Just a quick heads up (I am not really here today/this week):
Last week the tpm module in autosign01 failed. robosignatory normally
binds to a tpm so if any keys/files were copied off to somewhere else,
they would be useless, because they require that exact machines tpm to
Thanks to Patrick from the iot team, things are back and working, but in
a degraded state. Basically currently robosign is requiring passphrases
be manually input by an admin on any restart (and then keeping that
information in the kernel keyring).
I'm out this week, Patrick is also out for a while, so I would urge us
to not make autosign mods right now. As soon as we are back, we can
evaluate if getting the tpm replaced is the way to go or other measues.
Show replies by date