Post #2245019

Implemented TPM2 auto-unlock and most of systemd-pcr{phase,fs} for initramfs-tools to get rid of dracut [1]. There's such an amazing amount of potential confused deputies in a typical initramfs (all flavors) that it's like having an entire sheriff's department in your computer. If you're doing TPM auto-unlock without systemd-pcrphase (PCR 11) or equivalent, grabbing your encrypted root partition can likely be done in less than an hour of physical access without attacking the main OS or any kind of the TPM snooping or other hard work. pcrphase raises the bar, but you still have to get a _lot_ of fairly complex and non-obvious stuff right along the boot chain. [1] dracut is kind of a second-class citizen on Debian, but it _could_ be fine on its own. However when combined with its systemd-in-the-initramfs module (enabled by default), the result is just an incredible fucking mess of pointless complexity. And I'm saying this after getting way too familiar with the giant pile of shell scripts that is initramfs-tools.