From c1f7133be790a972400ba63ca40f92ed699d216e Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Wed, 30 Sep 2026 08:54:59 +0100 Subject: Enable signed initrd and NvPCR measurements --- justfile | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'justfile') diff --git a/justfile b/justfile index daeb4f0..1299506 100644 --- a/justfile +++ b/justfile @@ -149,6 +149,21 @@ nix-daemon-update: _require-canonical test: @python3 -m unittest discover -s tests -v +# Check the signed UKIs and NvPCR configuration. Pass staged UKIs to omit boot checks. +[positional-arguments] +tpm-nvpcr-check +images: _require-host + @sudo /usr/bin/python3 scripts/tpm_nvpcr.py "$@" + +# Remove only this repo's obsolete zero-byte NvPCR masks after recovery is ready. +tpm-nvpcr-unmask: _require-host + @sudo /usr/bin/python3 scripts/tpm_nvpcr_unmask.py + +_require-host: + #!/usr/bin/env bash + set -eu + source just-lib.sh + _require_host + # ═══════════════════════════════════════════════════════════════════ # Updates # ═══════════════════════════════════════════════════════════════════ -- cgit v1.3.1