Arch Linux Forums

TPM (PCR 7 + 11) Setup Failure.

dummy@example.com (LeFauconBlanc) — Sun, 19 Jul 2026 23:41:56 +0000

Hello, I have a dual-booted ThinkPad T14 Gen 3 AMD, Arch Linux (KDE Plasma Wayland) and Windows 11. A Windows update occured and my TPM + PIN (PCR 7 + 11) broke. I've tried cryptenroll with just PCR 7 and it did work, so I've pinpointed the problem to PCR 11. I've tried regenerating PCR public and private keys and still get TPM policy does not match current system state. Either system has been tempered with or policy out-of-date: Operation not permitted. I've tried clearing TPM in BIOS then re-enrolling.

If anybody can give me some resources that touch on this situation more or point out the problem I'd really appreciate it. If I don't include enough of my situation, please ask for more.

[lefauconblanc@m0bileTank ~]$ cat /etc/kernel/uki.conf
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it under the
# terms of the GNU Lesser General Public License as published by the Free
# Software Foundation; either version 2.1 of the License, or (at your option)
# any later version.
#
# Ini-style configuration file for ukify(1) which is only effective when
# $KERNEL_INSTALL_LAYOUT or layout= in install.conf is set to uki and
# $KERNEL_INSTALL_UKI_GENERATOR or uki_generator= in install.conf is set to
# ukify, or is unset. $KERNEL_INSTALL_CONF_ROOT may be used to override the
# search path.
#
# See kernel-install(8) for details.

[UKI]
#Initrd=
#Microcode=
#Splash=/usr/share/systemd/bootctl/splash-arch.bmp
PCRPKey=/etc/systemd/tpm2-pcr-keys/tpm2-pcr-public-key.pem
#PCRBanks=
#SecureBootSigningTool=sbsign
#SecureBootPrivateKey=/etc/kernel/secure-boot-private-key.pem
#SecureBootCertificate=/etc/kernel/secure-boot-certificate.pem
#SecureBootCertificateDir=
#SecureBootCertificateName=
#SecureBootCertificateValidity=
#SigningEngine=
#SignKernel=

[PCRSignature:initrd]
PCRPrivateKey=/etc/systemd/tpm2-pcr-keys/tpm2-pcr-private-key.pem
PCRPublicKey=/etc/systemd/tpm2-pcr-keys/tpm2-pcr-public-key.pem
#Phases=enter-initrd

