yarn: rotate tpm identity after fTPM reset

Browse Source

BIOS 2423→4101 update on yarn required an fTPM reset, which broke the
sealed age identity at /var/lib/agenix/tpm-identity. Bootstrapped a new
identity against the new SRK and rotated yarn's recipient.

age-plugin-tpm 1.0+ emits age1tag1… (p256tag) recipients by default and
refuses to encrypt to legacy age1tpm1… ones, so rotated mreow's recipient
to the same encoding (same key, new bech32 HRP) and added an
age-plugin-tag→age-plugin-tpm symlink in the rage wrapper so rage's
plugin dispatch finds the binary under the new prefix. Stripped the
trailing host labels from the tpm recipient strings — rage's stricter
bech32 parser now rejects the trailing whitespace; labels live in
adjacent Nix comments instead.

...

This commit is contained in:

Simon Gardling

2026-04-30 14:08:36 -04:00

parent cc97c99422

commit 26401f5316

7 changed files with 16 additions and 5 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

BIN

secrets/desktop/nix-cache-netrc.age

Binary file not shown.

BIN

secrets/desktop/oo7-keyring-password.age

Binary file not shown.

BIN

secrets/desktop/password-hash.age

Binary file not shown.

BIN

secrets/desktop/secureboot.tar.age

Binary file not shown.

BIN

secrets/secrets.nix

Binary file not shown.