From b51850d65af432f08b22d09662bfab15ebbbd079 Mon Sep 17 00:00:00 2001
From: MrCode-2005 <vishnusajeev2005@gmail.com>
Date: Mon, 17 Aug 2026 22:29:19 +0530
Subject: [PATCH] internal/exec/stages/disks: guard against nil tang Thumbprint
 deref

This fixes a panic caused by an unchecked nil pointer dereference on
tang.Thumbprint when processing LUKS clevis configurations.
---
 internal/exec/stages/disks/luks.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/internal/exec/stages/disks/luks.go b/internal/exec/stages/disks/luks.go
index 72fde098b..7303e8643 100644
--- a/internal/exec/stages/disks/luks.go
+++ b/internal/exec/stages/disks/luks.go
@@ -329,9 +329,13 @@ func (s *stage) createLuks(config types.Config) error {
 								return fmt.Errorf("unmarshalling advertisement: %v", err)
 							}
 						}
+						thumbprint := ""
+						if tang.Thumbprint != nil {
+							thumbprint = *tang.Thumbprint
+						}
 						c.Pins.Tang = append(c.Pins.Tang, Tang{
 							URL:           tang.URL,
-							Thumbprint:    *tang.Thumbprint,
+							Thumbprint:    thumbprint,
 							Advertisement: adv,
 						})
 					}