diff options
| author | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-09-30 08:54:59 +0100 |
|---|---|---|
| committer | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-09-30 08:54:59 +0100 |
| commit | e2801701c9256d3868df072ddf60d4c82c78dc17 (patch) | |
| tree | f9c7c3b41a2d7d5866bd449ae442ca3427b685c5 /docs | |
| parent | 2772673455da499cb852d9cf921e49621a0ed6a4 (diff) | |
| download | dotfiles-e2801701c9256d3868df072ddf60d4c82c78dc17.tar.gz dotfiles-e2801701c9256d3868df072ddf60d4c82c78dc17.tar.bz2 dotfiles-e2801701c9256d3868df072ddf60d4c82c78dc17.zip | |
Check NvPCR services in staged UKIs
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/tpm-unlock.md | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/docs/tpm-unlock.md b/docs/tpm-unlock.md index 6a95ac7..653b099 100644 --- a/docs/tpm-unlock.md +++ b/docs/tpm-unlock.md @@ -185,10 +185,10 @@ is agreed. Stop if any command fails. /var/lib/dotfiles/tpm-nvpcr/stage/arch-linux-lts-fallback.efi ``` - The check reads `.pcrpkey`, `.pcrsig`, and `.cmdline` using ukify, then - verifies each Secure Boot signature with the enrolled `sbctl` certificate. - Stop on any mismatch. The `systemd-pcrextend` socket and early setup units - must be present in both initramfs variants. + The check reads `.pcrpkey`, `.pcrsig`, and `.cmdline` using ukify. It uses + `lsinitcpio` to check the four required initrd units and verifies each + Secure Boot signature with the enrolled `sbctl` certificate. Stop on any + mismatch. 7. Copy each checked image to the ESP under a temporary name, then rename it into place before copying the next one. This needs space for only one extra |