diff options
| author | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-09-30 08:54:59 +0100 |
|---|---|---|
| committer | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-09-30 08:54:59 +0100 |
| commit | 2772673455da499cb852d9cf921e49621a0ed6a4 (patch) | |
| tree | 5ea524bbfc6db6e6b1b2c31c2d06ceba812a8775 /docs/tpm-unlock.md | |
| parent | c1f7133be790a972400ba63ca40f92ed699d216e (diff) | |
| download | dotfiles-2772673455da499cb852d9cf921e49621a0ed6a4.tar.gz dotfiles-2772673455da499cb852d9cf921e49621a0ed6a4.tar.bz2 dotfiles-2772673455da499cb852d9cf921e49621a0ed6a4.zip | |
Reduce ESP space needed for NvPCR deployment
Diffstat (limited to 'docs/tpm-unlock.md')
| -rw-r--r-- | docs/tpm-unlock.md | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/docs/tpm-unlock.md b/docs/tpm-unlock.md index be02edd..6a95ac7 100644 --- a/docs/tpm-unlock.md +++ b/docs/tpm-unlock.md @@ -190,9 +190,10 @@ is agreed. Stop if any command fails. Stop on any mismatch. The `systemd-pcrextend` socket and early setup units must be present in both initramfs variants. -7. Copy the checked images to the ESP with temporary names, then rename them - into place. Do not reboot after a partial copy. Restore from the backup if - a copy or verification fails. +7. Copy each checked image to the ESP under a temporary name, then rename it + into place before copying the next one. This needs space for only one extra + image at a time. Do not reboot after a partial copy. Restore from the backup + if a copy or verification fails. ```sh sudo bash -euo pipefail -c ' @@ -200,9 +201,6 @@ is agreed. Stop if any command fails. arch-linux-lts.efi arch-linux-lts-fallback.efi; do install -m 0644 "/var/lib/dotfiles/tpm-nvpcr/stage/$name" \ "/boot/EFI/Linux/$name.next" - done - for name in arch-linux-hardened.efi arch-linux-hardened-fallback.efi \ - arch-linux-lts.efi arch-linux-lts-fallback.efi; do mv -f "/boot/EFI/Linux/$name.next" "/boot/EFI/Linux/$name" done ' |