evaporatingtime

I've noticed that if you don't use PCR8 then the automatic decryption still takes place if you boot into recovery mode at the grub2 menu (this is with Ubuntu 20.04)....

> Otherwise, if it unlocks in recovery mode, cryptsetup and/or TPM assignment was misconfigured. Yes, it's unlocking in recovery mode so the filesystem is exposed in the root shell. >...

After some investigations into the computer in question, the problem was that (presumably due to bugs in the UEFI firmware) the EFI stub boot entry created by `efibootmgr` in `setup`...