VOVogtinator·Jan 17, 2025
That's the design with sdbootutil in openSUSE (https://en.opensuse.org/Systemd-fde, https://github.com/openSUSE/sdbootutil).
In Bypassing disk encryption on systems with automatic TPM2 unlockopenSUSE
sdbootutil
Shell2024–2025
openSUSE / sdbootutil
sdbootutil
Discover this repository through its Hacker News conversations.
2Distinct people
3Mentions
0Explicit recommenders
59GitHub stars
What to know before exploring
What it is
A public description has not been verified.
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by week3 dated mentions
Observed mentions: 2024-07-23 01:05:45 UTC to 2025-01-17 08:36:00 UTC. Weeks start Monday, UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Jul 22 | 2024-07-22 00:00:00 UTC | 2024-07-29 00:00:00 UTC | 1 | 0 | 1 |
| Jul 29 | 2024-07-29 00:00:00 UTC | 2024-08-05 00:00:00 UTC | 0 | 0 | 0 |
| Aug 5 | 2024-08-05 00:00:00 UTC | 2024-08-12 00:00:00 UTC | 0 | 0 | 0 |
| Aug 12 | 2024-08-12 00:00:00 UTC | 2024-08-19 00:00:00 UTC | 0 | 0 | 0 |
| Aug 19 | 2024-08-19 00:00:00 UTC | 2024-08-26 00:00:00 UTC | 0 | 0 | 0 |
| Aug 26 | 2024-08-26 00:00:00 UTC | 2024-09-02 00:00:00 UTC | 0 | 0 | 0 |
| Sep 2 | 2024-09-02 00:00:00 UTC | 2024-09-09 00:00:00 UTC | 0 | 0 | 0 |
| Sep 9 | 2024-09-09 00:00:00 UTC | 2024-09-16 00:00:00 UTC | 0 | 0 | 0 |
| Sep 16 | 2024-09-16 00:00:00 UTC | 2024-09-23 00:00:00 UTC | 0 | 0 | 0 |
| Sep 23 | 2024-09-23 00:00:00 UTC | 2024-09-30 00:00:00 UTC | 0 | 0 | 0 |
| Sep 30 | 2024-09-30 00:00:00 UTC | 2024-10-07 00:00:00 UTC | 0 | 0 | 0 |
| Oct 7 | 2024-10-07 00:00:00 UTC | 2024-10-14 00:00:00 UTC | 0 | 0 | 0 |
| Oct 14 | 2024-10-14 00:00:00 UTC | 2024-10-21 00:00:00 UTC | 0 | 0 | 0 |
| Oct 21 | 2024-10-21 00:00:00 UTC | 2024-10-28 00:00:00 UTC | 0 | 0 | 0 |
| Oct 28 | 2024-10-28 00:00:00 UTC | 2024-11-04 00:00:00 UTC | 0 | 0 | 0 |
| Nov 4 | 2024-11-04 00:00:00 UTC | 2024-11-11 00:00:00 UTC | 0 | 0 | 0 |
| Nov 11 | 2024-11-11 00:00:00 UTC | 2024-11-18 00:00:00 UTC | 0 | 0 | 0 |
| Nov 18 | 2024-11-18 00:00:00 UTC | 2024-11-25 00:00:00 UTC | 0 | 0 | 0 |
| Nov 25 | 2024-11-25 00:00:00 UTC | 2024-12-02 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2 | 2024-12-02 00:00:00 UTC | 2024-12-09 00:00:00 UTC | 0 | 0 | 0 |
| Dec 9 | 2024-12-09 00:00:00 UTC | 2024-12-16 00:00:00 UTC | 0 | 0 | 0 |
| Dec 16 | 2024-12-16 00:00:00 UTC | 2024-12-23 00:00:00 UTC | 0 | 0 | 0 |
| Dec 23 | 2024-12-23 00:00:00 UTC | 2024-12-30 00:00:00 UTC | 0 | 0 | 0 |
| Dec 30 | 2024-12-30 00:00:00 UTC | 2025-01-06 00:00:00 UTC | 0 | 0 | 0 |
| Jan 6 | 2025-01-06 00:00:00 UTC | 2025-01-13 00:00:00 UTC | 0 | 0 | 0 |
| Jan 13 | 2025-01-13 00:00:00 UTC | 2025-01-20 00:00:00 UTC | 2 | 0 | 2 |
What Hacker News says
3 sources> You can mitigate this by including PCRs that sign the kernel and initrd.
No, that's not an effective mitigation. The signed kernel+initrd would still boot into the impersonated root.
> however it means whenever you update you need to unlock manually. On Redhat-based distros this can be done with PCRs 8 and 9, though IIRC this may change on other distros.
> Also AFAIK there is no standard way to guess the new PCRs on reboot so you can't pre-update them before rebooting. So you either need to unlock manually or use a network decryption like dracut-sshd.
With some logic to update the values on kernel updates and re-seal the secret this can be handled transparently. That's the design with sdbootutil in openSUSE (https://en.opensuse.org/Systemd-fde, https://github.com/openSUSE/sdbootutil).
In Bypassing disk encryption on systems with automatic TPM2 unlockSome time ago they did add systemd-boot as a supported option and apparently it also generates one entry per snapshot.
https://news.opensuse.org/2024/03/05/systemd-boot-integratio...
https://en.opensuse.org/Systemd-boot#Installation_with_full_...
https://github.com/openSUSE/sdbootutil
I haven't tried it though so I don't know for sure. (I have my own custom systemd-boot setup that predates theirs, and since my setup uses signed UKIs and theirs doesn't, I don't care to switch to theirs. I can still switch snapshots manually with `btrfs subvol` anyway; it just might require a live CD in case the default snapshot doesn't boot.)
In Timeshift: System Restore Tool for Linux