Allow no-argument NvPCR boot check

2 files changed, 11 insertions, 1 deletions

diff --git a/justfile b/justfile
index 1299506..61c495e 100644
--- a/justfile
+++ b/justfile
@@ -151,7 +151,7 @@ test:
 
 # Check the signed UKIs and NvPCR configuration. Pass staged UKIs to omit boot checks.
 [positional-arguments]
-tpm-nvpcr-check +images: _require-host
+tpm-nvpcr-check *images: _require-host
     @sudo /usr/bin/python3 scripts/tpm_nvpcr.py "$@"
 
 # Remove only this repo's obsolete zero-byte NvPCR masks after recovery is ready.
diff --git a/tests/test_nvpcr.py b/tests/test_nvpcr.py
index 02bafb1..57b3c81 100644
--- a/tests/test_nvpcr.py
+++ b/tests/test_nvpcr.py
@@ -12,6 +12,16 @@ ROOT = Path(__file__).resolve().parents[1]
 
 
 class NvPCRConfigTests(unittest.TestCase):
+    def test_check_recipe_accepts_no_images_or_one_image(self):
+        for images in ((), ("candidate.efi",)):
+            output = subprocess.check_output(
+                ["just", "--dry-run", "tpm-nvpcr-check", *images],
+                cwd=ROOT,
+                stderr=subprocess.STDOUT,
+                text=True,
+            )
+            self.assertIn("scripts/tpm_nvpcr.py", output)
+
     def test_hook_adds_required_initrd_services(self):
         hook = ROOT / "etc/initcpio/install/nvpcr"
         output = subprocess.check_output(