fdectl: Report specific error when lsblk fails in chroot + + tpm: Support persistent SRK (bsc#1248516) + + tpm: Always add PCR4 when comparing events + + firstboot: remove the dracut conf for the key file + (bsc#1243877) + + firstboot: use the real path to initrd (bsc#1244323) + + tpm: Create the log directory + + Improve tpm-snapshot and tpm-inspect + + tpm: Fix the file path for the predicted PCR + + tpm: Fix the output format of tpm-inspect + + tpm: skip event comparison +- Drop merged patches + + fde-tools-bsc1243877-firstboot-remove-key-conf.patch + + fde-tools-bsc1244323-firstboot-fix-lsinitrd.patch + + fde-tools-bsc1246464-use-default-uefi-boot-path.patch + + fde-tools-bsc1248516-tpm-Support-persistent-SRK.patch + +------------------------------------------------------------------- Old: ---- fde-tools-0.7.3.tar.bz2 fde-tools-bsc1243877-firstboot-remove-key-conf.patch fde-tools-bsc1244323-firstboot-fix-lsinitrd.patch fde-tools-bsc1246464-use-default-uefi-boot-path.patch fde-tools-bsc1248516-tpm-Support-persistent-SRK.patch New: ---- fde-tools-0.7.6.tar.bz2 ----------(Old B)---------- Old:- Drop merged patches + fde-tools-bsc1243877-firstboot-remove-key-conf.patch + fde-tools-bsc1244323-firstboot-fix-lsinitrd.patch Old: + fde-tools-bsc1243877-firstboot-remove-key-conf.patch + fde-tools-bsc1244323-firstboot-fix-lsinitrd.patch + fde-tools-bsc1246464-use-default-uefi-boot-path.patch Old: + fde-tools-bsc1244323-firstboot-fix-lsinitrd.patch + fde-tools-bsc1246464-use-default-uefi-boot-path.patch + fde-tools-bsc1248516-tpm-Support-persistent-SRK.patch Old: + fde-tools-bsc1246464-use-default-uefi-boot-path.patch + fde-tools-bsc1248516-tpm-Support-persistent-SRK.patch ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ fde-tools.spec ++++++ --- /var/tmp/diff_new_pack.z58vU4/_old 2026-08-04 21:28:31.291823476 +0200 +++ /var/tmp/diff_new_pack.z58vU4/_new 2026-08-04 21:28:31.315824306 +0200 @@ -1,7 +1,7 @@ # # spec file for package fde-tools # -# Copyright (c) 2026 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -21,7 +21,7 @@ %endif Name: fde-tools -Version: 0.7.3 +Version: 0.7.6 Release: 0 Summary: Tools required for Full Disk Encryption License: GPL-2.0-only @@ -31,10 +31,6 @@ Source1: fde-tools.service Source2: fde-tools.conf Patch0: fde-tools-firstboot-alp-snapshot.patch -Patch1: fde-tools-bsc1243877-firstboot-remove-key-conf.patch -Patch2: fde-tools-bsc1244323-firstboot-fix-lsinitrd.patch -Patch3: fde-tools-bsc1246464-use-default-uefi-boot-path.patch -Patch4: fde-tools-bsc1248516-tpm-Support-persistent-SRK.patch BuildRequires: help2man BuildRequires: pkgconfig(json-c) BuildRequires: pkgconfig(libcryptsetup) ++++++ fde-tools-0.7.3.tar.bz2 -> fde-tools-0.7.6.