From 28bcb928e54730b7abcece2e34dcea176d97d5ee Mon Sep 17 00:00:00 2001 From: Vishnu M S Date: Fri, 30 Oct 2026 03:31:27 +0530 Subject: [PATCH] internal/exec/stages/disks: guard against nil tang Thumbprint deref Defensively guard against an unchecked nil pointer dereference on tang.Thumbprint when processing LUKS clevis configurations. --- docs/release-notes.d/luks-tang-thumbprint-guard.change.md | 1 + internal/exec/stages/disks/luks.go | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 docs/release-notes.d/luks-tang-thumbprint-guard.change.md diff --git a/docs/release-notes.d/luks-tang-thumbprint-guard.change.md b/docs/release-notes.d/luks-tang-thumbprint-guard.change.md new file mode 100644 index 000000000..393ed404b --- /dev/null +++ b/docs/release-notes.d/luks-tang-thumbprint-guard.change.md @@ -0,0 +1 @@ +Defensively guard against nil Tang thumbprint dereference when generating LUKS configuration diff --git a/internal/exec/stages/disks/luks.go b/internal/exec/stages/disks/luks.go index 037f5da8b..4dfe9fa82 100644 --- a/internal/exec/stages/disks/luks.go +++ b/internal/exec/stages/disks/luks.go @@ -330,9 +330,13 @@ func (s *stage) createLuks(config types.Config) error { return fmt.Errorf("unmarshalling advertisement: %v", err) } } + thumbprint := "" + if tang.Thumbprint != nil { + thumbprint = *tang.Thumbprint + } c.Pins.Tang = append(c.Pins.Tang, Tang{ URL: tang.URL, - Thumbprint: *tang.Thumbprint, + Thumbprint: thumbprint, Advertisement: adv, }) }