From 2772673455da499cb852d9cf921e49621a0ed6a4 Mon Sep 17 00:00:00 2001
From: sommerfeld <sommerfeld@sommerfeld.dev>
Date: Wed, 30 Sep 2026 08:54:59 +0100
Subject: Reduce ESP space needed for NvPCR deployment

---
 docs/tpm-unlock.md | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

(limited to 'docs')

diff --git a/docs/tpm-unlock.md b/docs/tpm-unlock.md
index be02edd..6a95ac7 100644
--- a/docs/tpm-unlock.md
+++ b/docs/tpm-unlock.md
@@ -190,9 +190,10 @@ is agreed. Stop if any command fails.
    Stop on any mismatch. The `systemd-pcrextend` socket and early setup units
    must be present in both initramfs variants.
 
-7. Copy the checked images to the ESP with temporary names, then rename them
-   into place. Do not reboot after a partial copy. Restore from the backup if
-   a copy or verification fails.
+7. Copy each checked image to the ESP under a temporary name, then rename it
+   into place before copying the next one. This needs space for only one extra
+   image at a time. Do not reboot after a partial copy. Restore from the backup
+   if a copy or verification fails.
 
    ```sh
    sudo bash -euo pipefail -c '
@@ -200,9 +201,6 @@ is agreed. Stop if any command fails.
        arch-linux-lts.efi arch-linux-lts-fallback.efi; do
        install -m 0644 "/var/lib/dotfiles/tpm-nvpcr/stage/$name" \
          "/boot/EFI/Linux/$name.next"
-     done
-     for name in arch-linux-hardened.efi arch-linux-hardened-fallback.efi \
-       arch-linux-lts.efi arch-linux-lts-fallback.efi; do
        mv -f "/boot/EFI/Linux/$name.next" "/boot/EFI/Linux/$name"
      done
    '
-- 
cgit v1.3.1