Ota

Migrating RAUC’s mTLS client key from a file on disk to a TPM2-backed PKCS#11 URI. The recipe wiring was straightforward; the URI was not. module-path is a p11-kit URI extension that libp11 — the parser RAUC’s streaming path actually uses — rejects outright.

Switching RAUC’s streaming mTLS client key from a file path to a PKCS#11 URI produced a one-line error with no obvious cause. The real problem was not the module path, not the engine, and not a missing PIN — it was the sandbox user’s group membership and what tpm2-pkcs11 needs to initialise.