[lefauconblanc@m0bileTank ~]$ sudo ukify inspect /boot/efi/Linux/fe916b87c8864f5d9525d549af8b8132-7.1.4-arch1-1.efi
.sbat:
size: 325 bytes
sha256: 653af6e3ca67a4a0d9e1c85e67810caa071e36fcb49302dc62b8013ed0725fb2
text:
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
systemd-stub,1,The systemd Developers,systemd,261,https://systemd.io/
systemd-stub.arch,1,Arch Linux,systemd,261.1,https://archlinux.org/packages/core/x86_64/systemd/
uki,1,UKI,uki,1,https://uapi-group.org/specifications/specs/unified_kernel_image/
.osrel:
size: 382 bytes
sha256: 71ff7a6e248d9a0718344c957ec709cb6f0b18631682fa404d7cff2af3ff341d
text:
NAME="Arch Linux"
PRETTY_NAME="Arch Linux"
ID=arch
BUILD_ID=rolling
ANSI_COLOR="38;2;23;147;209"
HOME_URL="https://archlinux.org/"
DOCUMENTATION_URL="https://wiki.archlinux.org/"
SUPPORT_URL="https://bbs.archlinux.org/"
BUG_REPORT_URL="https://gitlab.archlinux.org/groups/archlinux/-/issues"
PRIVACY_POLICY_URL="https://terms.archlinux.org/docs/privacy-policy/"
LOGO=archlinux-logo
.cmdline:
size: 541 bytes
sha256: 5aa986ad050d89cec236040017f0761aca2cce5d319591e407bf1973cf2654e9
text:
rd.luks.name=1994193e-269f-46a6-a781-25dffb534165=arch-root rd.luks.name=41c23ed9-dfe6-4729-aa18-33c8bf28e473=arch-swap root=/dev/mapper/arch-root rd.luks.options=arch-root:tpm2-device=auto resume=/dev/mapper/arch-swap rd.luks.optio
ns=arch-swap:tpm2-device=auto tpm_tis.interrupts=0 splash quiet loglevel=3 systemd.show_status=auto rd.udev.log_level=3 vt.global_cursor_default=0 lsm=landlock,lockdown,yama,integrity,apparmor,bpf audit=1 audit_backlog_limit=16384 btusb
.enable_autosuspend=0 systemd.machine_id=fe916b87c8864f5d9525d549af8b8132
.uname:
size: 13 bytes
sha256: 59df3a99744710b755986600297ef0658046e9c2a8a4adaf7cdd1e4874aa84a4
text:
7.1.4-arch1-1
.pcrpkey:
size: 451 bytes
sha256: 9e71cb3a02d2b87029e3524ad0fa1a446c9a238b360520ec66ccacc986e03af8
text:
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiQVTgXRQ8oQFgotb8Y0s
u95yZuzOra/L36B9f65cH4K4R1QaPWehUbhue6dZAN/N0RKhm4+PWioJ1AfZmjG5
x+54cwVWbKA5tW8JeqVcTKjzDhZvYo7JtlJfJ4HypBpgQWfTFlPu9fuXZ47NprZk
REIj4fikkWG1aEgvwQHTQw8enEeHLup2XhRQJ9RxU/F1ir43CdjojMS8xFaEKj3E
M+iYZPGWz+fRc5aibhb/KrOCoxgYMo3TVYrhgIHWpj6NmE5kwsoWQtfAsfFQ1gdp
CMVA+dTusIaT/w2DyAYY9JOWPzWaAqH0IPhjgbL4VYhLzGmKaEAq0bIZYLhngfPl
YQIDAQAB
-----END PUBLIC KEY-----
.linux:
size: 17076736 bytes
sha256: 442c4d5513d726cfcc8c7e8ec54bfa68efb30db2be8caec6ecbb5c3f90ece0d8
.initrd:
size: 57518980 bytes
sha256: 67834e386d14dec1018a1dc0d3a816249fbb65f7d7333ff6358803b8f2cde100
.pcrsig:
size: 8398 bytes
sha256: c4aa7441b5be754aa5edfea1689903d4455c48485400a24dfef9c91d4c066594
text:
{"sha1": [{"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "0e9f25a0821b85259aad106daf35be0182e94c75866b558e4071e6f7eeeafd84", "sig": "bhGw4uDC4X/s+gEt3esgRP2mLW4PUVEsW5NtMObdlbVaGNLY
g0j7RV4pQv7++ImN15mBegAbrmePUNO8QhLGsvdE8ik0QNBdSq/NgUmG01+r7dD57d4wm+cMiTYDbzw2/3kpGfWFZF57loZK849XdYItl+KKq23xJRHsa8reFOfwPu5wXbI6/MpO+CtcF2X2sJ59OqDcJZvQvF1NocQvVU1hMNK8jfjwjm8EIeW4O+9/a9dQ8UV9zSVBg9qXTu8OadEUL1BuBzMdIgvY/6kEiGEV651h
hmLBMCN5i+acHS14WT8fY6gpjOICIFZLTT3Hnw7T2tV1B6A/dYxYytrVkQ=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "15dfb34d5343d09f1496dedfbdf0ead23ed243a80971d0501ecc1b45d37c33ec", "sig":
"c/cWf9Ih39dQjIwb52y16ommtJq9khXEOiMCdMndn/fCPUnOVzKaJL7PCA2NIeU1fcoqnks0BsS3ho7VTjwPzaYH3AVeDO4Lmgiehwh1c/gMNNeKM3uwpc6gvgssxlFrIK6NgJNyBIsaGE/072egY1xVe3lsUTWNZSEO3oQe+dtssK69tm1hoqrM+dNlDyhgX2pf4cUjU1GcH4EtNtjNWfQ0ChWxLtVMZ6X6yJs9GL
