nixos/systemd-stage-1: Don't enable TPM2 on scripted stage 1

[ElvishJerricco]

Fixes #344963

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[arianvp]

Does it actually fix that issue? This just masks it. As soon as someone enables systemd-initrd on their RPI they'll run into it again. The real issue is that this conditional is wrong no?

lib.optional (
            !(pkgs.stdenv.hostPlatform.isRiscV64 || pkgs.stdenv.hostPlatform.isArmv7)
          ) "tpm-crb";

[arianvp]

Like I'm still fine with merging this. But I disagree it fixes the linked issue.

[ElvishJerricco]

@arianvp I agree but the point of this PR is to revert to the old behavior. There isn't a reasonable fix for the issue. These kernel modules do exist in linux on aarch64, so we can't just gate on the architecture. It's just the RPi kernel that doesn't have them. We'd have to be able to detect what kernel modules are available at eval time.