Skip to content

Choose initramfs generator based on Ubuntu release - #2834

Merged
enoch85 merged 1 commit into
mainfrom
tpm2-initramfs-per-release
Aug 7, 2026
Merged

Choose initramfs generator based on Ubuntu release#2834
enoch85 merged 1 commit into
mainfrom
tpm2-initramfs-per-release

Conversation

@szaimen

@szaimen szaimen commented Aug 7, 2026

Copy link
Copy Markdown
Collaborator

Problem

#2833 switched tpm2-unlock.sh to dracut -f unconditionally. That fixed 26.04, but 24.04 is still in the supported range (SUPPORTED_VERSION_MIN=24.04 in lib.sh) and generates its initramfs with initramfs-tools, so the unconditional switch regressed it.

That commit also installed both clevis-initramfs and clevis-dracut. Each ships a hook that injects clevis into the initramfs, so on 26.04 you get the dracut path plus a stale initramfs-tools hook.

Change

Pick the package and the update command together, once, based on the release codename:

Release Package Command
noble (24.04) clevis-initramfs update-initramfs -u -k 'all'
later (26.04+) clevis-dracut dracut -f

Three follow-on fixes:

  • Only the release-appropriate clevis package is installed, so there are no competing initramfs hooks.
  • The rollback apt-get purge matches what was installed, so it no longer fails on an absent package.
  • The command is held in an array and invoked once, keeping the single msg_box/exit 1 error path rather than duplicating the condition.

The check keys off $CODENAME rather than a numeric comparison. check_distro_version already rejects anything outside the supported range, and this project only supports LTS releases, so $DISTRO can only be 24.04.x or 26.04.x here — a numeric cutoff would have needed a magic version number that appears nowhere in the project's policy. Testing for noble also makes dracut the default, so future releases land on the right path automatically.

The is_this_installed check still tests both package names on purpose: it's a "have you run this before?" probe, and anyone who ran the script at 58af3bc on 26.04 may have clevis-initramfs installed.

Testing

shellcheck -x not-supported/tpm2-unlock.sh passes clean.

I have not verified that clevis-dracut exists under exactly that name in the 26.04 archive — that rests on the report in #2833 and the Ubuntu clevis guide, as it did before this change. Worth a confirmation from someone with a 26.04 box, along with a real 24.04 run to confirm the restored path.

🤖 AI (if applicable)

  • The content of this PR was partly or fully generated using AI

Commit 58af3bc switched tpm2-unlock.sh to dracut unconditionally, which
broke the script on 24.04 where the initramfs is generated by
initramfs-tools. It also installed both clevis-initramfs and
clevis-dracut, so each shipped a hook injecting clevis into the
initramfs.

Pick the package and the update command per release instead: noble keeps
clevis-initramfs and update-initramfs, later releases use clevis-dracut
and dracut. The rollback purge now matches what was installed, so it no
longer fails on an absent package.

Signed-off-by: Simon L. <szaimen@e.mail.de>
@szaimen
szaimen requested a review from enoch85 August 7, 2026 17:01
@szaimen szaimen mentioned this pull request Aug 7, 2026
1 task
@enoch85
enoch85 merged commit 3774f9d into main Aug 7, 2026
8 of 9 checks passed
@enoch85

enoch85 commented Aug 7, 2026

Copy link
Copy Markdown
Member

Thanks @szaimen!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants