Clevis

No entries match these filters. Clear filters

1. v24 Oct 15, 2026 · issue 110

   Clevis v24 adds optional mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. support to the tang pin and drops the TPM1 network dependency from dracutdracutA Linux initramfs build framework maintained by the kernel community that assembles the early-boot environment; cyber tools use it to create custom bootable images with specific drivers or modules baked in..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v24 https://github.com/latchset/clevis.git
   # already have the repo? check out this version:
   $ git checkout v24

   • Adds optional mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. (mTLS) support to the tang pin for authenticated tang server connections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Drops the network dependency from the TPM1 dracut module, so TPM1 unlocking no longer requires network availability at boot.
   • Includes libpcsclite_real.so in the dracut initrd PKCS#11PKCS#11The standard programming interface software uses to ask an HSM, smart card or token to sign or decrypt with a key it holds. Supporting it lets a tool keep its keys in hardware. module to enable PKCS#11 token access during early boot on distributions that ship the library.
   • Orders clevis-luks-askpass after network-online.target in the tang dracut module when systemd is included, ensuring network is ready before tang unlock is attempted.
   • Passes --force-password to luksChangeKey to bypass pwquality/cracklib checks for Clevis-generated random keys.
   • Adds optional mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. (mTLS) support to the tang pin for authenticated tang server connections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   4 more in Everything

2. v23 May 13, 2026 · release notes

   Clevis v23 adds TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake. 1.2 support and a build option to make the tpm1 pin optional.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v23 https://github.com/latchset/clevis.git
   # already have the repo? check out this version:
   $ git checkout v23

   • Adds TPM 1.2 support via a new tpm1 pin, enabling Clevis-based automated decryption on legacy hardware with TPM 1.2 chips.
   • Adds a Meson build option to make the tpm1 pin optional, allowing packagers and builders to exclude TPM 1.2 support from the binary.

   2 details in Everything

3. v22 Mar 16, 2026 · release notes

   Clevis v22 adds non-block-device LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations. unlocking, a pin authoring template, and TPM2 PCR algorithm auto-detection.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v22 https://github.com/latchset/clevis.git
   # already have the repo? check out this version:
   $ git checkout v22

   • Supports unlocking non-block-device volumes (e.g. loop files, network-backed volumes) via clevis-luks-askpass.
   • Adds a pin template with documentation and a sample file pin to help authors write custom Clevis pins.
   • TPM2 pin now auto-selects the first PCR algorithm bank supported by the TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake. as the default, improving hardware compatibility.
   • Copies a CA certificate bundle into initramfs-tools so curl can perform HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. connections during early boot.
   • Installs clevis-pin-tpm2 into the initrd automatically when the TPM2 pin is required.

   5 details in Everything

4. v21 Sep 24, 2024 · release notes

   Clevis v21 adds experimental PKCS#11PKCS#11The standard programming interface software uses to ask an HSM, smart card or token to sign or decrypt with a key it holds. Supporting it lets a tool keep its keys in hardware. pin support for hardware token-based unlocking.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v21 https://github.com/latchset/clevis.git
   # already have the repo? check out this version:
   $ git checkout v21

5. v16 Feb 9, 2021 · release notes

   Clevis v16 adds clevis luks pass command for LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations. passphrase interaction and binary keyfile support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v16 https://github.com/latchset/clevis.git
   # already have the repo? check out this version:
   $ git checkout v16

   • Adds support for TPM2-tools 5.X in the tpm2 pin
   • Adds proper support for binary keyfiles in Clevis operations

   2 details in Everything

6. v15 Oct 28, 2020 · release notes

   Adds clevis luks subcommands (edit, report, regen), -y flag to bind, and on-demand initramfs network.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v15 https://github.com/latchset/clevis.git
   # already have the repo? check out this version:
   $ git checkout v15

   └──▷ USE IT
   Non-interactively bind a LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations. device to a Tang server without user prompts.
   shell copy

   clevis luks bind -d /dev/sda1 tang '{"url":"http://tang.example.com"}' -y

   Update an existing LUKS binding with a new Tang server URL using the regen command.
   shell copy

   clevis luks regen -d /dev/sda1 tang '{"url":"http://new-tang.example.com"}'

   Inspect the current encryption policy and token IDs of a bound LUKS device.
   shell copy

   clevis luks report -d /dev/sda1

   • Introduces clevis luks edit command to modify existing LUKS bindings
   • Introduces clevis luks report command to display current LUKS binding status
   • Introduces clevis luks regen command to re-bind a LUKS volume with updated policy
   • Adds -y (assume yes) argument to clevis luks bind to enable non-interactive execution
   • Allows specifying a custom token ID when binding via the new --token-id option

   5 details in Everything

7. v14 Aug 31, 2020 · release notes

   Clevis v14 improves multiple LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations. boot unlocking; removes automatic rd.neednet=1 for tang.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v14 https://github.com/latchset/clevis.git
   # already have the repo? check out this version:
   $ git checkout v14

   • Improved support for unlocking multiple LUKS devices on boot
   • rd.neednet=1 is no longer added automatically by the dracut unlocker

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The dracut unlocker no longer automatically appends rd.neednet=1, requiring manual network setup when using tang.