Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Add tpm2 backed full disk encryption to the iso
Reported by tanshkoul · filed Jul 12, 2025Closed upstream on 2025-08-31 by dhh. GitHub close reason: completed. No closing PR or commit is recorded — "completed" alone is not evidence of a fix.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
Would be awesome to have this feature via systemd-cyptenroll and let the disk autodecrypt via tpm2. Its an upcoming feature in Ubuntu 25.10 thats coming to proper completion ( i.e proper nvidia driver support since their implementation uses a snap based kernel and doesnt support proprietary drivers as of now but we dont have to worry about those issues).
First dracut and tpm2-tools will be needed and then sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 /dev/nvme0n1p3, then edit /etc/crypttab to look like nvme0n1p3_crypt UUID=<leave your UUID as is> none tpm2-device=auto,luks,discard, then sudo dracut -f should make this possible. Its better to not include PCR 1 in my opinion if people would like to add a ram stick or any basic hardware replacements. Also better to keep PCR 9 omitted because of kernel updates.
To generate recovery key: systemd-cryptenroll --recovery-key /dev/nvme0n1p3
These commands could be executed when the user selects disk encryption during installation.
Wonderful documentation here by the Framework community: Setup TPM2 Autodecrypt
View raw text
Would be awesome to have this feature via systemd-cyptenroll and let the disk autodecrypt via tpm2. Its an upcoming feature in Ubuntu 25.10 thats coming to proper completion ( i.e proper nvidia driver support since their implementation uses a snap based kernel and doesnt support proprietary drivers as of now but we dont have to worry about those issues). First `dracut` and `tpm2-tools` will be needed and then `sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 /dev/nvme0n1p3`, then edit `/etc/crypttab` to look like `nvme0n1p3_crypt UUID=<leave your UUID as is> none tpm2-device=auto,luks,discard`, then `sudo dracut -f` should make this possible. Its better to not include PCR 1 in my opinion if people would like to add a ram stick or any basic hardware replacements. Also better to keep PCR 9 omitted because of kernel updates. To generate recovery key: `systemd-cryptenroll --recovery-key /dev/nvme0n1p3` These commands could be executed when the user selects disk encryption during installation. Wonderful documentation here by the Framework community: [Setup TPM2 Autodecrypt](https://community.frame.work/t/guide-setup-tpm2-autodecrypt/39005/1)
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.