sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

tpm design

Browse Source
This commit is contained in:
Audiobuzz
2026-06-28 18:32:36 +09:30
parent ce5af959ad
commit 5232b36614
3 changed files with 278 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/TODO.md
+8
View File
@@ -920,6 +920,14 @@ UKI + isolated VLAN + read-back verify.**
## [ ] 11. (DESIGN) TPM 802.1X identity enrolment (TOFU + OOB fingerprint)
**Authoritative design consolidated 2026-06-28:
[tpm-enrolment-design.md](tpm-enrolment-design.md)** — unifies this item with the
fleet-manager (the broker = the fleet-manager's one unauthenticated bootstrap
endpoint; approval births the inventory record) and the full identity lifecycle
(enrol / renew / alert). **v1 decision: fingerprint-only OOB assurance**; TPM
attestation (ACME `device-attest-01`) is the documented later upgrade. The notes
below are retained as the originating decisions; the design note is canonical.
How a host gets its **802.1X EAP-TLS client identity** the first time — the key at
TPM handle `0x81010001` + cert at NV `0x01800001` that invariant #1 says must come
from enrolment, never the image. Distinct from #10 (that enrols *Secure Boot*