can't re-install uc20 with provisioned tpm, even after manually clearing

[Ian Johnson]

After installing a uc20 image with tpm and secure boot turned on, and going to re-install it I reset the tpm after shutting down the VM and upon booting it into install mode it still fails to reinstall with the following message:

$ snap tasks 2
Status Spawn Ready Summary
Error today at 14:35 UTC today at 14:35 UTC Setup system for run mode

......................................................................
Setup system for run mode

2020-05-18T14:35:38Z ERROR cannot create partitions: cannot seal the encryption key: cannot seal and store encryption key: cannot seal data: cannot create key data file: open /run/mnt/ubuntu-seed/device/fde/ubuntu-data.sealed-key: file exists

This seems to stem from https://github.com/snapcore/secboot/blob/master/seal.go#L169 which opens the key file with os.O_CREATE, so it cannot overwrite an existing keyfile, but I think in this situation we do want to overwrite the existing keyfile as the TPM is not provisioned (in my case I manually reset the swtpm permall file after it got provisioned for the first install mode boot) and so the keyfile that is there is in effect useless , so the expectation would be that upon re-install mode we would re-provision the TPM with a new keyfile.

[Samuele Pedroni (pedronis)]

as we discussed the issue is really that the code clearing/recreating the partition should also remove the file (it is useless anyway once we drop the partition)

[Vic Liu (zongminl)]

This issue could still be reproduced with uc20-beta-20200527.5

[Vic Liu (zongminl)]

Log in comment #2 was captured after a reboot with command systemd.debug-shell=1, this is the screen capture at the moment reinstall failed.

[Claudio Matsuoka (cmatsuoka)]

Ian has a fix for this but I believe it never landed. We'll confirm the status with him when he returns tomorrow.

[Claudio Matsuoka (cmatsuoka)]

Amend that, tomorrow would be too late so we'll see what to do today.

[Michael Vogt (mvo)]

https://github.com/snapcore/snapd/pull/8762 is currently being worked on

[Vic Liu (zongminl)]

Tested 20200529.3 on Intel NUC NUC7CJYH with Secure Boot on, reinstalling system with provisioned TPM after manually cleared TPM with `echo 5 | sudo tee /sys/class/tpm/tpm0/ppi/request` is working fine now.