A debug-info kernel overshoots U-Boot’s decompression buffer by 1.85 MiB. The bundle verifies at every layer, RAUC reports success, and the board silently falls back to the old slot, because the one property that mattered is only observable at bootm time on the device.
Migrating RAUC’s mTLS client key from a file on disk to a TPM2-backed PKCS#11 URI. The recipe wiring was straightforward; the URI was not. module-path is a p11-kit URI extension that libp11 — the parser RAUC’s streaming path actually uses — rejects outright.
Switching RAUC’s streaming mTLS client key from a file path to a PKCS#11 URI produced a one-line error with no obvious cause. The real problem was not the module path, not the engine, and not a missing PIN — it was the sandbox user’s group membership and what tpm2-pkcs11 needs to initialise.