YYH1EILK2qXo+9Fdk/eulRF1M8o/zv4Ur57TOXcOLLfmPPpD9Lp0pECc6ZEJ8Ao7gihTGoHvtv+GI3Ixr32zjon5oO7TkO1sRCCgbuS8f56Q=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "04a605b621da69705195863
df6d32b1a7763d73061a5ff9412adb6d6cc6f631d", "sig": "cOLgEPyVE3xll8YT5sOa912qgNP5+ow9lz9e6sgr+QedkZgd7tJpVxUZb48VTw1V+87CAl2L/IjX21y+cKB6AC5J9QF/zqHSZX/FWNXieV8exE+XdFCZ40jlAKJFPjCB9MOz2w+G0wGuFmFEcMWzr+IIzXb5LXukXV9fl34xQbBJrGiNyQRTZQ5W
UR5mkUUURRwoUtzb/tYZlR5kJ8+BY7dOcKet83rmNzEXhw7YVuqEPiMAswKOdcaLjay7v/S0Bb7GhMgHHbVS8YAfcQAkwgoHTAsIcopePZhETYDU3GcuTXEoLs3m5bvUEqHdkU5klqBx0PyKs+6DKVaRTJQeJw=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70
db4cf22f7d260b14", "pol": "e1fd80c5195143efff66b4a38fae25853cabb3916f9319f4dce1506c8e492e33", "sig": "Q6rkFZR56JKMvJ+KamAxFmT7w/UOGaKiPdLWIsMBnPSKd9YAdj5gLCi8B4FhnP/0dPDEIyq9mEr7H1/Wb2Z1NCleq3ik6F5KjPkB8h/GtGAmr2MAGD5E1w+9jxCCbIPrlTSUP/
yJSJr9rRRhViNyChQV0FqfFofZ6nlKnwTWQ/zH5mQEdKBl5onDLE7s2UJzuVgCxODVHEouIj93aLdFswFhI649DkljgBqw5nSF78wlwsu1zzzYgr1IPwE1bNA58AEnB4CEYbljysU6h56QFZHjglq86aUgCSgofTlGC1se1qX6jDI0tUzT9hpQQkzsLE9GQt5ZTy7ppQ/7B6Kikg=="}], "sha256": [{"pcrs": [
11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "f35eda479739bafb47006456b38bbf7fa099750c3271ab751951b8df970807cb", "sig": "Lp20DGnyRpiGqulKBdDzPEjvE//aGvWbQAkFdf6YPasEB1bM5G8FqDvOLaF5T73PBOs4wR5/
0O+DGqGNBlRvakO7QQtxgRmsmKGtxyjByjrGVhjMeNj9H8cPisE1sGH9nEN1PbDo86yDXAkLwzkhRZxi/+eKwPfsSuz2lQA+CYh7wWDDI+IuJu3xcJ174ZpYJV6pc02hKdIAlM8C/j+4OT6ayHYe5Z5hAn9qG/gI4XZgFHEXK14XsjMmASZwAPiZPO5Ptly0cWPU4PwGmcrfz0d5UZpj8+8EFQQ1eG0LIMoNv/9U5/2e
RAbd2n6qN/5iWCXgZLZ5I6DV+ImeTh7Bng=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "d747751bf0f9b73df34ebec36fa7a1cabc270ab88f51d9ad11667c3f860ae493", "sig": "KisVGLh4Et41JEQygI/hRb
Nb7FQx1knEtGQzlkfueq9vBoKE1So7ktHXmVhmoWmh6ro0j/b5y2SmTQSbaCiZuhn6C/Dp58k17Lv8EcHBXUTP/jNcUn+9NTvYU6sE03sqZXmwoB4GqMybGZzH8Sm8i86x65yalCTjAXlYawKrR38qI4GmqQAvTDGN4TRJgMT4BiTIcQ38Vi0hvDtWfwaStYTiLGioQKKqM+0W6da45DtmEg2OivBSjWF4Sl4WjWXi36
k6rEfL+zE+1Tg4MoDFVKVj1HIEH5YIn3zjTMJ1n/w1zcNhXlycjgz/gm7oVXvx7xeKQ1wkya+0tCTMHB2Eww=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "4eef6144e278e72b7984b8dd6e25550c3903de2cc5b7f83
0c4cb5272912a6339", "sig": "GoO0V02xq4J5p8+EdxOKxCXINbEwe/NlvkAp+veqilmh55K+jkDOIMLp3WHRWS5UoACcCdrWydgJVj5CIVDhPKOzZyhq1HRjvhO7dDBkeRRStsk+qFox/bf/cgiRs0l+44zr43q1e4huoqPxuLs3Hg9QwngfVKucVaE8K2GhnzRsYDEIVx7TXTnJZyJ86AOAzhNqWyYFm83WsW6j
XjHMHWfBWz0bOfI7m7Gtee90RfipoI/WFVM0z0feuE8itQn2RMTWG5wOVk3rk6+KrD9VGlAhfgDQg1swXfvNTX3azrF31gRWbWDx/n+PifrC9NNwtbpcBWtX7tRTMidl8ocTxg=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol"
: "42766b2d25f9ea50925ffafb7879f6feaf0c6e60c92ceab9e1062194119ec7f7", "sig": "Y9qm4rlbvE5G/TcVeYnJFESxBOtO3vpC0H64+qY9VGN4AfvKkmme7vS8bqsaQqSHY3f0vvj2pKv+qf1SXjyvs0UDmLn3XB/VAQmmZ+733CGO1ipR1vxiX/Tr6U13cvoj5nSr/vJ0BNjqmzUWEkspI18fW6VunK
7eI4g02HvmFIJzjfWJZDHRhc8yr56iJ8epE7AKZ81db88lVdiDVDdDSPYHJc2KNeH9BnXYelHAdwGNGNfG8jcTHEZMA2QG+8LADdokzlg8VZepnPKyw5Tzi5jFWh5d8Ff0diD8GQEXcqraqCxZ8ozdqypoC+OzvFh5tPb0Cfy2PBG4up9jQPmNHw=="}], "sha384": [{"pcrs": [11], "pkfp": "d85efb34ef
d1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "06b01c0ce05fc88ef7a6f6d380db5aa5b8b6cfb27c17654780d05f00abd65684", "sig": "TF+/dy4v2UjcX0kbQyF6fa+jo/mNMPwf401Jj28Pa/Fe/8tDVp38heuDCoHK2bxSgi5KaQ9YRU099sDS3no8nEorLfWJSTWp
P8/uj4dOWV0kIEPPnycvua+8NwKkGdvJx9MJV1ijluJkjBqU7N8+cwn4zA0gIxPRUFcoTRfql+75ghGP5ayOhXWJRDXOiZFr/dM+XsXxqjAKBoiek8uKId5Yenqp2KwCusExgCNXZgKRu84oKzvwjVgpp+HnY5D7qTgnyqr+WHNL//Ex77ftO5Eu2VlxSZCxoKnvWwWq5//YE7xlTl7ameN49zCuUmzRCST4Le3V23NF
