Skip to content

base: install tpm2-pkcs11 and use it for SSH - #11

Merged
hnez merged 3 commits into
mainfrom
lgo/tpm
Jun 29, 2026
Merged

base: install tpm2-pkcs11 and use it for SSH#11
hnez merged 3 commits into
mainfrom
lgo/tpm

Conversation

@hnez

@hnez hnez commented Jun 26, 2026

Copy link
Copy Markdown
Member

This enables us to log into hosts via SSH without exposing the private key to the running jobs.

This has become possible with the merge of forrest-runner/forrest#49.

hnez added 2 commits June 26, 2026 10:03
There is really no reason why a C compiler should be part of our base
image.

Signed-off-by: Leonard Göhrs <l.goehrs@pengutronix.de>
This does not matter in practice, but I think it looks clever.

Signed-off-by: Leonard Göhrs <l.goehrs@pengutronix.de>
@hnez

hnez commented Jun 29, 2026

Copy link
Copy Markdown
Member Author

I have changed the config to only set the PKCS11Provider if a TPM is present and a tpm2-pkcs11 store is configured, because the provider prints error messages on every use if no store is present.

Comment thread base/ssh_config
Comment thread base/ssh_config Outdated
@hnez
hnez force-pushed the lgo/tpm branch 2 times, most recently from f14ac94 to 66dc942 Compare June 29, 2026 08:39
This enables us to log into hosts via SSH without exposing the private key
to the running jobs.

The tpm2-pkcs11 provider prints error messages when no store is set up,
so only use it when one is present.

Signed-off-by: Leonard Göhrs <l.goehrs@pengutronix.de>

@jluebbe jluebbe left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, but note I've not tested this.

@hnez
hnez merged commit 5344670 into main Jun 29, 2026
@hnez
hnez deleted the lgo/tpm branch June 29, 2026 12:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants