Mkinitcpio >=42 requires manual intervention for TPM2-based unlocking of LUKS devices
Key points
Arch Linux warns that mkinitcpio 42 changes TPM2 measurements, so some systems that unlock LUKS volumes with the TPM need manual intervention. The notice was posted on 22 September 2026.
What changed
- Starting with package version
42-1, the mkinitcpiosystemdhook includessystemd-pcrosseparator.service, as intended by systemd v261. - This alters the measurements of PCR values 0 to 7, 9 and 12 to 14.
Who is affected
- Systems that use the
systemdhook and unlock LUKS partitions with a TPM2 policy that depends on any of those PCR values.
What to do
- Re-enroll the TPM2 device for the affected volumes.
- With pinned PCR values, follow
systemd-cryptenroll(1)or the ArchWiki article on systemd-cryptenroll. - With custom policies and a disabled
systemd-pcrlock-make-policy.service, seesystemd-pcrlock(8).
Summary by DistroNews, based on the original post.
Starting with package version 42-1, the mkinitcpio systemd hook now includes systemd-pcrosseparator.service (as intended by systemd v261). This affects the measurements of PCR values 0-7, 9 and 12-14. If you configured the systemd hook and unlock LUKS partitions, that depend on these values, you need to re-enroll the TPM2 in use. For guidance, please refer to systemd-cryptenroll(1), or the ArchWiki article on systemd-cryptenroll, when using pinned values. Refer to systemd-pcrlock(8), when relying on custom policies and a disabled systemd-pcrlock-make-policy.service.
This is the summary Arch Linux News published with the story. The full text is on the original page.
Read the original at archlinux.org