Remove "hash" when calling clevis-encrypt (BugFix)

[tomli380576]

WARNING: This modifies com.canonical.certification::sru-server

Description

Fixes #2820

Resolved issues

See #2820 for the details

Documentation

Tests

Device with only sha384 PCR banks: https://certification.canonical.com/hardware/202607-39061/submission/509175/

Normal x86 laptop: https://certification.canonical.com/hardware/202601-38351/submission/509176/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.32%. Comparing base (1acd778) to head (2246b77).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2822   +/-   ##
=======================================
  Coverage   61.32%   61.32%           
=======================================
  Files         499      499           
  Lines       50363    50363           
  Branches     8848     8848           
=======================================
  Hits        30886    30886           
  Misses      18637    18637           
  Partials      840      840           

Flag	Coverage Δ
provider-tpm2	52.33% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟢 Approval recommended

The change is minimal, directly matches the linked bug’s root cause, and updates only the clevis invocation parameters without broader behavioral risk.

Pull request overview

This PR fixes TPM2 clevis RSA/ECC PXU job templates so they no longer pass the hash field to clevis-encrypt-tpm2, avoiding failures on devices whose TPM2 PCR banks are not sha256 (e.g., sha384-only).

Changes:

• Remove "hash": "{pcr_bank}" from the clevis-encrypt-tpm2 JSON config for RSA PCR-bank jobs.
• Remove "hash": "{pcr_bank}" from the clevis-encrypt-tpm2 JSON config for ECC PCR-bank jobs.

File summaries

File	Description
providers/tpm2/units/clevis.pxu	Drops the hash field from clevis TPM2 encryption config in RSA/ECC template jobs to prevent sha384 PCR-bank failures.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.