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fde-tools-0.7.3/fde.sh new/fde-tools-0.7.6/fde.sh --- old/fde-tools-0.7.3/fde.sh 2025-05-15 04:36:45.448329189 +0200 +++ new/fde-tools-0.7.6/fde.sh 2026-07-30 04:47:16.538494203 +0200 @@ -22,7 +22,7 @@ : ${SHAREDIR:=/usr/share/fde} -version=0.7.3 +version=0.7.6 opt_bootloader=grub2 opt_uefi_bootdir="" @@ -76,6 +76,7 @@ tpm-disable disable TPM protection tpm-wipe wipe out the keyslot for the sealed key tpm-authorize update the authorized pcr policy in the sealed key + tpm-inspect check the pcr policy of the sealed key EOF } @@ -217,6 +218,14 @@ luks_devices=$(luks_get_volume_for_fsdev "$fsdev") if [ -z "$luks_devices" ]; then display_errorbox "Cannot find the underlying partition for $fsdev" + + # Compare the device ID and inode of '/' against the root of PID 1. + # A mismatch indicates a chroot environment. + if [ "$(stat -c %d:%i /)" != "$(stat -c %d:%i /proc/1/root/.)" ]; then + # 'lsblk' may fail to show the filesystem type in a chroot environment + # due to incomplete udev db. + display_errorbox "Operation not supported in a chroot environment" + fi exit 1 fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fde-tools-0.7.3/firstboot/fde new/fde-tools-0.7.6/firstboot/fde --- old/fde-tools-0.7.3/firstboot/fde 2025-05-15 04:22:23.193426205 +0200 +++ new/fde-tools-0.7.6/firstboot/fde 2025-07-29 05:00:40.734993675 +0200 @@ -114,10 +114,14 @@ return 1 fi + # bsc#1244323 lsinitrd may not be able to deal with the symlink properly. + # To avoid the potential error, always use the real path to the initrd. + sys_initrd="`readlink -f /boot/initrd`" + # KIWI may save sha256sum of the LUKS header in initrd before reencrypting # the root partition. If the checksum differs from the one of the current # LUKS header, the root partition is already reencryted. - luks_hdr_sum_kiwi="`lsinitrd --file root/.luks.header /boot/initrd`" + luks_hdr_sum_kiwi="`lsinitrd --file root/.luks.header ${sys_initrd}`" if [ "${luks_hdr_sum_kiwi}" != "" ]; then cryptsetup luksHeaderBackup ${luks_dev} --header-backup-file /root/.luks.header luks_hdr_sum_cur="`sha256sum /root/.luks.header | cut -f1 -d' '`" @@ -146,6 +150,9 @@ rm -f "${luks_keyfile}" + # Remove the dracut conf for the key file + rm -f /etc/dracut.conf.d/99-luks-boot.conf + # Replace the key file path in /etc/crypttab with "/.virtual-root.key" # to avoid errors when unmounting the LUKS partition (bsc#1218181) sed -i "s,${luks_keyfile},/.virtual-root.key,g" /etc/crypttab diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fde-tools-0.7.3/share/grub2 new/fde-tools-0.7.6/share/grub2 --- old/fde-tools-0.7.3/share/grub2 2025-05-14 09:25:32.495540678 +0200 +++ new/fde-tools-0.7.6/share/grub2 2026-07-30 04:47:12.995515101 +0200 @@ -82,11 +82,14 @@ function grub_update_early_config { local sealed_key_file="$1" - local rsa_key_size=$(tpm_get_rsa_key_size) grub_set_control GRUB_ENABLE_CRYPTODISK "y" grub_set_control GRUB_TPM2_SEALED_KEY "$sealed_key_file" - grub_set_control GRUB_TPM2_SRK_ALG "RSA${rsa_key_size}" + if [ "$(tpm_get_ecc_srk_support)" = "yes" ]; then + grub_set_control GRUB_TPM2_SRK_ALG "ECC" + else + grub_set_control GRUB_TPM2_SRK_ALG "RSA" + fi # Do not clear the password implicitly; require fdectl or # jeos firstboot to do so explicitly. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fde-tools-0.7.3/share/systemd-boot new/fde-tools-0.7.6/share/systemd-boot --- old/fde-tools-0.7.3/share/systemd-boot 2025-05-14 09:25:32.495540678 +0200 +++ new/fde-tools-0.7.6/share/systemd-boot 2026-07-30 04:47:12.995515101 +0200 @@ -71,7 +71,6 @@ not_implemented return 1 } - ################################################################## # This function implements the boot loader specific part of # tpm-enable when using an authorized policy. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fde-tools-0.7.3/share/tpm new/fde-tools-0.7.6/share/tpm --- old/fde-tools-0.7.3/share/tpm 2025-05-14 09:25:32.495540678 +0200 +++ new/fde-tools-0.7.6/share/tpm 2026-07-30 04:47:12.995515101 +0200 @@ -18,6 +18,7 @@ # Written by Olaf Kirch <[email protected]> FDE_DEFAULT_AUTHORIZED_POLICY="authorized-policy" +FDE_SNAPSHOT_NAME="tpm-snapshot" ################################################################## # Check whether a TPM is present and working reasonably well @@ -56,7 +57,7 @@ # Check if pcr-oracle supports rsa-test # If pcr-oracle prints "Unknown action", fall back to default. - if pcr-oracle rsa-test 2>&1 | grep -q "Unknown action"; then + if LC_ALL=C pcr-oracle rsa-test 2>&1 | grep -q "Unknown action"; then __fde_rsa_key_size="2048" echo "$__fde_rsa_key_size" return @@ -78,34 +79,122 @@ echo "$__fde_rsa_key_size" } +function tpm_get_ecc_srk_support { + + declare -g __fde_ecc_srk + + if [ -n "$__fde_ecc_srk" ]; then + echo "$__fde_ecc_srk" + return + fi + + if LC_ALL=C pcr-oracle --ecc-srk 2>&1 | grep -q "unrecognized option"; then + __fde_ecc_srk="no" + echo "$__fde_ecc_srk" + return + fi + + # Fallback to "auto" if FDE_ECC_SRK is empty + local ecc_srk="${FDE_ECC_SRK:-auto}" + + if [ "$ecc_srk" = "yes" ]; then + __fde_ecc_srk="yes" + echo "$__fde_ecc_srk" + return + fi + + if [ "$ecc_srk" = "no" ]; then + __fde_ecc_srk="no" + echo "$__fde_ecc_srk" + return + fi + + # If FDE_ECC_SRK is "auto", resolve dynamically + if [ "$ecc_srk" = "auto" ]; then + # Fresh install or reset: Use pcr-oracle's ecc-test to verify support + if pcr-oracle ecc-test >/dev/null 2>&1; then + __fde_ecc_srk="yes" + else + __fde_ecc_srk="no" + fi + echo "$__fde_ecc_srk" + return + fi + + __fde_ecc_srk="no" + echo "$__fde_ecc_srk" +} + function tpm_snapshot { - local snapshot="tpm-snapshot" + # TODO Add an ID to the snapshot name + local snapshot=${FDE_SNAPSHOT_NAME} local tmpdir=$(fde_make_tempfile snapshot) mkdir -p ${tmpdir} local stop_event=$(bootloader_stop_event) + if [ -z "$FDE_LOG_DIR" ]; then + FDE_LOG_DIR=/var/log/fde + fi + + if [ ! -d "$FDE_LOG_DIR" ]; then + fde_trace "${FDE_LOG_DIR} doesn't exist. Skip snapshot creation" + return 0 + fi + pcr-oracle \ --from eventlog \ --create-testcase ${tmpdir}/${snapshot} \ --stop-event "$stop_event" \ --after \ - predict all > /dev/null + predict "$FDE_SEAL_PCR_LIST" > ${tmpdir}/predicted-pcr.txt - if [ -z "$FDE_LOG_DIR" ]; then - FDE_LOG_DIR=/var/log/fde - fi + mv ${tmpdir}/predicted-pcr.txt ${tmpdir}/${snapshot}/predicted-pcr.txt + cp /proc/sys/kernel/random/boot_id ${tmpdir}/${snapshot}/boot_id - tar Jcf ${FDE_LOG_DIR}/${snapshot}.tar.xz -C ${tmpdir} ${snapshot} + tar Jcf ${FDE_LOG_DIR}/${snapshot}.tar.xz -C ${tmpdir} ${snapshot} - rm -rf ${tmpdir} + rm -rf ${tmpdir} +} + +function tpm_pcr_usage { + local pcr=$1 + + # References: + # https://uapi-group.org/specifications/specs/linux_tpm_pcr_registry/ + # https://tianocore-docs.github.io/edk2-TrustedBootChain/release-1.00/3_TCG_Trusted_Boot_Chain_in_EDKII.html + declare -A pcr_usage_strs + pcr_usage_strs["0"]="[UEFI] Core system firmware executable code" + pcr_usage_strs["1"]="[UEFI] Core system firmware data/host platform configuration" + pcr_usage_strs["2"]="[UEFI] Extended or pluggable executable code" + pcr_usage_strs["3"]="[UEFI] Extended or pluggable firmware data" + pcr_usage_strs["4"]="[UEFI,shim,GRUB2,systemd] Boot loader and additional drivers" + pcr_usage_strs["5"]="[UEFI] GPT/Partition table" + pcr_usage_strs["6"]="[UEFI] Host Platform Manufacturer Specific" + pcr_usage_strs["7"]="[UEFI] Secure Boot Policy" + pcr_usage_strs["8"]="[GRUB2] Commands and kernel command line" + pcr_usage_strs["9"]="[GRUB2] All files read (grub.cfg, kernel, initrd)" + pcr_usage_strs["10"]="[IMA] Protection of the IMA measurement log" + pcr_usage_strs["11"]="[systemd] All components of unified kernel images" + pcr_usage_strs["12"]="[systemd] Kernel command line, system credentials and system configuration images" + pcr_usage_strs["13"]="[systemd] All system extension images for the initrd" + pcr_usage_strs["14"]="[shim] MOK certificates and hashes" + + echo "${pcr_usage_strs[${pcr}]}" } function tpm_inspect { - local snapshot="tpm-snapshot" + # TODO Add an ID to the snapshot name + local snapshot=${FDE_SNAPSHOT_NAME} local snapshot_file="${FDE_LOG_DIR}/${snapshot}.tar.xz" local tmpdir=$(fde_make_tempfile inspect) + local stop_event=$(bootloader_stop_event) + local sys_boot_id="/proc/sys/kernel/random/boot_id" + local pcr_out + local pcr_list + local mismatch_lines + local ret # FIXME use bootloader specific snapshot local grubsnapshot="/sys/firmware/efi/efivars/GrubPcrSnapshot-7ce323f2-b841-4d30-a0e9-5474a76c9a3f" @@ -119,17 +208,71 @@ tar xf ${snapshot_file} -C ${tmpdir} - local stop_event=$(bootloader_stop_event) - - pcr-oracle \ + pcr_out=$(pcr-oracle \ --from eventlog \ --verify snapshot \ --replay-testcase ${tmpdir}/${snapshot} \ - --stop-event "$stop_event" \ + --stop-event "${stop_event}" \ + --after \ + predict ${FDE_SEAL_PCR_LIST} 2>&1) + ret=$? + + if [ $ret -eq 0 ]; then + echo "Sealed PCR matching the current settings" + rm -rf ${tmpdir} + return 0 + fi + + # Check the errors from pcr-oracle + + # Interpret the pcr-oracle output + mismatch_lines=$(grep MISMATCH <<<${pcr_out}) + if [ -z "$mismatch_lines" ]; then + fde_trace "$pcr_out" + rm -rf ${tmpdir} + return 1 + fi + pcr_list=$(echo ${mismatch_lines} | cut -d' ' -f 1 | cut -d':' -f 2) + + # Check the boot ID and see if the predicted PCR values are for the next + # boot or not. + if [ -f ${tmpdir}/${snapshot}/boot_id ]; then + if diff ${tmpdir}/${snapshot}/boot_id ${sys_boot_id} > /dev/null; then + echo "Sealed key authorized for the next boot" + rm -rf ${tmpdir} + return 0 + fi + fi + + fde_trace "PCR mismatch detected:" + for pcr in ${pcr_list}; do + fde_trace "* PCR ${pcr}: $(tpm_pcr_usage ${pcr})" + done + + # Check if pcr-oracle support '--compare-current'. + if LC_ALL=C pcr-oracle --compare-current 2>&1 | grep -q "unrecognized option"; then + return 0 + fi + + fde_trace "" + fde_trace "" + + # SBAT event in PCR7 needs PCR4 events to locate the EFI binary, so we + # always add PCR4 to the list. + inspect_pcr_list=$(echo "${pcr_list} 4" | tr ' ' '\n' | sort -n | uniq | paste -s -d ',') + + # List the detailed TPM events of the affected PCR + pcr_out=$(pcr-oracle \ + --from eventlog \ + --replay-testcase ${tmpdir}/${snapshot} \ + --compare-current \ + --stop-event "${stop_event}" \ --after \ - predict ${FDE_SEAL_PCR_LIST} + predict ${inspect_pcr_list} 2>&1) + fde_trace "${pcr_out}" - rm -rf ${tmpdir} + rm -rf ${tmpdir} + return 0 } function tpm_platform_parameters { @@ -141,7 +284,7 @@ fi # Check if pcr-oracle supports "--target-platform" - if pcr-oracle --target-platform 2>&1 | grep -q "unrecognized option"; then + if LC_ALL=C pcr-oracle --target-platform 2>&1 | grep -q "unrecognized option"; then __fde_platform_param="--key-format tpm2.0" echo "$__fde_platform_param" return @@ -157,10 +300,16 @@ local sealed_secret=$2 local extra_opts=$(tpm_platform_parameters) - local rsa_size=$(tpm_get_rsa_key_size) - if [ -n "$rsa_size" -a "$rsa_size" -ne 2048 ]; then - extra_opts="${extra_opts} --rsa-bits ${rsa_size}" + if [ "$(tpm_get_ecc_srk_support)" = "yes" ]; then + extra_opts="${extra_opts} --ecc-srk" + fi + + if [ -n "$FDE_TPM_PERSISTENT_SRK" ]; then + # Check if pcr-oracle supports '--persistent-srk' + if ! LC_ALL=C pcr-oracle --persistent-srk 2>&1 | grep -q "unrecognized option"; then + extra_opts="${extra_opts} --persistent-srk ${FDE_TPM_PERSISTENT_SRK}" + fi fi local stop_event=$(bootloader_stop_event) @@ -183,28 +332,49 @@ key_size=$1 local extra_opts=$(tpm_platform_parameters) + if [ "$(tpm_get_ecc_srk_support)" = "yes" ]; then + extra_opts="${extra_opts} --ecc-srk" + fi secret=$(fde_make_tempfile secret) dd if=/dev/zero of=$secret bs=$key_size count=1 status=none >&2 - secret=$(fde_make_tempfile secret) sealed_secret=$(fde_make_tempfile sealed_secret) + signed_secret=$(fde_make_tempfile signed_secret) recovered=$(fde_make_tempfile recovered) - result=1 - dd if=/dev/zero of=$secret bs=$key_size count=1 status=none >&2 + rsa_privkey=$(fde_make_tempfile rsa_privkey) + auth_policy=$(fde_make_tempfile auth_policy) + + result=1 fde_trace "Testing TPM seal/unseal" + + pcr-oracle \ + --rsa-generate-key \ + --private-key "$rsa_privkey" \ + --auth "$auth_policy" \ + --algorithm $FDE_SEAL_PCR_BANK \ + create-authorized-policy "$FDE_SEAL_PCR_LIST" + + pcr-oracle ${extra_opts} \ + --auth "$auth_policy" \ + --input "$secret" \ + --output "$sealed_secret" \ + seal-secret + pcr-oracle ${extra_opts} \ --algorithm "$FDE_SEAL_PCR_BANK" \ - --input "$secret" \ - --output "$sealed_secret" \ - --from current \ - seal-secret "$FDE_SEAL_PCR_LIST" + --policy-name "authorized-policy-test" \ + --private-key "$rsa_privkey" \ + --from current \ + --input "$sealed_secret" \ + --output "$signed_secret" \ + sign "$FDE_SEAL_PCR_LIST" pcr-oracle ${extra_opts} \ --algorithm "$FDE_SEAL_PCR_BANK" \ - --input "$sealed_secret" \ + --input "$signed_secret" \ --output "$recovered" \ unseal-secret @@ -226,15 +396,21 @@ local authorized_policy="$3" local