From 1245ffb04f412da893b3968c45a3f71ffbd02ffc Mon Sep 17 00:00:00 2001 From: djach7 Date: Tue, 11 Aug 2026 09:52:10 -0400 Subject: [PATCH] fix(iot): disable virtual TPM on VMs that don't need it IoT tests don't exercise TPM or measured-boot functionality, but virt-install auto-adds a vTPM for UEFI boots on modern os-variants. A Fedora 44 SELinux userspace regression (selinux-policy 45.8-1) breaks swtpm-selinux's CIL policy compilation (RHBZ#2511086), leaving /usr/bin/swtpm mislabeled and unable to exec under libvirt. This fails every UEFI VM boot in CI. Since the vTPM was never needed, explicitly disable it instead of waiting for the swtpm fix to reach stable repos. iot-simplified-installer.sh is left as-is because it tests encrypted root (coreos.inst.crypt_root=1) which requires TPM emulation. See also: fedora-iot/greenboot-rs#193 Co-Authored-By: Claude Opus 4.6 Signed-off-by: djach7 --- iot-bootc-image.sh | 1 + iot-installer.sh | 1 + iot-raw-image.sh | 1 + 3 files changed, 3 insertions(+) diff --git a/iot-bootc-image.sh b/iot-bootc-image.sh index dc68e875b..83e6141ba 100755 --- a/iot-bootc-image.sh +++ b/iot-bootc-image.sh @@ -212,6 +212,7 @@ sudo virt-install --name="iot-bootc-image-${TEST_UUID}"\ --os-type linux \ --os-variant ${OS_VARIANT} \ --boot "uefi" \ + --tpm none \ --nographics \ --noautoconsole \ --wait=-1 \ diff --git a/iot-installer.sh b/iot-installer.sh index a2bd8d138..40e0fb421 100755 --- a/iot-installer.sh +++ b/iot-installer.sh @@ -209,6 +209,7 @@ virt-install --name="iot-${TEST_UUID}" \ --os-variant "${OS_VARIANT}" \ --cdrom "/var/lib/libvirt/images/${IMAGE_FILENAME}" \ --boot uefi \ + --tpm none \ --nographics \ --noautoconsole \ --wait=-1 \ diff --git a/iot-raw-image.sh b/iot-raw-image.sh index 6200cabe3..fdd64bb4c 100755 --- a/iot-raw-image.sh +++ b/iot-raw-image.sh @@ -230,6 +230,7 @@ sudo virt-install --name="iot-${TEST_UUID}" \ --os-type linux \ --os-variant ${OS_VARIANT} \ --boot uefi \ + --tpm none \ --nographics \ --noautoconsole \ --wait=-1 \