UX improvements: TPM reseal (HOTP/TOTP/DUK) adds integrity report; detects disk/tpm swap and guide user into action, add terminal colors and guidance! Reduced quiet noise.

[tlaurion]

• merge Root hash generalize #2067 first (confirmed to work on Qubes 4.3 LUKS+Thin LVM+Ext4!)

---

Improve TPM/TOTP/HOTP recovery and reseal behavior by adding integrity-first
gating, clearer failure handling, and stronger rollback preflight checks.

• add integrity report + investigation flows in GUI, with explicit actions
  before reseal/reset paths
• introduce TPM reset-required markers and rollback preflight validation to
  fail early on inconsistent TPM state
• make unseal/seal paths safer and more recoverable (nonfatal unseal mode,
  clearer reset/reseal guidance, better TPM1/TPM2 handling)
• improve kexec signing reliability with explicit signing key selection and
  actionable GPG error diagnostics
• avoid hiding interactive password/PIN prompts by removing inappropriate
  debug wrappers around sensitive interactive commands
• add run_lvm wrapper and switch runtime scripts to reduce harmless LVM noise
• refresh TPM2 primary-handle hash in update/signing flows to keep trust
  metadata in sync
• add new qemu fbwhiptail prod_quiet board configs for TPM1 and TPM2
• fix board-name values for existing qemu hotp prod_quiet variants
• document QEMU canokey state reuse and TPM2 pcap capture debugging
• ignore exported public key artifacts (*.asc) in .gitignore
• add TRACE_FUNC example under doc/logging.md
• add coloring to console. See doc/logging.md for assumption changes (It was initially thought that logging under /tmp/debug.log was to be limited by informational modes (debug/quiet/info) where now everything that can be logged is logged, where the information level gives everything it can, without secrets output
  • Addition of STATUS, STATUS_OK and INPUT under /etc/functions to uniformize coloring
  • All wrappers are now colorized with ansi escape characters
• And many other fixes found along the way.

---

Tested : simulating or real firmware upgrade from master to this PR CI created rom artifacts 03/11/2026

• qemu-fbwhiptail-tpm2
• qemu-fbwhiptail-tpm1
• qemu-fbwhiptail-tpm2-hotp
• qemu-fbwhiptail-tpm1-hotp
• qemu-fbwhiptail-tpm2-hotp-prod_quiet
• qemu-fbwhiptail-tpm1-hotp_prod_quiet
• v540tu (real hardware TPM2+HOTP
  • Debian-13 DVD install based LUKS+EXT4 default deployment factory reset up to TPM DUK setup and kexec into dev env (Where I do KVM based testing for devel, including root hashes creation + verification to extend testing of Root hash generalize #2067)
• x230-hotp-maximized (TPM1.2 + HOTP)
  • Tested root hashes on QubesOS 4.3 (LUKS+ThinLVM+ext4 dom0) creation + verification after updates (Root hash generalize #2067 continuation confirmed working) + Factory reset up to TPM DUK kexec into QubesOS 4.3
  • 'o' early at boot still generates a single random diceware passphrase shared for all security components.

Workflow change
CC @wessel-novacustom comments?
There were reports of Heads not providing integrity checks prior of resealing TOTP/HOTP, so that user is confident about the state of /boot prior of resealing TOTP/HOTP/DUK which would resign /boot content.

Normal workflow after upgrading firmware while /boot unchanged

Normal non-hotp boot workflow requesting TPM DUK

Other corners cases

TPM reset from OS?

Similar to above, but pushes for TPM Reset since TPM reseal won't work

Replaced gpg key, mismatch from USB Security dongle etc

This is where testing of corner cases is lacking (too much time involved here already)

[Copilot]

Pull request overview

This PR improves Heads’ TPM reseal UX by adding an integrity “gate” (TOTP/HOTP + /boot verification) and better detection/handling of TPM/disk swap or rollback-counter inconsistencies, plus some QEMU-focused debugging/documentation updates.

Changes:

• Add measured integrity reporting + discrepancy investigation flows, and integrate them into reseal/reset paths in the GUI.
• Improve TPM rollback-counter handling (preflight validation, clearer error guidance, better prompt visibility).
• Replace fdisk-based disk display with a sysfs-based helper and add QEMU troubleshooting/debug tips (including TPM2 pcap capture).

