On Wed, Dec 2, 2020 at 12:08 PM Jerry Snitselaar jsnitsel@redhat.com wrote:
We are looking to no longer support TPM1.2 in RHEL9. Than raised the question with regards to opencryptoki-tpmtok if it should be changed in Fedora as well, so I thought I'd see what everyone thinks about future TPM1.2 support in Fedora. I know at one point in the last year or so trousers almost dropped from Fedora due to being orphaned for quite a while. From what I could find the following packages have dependencies:
ecryptfs-utils - --disable-tspi openconnect - looks like it will only build support if trousers-devel is there, and makes use of tpm2-tss as well. strongswan - --enable-tss-tss2 instead of --enable-tss-trousers? tboot - the trousers dependency was just in a policy tool that has now been deprecated upstream. opencryptoki-tpmtok - --disable-tpmtok
tpm-quote-tools, tpm-tools, and trousers are all tpm1.2 specific packages.
Another thing is that in the kernel there currently is no way to build with just tpm1.2 or tpm2.0 support so the kernel support for tpm1.2 would still be there.
I don't think Fedora needs to drop the tpm1.2 support if people want to continue supporting it, but wanted to put the question out there and see how everyone felt.
How much support is needed? I've written some TPM1.2 code that no one uses, so I don't personally care, but I'm pretty sure there are quite a few systems around that use TPM 1.2 For example, until I manually did the magic incantation to switch my laptop from its TPM 1.2 default to TPM 2 mode, it had TPM 1.2. It's not even particularly old.
I think we should at least keep TPM 1.2 kernel support, but basic user support where it's not too inconvenient seems reasonable.