I have Guix installed on an NVME that I pulled out of another laptop and the framework is unable to detect it. The bootloader is configured as EFI and it’s full-disk encrypted. I tried disabling secure boot but that didn’t fix it.
Edit: I booted from a flash drive and it can see the partitions on the drive so clearly both the slot and the drive work.
One issue to address in full disk encryption is that the blocks where the operating system is stored must be decrypted before the OS can boot, meaning that the key has to be available before there is a user interface to ask for a password. Most Full Disk Encryption solutions utilize Pre-Boot Authentication by loading a small, highly secure operating system which is strictly locked down and hashed versus system variables to check for the integrity of the Pre-Boot kernel. Some implementations such as BitLocker Drive Encryption can make use of hardware such as a Trusted Platform Module to ensure the integrity of the boot environment, and thereby frustrate attacks that target the boot loader by replacing it with a modified version. This ensures that authentication can take place in a controlled environment without the possibility of a bootkit being used to subvert the pre-boot decryption.
With a pre-boot authentication environment, the key used to encrypt the data is not decrypted until an external key is input into the system.
I’m not sure about the details (I think it’s encrypted with LUKS?) but I don’t think there is a key stored on the machine that ties the boot drive to it. It asks for a password on boot, so I think it uses that to decrypt the drive. To clarify, it’s GRUB that asks for the password before the root partition is decrypted.