Executive summary

mkinitcpio version 42-1 now includes systemd-pcrosseparator.service through the systemd hook, in line with the systemd v261 changes. This affects PCR values 0-7, 9, and 12-14, so TPM2 configurations that unlock LUKS volumes based on those measurements must be re-enrolled.

Problem addressed

I read the Arch Linux announcement about changes to mkinitcpio Starting with package version 42-1, the systemd hook now includes systemd-pcrosseparator.service as intended by systemd v261. following systemd v261.

This is not a minor update: previously measured PCR values may change due to Presence of a new service in the initrd. Calculated PCR values for PCR 0-7, 9, and 12-14 may change. If LUKS unlock depends on the old values, the TPM2 key becomes unusable until re-enrollment.

Key features and code examples

The important change is to the PCR signature, not the number of policies or new options. Archmerekomendasikan two jalur handled，分别:

  • systemd-cryptenroll(1) or the ArchWiki article systemd-cryptenroll to use pinned values.
  • systemd-pcrlock(8) for custom policies when systemd-pcrlock-make-policy.service is disabled.

Example verification, for illustration:

systemd-analyze pcrs
bootctl status
systemctl status systemd-pcrosseparator.service

Example TPM2 LUKS configuration using systemd-cryptenroll, for illustration:

systemd-cryptenroll --tpm2-device=auto /dev/nvme0n1p2

Impact and upgrade notes

Check whether your initrd uses the systemd hook and whether LUKS unlocking depends on PCR 0-7, 9, or 12-14. If so, re-enroll TPM2 before the change locks you out.

For pinned values, follow the systemd-cryptenroll(1) documentation. For custom policies with systemd-pcrlock-make-policy.service disabled, use the systemd-pcrlock(8) reference. Systems that do not rely on TPM2-based LUKS unlocking require no special action for this change.

---

First announced in Arch Linux News. Read the original source for full details.

Read also