From c472177d1399536a5f09efd650ec331294c2cca8 Mon Sep 17 00:00:00 2001
From: "Simon L." <szaimen@e.mail.de>
Date: Fri, 7 Aug 2026 18:58:34 +0200
Subject: [PATCH] Choose initramfs generator based on Ubuntu release

Commit 58af3bc switched tpm2-unlock.sh to dracut unconditionally, which
broke the script on 24.04 where the initramfs is generated by
initramfs-tools. It also installed both clevis-initramfs and
clevis-dracut, so each shipped a hook injecting clevis into the
initramfs.

Pick the package and the update command per release instead: noble keeps
clevis-initramfs and update-initramfs, later releases use clevis-dracut
and dracut. The rollback purge now matches what was installed, so it no
longer fails on an absent package.

Signed-off-by: Simon L. <szaimen@e.mail.de>
---
 not-supported/tpm2-unlock.sh | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/not-supported/tpm2-unlock.sh b/not-supported/tpm2-unlock.sh
index 57443c8263..888d9e65b1 100644
--- a/not-supported/tpm2-unlock.sh
+++ b/not-supported/tpm2-unlock.sh
@@ -19,6 +19,18 @@ debug_mode
 # Check if root
 root_check
 
+# Noble (24.04) generates the initramfs with initramfs-tools,
+# later releases use dracut
+# https://ubuntu.com/server/docs/how-to/security/tpm-backed-luks-decryption-with-clevis/
+if [ "$CODENAME" = "noble" ]
+then
+    CLEVIS_INITRAMFS_PACKAGE="clevis-initramfs"
+    INITRAMFS_UPDATE=(update-initramfs -u -k 'all')
+else
+    CLEVIS_INITRAMFS_PACKAGE="clevis-dracut"
+    INITRAMFS_UPDATE=(dracut -f)
+fi
+
 # Check if already installed
 if is_this_installed clevis-luks || is_this_installed clevis-tpm2 || is_this_installed clevis-initramfs || is_this_installed clevis-dracut
 then
@@ -71,7 +83,7 @@ then
 fi
 
 # Install needed tools
-apt-get install clevis-tpm2 clevis-luks clevis-initramfs clevis-dracut -y
+apt-get install clevis-tpm2 clevis-luks "$CLEVIS_INITRAMFS_PACKAGE" -y
 
 # Execute the script
 print_text_in_color "$ICyan" "Setting up automatic unlocking via TPM2..."
@@ -79,13 +91,13 @@ if ! echo "$PASSWORD" | clevis luks bind -k - -d "/dev/${ENCRYPTED_DEVICE[*]}" t
 then
     msg_box "Something has failed while trying to configure clevis luks.
 We will now uninstall all needed packets again, so that you are able to start over."
-    apt-get purge clevis-tpm2 clevis-luks clevis-initramfs clevis-dracut -y
+    apt-get purge clevis-tpm2 clevis-luks "$CLEVIS_INITRAMFS_PACKAGE" -y
     apt-get autoremove -y
     msg_box "All installed packets were successfully removed."
     exit 1
 fi
 print_text_in_color "$ICyan" "Updating initramfs..."
-if ! dracut -f
+if ! "${INITRAMFS_UPDATE[@]}"
 then
     msg_box "Errors during initramfs update"
     exit 1