Fedora Account System
Red Hat Associate
Red Hat Customer
+++ This bug was initially created as a clone of Bug #2325522 +++ The default PCR bank for TPM2 is sha1, which is not always supported (it is legacy and optional for implementation). Make this more future-proof and use the first bank with non-empty set of PCRs, which is returned from TPM by tpm2_getcap pcrs. The swtpm by default does not create sha1 bank, so this fixes usage with swtpm. Reproducible: Always Steps to Reproduce: 1.Configure TPM2 bank without sha1 2.Try configuring clevis without specifying bank 3.Check error: # echo foo | clevis encrypt tpm2 '{"pcr_ids": "7"}' | clevis decrypt Unable to validate combination of PCR bank 'sha1' and PCR IDs '7'. Actual Results: # echo foo | clevis encrypt tpm2 '{"pcr_ids": "7"}' | clevis decrypt Unable to validate combination of PCR bank 'sha1' and PCR IDs '7'. Expected Results: Encryption/Decryption should be performed correctly independently of the bank: # echo foo | clevis encrypt tpm2 '{"pcr_ids": "7"}' | clevis decrypt foo
FEDORA-2024-82d4e1704f (clevis-21-6.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2024-82d4e1704f
FEDORA-2024-82d4e1704f has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-82d4e1704f` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-82d4e1704f See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2024-82d4e1704f (clevis-21-6.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report.