extra_opts=$(tpm_platform_parameters) - local rsa_size=$(tpm_get_rsa_key_size) - if [ -n "$rsa_size" -a "$rsa_size" -ne 2048 ]; then - extra_opts="${extra_opts} --rsa-bits ${rsa_size}" + if [ "$(tpm_get_ecc_srk_support)" = "yes" ]; then + extra_opts="${extra_opts} --ecc-srk" fi # If we are expected to use an authorized policy, seal the secret # against that, using pcr-oracle rather than the tpm2 tools if [ -n "$authorized_policy" ]; then + if [ -n "$FDE_TPM_PERSISTENT_SRK" ]; then + # Check if pcr-oracle supports '--persistent-srk' + if ! LC_ALL=C pcr-oracle --persistent-srk 2>&1 | grep -q "unrecognized option"; then + extra_opts="${extra_opts} --persistent-srk ${FDE_TPM_PERSISTENT_SRK}" + fi + fi + pcr-oracle ${extra_opts} \ --authorized-policy "$authorized_policy" \ --input $secret \ @@ -283,7 +459,7 @@ # Generate the private key if it does not exist local extra_opts= - if [ ! -f "$secret_key" ]; then + if [ ! -f "$secret_key" ] || [ "$command" = "regenerate-key" ]; then local rsa_size=$(tpm_get_rsa_key_size) extra_opts="--rsa-generate-key" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fde-tools-0.7.3/share/uefi new/fde-tools-0.7.6/share/uefi --- old/fde-tools-0.7.3/share/uefi 2023-04-24 08:15:51.917030960 +0200 +++ new/fde-tools-0.7.6/share/uefi 2025-07-29 05:00:40.738993652 +0200 @@ -57,14 +57,18 @@ file=$(efibootdump "Boot$entry" | sed 's/.*File(\([^)]*\)).*/\1/;t;d' | tr '\\' /) # Some boot setups do not use an EFI path with a file component. - # Our ALP kvm images built with kiwi fall into that category. # - # As a fallback, check if there is exactly one grub entry in /boot/efi, - # and if so, use that. + # As a fallback, check the default EFI boot path: \EFI\BOOT\boot*.efi if [ -z "$file" -a -d "/boot/efi/EFI" ]; then - set -- /boot/efi/EFI/*/grub.cfg - if [ $# -eq 1 -a -f "$1" ]; then - realpath $1 + arch=$(uname -m) + if [ x"$arch" = xx86_64 ]; then + boot_efi=bootx64.efi + elif [ x"$arch" = xaarch64 ]; then + boot_efi=bootaa64.efi + fi + + if [ -f /boot/efi/EFI/BOOT/$boot_efi ]; then + realpath "/boot/efi/EFI/BOOT/$boot_efi" return 0 fi fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fde-tools-0.7.3/sysconfig.fde new/fde-tools-0.7.6/sysconfig.fde --- old/fde-tools-0.7.3/sysconfig.fde 2025-05-14 09:25:32.495540678 +0200 +++ new/fde-tools-0.7.6/sysconfig.fde 2026-07-30 04:47:12.995515101 +0200 @@ -37,7 +37,18 @@ # Set to yes/no FDE_TPM_AUTO_UPDATE="yes" -# The RSA key size to be used for SRK and the private sign key +# Configure whether to use ECC SRK instead of RSA SRK +# Set to yes/no/auto (default is auto) +FDE_ECC_SRK="auto" + +# The RSA key size to be used for the private sign key # Expected values: 2048, 3072, 4096, or just leave it empty to let fdectl # to determine the size at runtime FDE_RSA_KEY_SIZE="" + +# Specify the TPM persistent handle to store SRK +# The valid range of this variable is 0x81000000~0x817FFFFF. +# If this variable is unset, grub2 will generate SRK dynamically. +# NOTE: The persistent handle will be overwritten. Please make sure that no +# other program is using the same handle before setting this variable. +FDE_TPM_PERSISTENT_SRK=""