Reviewed changes

Copilot reviewed 8 out of 20 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
targets/qemu.md	Adds QEMU troubleshooting notes (Canokey state reuse, TPM2 pcap capture).
initrd/etc/gui_functions	Adds integrity report + investigation UI helpers; system info now uses disk_info_sysfs.
initrd/etc/functions	Adds trace stack, rollback-counter preflight helpers, sysfs disk info helper, and multiple TPM/boot-device related adjustments.
initrd/bin/unseal-totp	Improves TPM2 primary-handle error handling and adds nonfatal mode support.
initrd/bin/unseal-hotp	Improves TPM2 primary-handle + rollback-state-aware error handling and adds nonfatal mode support.
initrd/bin/tpmr	Improves TPM2 counter increment auth handling, counter-create UX, and TPM2 seal/unseal messaging.
initrd/bin/seal-totp	Adds TPM2 primary-handle precheck + clearer sealing failure guidance.
initrd/bin/root-hashes-gui.sh	Improves tracing/debugging and adds more flexible LVM LV selection/cleanup.
initrd/bin/oem-system-info-xx30	Switches disk listing to disk_info_sysfs to avoid fdisk/busybox limitations.
initrd/bin/oem-factory-reset	Adjusts TPM counter increment handling and removes duplicated integrity report implementation.
initrd/bin/kexec-sign-config	Changes TPM counter increment handling and adds a pre-check for empty GPG keyring; modifies signing pipeline.
initrd/bin/kexec-select-boot	Hard-fails on TPM2 primary handle hash mismatch with a stronger warning.
initrd/bin/kexec-seal-key	Tweaks passphrase prompts/formatting for improved UX.
initrd/bin/gui-init	Adds integrity gate + rollback-counter preflight UX and integrates investigation/report flows.
boards/qemu-coreboot-fbwhiptail-tpm2/qemu-coreboot-fbwhiptail-tpm2.config	Documents TPM2 pcap capture option in board config.
boards/qemu-coreboot-fbwhiptail-tpm2-prod_quiet/qemu-coreboot-fbwhiptail-tpm2-prod_quiet.config	Adds a new “prod_quiet” QEMU TPM2 board config.
boards/qemu-coreboot-fbwhiptail-tpm2-hotp-prod_quiet/qemu-coreboot-fbwhiptail-tpm2-hotp-prod_quiet.config	Adjusts board name and minor formatting.
boards/qemu-coreboot-fbwhiptail-tpm1-prod_quiet/qemu-coreboot-fbwhiptail-tpm1-prod_quiet.config	Adds a new “prod_quiet” QEMU TPM1 board config.
boards/qemu-coreboot-fbwhiptail-tpm1-hotp-prod_quiet/qemu-coreboot-fbwhiptail-tpm1-hotp-prod_quiet.config	Adjusts board name.
.gitignore	Ignores *.asc files.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 20 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 19 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 23 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 24 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 24 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tlaurion]

Still WiP but I would appreciate early testing from all board testers tagged under BOARDS_AND_TESTERS.md:

[tlaurion]

Still Wip, but I would appreciate all testers to participate in testing and reporting corner case issues.

From master's https://github.com/linuxboot/heads/blob/1ab159f22599e7f3b8254ed6ed30bbd617eb4a5a/BOARDS_AND_TESTERS.md, here's all official testers we currently have:
@3hhh @akfhasodh @akunterkontrolle @alexmaloteaux @arhabd @bwachter @computer-user123 @daringer @doob85 @doritos4mlady @eganonoa @fhvyhjriur @gaspar-ilom @HarleyGodfrey @househead @icequbes1 @jan23 @jans23 @jnscmns @JonathonHall-Purism @kjkent @lsafd @MattClifton76 @merge @mkopec@d-wid @MrChromebox @n4ru @nestire @nitrosimon @notgivenby @pcm720 @rbreslow @ResendeGHF @shamen123 @srgrint @ThePlexus @thickfont @Thrilleratplay @tlaurion @Tonux599 @weyounsix @zifxify

This has no chance of bricking. Please report anything you find since this is aimed for next and soon feature freeze 2026-04 thank you.

[tlaurion]

Working on it some more. some more detection on empty keyring, mismatching kexec.sig key used to sign vs currently help by usb security dongle etc.

