feat: add optional pin for luks tpm2 unlock just command (#297)

Co-authored-by: Kyle Gospodnetich <[email protected]>

build/ublue-os-luks/luks-enable-tpm2-autounlock

@@ -43,6 +43,13 @@ else
   exit 1
 fi
 
+SET_PIN_ARG=""
+read -p "Would you like to set a pin? " -n 1 -r
+echo
+if [[ $REPLY =~ ^[Yy]$ ]]; then
+  SET_PIN_ARG=" --tpm2-with-pin=yes "
+fi
+
 # Specify Crypt Disk by-uuid
 CRYPT_DISK="/dev/disk/by-uuid/$DISK_UUID"
 
@@ -63,7 +70,7 @@ fi
 
 ## Run crypt enroll
 echo "Enrolling TPM2 unlock requires your existing LUKS2 unlock password"
-systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 "$CRYPT_DISK"
+systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 "$SET_PIN_ARG" "$CRYPT_DISK"
 
 
 if lsinitrd 2>&1 | grep -q tpm2-tss > /dev/null; then