I backported your patches to secboot[1] and go-tpm2[2] which are currently used[3] by snapd.
With test image which includes your patches, I can install uc20 when the hash algorithm SM3 is enabled in BIOS.
But, the encrypted partition is still not created successfully because the test kernel snap is unsigned.
When I install uc20, I have to disable secure boot.
I'm trying to build a signed kernel snap and install uc20 with secure boot enabled.
I will keep you informed of the progress.
@Chris
I backported your patches to secboot[1] and go-tpm2[2] which are currently used[3] by snapd.
With test image which includes your patches, I can install uc20 when the hash algorithm SM3 is enabled in BIOS.
But, the encrypted partition is still not created successfully because the test kernel snap is unsigned.
When I install uc20, I have to disable secure boot.
I'm trying to build a signed kernel snap and install uc20 with secure boot enabled.
I will keep you informed of the progress.
--- /github. com/EthanHsieh/ secboot/ commit/ f1b9e1593b2a952 be77b63f8b31cc3 787b1e3e0d /github. com/EthanHsieh/ go-tpm2/ commit/ b5a8526eb240268 9024c0deeba7787 33036a3084 /github. com/snapcore/ snapd/blob/ master/ vendor/ vendor. json
[1] https:/
[2] https:/
[3] https:/