From 76db86a22a23ccfed07d6160cfdab4ef60067ef0 Mon Sep 17 00:00:00 2001
From: sommerfeld <sommerfeld@sommerfeld.dev>
Date: Wed, 30 Sep 2026 08:54:59 +0100
Subject: Mask unused NvPCR measurements on the Arch host

---
 etc/mkinitcpio.conf.d/60-no-nvpcr.conf | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 etc/mkinitcpio.conf.d/60-no-nvpcr.conf

(limited to 'etc/mkinitcpio.conf.d/60-no-nvpcr.conf')

diff --git a/etc/mkinitcpio.conf.d/60-no-nvpcr.conf b/etc/mkinitcpio.conf.d/60-no-nvpcr.conf
new file mode 100644
index 0000000..06b94ff
--- /dev/null
+++ b/etc/mkinitcpio.conf.d/60-no-nvpcr.conf
@@ -0,0 +1,9 @@
+# Keep the unused NvPCR definitions and consumers masked in the initramfs.
+FILES+=(
+    /etc/nvpcr/cryptsetup.nvpcr
+    /etc/nvpcr/hardware.nvpcr
+    /etc/nvpcr/login.nvpcr
+    /etc/nvpcr/verity.nvpcr
+    /etc/systemd/system/systemd-pcrlogin@.service
+    /etc/systemd/system/systemd-pcrproduct.service
+)
-- 
cgit v1.3.1