From c1f7133be790a972400ba63ca40f92ed699d216e Mon Sep 17 00:00:00 2001
From: sommerfeld <sommerfeld@sommerfeld.dev>
Date: Wed, 30 Sep 2026 08:54:59 +0100
Subject: Enable signed initrd and NvPCR measurements

---
 etc/kernel/uki.conf | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 etc/kernel/uki.conf

(limited to 'etc/kernel/uki.conf')

diff --git a/etc/kernel/uki.conf b/etc/kernel/uki.conf
new file mode 100644
index 0000000..82b7801
--- /dev/null
+++ b/etc/kernel/uki.conf
@@ -0,0 +1,9 @@
+[UKI]
+PCRPKey=/etc/systemd/tpm2-pcr-public-key.pem
+PCRBanks=sha256
+
+[PCRSignature:initrd]
+PCRPrivateKey=/etc/systemd/tpm2-pcr-private-key.pem
+PCRPublicKey=/etc/systemd/tpm2-pcr-public-key.pem
+Phases=enter-initrd
+PolicyRef=initrd
-- 
cgit v1.3.1