BYhbqLNzEw=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "16f496b2493074eaf7ef72e42cc25b0a489194825c33ba91fb19a1fae2e0dc33", "sig": "Wsd6/MRIb8uP6o81cl9Y0IdEkNltrG0j3ZEhdMNkcgWvOm
gXeVmDAYdm+V7g0sEzjo1TEAtsfVaPKbT7X+Q1LcCdPCwAMUVo7zMmJZczkpH6IDN+2VrgGufsV0ramkiTvN/zmBeo6p96nCaYG2aBMsH65m+a6dbU6NcPGr/3aabXl9kq6IhpOZwO3uBVZL92sgEwy22EMSEFHg8TyjYs1DXOvBxmUpeQXsbVkNbvKqvi3RWrTtVGr0c/l3F+9RYecpab/g2ExlpOb+ha5MhGE//6uX
+FNoHKciobhNGHA9HoTCyJvYaFPLKZVK00V2s45T4T+mG6GRcmXXHiHYUb7g=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "839eba11eb506324ced2e86fe6055322c047c2b71ca2add668a2d8ed09e5f032", "sig
": "YmoHDP4PID+gxS5BfOq2nz0sbJAd8sHvWUq/oQiuHhGiSCmLpcym7yRgZuaPoZVwABfA8pf0AIXUrbmP0HbYmMu6BkbIQ454q1HNMEOPiimS67lZTfKgp0vKggFjsmn7K+3SFU3FpQguatSWGIkVD9kdRQqyuNjc24mi/RbNRtR0+NPKtLdrQaOQFUaGJnM+pWBUO9tIvQC+Ddv1BoMGq9OfKiVnhVIcSGJ6LYq0
7UXkHEiyIMzT/4/XAEb6mj+w52zF2PdS/AvMXsnvjriSNQEqELKxtviWrz4e0avWvfKL+pzCDORgzIpM8p0h9zA3IyoRYwLgfLyIkwBw05RjHg=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "291133f2dda53e98c3859
7f3f76f31e83aff6a49a5f283a9526343a106b1fadc", "sig": "N6jF8SX71NsgZsnDlnb6NTAQZV4ASMyvkcAlmJdrdkfiPBNhrbBOz+9a7hR0wB3OGrrUR7L/KDWlzx7TpRD5NRl2Hl/kIUK5yZAEmDAqPKEt1bWwcVtiwcK0CzDUkmivIjehpzv+MI191dDUb94PQczddeDNUWTlRYJScZsli8bOcjQ3+AemAr
ai9rXkPAPX8bFR1gyrsV40D9AFUeKPkkPDkhOZPwGQv/ARRI17y2I441oHRirxhibXcHQZuFXop7SP7Lqn4BwMCMfOFwJ6mVPqxw/KlZ83rpfpNAu5omjlgJKsFjtHRsRPP97CjVHZVRPpJtFz1QdD209T4WQonQ=="}], "sha512": [{"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465
d0e51f12bc7d70db4cf22f7d260b14", "pol": "40de7d58cb2beae0d20a39e9d5ed7fa90ad85f03d32e77a96ac7b593e02ec2db", "sig": "YRxh2Qy7B07I/8Ru57rpfwTnWwdAmS4RZRHdEqc6w7YIRTJw31++DRjpXM1mWevSW4VXuQ/IFlUrB1H5QAEzCzQHSgerMClIT73OwoXuwKGVawhIqC0mDQQl
1jaSuUVVEZSD7rRsveldmBZm+OOTvP8AcnUJj+RwNcthk19PTLh2WZobzscGXEa9tmIKVQV4NvLOGPaiH1jUy3BTBIr6hiXMsYd8KsAw2c4ybHzABxZCeWANaZRp22KzuyaWHbJVjil98MGiFYw3PwKushvpQrTj1/adbtm6Be8ptCH8fWTNfUBgZ/mTpr8TY3fsx3K+PtzCKYvq+bHq2fCVjlic7w=="}, {"pcrs":
[11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "a5f4ea37223618d4d2465574ce3839bc4289895f588d83872efb3e61df34f012", "sig": "Az4wrKYgW1pdc/+KFLj0QlWXSJxggP4uqkRvop1CkQnbc7LjfbUGYQzB/N6TJCLdE54T+V
ZSpFT58EpZ/3yX638zx6p0XwQa+KRO4w/2id+REYmxUJhIAq1l8a3oDeaEx+6UBvMWvjqXw3cZSia99+O13BhutsIwNNfM0+VZZlPdoXuGIMdg5HHVgNSU6WfuHTe6Mdsn6SCxAbUTnRzLrz6B8BpRXev+nopHJ7Qd5Z50ey2yYAnfaDQr1yT70Sl5p0P5l3pGrA/iaNS0RSdjLNZ41dcnQI7zUpCAVaaad+Pg1iTkJL
oyF0MzfNEp7lqcPrrZ3/cyV45mgaXcbQYrHw=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "def273c8211fa2f69f24f1c7e827285d26c07c10baa52581b489af821fc64b92", "sig": "hunGQoQxKEhOhZscwJBa
4eOJ/rI/q0Chax8Xl5ph333lbGLZrxgU6bj5xMEp+7MGQcZ6viAwKOfqtwwurMFOTXnCjlS0+edCpqjdqqZMKsaGywg+WJzvFej5OkV57RfqJuWdSYCSW+8j97JgdYnjlgL8XfYkLrNz31d3MrMidDq0HuILriUiqtsjeFmbQDP3QcTxJK6fG3DXrIK2byyqdcZBce+HJ7K9uuQ0JhBv/wj7ejf8FerCLpgiSSnd9ySz
VdpX1bRcctxqd5bg0McdfX4ra4hvvKEUZdq6dfggI4nEwEefVnE6vgGhzP/fEG5xUtPG3n1GuisZpZIfwUIzrA=="}, {"pcrs": [11], "pkfp": "d85efb34efd1ef86ebbfd5d59f06f7d465d0e51f12bc7d70db4cf22f7d260b14", "pol": "201c345fe6b0bb1693848bed643d4f73ab0be3cb0acc3
9c22cc257c8c5bd93fb", "sig": "AhDV3Pj0gv0aZJeaj3t9R70Jhiw49CROlrIvC9xG6LdYshWUUwOqQTgnitdYOHqabCdXEDXWOB9MzBcvhsbNlggwDsWVvWbIe+Y0E2PFsT5nPSzNJcTTzmexOpmPK/0Y8vEsjmKYoAoIoc9YPyFkQEsev/VgSwmWQx1XJ+9mgXPk/Hg046h/ICP9XphiE4xJIcxR3Qg+bGCWen
UObMLh8qlhnWxwpu+EHEXZZrawykfFIufDKPuSL6+xl7i7Ty5eSPpMrcwYzYIf9sghi2naV4Knfg541/C1EjKESLYW14NuAisxD8bi5FLUcWQzonlA71IKPW/tMz61ZmoT6c/N2A=="}]}

