Re: [isar-cip-core][PATCH 0/2] Remove unsupported combinations for factory-reset from Kconfig and document them explicitly
Quirin Gylstorff <[email protected]>
| Newsgroups | org.cip-project.lists.cip-dev |
|---|---|
| Message-ID | <[email protected]> |
On 8/7/26 5:44 PM, [email protected] wrote: > From: Alexander Heinisch <[email protected]> > > By default factory reset clears the tpm. Therefore, keys needed to > decrypt the immutable A/B rootfs in full disk encryption setups > cannot be retrieved anymore. Thus, the boot fails and the device > cannot be recovered. > > This patch series removes such combination from the kconfig and documents > the issue explicitly. This was never in scope of the factory reset. You could implement it by moving the keys into the boot partition. But this move will create another can of worms. ACK. Quirin > > Alexander Heinisch (2): > doc/README.factory-reset: Explicitly document full disk encryption is > not supported with factory reset tpm clearing enabled. > Kconfig: Do not offer factory reset with full disk encryption enabled. > > Kconfig | 2 +- > doc/README.factory-reset.md | 4 +++- > 2 files changed, 4 insertions(+), 2 deletions(-) > > -- > 2.47.3 >