Skip to content

[13.4-stable] Backport vTPM fixes#5796

Merged
rene merged 2 commits intolf-edge:13.4-stablefrom
shjala:13.4-stable.bp.5398
May 6, 2026
Merged

[13.4-stable] Backport vTPM fixes#5796
rene merged 2 commits intolf-edge:13.4-stablefrom
shjala:13.4-stable.bp.5398

Conversation

@shjala
Copy link
Copy Markdown
Member

@shjala shjala commented Apr 14, 2026

Description

Backport of #5398

PR dependencies

List all dependencies of this PR (when applicable, otherwise remove this
section).

How to test and validate this PR

Please describe how the changes in this PR can be validated or verified. For
example:

  • If your PR fixes a bug, outline the steps to confirm the issue is resolved.
  • If your PR introduces a new feature, explain how to test and validate it.

This will be used

  1. to provide test scenarios for the QA team
  2. by a reviewer to validate the changes in this PR.

The first is especially important, so, please make sure to provide as much
detail as possible.

If it's covered by an automated test, please mention it here.

Changelog notes

Text in this section will be used to generate the changelog entry for
release notes. The consumers of this are end users, not developers.
So, provide a clear and short description of what is changed in the PR from
the end user perspective. If it changes only tooling or some internal
implementation, put a note like "No user-facing changes" or "None".

PR Backports

For all current LTS branches, please state explicitly if this PR should be
backported or not. This section is used by our scripts to track the backports,
so, please, do not omit it.

Here is the list of current LTS branches (it should be always up to date):

  • 16.0-stable
  • 14.5-stable
  • 13.4-stable

For example, if this PR fixes a bug in a feature that was introduced in 14.5,
you can write:

- 16.0-stable: To be backported.
- 14.5-stable: No, as the feature is not available there.
- 13.4-stable: No, as the feature is not available there.

Also, to the PRs that should be backported into any stable branch, please
add a label stable.

Checklist

  • I've provided a proper description
  • I've added the proper documentation
  • I've tested my PR on amd64 device
  • I've tested my PR on arm64 device
  • I've written the test verification instructions
  • I've set the proper labels to this PR

For backport PRs (remove it if it's not a backport):

  • I've added a reference link to the original PR
  • PR's title follows the template

And the last but not least:

  • I've checked the boxes above, or I've provided a good reason why I didn't
    check them.

Please, check the boxes above after submitting the PR in interactive mode.

shjala added 2 commits April 14, 2026 17:23
Update eve-api to include the latest changes that
support dynamic PCRs

Signed-off-by: Shahriyar Jalayeri <shahriyar@posteo.de>
This commit introduces the ability to dynamically update the PCR policy
used for sealing the disk encryption key, allowing the controller to
define which PCRs are used for sealing.

Key changes:
evetpm: Added functionality to persist and validate PCR policy
  configuration in policy-pcr.json, plus recovring policy in case
  of configuration corruption.
vaultmgr: Updated key handling logic to detect policy changes from the
  controller, persist the new policy, and trigger a reseal of
  the disk encryption key.
zedagent: Added extraction of PCR policy information from
  AttestStorageKeys protobuf messages to pass to vaultmgr.
types: Introduced VaultKeyPolicyPCR struct and PolicyPcrFile constant
  to support policy propagation.
tests: Added unit tests for policy digest computation and validation.

Signed-off-by: Shahriyar Jalayeri <shahriyar@posteo.de>
(cherry picked from commit c4982d6)
Signed-off-by: Shahriyar Jalayeri <shahriyar@posteo.de>
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 14, 2026

Codecov Report

❌ Patch coverage is 45.23810% with 92 lines in your changes missing coverage. Please review.
✅ Project coverage is 30.33%. Comparing base (8077a3d) to head (8a5f038).
⚠️ Report is 186 commits behind head on 13.4-stable.

Files with missing lines Patch % Lines
pkg/pillar/evetpm/tpm.go 45.23% 82 Missing and 10 partials ⚠️
Additional details and impacted files
@@               Coverage Diff               @@
##           13.4-stable    #5796      +/-   ##
===============================================
+ Coverage        24.78%   30.33%   +5.55%     
===============================================
  Files                8        8              
  Lines             1138      989     -149     
===============================================
+ Hits               282      300      +18     
+ Misses             788      611     -177     
- Partials            68       78      +10     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link
Copy Markdown
Contributor

@eriknordmark eriknordmark left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pkg/vtpm diffs include
// FIX-ME : update this after pillar changes is merged!!!
Does that mean there is a follow-up backport PR needed once this is merged into 13.4-stable?

@shjala
Copy link
Copy Markdown
Member Author

shjala commented Apr 20, 2026

I have a fix for master, I want to include it in this backport PR, so keeping open for now.

@shjala shjala mentioned this pull request Apr 21, 2026
9 tasks
@eriknordmark
Copy link
Copy Markdown
Contributor

Does 13.4-stable also need the log rotation fix?

@shjala
Copy link
Copy Markdown
Member Author

shjala commented May 4, 2026

Does 13.4-stable also need the log rotation fix?

Yes, I'll pull all the fixes same as 14.x PR.

@shjala shjala changed the title [13.4-stable] Add dynamic PCR policy support for disk key sealing [13.4-stable] Backport vTPM fixes May 4, 2026
Copy link
Copy Markdown
Contributor

@rene rene left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kicking off tests....

@rene rene merged commit 7036a54 into lf-edge:13.4-stable May 6, 2026
40 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants