Any examples how to add TPM support and clevis to a custom ZBM image?

[timkgh]

IIUC, building a custom image happens in a container, the host (Ubuntu in my case) packages do not matter, beyond podman/docker. Hence I have to figure out what I need to do for the Void Linux dracut configuration in the container to make tpm-tools and clevis packages part of the ZBM initramfs, correct?

Any pointers or examples where someone else did something similar?

As a side question, I'm a bit confused why both dracut and mkinitcpio are available. Is it for flexbility for those who may not be familiar with dracut? If I am not with either, stay with the default dracut then?

Thank you.

[ahesford]

Buildng a custom image happens in a container when you use zbm-builder.sh or drive the container entrypoint directly. You can build custom images directly from your host if you have all of the pieces required by generate-zbm.

ZFSBootMenu supports both dracut and mkinitcpio because we don't want to be entirely dependent on a single initramfs generator. You can stick with whatever generator you find easier to install and learn.

[timkgh]

For Ubuntu 24.04 LTS, would you recommend using the container or build on the host? Of course considering that I want to end up with tpm-tools and clevis in the generated initramfs. Fwiw, clevis is not critical, just nice to use, I think I can manually use the TPM via the (clunky) tpm-tools commands.

Also, I'm not sure I understand how building on the host works, Ubuntu uses initramfs-tools. Would I have to install dracut on Ubuntu?

[timkgh]

Or ... can I just make a kernel and initramfs on Ubuntu that has dropbear, tpm-tools and clevis, using the default Ubuntu initramfs-tools, and then have generate-zbm use those? This would be very useful because of the custom decryption I need to do so it would be nice to use the same kernel+initramfs for both ZBM and BE.
But then ... would it be easier to just use systemd-boot with a UKI that the UEFI can build directly?