# Disable the make-policy service that its on by default on some systemd versions
# it creates a pcrlock.json policy that conflicts with our mesurements when trying to enroll it
RUN if [ "$(which-init.sh)" = "systemd" ]; then \
      systemctl disable systemd-pcrlock-make-policy || true; \
      systemctl mask systemd-pcrlock-make-policy || true; \
      journalctl --vacuum-size=1K || true; \
    fi

Failed to find TPM2 pcrlock policy file 'pcrlock.json': No such file or directory
Loaded 'libcryptsetup.so.12' via dlopen()
Allocating context for crypt device /dev/vda2.
Trying to open and read device /dev/vda2 with direct-io.
Initialising device-mapper backend library.
Trying to load LUKS2 crypt type from device /dev/vda2.
Crypto backend (OpenSSL 3.3.1 4 Jun 2024 [default][legacy][threads][argon2]) initialized in cryptsetup library version 2.7.2.
Detected kernel Linux 6.11.0-8-generic x86_64.
Loading LUKS2 header (repair disabled).
Acquiring read lock for device /dev/vda2.
Opening lock resource file /run/cryptsetup/L_253:2
Verifying lock handle for /dev/vda2.
Device /dev/vda2 READ lock taken.
Trying to read primary LUKS2 header at offset 0x0.
Opening locked device /dev/vda2
Verifying locked device handle (bdev)
LUKS2 header version 2 of size 16384 bytes, checksum sha256.
Checksum: 1600643437bedd2cf5a4772844cd2b2019150f48809651f25abe9cfc07035c2e (on-disk)
Checksum: 1600643437bedd2cf5a4772844cd2b2019150f48809651f25abe9cfc07035c2e (in-memory)
Trying to read secondary LUKS2 header at offset 0x4000.
Reusing open ro fd on device /dev/vda2
LUKS2 header version 2 of size 16384 bytes, checksum sha256.
Checksum: 51b03200666a9cd3ddb1e033930b9233374e31e51f49924d4593cc8338c51e4b (on-disk)
Checksum: 51b03200666a9cd3ddb1e033930b9233374e31e51f49924d4593cc8338c51e4b (in-memory)
Device size 67108864, offset 16777216.
Device /dev/vda2 READ lock released.
PBKDF argon2id, time_ms 2000 (iterations 0), max_memory_kb 1048576, parallel_threads 4.
Requesting JSON for token 0.
Requesting JSON for token 1.
Requesting JSON for token 2.
Requesting JSON for token 3.
Requesting JSON for token 4.
Requesting JSON for token 5.
Requesting JSON for token 6.
Requesting JSON for token 7.
Requesting JSON for token 8.
Requesting JSON for token 9.
Requesting JSON for token 10.
Requesting JSON for token 11.
Requesting JSON for token 12.
Requesting JSON for token 13.
Requesting JSON for token 14.
Requesting JSON for token 15.
Requesting JSON for token 16.
Requesting JSON for token 17.
Requesting JSON for token 18.
Requesting JSON for token 19.
Requesting JSON for token 20.
Requesting JSON for token 21.
Requesting JSON for token 22.
Requesting JSON for token 23.
Requesting JSON for token 24.
Requesting JSON for token 25.
Requesting JSON for token 26.
Requesting JSON for token 27.
Requesting JSON for token 28.
Requesting JSON for token 29.
Requesting JSON for token 30.
Requesting JSON for token 31.
Keyslot 0 priority 1 != 2 (required), skipped.
Trying to open LUKS2 keyslot 0.
Running keyslot key derivation.
Reading keyslot area [0x8000].
Acquiring read lock for device /dev/vda2.
Opening lock resource file /run/cryptsetup/L_253:2
Verifying lock handle for /dev/vda2.
Device /dev/vda2 READ lock taken.
Reusing open ro fd on device /dev/vda2
Device /dev/vda2 READ lock released.
Verifying key from keyslot 0, digest 0.
Loaded 'libtss2-esys.so.0' via dlopen()
Loaded 'libtss2-rc.so.0' via dlopen()
Loaded 'libtss2-mu.so.0' via dlopen()
Assertion 'c' failed at src/shared/tpm2-util.c:2806, function tpm2_get_best_pcr_bank(). Aborting.

systemd 256 (256.5-2ubuntu3)
+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT +LIBARCHIVE