doc: fix PCR table and stale comment - #2203
Open
tlaurion wants to merge 3 commits into
Open
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Repository documentation is left internally inconsistent (doc/security-model.md still describes PCR 16 as calcfuturepcr “scratch”), which undermines the accuracy goal of this doc-focused PR.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR corrects TPM PCR documentation and updates a stale comment in the initrd sealing flow to accurately reflect which PCR is extended during LUKS header measurement.
Changes:
- Updates the
doc/tpm.mdPCR table to mark PCR 16 as unused by Heads and not part of any sealing policy. - Fixes a stale comment in
initrd/bin/kexec-seal-key.shto correctly describe measuring LUKS headers into PCR 6 and producing/tmp/luksDump.txtforcalcfuturepcr.
File summaries
| File | Description |
|---|---|
| initrd/bin/kexec-seal-key.sh | Updates the measurement comment to correctly reference PCR 6 and /tmp/luksDump.txt. |
| doc/tpm.md | Corrects the PCR table entry for PCR 16 to reflect actual Heads behavior. |
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
tlaurion
force-pushed
the
doc/tpm-pcr-corrections
branch
2 times, most recently
from
September 7, 2026 19:55
fcb9c6e to
13082a7
Compare
This was referenced Sep 7, 2026
tlaurion
force-pushed
the
doc/tpm-pcr-corrections
branch
from
September 7, 2026 20:01
13082a7 to
5d590e9
Compare
tlaurion
added a commit
to tlaurion/heads-wiki
that referenced
this pull request
Sep 7, 2026
PCR 16 was historically scratch space for calcfuturepcr on TPM1 (PCR 23 on TPM2). calcfuturepcr was later rewritten to replay from cbmem -L event log, eliminating the need for any scratch PCR. PCR 16 is now unused. Extends doc/tpm.md fix (linuxboot/heads#2203). Signed-off-by: Thierry Laurion <insurgo@riseup.net>
tlaurion
force-pushed
the
doc/tpm-pcr-corrections
branch
from
September 7, 2026 23:59
5d590e9 to
5072786
Compare
tlaurion
added a commit
to tlaurion/heads-wiki
that referenced
this pull request
Sep 7, 2026
PCR 16 was historically scratch space for calcfuturepcr on TPM1 (PCR 23 on TPM2). calcfuturepcr was later rewritten to replay from cbmem -L event log, eliminating the need for any scratch PCR. PCR 16 is now unused. Extends doc/tpm.md fix (linuxboot/heads#2203). Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Extends wiki iteration-1 (linuxboot/heads-wiki#246) to doc/tpm.md. - PCR 16: change from 'scratch use only' to accurate history — was scratch PCR on TPM1 (PCR 23 on TPM2) in old calcfuturepcr; now unused after rewrite to replay from cbmem -L event log - kexec-seal-key.sh:274: fix stale comment that referenced PCR 16 — the code calls qubes-measure-luks.sh which extends PCR 6, not PCR 16 Signed-off-by: Thierry Laurion <insurgo@riseup.net>
tlaurion
force-pushed
the
doc/tpm-pcr-corrections
branch
2 times, most recently
from
September 8, 2026 02:08
5ecee21 to
35e36b1
Compare
Extends wiki iteration-1 (linuxboot/heads-wiki#246) to doc/tpm.md. - PCR 16: removed from security-model.md diagram — unused, not relevant to the security model - kexec-seal-key.sh:274: fix stale comment that referenced PCR 16 — the code calls qubes-measure-luks.sh which extends PCR 6, not PCR 16 Signed-off-by: Thierry Laurion <insurgo@riseup.net>
tlaurion
force-pushed
the
doc/tpm-pcr-corrections
branch
from
September 8, 2026 02:08
35e36b1 to
a4c25a6
Compare
PCR 16 was historically used as scratch space by calcfuturepcr on TPM1 (PCR 23 on TPM2). PR linuxboot#1428 rewrote calcfuturepcr to replay from cbmem -L event log, eliminating the need for any scratch PCR. Remove all PCR 16 references: - doc/tpm.md: remove PCR 16 row from PCR table - doc/security-model.md: remove PCR 16 (Scratch) box from diagram - kexec-seal-key.sh: fix stale comment referencing PCR16 Signed-off-by: Thierry Laurion <insurgo@riseup.net>
tlaurion
added a commit
to tlaurion/heads-wiki
that referenced
this pull request
Sep 8, 2026
PCR 16 was historically scratch space for calcfuturepcr on TPM1 (PCR 23 on TPM2). calcfuturepcr was later rewritten to replay from cbmem -L event log, eliminating the need for any scratch PCR. PCR 16 is now unused. Extends doc/tpm.md fix (linuxboot/heads#2203). Signed-off-by: Thierry Laurion <insurgo@riseup.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends wiki iteration-1 (linuxboot/heads-wiki#246) to
doc/tpm.md.Changes
PCR 16 in
doc/tpm.mdtable (line 167): Changed from "scratch use only" to accurate history — was scratch PCR on TPM1 (PCR 23 on TPM2) in oldcalcfuturepcr; now unused after rewrite to replay fromcbmem -Levent log.kexec-seal-key.sh:272-275: Fixed stale comment that referenced PCR 16. The code callsqubes-measure-luks.shwhich extends PCR 6, not PCR 16. Comment now accurately describes the LUKS header measurement flow.Evidence
68cc9d0b132(2017): originaltpm calcfuturepcr -ix 16call inkexec-seal-key.sh80c4a7ea6ea: TPM1 branch used PCR 16, TPM2 used PCR 23d1a18f1f83b:tpmr.shintroduced,calcfuturepcrrewritten toreplay_pcrusingcbmem -Ltpmr.sh:208-230:replay_pcrrejectspcr >= 8, no physical PCR touchedqubes-measure-luks.sh:24: extends PCR 6 with LUKS header hashRelated