ThinkPad X1 Carbon, 11gen - OprionROM with tpm-eventlog

[tblancher]

I managed to successfully get Secure Boot working without the Microsoft Third Party CA keys, despite having several OptionROMs. I haven't tried it without this disabled, but my Secure Boot menu in my UEFI BIOS has a toggle for "Allow Microsoft Third Party CA." Again, I have this DISABLED. I'm really not sure if that makes a difference.

I also have a fix_tpm function (zsh, but should work fine in Bash):

fix_tpm () {
	local device="${1:-/dev/nvme0n1p2}" 
	echo "🔐 Re-enrolling TPM2 for device: $device"
	if sbctl status --json | jq --compact-output --raw-output --exit-status '.setup_mode' &> /dev/null
	then
		echo "⚠️  Secure Boot is in Setup Mode. Enrolling CUSTOM keys only."
		sudo sbctl enroll-keys --tpm-eventlog
	fi
	sudo systemd-cryptenroll "$device" --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=0+7
	if [ $? -eq 0 ]
	then
		echo "✅ TPM re-enrollment successful."
	else
		echo "❌ TPM re-enrollment failed."
	fi
}