2 Commits

Author	SHA1	Message	Date
Noel Georgi	166d75fe88	fix: tpm2 encrypt/decrypt flow ... The previous flow was using TPM PCR 11 values to bound the policy which means TPM cannot unseal when UKI changes. Now it's fixed to use PCR 7 which is bound to the SecureBoot state (SecureBoot status and Certificates). This provides a full chain of trust bound to SecureBoot state and signed PCR signature. Also the code has been refactored to use PolicyCalculator from the TPM library. Signed-off-by: Noel Georgi <git@frezbo.dev>	2023-07-14 23:58:59 +05:30
Andrey Smirnov	53873b8444	refactor: move ukify into Talos code ... This is intemediate step to move parts of the `ukify` down to the main Talos source tree, and call it from `talosctl` binary. The next step will be to integrate it into the imager and move `.uki` build out of the Dockerfile. Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>	2023-07-13 19:14:32 +04:00