[lefauconblanc@m0bileTank ~]$ systemd-analyze pcrs
NR NAME SHA256
0 platform-code e4c529bcd991bce2b073a8cfffc642f98b00afea98eb48a647a05baf528f8c3b
1 platform-config a3b3daeb1ecd973507346469dee4dd2cd77049b8c99383780a5b06471b1cb3c5
2 external-code d1e729ad881cea3f548aa7d63aaae05b02a57e2424245203bdb1f2a914088f80
3 external-config 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
4 boot-loader-code bb52a724c85ac37c2286d601ad2f060249f38dc0bde80f6ea3bfb0b18a98be43
5 boot-loader-config 8af5bf06cac287211d4b8b4c7f20ad228e368a4b6e0137b2eb4688218690cd07
6 host-platform 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
7 secure-boot-policy b0cb045cb82dd833d12fbe2866e3fd0f75945cd8dd776948cc255b5369f41398
8 - 0000000000000000000000000000000000000000000000000000000000000000
9 kernel-initrd e3aa2874996ac9b50d62f891f6abbc072ab2794885e2572ba9f3924cc46cd976
10 ima 0000000000000000000000000000000000000000000000000000000000000000
11 kernel-boot baa1b41191c86bbe4dcb3d4e6e7d0ca9ce58c162184c8396d7c6fd1d62d48f90
12 kernel-config 06235990c438721d8901ab9ac8875b6cbaa462203746921a83c594a9921e411a
13 sysexts 0000000000000000000000000000000000000000000000000000000000000000
14 shim-policy 0000000000000000000000000000000000000000000000000000000000000000
15 system-identity 0000000000000000000000000000000000000000000000000000000000000000
16 debug 0000000000000000000000000000000000000000000000000000000000000000
17 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
18 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
19 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
20 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
21 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
22 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
23 application-support 0000000000000000000000000000000000000000000000000000000000000000

