Package: tee-supplicant Version: 4.5.0-1 Followup-For: Bug #1043241 Dear maintainer,
the tee-supplicant binary in trixie is built with the upstream default RPMB_EMU=1 (see tee-supplicant/CMakeLists.txt / Makefile in the optee_client source; debian/rules does not override it). With RPMB_EMU, the code accessing real RPMB devices (/dev/mmcblk*rpmb via MMC_IOC_MULTI_CMD) is compiled out entirely and replaced with an in-memory emulation. Consequences on systems where OP-TEE uses RPMB-backed secure storage (the standard configuration on devices with eMMC, e.g. any board following the OP-TEE + fTPM measured-boot setup): the emulated RPMB does not match the device's provisioned RPMB authentication key, all secure storage operations fail (or, worse, appear to work against a volatile fake), and TEE applications such as the Microsoft fTPM cannot open sessions. Verification: `strings /usr/sbin/tee-supplicant | grep mmcblk` returns nothing on the emu build. RPMB emulation is an upstream development convenience for systems without RPMB hardware; a distribution binary should serve real hardware. Please build with RPMB_EMU disabled (-DRPMB_EMU=OFF for cmake, RPMB_EMU=0 for make). If there is concern about developers relying on the emulation, an alternative is shipping both binaries or a runtime option, but the default should be real RPMB access. Thanks! -- System Information: Debian Release: 13.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: arm64 (aarch64) Kernel: Linux 6.12.95+deb13-arm64 (SMP w/8 CPU threads) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages tee-supplicant depends on: ii libc6 2.41-12+deb13u3 ii libteec2 4.5.0-1 tee-supplicant recommends no packages. tee-supplicant suggests no packages. -- no debconf information
