Show NvPCR check command errors

2 files changed, 14 insertions, 2 deletions

diff --git a/scripts/tpm_nvpcr.py b/scripts/tpm_nvpcr.py
index 14a250c..4f110fa 100644
--- a/scripts/tpm_nvpcr.py
+++ b/scripts/tpm_nvpcr.py
@@ -30,7 +30,11 @@ INITRD_UNITS = (
 
 
 def run(*command: str) -> str:
-    result = subprocess.run(command, capture_output=True, text=True, check=True)
+    try:
+        result = subprocess.run(command, capture_output=True, text=True, check=True)
+    except subprocess.CalledProcessError as exc:
+        detail = (exc.stderr or exc.stdout or "no error output").strip()
+        raise RuntimeError(f"{command[0]} exited {exc.returncode}: {detail}") from exc
     return result.stdout
 
 
@@ -142,6 +146,6 @@ def main() -> int:
 if __name__ == "__main__":
     try:
         sys.exit(main())
-    except (OSError, TypeError, ValueError, subprocess.CalledProcessError) as exc:
+    except (OSError, TypeError, ValueError, RuntimeError) as exc:
         print(f"NvPCR check failed: {exc}", file=sys.stderr)
         sys.exit(1)
diff --git a/tests/test_nvpcr.py b/tests/test_nvpcr.py
index 5f36bb7..02bafb1 100644
--- a/tests/test_nvpcr.py
+++ b/tests/test_nvpcr.py
@@ -83,6 +83,14 @@ def sections(public_key, *, policies=None, options=None):
 
 
 class NvPCRImageTests(unittest.TestCase):
+    def test_command_failure_reports_stderr(self):
+        error = subprocess.CalledProcessError(1, ["ukify"], stderr="file not found")
+        with (
+            mock.patch.object(tpm_nvpcr.subprocess, "run", side_effect=error),
+            self.assertRaisesRegex(RuntimeError, "ukify exited 1: file not found"),
+        ):
+            tpm_nvpcr.run("ukify", "inspect", "missing.efi")
+
     def test_initrd_has_required_units(self):
         listing = "\n".join(
             f"usr/lib/systemd/system/{unit}" for unit in tpm_nvpcr.INITRD_UNITS