[lefauconblanc@m0bileTank ~]$ sudo cryptsetup luksDump /dev/nvme0n1p5
LUKS header information
Version: 2
Epoch: 193
Metadata area: 16384 [bytes]
Keyslots area: 16744448 [bytes]
UUID: 1994193e-269f-46a6-a781-25dffb534165
Label: systemd-tpm2
Subsystem: (no subsystem)
Flags: (no flags)

Data segments:
0: crypt
offset: 16777216 [bytes]
length: (whole device)
cipher: aes-xts-plain64
sector: 512 [bytes]

Keyslots:
0: luks2
Key: 512 bits
Priority: normal
Cipher: aes-xts-plain64
Cipher key: 512 bits
PBKDF: argon2id
Time cost: 9
Memory: 1048576
Threads: 4
Salt: d3 dd 09 62 84 2c 7f b5 5c ba 9a 67 75 fb 92 a8
14 1d da 86 3c 57 1b e2 4b c6 c9 c8 f2 9e 3d eb
AF stripes: 4000
AF hash: sha256
Area offset:290816 [bytes]
Area length:258048 [bytes]
Digest ID: 0
1: luks2
Key: 512 bits
Priority: normal
Cipher: aes-xts-plain64
Cipher key: 512 bits
PBKDF: pbkdf2
Hash: sha512
Iterations: 1000
Salt: 28 b8 e3 e2 1e 17 52 17 d7 e8 4f d0 35 04 f4 73
a7 c5 a0 e7 d1 8c 60 1c e5 d5 62 b8 cd 80 69 4e
AF stripes: 4000
AF hash: sha512
Area offset:32768 [bytes]
Area length:258048 [bytes]
Digest ID: 0
Tokens:
0: systemd-tpm2
tpm2-hash-pcrs: 7+11
tpm2-pcr-bank: sha256
tpm2-pubkey:
2d 2d 2d 2d 2d 42 45 47 49 4e 20 50 55 42 4c 49
43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 42 49
6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41
51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43
67 4b 43 41 51 45 41 69 51 56 54 67 58 52 51 38
6f 51 46 67 6f 74 62 38 59 30 73 0a 75 39 35 79
5a 75 7a 4f 72 61 2f 4c 33 36 42 39 66 36 35 63
48 34 4b 34 52 31 51 61 50 57 65 68 55 62 68 75
65 36 64 5a 41 4e 2f 4e 30 52 4b 68 6d 34 2b 50
57 69 6f 4a 31 41 66 5a 6d 6a 47 35 0a 78 2b 35
34 63 77 56 57 62 4b 41 35 74 57 38 4a 65 71 56
63 54 4b 6a 7a 44 68 5a 76 59 6f 37 4a 74 6c 4a
66 4a 34 48 79 70 42 70 67 51 57 66 54 46 6c 50
75 39 66 75 58 5a 34 37 4e 70 72 5a 6b 0a 52 45
49 6a 34 66 69 6b 6b 57 47 31 61 45 67 76 77 51
48 54 51 77 38 65 6e 45 65 48 4c 75 70 32 58 68
52 51 4a 39 52 78 55 2f 46 31 69 72 34 33 43 64
6a 6f 6a 4d 53 38 78 46 61 45 4b 6a 33 45 0a 4d
2b 69 59 5a 50 47 57 7a 2b 66 52 63 35 61 69 62
68 62 2f 4b 72 4f 43 6f 78 67 59 4d 6f 33 54 56
59 72 68 67 49 48 57 70 6a 36 4e 6d 45 35 6b 77
73 6f 57 51 74 66 41 73 66 46 51 31 67 64 70 0a
43 4d 56 41 2b 64 54 75 73 49 61 54 2f 77 32 44
79 41 59 59 39 4a 4f 57 50 7a 57 61 41 71 48 30
49 50 68 6a 67 62 4c 34 56 59 68 4c 7a 47 6d 4b
61 45 41 71 30 62 49 5a 59 4c 68 6e 67 66 50 6c
0a 59 51 49 44 41 51 41 42 0a 2d 2d 2d 2d 2d 45
4e 44 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d
2d 2d 0a
tpm2-pubkey-pcrs: 11
tpm2-primary-alg: ecc
tpm2-pin: true
tpm2-pcrlock: false
tpm2-salt: true
tpm2-srk: true
tpm2-pcrlock-nv: false
tpm2-policy-hash:
c7 46 a4 90 40 a6 e8 33 6a a2 78 59 b2 30 d4 f8
9a 6b df b1 ba c4 4f f5 5e b8 cc e7 0f ae b7 5f
tpm2-blob: 00 9e 00 20 4b 8d c4 f3 ae 28 05 78 6a 0c 94 3a
c5 dc a6 93 a6 a8 ce 89 99 d4 a0 5a ba 56 bd 1d
73 72 4b f4 00 10 3d 54 33 f3 15 6a 5c 27 cd 8f
05 25 3b a6 f0 c7 8e d0 a1 63 73 e1 c6 8d a7 f5
af 95 f9 9a 79 64 74 48 dd d4 b0 60 77 88 a2 1a
47 d8 ab 68 6e 92 2e 8d 98 a0 ac 67 3e 7d d8 27
b5 90 ef 16 c3 32 33 8e 79 57 4c 63 ca 29 8d 2d
c7 dd 88 29 e3 c2 ba c8 1b b7 c2 46 b6 6e 7b b7
b0 71 d9 e4 e2 90 72 15 79 3d 35 f2 00 4f b6 04
0b 73 bc b5 b3 cd 78 1d 90 92 9a 65 1c 05 55 50
00 4e 00 08 00 0b 00 00 00 12 00 20 c7 46 a4 90
40 a6 e8 33 6a a2 78 59 b2 30 d4 f8 9a 6b df b1
ba c4 4f f5 5e b8 cc e7 0f ae b7 5f 00 10 00 20
ce 86 15 ae 47 9c dd fd 26 d1 60 77 8f 2e 2c ca
c9 b8 2d cb 8d ae bf 96 f0 f9 8e f2 31 4f 11 42
Keyslot: 1
Digests:
0: pbkdf2
Hash: sha256
Iterations: 370783
Salt:
31
2a
a5
59
b1
79
95
26
d9
1b
66
6e
06
1b
6b
ef

