Mkinitcpio 42 requires manual TPM2 re-enrollment for LUKS unlocking
Key Takeaway
Users using the systemd hook in mkinitcpio to unlock LUKS partitions via TPM2 must re-enroll their TPM2 devices due to changes in PCR measurements.
Summary
Starting with mkinitcpio version 42-1, the systemd hook now includes the systemd-pcrosseparator.service as designed in systemd v261. This change alters the measurements of PCR values 0-7, 9, and 12-14. Consequently, users who rely on these specific PCR values to automatically unlock LUKS partitions must manually re-enroll their TPM2 hardware.
Technical impact on PCR measurements
- The update introduces systemd-pcrosseparator.service into the mkinitcpio systemd hook.
- Affected PCR values include 0-7, 9, and 12-14.
- Users utilizing systemd-cryptenroll with pinned values must re-enroll.
- Users relying on custom policies with a disabled systemd-pcrlock-make-policy.service should consult systemd-pcrlock(8).
Why it matters
This change affects Arch Linux users who implement automated disk encryption unlocking via TPM2, potentially preventing successful boots if not addressed.
Original reference: archlinux.org →