Unable to enable TPM FDE in installer - Ubuntu 26.04 LTS

[jnsgruk]

Heyo 👋🏻

Yesterday I did a clean build on my desktop machine, and where in a previous release this worked, I was unable to get the UEFI into a state where the installer would let me use TPM FDE.

I reset the TPM, restored factory keys and otherwise tried all combos I could, but kept getting the error:

"INVALID_SECURE_BOOT_MODE" and "error with secure boot policy (PCR7) measurements, deployed mode should be enabled in order to generate secure boot profiles"

The motherboard is an MSI MPG CARBON X670E - so relatively recent.

[chrisccoulson]

Whilst it's preferred to enable deployed mode if possible, the installer is meant to offer a way to continue installing with this error because we know it's not possible to resolve it on some hardware platforms. Is that not happening in this case?

[jnsgruk]

No, it just says it can't be enabled and my only option is to go back and choose a different encryption method.

[cmmrandau]

same problem here

[valentindavid]

Just to make sure... could you run: snap version

[valentindavid]

Also what is the output of: sudo snap debug api /v2/systems/enhanced-secureboot-desktop | jq '.result."storage-encryption"'

[jnsgruk]

Are you looking for the result of that in the installer session? If so I'll need to wait until I'm back at my other PC

[valentindavid]

Are you looking for the result of that in the installer session?

Yes.