I just switched to systemd-boot and I have some issues.
The system has an encrypted btrfs mounted as / but it does not get automatically mounted and always asks me to enter the password. I have checked many documentations and nothing helped.
Output of cryptsetup luksDump /dev/nvme1n1p2 contains systemd-tpm2 and the TPM 2.0 is available and I tried running sudo sdbootutil enroll --method=tpm2 and it says the key has been enrolled.
Moreover, I have a Windows installed in /dev/nvme0n1 and it has a separate ESP. I wish to add it into the systemd-boot list. How to do that anyway?
To unlock the key TPM2 must have the expected state. Which can change due to many reasons. You can try wipe out the slot and re-enroll the key again. E.g. as described in Quickstart in Full Disk Encryption with TPM and YaST2 - openSUSE News (I have not tried this particular procedure).
I do not think it is possible. systemd-boot looks for boot menu entries on the device from which it has been started. This includes Windows auto-detection . And you cannot explicitly refer to a device path in the loader entry, all paths are relative to the device systemd-boot was loaded from.
Yes I can boot it via system UEFI by changing the boot order but I simply think that should not be the only choice. I am now considering installing something like rEFInd and add systemd boot and Windows Boot Manager into it, if systemd boot cannot just do it.
sudo systemd-cryptenroll /dev/nvme0n1p2
SLOT TYPE
0 password
1 tpm2
And
sudo systemd-cryptenroll /dev/nvme0n1p2
SLOT TYPE
0 password
vincent@VSONLAPTOPASUS:~> sudo sdbootutil enroll --method=tpm2
Failed to stat //.snapshots/369/info.xml
Failed to stat //.snapshots/370/info.xml
Failed to stat //.snapshots/371/info.xml
Failed to stat //.snapshots/372/info.xml
Failed to stat //.snapshots/375/info.xml
Failed to stat //.snapshots/376/info.xml
Failed to stat //.snapshots/377/info.xml
Failed to stat //.snapshots/378/info.xml
Failed to stat //.snapshots/379/info.xml
Failed to stat //.snapshots/380/info.xml
Failed to stat //.snapshots/381/info.xml
loading 369 failed
loading 370 failed
loading 371 failed
loading 372 failed
loading 375 failed
loading 376 failed
loading 377 failed
loading 378 failed
loading 379 failed
loading 380 failed
loading 381 failed
Garbage after device path end, ignoring.
Garbage after device path end, ignoring.
Garbage after device path end, ignoring.
Garbage after device path end, ignoring.
NVIndex policy created
Password for /dev/nvme0n1p2: .......
New TPM2 token enrolled as key slot 1.
Seems everything should be working, but not.
In /etc/cryppttab
# File created by sdbootutil. Comments will be removed
# Add the 'x-sdbootutil.ignore' option to un-track a device
cr_root UUID=39f63f0f-153c-4204-b9de-e2f036f39cc9 none x-initrd.attach,tpm2-device=auto,tpm2-measure-pcr=yes
Moreiver, may you help me figure out whether the output above means the snapshots are not working? Or maybe is there a way to manage the really long snapshot list in sdboot.