Currently, whole-disk encryption only works with TPM v1.2. TPM in firmware (aka fTPM) is based on TPM v2.0. This issue here covers: - enabling the TPM 2.0 userspace = https://github.com/01org/tpm2.0-tools - adding the necessary kernel configuration (if needed) - adding a "tpm2.0" image and distro feature, with the corresponding changes to the code which currently only supports tpm1.2 (initramfs, installer): as for 1.2, usage of 2.0 is meant to be optional with parameters to make it mandatory - testing under qemu, using the experimental https://github.com/stefanberger/swtpm/tree/tpm2-preview *Not* covered is testing on real hardware. Joule might work, but testing and automating that is something that needs to be done by QA.
https://github.com/pohly/intel-iot-refkit/commits/tpm2 contains my work-in-progress changes. Currently it only allows building tpm2.0-tools from meta-measured. Clearly I am not going to finish this for M2, so I propose moving it to M3.
Still valid and should be possible to refactor refkit implementation.
Unfortunately, meta-measured (https://github.com/flihp/meta-measured) is now marked as archived. The most current tpm support is in meta-tpm (https://git.yoctoproject.org/meta-security/tree/meta-tpm) The number of recipes there is probably too much to move into oe-core, so we might want to create a reference implementation in meta-security. Hopefully one that could be tested on the AutoBuilder.
bulk change to add Saul's non-WR address.
Bulk change: Remove Saul's old WR address.