Also coming: colorized output.

Will leave it to proper UX flow on upgrade trying to catch all corner case and move STATUS output and INPUT whiptail prompt to after porting missing functions into fbwhiptail later #2069 if funding/interest.

[tlaurion]

Still Wip, but I would appreciate all testers to participate in testing and reporting corner case issues.

From master's https://github.com/linuxboot/heads/blob/1ab159f22599e7f3b8254ed6ed30bbd617eb4a5a/BOARDS_AND_TESTERS.md, here's all official testers we currently have: @3hhh @akfhasodh @akunterkontrolle @alexmaloteaux @arhabd @bwachter @computer-user123 @daringer @doob85 @doritos4mlady @eganonoa @fhvyhjriur @gaspar-ilom @HarleyGodfrey @househead @icequbes1 @jan23 @jans23 @jnscmns @JonathonHall-Purism @kjkent @lsafd @MattClifton76 @merge @mkopec@d-wid @MrChromebox @n4ru @nestire @nitrosimon @notgivenby @pcm720 @rbreslow @ResendeGHF @shamen123 @srgrint @ThePlexus @thickfont @Thrilleratplay @tlaurion @Tonux599 @weyounsix @zifxify

This has no chance of bricking. Please report anything you find since this is aimed for next and soon feature freeze 2026-04 thank you.

Go!

[Copilot]

Pull request overview

Copilot reviewed 14 out of 47 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[tlaurion]

@macpijan @mkopec + @3hhh @akfhasodh @akunterkontrolle @alexmaloteaux @arhabd @bwachter @computer-user123 @daringer @doob85 @doritos4mlady @eganonoa @fhvyhjriur @gaspar-ilom @HarleyGodfrey @househead @icequbes1 @jan23 @jans23 @jnscmns @JonathonHall-Purism @kjkent @lsafd @MattClifton76 @merge @mkopec@d-wid @MrChromebox @n4ru @nestire @nitrosimon @notgivenby @pcm720 @rbreslow @ResendeGHF @shamen123 @srgrint @ThePlexus @thickfont @Thrilleratplay @tlaurion @Tonux599 @weyounsix @zifxify

Would be nice if you tested (no need for hardware: swtpm+canokey) in cloned ~/heads dir for this PR:
( This is short version of https://github.com/tlaurion/heads/blob/e12252b46335ccf73745e1b2ac0767dc5c9a2ec6/targets/qemu.md, considered you have installed docker-ce per README.md )

cd ~ #go into a directory that is writeable for you
git clone https://github.com/tlaurion/heads #because my PR comes from there
cd ~/heads #change directory to what we just cloned
git checkout tpm_reseal_ux-integrity_report-detect_disk_and_tpm_swap #this PR's branch
git pull origin #if any changes were made since this post as can be seen on the PR
./docker_repro.sh make BOARD=qemu-coreboot-fbwhiptail-tpm2-prod_quiet # builds
./docker_repro.sh make BOARD=qemu-coreboot-fbwhiptail-tpm2-prod_quiet INSTALL_IMG=<~/heads/path_to_iso.iso> run  #install OS or otherwise cp -alf qcow2 image to build/x86/qemu-coreboot-fbwhiptail-tpm2-prod_quiet/root.qcow2
./docker_repro.sh make BOARD=qemu-coreboot-fbwhiptail-tpm2-prod_quiet run #do oem-factory-reset, say y when asked to copy public key to usb drive
sudo losetup --find --partscan --show ./build/x86/qemu-coreboot-fbwhiptail-tpm2-prod_quiet/usb_fd.raw #note detected loop dev, here I suppose loop10
sudo mount /dev/loop21 /media/cdrom/ #mount loop device so you can cp public key since we have #https://github.com/linuxboot/heads/issues/1203
cp /media/cdrom/<pubkey_fingerprint.asc> pubkey.asc
sudo umount /media/cdrom #unmount, so that loop is left as an uused device
./docker_repro.sh make BOARD=qemu-coreboot-fbwhiptail-tpm2-prod_quiet PUBKEY_ASC=pubkey.asc inject_gpg run

Then follow the prompts. You should be guided into reownership. Reboot.
Seal TPM/HOTP.
Select default boot.
Say yes to define TPM DUK.
Report any bug encountered!

Thanks.