{"record":{"id":"b250b09324012b23","repo":"gravitational/teleport","slug":"signchallenge-not-implemented-for-tpm-devices","errorCode":null,"errorMessage":"signChallenge not implemented for TPM devices","messagePattern":"signChallenge not implemented for TPM devices","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/devicetrust/native/device_linux.go","lineNumber":64,"sourceCode":"\nvar linuxDevice = &tpmDevice{\n\tisElevatedProcess: func() (bool, error) {\n\t\t// Always run TPM operations in-process.\n\t\t// The Linux impl will selectively escalate, via sudo, if necessary.\n\t\treturn true, nil\n\t},\n\tactivateCredentialInElevatedChild: func(encryptedCredential attest.EncryptedCredential, credActivationPath string, debug bool) ([]byte, error) {\n\t\treturn nil, errors.New(\"elevated credential activation not implemented for linux\")\n\t},\n}\n\nfunc enrollDeviceInit() (*devicepb.EnrollDeviceInit, error) {\n\tinit, err := linuxDevice.enrollDeviceInit()\n\treturn init, rewriteTPMPermissionError(err)\n}\n\nfunc signChallenge(chal []byte) (sig []byte, err error) {\n\treturn nil, errors.New(\"signChallenge not implemented for TPM devices\")\n}\n\nfunc getDeviceCredential() (*devicepb.DeviceCredential, error) {\n\tcred, err := linuxDevice.getDeviceCredential()\n\treturn cred, rewriteTPMPermissionError(err)\n}\n\nfunc solveTPMEnrollChallenge(\n\tchal *devicepb.TPMEnrollChallenge,\n\tdebug bool,\n) (*devicepb.TPMEnrollChallengeResponse, error) {\n\t// No need to call rewriteTPMPermissionError here, enrollDeviceInit must pass\n\t// first.\n\treturn linuxDevice.solveTPMEnrollChallenge(chal, debug)\n}\n\nfunc solveTPMAuthnDeviceChallenge(\n\tchal *devicepb.TPMAuthenticateDeviceChallenge,","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/devicetrust/native/device_linux.go#L46-L82","documentation":"Stub on Linux: TPM device enrollment implements ECDH-attestation via activateCredential, but challenge signing with the TPM (used for device authentication) is not implemented on this platform, so signChallenge always fails.","triggerScenarios":"Thrown at lib/devicetrust/native/device_linux.go:64 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Enroll the device on a supported platform (e.g. macOS or Windows)","File an issue with Teleport to request Linux TPM signChallenge support"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}