87
a1
34
bf
ea
9a
68
aa
e6
76
98
ad
9c
83
be
d3
Digest:
05
97
96
fb
9f
63
f1
93
48
e5
90
b5
e8
3c
40
a5

d7
44
d1
90
c3
d8
6b
7b
ee
91
24
be
f8
22
64
47
Command successful.

[lefauconblanc@m0bileTank ~]$ sudo cryptsetup luksDump /dev/nvme0n1p6
LUKS header information
Version: 2
Epoch: 169
Metadata area: 16384 [bytes]
Keyslots area: 16744448 [bytes]
UUID: 41c23ed9-dfe6-4729-aa18-33c8bf28e473
Label: systemd-tpm2
Subsystem: (no subsystem)
Flags: (no flags)

Data segments:
0: crypt
offset: 16777216 [bytes]
length: (whole device)
cipher: aes-xts-plain64
sector: 512 [bytes]

Keyslots:
0: luks2
Key: 512 bits
Priority: normal
Cipher: aes-xts-plain64
Cipher key: 512 bits
PBKDF: argon2id
Time cost: 9
Memory: 1048576
Threads: 4
Salt: 7f aa f5 73 63 3f 64 a3 b3 4d a9 68 f5 12 6c a4
07 d6 bd 06 7a 99 3a 5d 51 bb 12 3e 81 57 90 18
AF stripes: 4000
AF hash: sha256
Area offset:290816 [bytes]
Area length:258048 [bytes]
Digest ID: 0
1: luks2
Key: 512 bits
Priority: normal
Cipher: aes-xts-plain64
Cipher key: 512 bits
PBKDF: pbkdf2
Hash: sha512
Iterations: 1000
Salt: 31 61 14 68 48 c6 8f 88 6c d6 bc 38 b0 8b 7c a9
e5 af dd e8 64 88 39 05 ba cc d1 1e f6 46 69 95
AF stripes: 4000
AF hash: sha512
Area offset:32768 [bytes]
Area length:258048 [bytes]
Digest ID: 0
Tokens:
0: systemd-tpm2
tpm2-hash-pcrs: 7+11
tpm2-pcr-bank: sha256
tpm2-pubkey:
2d 2d 2d 2d 2d 42 45 47 49 4e 20 50 55 42 4c 49
43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 42 49
6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41
51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43
67 4b 43 41 51 45 41 69 51 56 54 67 58 52 51 38
6f 51 46 67 6f 74 62 38 59 30 73 0a 75 39 35 79
5a 75 7a 4f 72 61 2f 4c 33 36 42 39 66 36 35 63
48 34 4b 34 52 31 51 61 50 57 65 68 55 62 68 75
65 36 64 5a 41 4e 2f 4e 30 52 4b 68 6d 34 2b 50
57 69 6f 4a 31 41 66 5a 6d 6a 47 35 0a 78 2b 35
34 63 77 56 57 62 4b 41 35 74 57 38 4a 65 71 56
63 54 4b 6a 7a 44 68 5a 76 59 6f 37 4a 74 6c 4a
66 4a 34 48 79 70 42 70 67 51 57 66 54 46 6c 50
75 39 66 75 58 5a 34 37 4e 70 72 5a 6b 0a 52 45
49 6a 34 66 69 6b 6b 57 47 31 61 45 67 76 77 51
48 54 51 77 38 65 6e 45 65 48 4c 75 70 32 58 68
52 51 4a 39 52 78 55 2f 46 31 69 72 34 33 43 64
6a 6f 6a 4d 53 38 78 46 61 45 4b 6a 33 45 0a 4d
2b 69 59 5a 50 47 57 7a 2b 66 52 63 35 61 69 62
68 62 2f 4b 72 4f 43 6f 78 67 59 4d 6f 33 54 56
59 72 68 67 49 48 57 70 6a 36 4e 6d 45 35 6b 77
73 6f 57 51 74 66 41 73 66 46 51 31 67 64 70 0a
43 4d 56 41 2b 64 54 75 73 49 61 54 2f 77 32 44
79 41 59 59 39 4a 4f 57 50 7a 57 61 41 71 48 30
49 50 68 6a 67 62 4c 34 56 59 68 4c 7a 47 6d 4b
61 45 41 71 30 62 49 5a 59 4c 68 6e 67 66 50 6c
0a 59 51 49 44 41 51 41 42 0a 2d 2d 2d 2d 2d 45
4e 44 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d
2d 2d 0a
tpm2-pubkey-pcrs: 11
tpm2-primary-alg: ecc
tpm2-pin: true
tpm2-pcrlock: false
tpm2-salt: true
tpm2-srk: true
tpm2-pcrlock-nv: false
tpm2-policy-hash:
c7 46 a4 90 40 a6 e8 33 6a a2 78 59 b2 30 d4 f8
9a 6b df b1 ba c4 4f f5 5e b8 cc e7 0f ae b7 5f
tpm2-blob: 00 9e 00 20 42 9a 18 fc 21 b6 32 00 be a8 bf e3
c7 2d f7 4e 8c 0d f9 d0 06 3e dc 1f fb 71 70 05
45 0d 8c 09 00 10 86 7f 6b d4 05 ae 9e 1a 23 b5
ed 24 7b 1e aa 10 14 27 7d 1a bf 65 85 88 00 2d
3f 51 fb 8c fc 9d 43 be 7d 80 b4 6d 0b 9c b9 ee
67 e0 31 84 70 a8 ae cf d3 ee 99 49 5a 64 c1 7e
6c 38 87 fd 0c eb c9 a2 5c 79 81 96 13 59 3e 3b
95 b7 41 4c 30 27 e2 c3 3f a0 1e a9 bf fa e0 26
3d 33 38 39 82 4a 5c 8f aa a6 f8 69 3f c2 e9 40
23 8a e6 cf 06 55 d4 a3 e9 9c 72 98 40 a9 b7 0b
00 4e 00 08 00 0b 00 00 00 12 00 20 c7 46 a4 90
40 a6 e8 33 6a a2 78 59 b2 30 d4 f8 9a 6b df b1
ba c4 4f f5 5e b8 cc e7 0f ae b7 5f 00 10 00 20
58 71 6c de 54 44 69 92 55 fb 63 db a5 12 a6 25
d0 f6 e2 a7 d0 29 ff 6c 11 41 4e b3 ad 0f f5 54
Keyslot: 1
Digests:
0: pbkdf2
Hash: sha256
Iterations: 371308
Salt:
ed
45
2d
1f
c6
dd
ec
ad
a2
de
d8
ee
4f
29
1c
03

95
a6
2c
a6
7a
70
0f
42
a3
61
eb
56
95
89
b7
2f
Digest:
1d
29
8c
a9
22
54
12
2f
9c
0e
bc
2d
4e
80
54
aa

24
2d
eb
fc
4f
b7
4f
59
25
b6
ed
7a
2a
bb
86
c4
Command successful.
[lefauconblanc@m0bileTank ~]$

extra/fig2dev: Package update not detected, but also cannot report.

dummy@example.com (dreieck) — Sun, 19 Jul 2026 22:30:38 +0000

Ahoj,

there is the Arch Linux package 'extra/fig2dev'.

It is out of date since year 2024 ('extra/fig2dev' is at version 3.2.9, upstream has released 3.2.9a).

On the package's website I can no longer flag it out of date; trying to do it via bug report gets the issue report automatically closed because this is not a packaging bug.

The Arch Wiki site "reasons for not beeing a bug" states

A package which is not-up-to-date. Users are not expected to manually flag packages out of date, since this is automated via bumpbuddy and the nvchecker files in each individual repository (see this example in the chromium package).

But the '.nvchecker.toml' file in the PKGBUILD repository for fig2dev seems not to catch the updated version number with 'a':

[fig2dev]
source = "regex"
url = "https://sourceforge.net/projects/mcj/files"
regex = 'fig2dev-(\d+\.\d+\.\d+).tar.xz'

.. so, what to do about it, if the version update is not automatically catched, but a manual report of beeing out of date is not possible and automatically closed for not beeing a bug?

Regards!

seem to have an initramfs problem

dummy@example.com (newme360) — Sun, 19 Jul 2026 21:20:24 +0000

I've had a look at Xorg.0.log.old and it seems not to have anything interesting in it. Probably did get lost, as the logs seemed pretty new..

Anyway thank you very much

TPM Crashed

dummy@example.com (dootfs) — Sun, 19 Jul 2026 21:06:31 +0000

Oh, it took a few tries, but I got the BIOS flashed eventually.

"Simply putting the .EXE file on a FAT32 USB was all it took to get the BIOS update flashed. That Dell support provides a .rcv file also is what made this so confusing. "

So the UEFI firmware is all updated, but the TPM is still out of whack.

Given the opportunity, I'm trying to get the whole system buttoned up with a non-Microsoft key so that SecureBoot will work better, and then sign the UKI.

Not trying to do a downgrade/package regression.

If I run sbctl to create new keys without using Microsoft's key, that'll lock me out, right? So I have to back up the EFI variables before doing that. Then I can remove the Platform Key and create a new set of keys that'll get stored as PCR values.

