I am trying to set up a Desktop (395) that I just got. I am struggling to get the Bluefin OS to “play” nice when TPM is turned on.
I need an immutable Linux OS with native container/Docker support that can run AI, and Bluefin checks most of those boxes and more.
I had to turn TPM off to install and run Bluefin. https://projectbluefin.io/
I tried to run mokutil/(ujust enroll-secure-boot-key) at the next startup. It doesn’t bring up the mokutil UI at the next startup. So I can’t add the Bluefin certificate. When I turn on TPM, it blocks my OS from loading, and the drive uses a passphrase to unlock, so that is a factor to consider.
Would using a DD image instead of an ISO image while installing with TPM enabled help at all?
Any suggestions?
You could manually enroll the key? Find the public keys, save them to a USB and upload them into the BIOS. That’s pretty much what the script does anyways, no? Just automated.
Here is a list of what I have tried.
A unique USB installation media in DD format (Rufus) fails to load when TPM is enabled. It works when TPM is disabled.
I also tried a separate FAT32 drive with the certificate (direct link to download the certificate in the README.md in the Bluefin Repository: bluefin/README.md at main · ublue-os/bluefin · GitHub) in both DER and ESL formats. The desktop BIOS doesn’t recognize or detect them, so it can’t load the signature into the TPM. I also tried the command from the README.md.
Running the mokutil script and then rebooting skips straight to the passphrase prompt to decrypt the hard drive. The pending update is still in the queue and never loads.
TPM Factory Reset. I didn’t think it would change anything, but I did it anyway. Same results.
If I turn off TPM, Bluefin (on USB and the internal drive) boots without issues.
It is looking more and more like I may just have to live without TPM, unless I am missing something.
Do you mean “TPM”, or do you mean “secure boot”? They are wildly different things. Secure boot involves the enrollment and management of certificates, machine owner keys (via mokutil) and more.
You may be able to find answers more readily if you use the right terms. 
Semantics.
I’m only aware of two other settings besides the default: “keep both Secure Boot and TPM active but hide it from the OS” and “deactivate Secure Boot”.
The former prevents an untrusted or unverified OS from booting, as the default setting does. The latter allows anything to boot up.
Obviously, as long as either the TPM or Secure Boot doesn’t trust Bluefin OS, I can’t boot it up.