From 6739045b173cc1be1f46bdf4b6167cbf9a883089 Mon Sep 17 00:00:00 2001
From: sommerfeld <sommerfeld@sommerfeld.dev>
Date: Wed, 30 Sep 2026 08:54:59 +0100
Subject: Require signed PCR 11 policy for TPM root unlock

---
 justfile | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'justfile')

diff --git a/justfile b/justfile
index 61c495e..a980ac5 100644
--- a/justfile
+++ b/justfile
@@ -154,6 +154,11 @@ test:
 tpm-nvpcr-check *images: _require-host
     @sudo /usr/bin/python3 scripts/tpm_nvpcr.py "$@"
 
+# Audit the combined LUKS TPM token. Use --trial until the old slot is removed.
+[positional-arguments]
+tpm-unlock-check *args: _require-host
+    @sudo /usr/bin/python3 -m scripts.tpm_unlock "$@"
+
 # Remove only this repo's obsolete zero-byte NvPCR masks after recovery is ready.
 tpm-nvpcr-unmask: _require-host
     @sudo /usr/bin/python3 scripts/tpm_nvpcr_unmask.py
-- 
cgit v1.3.1