Just gotta read through the Secure Boot Wiki entry.

I guess efitools is the way to go to pull the Secure Boot variables that the computer was shipped with.

But when I download efitools and run the command to pull the EFI variables:

$ for var in PK KEK db dbx ; do efi-readvar -v $var -o old_${var}.esl ; done
Variable PK has no entries
Variable KEK, length 3906
Variable db, length 8533
Variable dbx, length 22138

It looks like the Platform Key is missing? Where is the platform key stored?

jellyfin-mpv-shim crashes on startup

dummy@example.com (jonno2002) — Sun, 19 Jul 2026 20:09:03 +0000

i had a play with it, installed 'python-pystray' which is another optional dep and it works, seems like the app is working fine but the gui doesnt show up unless 'python-pystray' is installed
i would just install all the op deps just to be safe and let the package maintainer know as well i guess..

EDIT: actually now i think about it, the app is still working and can function without the gui if configured correctly so i guess the gui is optional technically

hdajackretask doesn't work anymore?

dummy@example.com (seth) — Sun, 19 Jul 2026 19:53:22 +0000

This has worked flawlessly until recently.

Does it still work w/ the LTS kernel? (if you can get a working setup we can look for differences, maybe the HW is captured by a different kernel module now)

NFS fstab entry makes Dolphin stuck at startup

dummy@example.com (X3R0) — Sun, 19 Jul 2026 19:46:39 +0000

if you are still having this issue (unlikely since this is a 3 year old post) give this a try
nfs _netdev,rw,noatime,nodiratime,x-systemd.automount,x-systemd.idle-timeout=600 0 0

BIOS settings when building packages [Non Issue]

dummy@example.com (seth) — Sun, 19 Jul 2026 19:09:53 +0000

Speculation: number of CPU cores changed, number of parallel jobs changed => no longer running OOM?

But you'd have to replicate the failing setup to analyze what's going wrong.

bluetooth not working linux 7.1.3

dummy@example.com (Yoruu_.) — Sun, 19 Jul 2026 17:38:23 +0000

sorry to whoever reads this post this is the first time i post someting on the internet

oc-rsync - Classic rsync re-implementation in pure Rust

dummy@example.com (oferchen) — Sun, 19 Jul 2026 17:24:12 +0000

yes, it is compatible with classic rsync and it also pass the rsync testsuite with no issues .

[RESOLVED] Clamonacc.service failing on start

dummy@example.com (seth) — Sun, 19 Jul 2026 16:15:39 +0000

\o/
Please always remember to mark resolved threads by editing your initial posts subject - so others will know that there's no task left, but maybe a solution to find.
Thanks.

GNOME Battery Charging options not available on ThinkPad

dummy@example.com (zcal) — Sun, 19 Jul 2026 15:15:35 +0000

The problem may be in the way that upower determines if the battery supports charge thresholds. I understand that it relies on udev to process /usr/lib/udev/rules.d/60-upower-battery.rules instead of just reading /sys/class/power_supply/BAT0/charge_{start,stop}_threshold directly.

Here's what happens when udev evaluates those rules:

$ udevadm test /sys/class/power_supply/BAT0
...
Loading udev rules files done.
BAT0: sd-device: 'uevent' sysattr contains invalid characters, refusing: DEVTYPE=power_supply\nPOWER_SUPPLY_NAME=BAT0\nPOWER_SUPPLY_TYPE=Battery\nPOWER_SUPPLY_STATUS=Charging\nPOWER_SUPPLY_PRESENT=1\nPOWER_SUPPLY_TECHNOLOGY=Li-poly\nPOWER_SUPPLY_CYCLE_COUNT=44\nPOWER_SUPPLY_VOLTAGE_MIN_DESIGN=15440000\nPOWER_SUPPLY_VOLTAGE_NOW=16236000\nPOWER_SUPPLY_POWER_NOW=28656000\nPOWER_SUPPLY_ENERGY_FULL_DESIGN=52500000\nPOWER_SUPPLY_ENERGY_FULL=54590000\nPOWER_SUPPLY_ENERGY_NOW=26580000\nPOWER_SUPPLY_CAPACITY=49\nPOWER_SUPPLY_CAPACITY_LEVEL=Normal\nPOWER_SUPPLY_TYPE=Battery\nPOWER_SUPPLY_MODEL_NAME=LNV-5B11M90028@\320\nPOWER_SUPPLY_MANUFACTURER=Celxpert\nPOWER_SUPPLY_SERIAL_NUMBER= 2026
...

There's a trailing \320 character on my battery's POWER_SUPPLY_MODEL_NAME property which causes it to be refused.

There's an open issue with systemd with a submitted patch that I believe should address my problem here. I'll wait until that makes its way into Arch's systemd package and confirm if so.

Fatal PCIe bus error

dummy@example.com (candybar) — Sun, 19 Jul 2026 15:05:32 +0000

I do have a GTX 970, though that PC does not post currently. I have no idea if it works or not. /fml

Idea: an AUR repo, to upload directly built packages

dummy@example.com (5hridhyan) — Sun, 19 Jul 2026 15:00:59 +0000

Idea: an AUR repo, to upload directly built packages

Idk why people re-invent ideas, and at some point they are creating problems to solutions.

Edit:

Fn Keys Not Working (Already checked other topics)

dummy@example.com (seth) — Sun, 19 Jul 2026 14:02:31 +0000

And what is Fn+F12?

bindl = , XF86AudioMute, exec, wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle
# Audio Input Mute (Microphone toggle)
bindl = , XF86AudioMicMute, exec, wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle

Do the wpctl commands do what you expect?