Laptop: Busted, won’t boot
My new(-ish now) laptop has mostly performed great over the just-over-a-year I’ve had it, and surprisingly I hadn’t managed to ratfuck my Linux installation in that time. Well, no time like the present, because on Monday I ran pacman -Syu tcpdump, it installed a pile of packages including a kernel update, I thought nothing of it and shut the machine down. Yesterday when I went to use it, and I was faced with a dreaded message: Please enter the recovery key for disk BLAH BLAH BLAH
Whoops.
I figured that something had failed to sign, but it took me a bit to figure out. First of all, I couldn’t get into the recovery immediately, because I was typing the key wrong. Note to future self: the hyphens in the recovery key are part of it, they’re not optional for aesthetic purposes.
But I managed to boot from a USB key after turning secureboot off, but then I was unable to decrypt and mount the disk, so I figured it was maybe because my USB key was too old (from ~2025) so I made a new one. It was at that point I figured out the hyphen thing, got into it, and no, it looks like everything worked correctly?
I started thinking about what the hell could have happened, noting that it was exactly 451 days since I installed it and maybe something expired. I checked sbctl verify and everything is signed, everything should be happy, but in the end re-enrolling a new key into luks and the TPM worked:
systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/sdX
I rebooted, flipped secureboot back on, and it’s straight into it without needing the key, happy days. But what caused it?
I was racking my brain trying to work it out when Avi came through today with the release notes I didn’t read:
Starting with package version
42-1, the mkinitcpio systemd hook now includessystemd-pcrosseparator.service(as intended by systemd v261).This affects the measurements of PCR values
0-7,9and12-14. If you configured the systemd hook and unlock LUKS partitions, that depend on these values, you need to re-enroll the TPM2 in use.
I checked my pacman.log and sure enough, I upgraded mkinitcpio to that exact version right before the shit hit the fan, so problem solved I guess? Operator error.
Whoops.
