It sounds like your issue could be related to changes in the TPM2 PCR (Platform Configuration Register) values following the update. Specifically, since you were using PCR 7 in your /etc/crypttab
configuration, and PCR 7 is tied to the Secure Boot state and configuration, any updates to the Secure Boot signatures might have altered the hash that PCR 7 measures. As a result, the TPM2 is no longer providing the correct unsealing key for automatic decryption, leading to failure in unlocking your drives.
Here are some troubleshooting steps you can try to resolve this issue:
- You can use
tpm2_pcrread
to see the current values for PCR 7 and compare them to the previous ones. If these values have changed due to the update, you might need to adjust your cryptsetup/TMP2 configuration accordingly.
tpm2_pcrread sha256:7