From 6739045b173cc1be1f46bdf4b6167cbf9a883089 Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Wed, 30 Sep 2026 08:54:59 +0100 Subject: Require signed PCR 11 policy for TPM root unlock --- run_onchange_after_deploy-etc.sh.tmpl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'run_onchange_after_deploy-etc.sh.tmpl') diff --git a/run_onchange_after_deploy-etc.sh.tmpl b/run_onchange_after_deploy-etc.sh.tmpl index 021d81d..03dc64e 100755 --- a/run_onchange_after_deploy-etc.sh.tmpl +++ b/run_onchange_after_deploy-etc.sh.tmpl @@ -21,15 +21,15 @@ if [ -f etc/kernel/uki.conf ]; then fi if ! sudo test -s /etc/systemd/tpm2-pcr-private-key.pem || ! sudo test -s /etc/systemd/tpm2-pcr-public-key.pem || - ! sudo test -s /boot/EFI/Linux/arch-linux-hardened-nvpcr-recovery.efi || ! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/etc.tar || ! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/arch-linux-hardened.efi || ! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/arch-linux-hardened-fallback.efi || ! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/arch-linux-lts.efi || ! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/arch-linux-lts-fallback.efi || + ! sudo test -s /boot/EFI/Linux/arch-linux-hardened.efi || ! sudo sbverify --cert /var/lib/sbctl/keys/db/db.pem \ - /boot/EFI/Linux/arch-linux-hardened-nvpcr-recovery.efi >/dev/null 2>&1; then - echo 'Create the PCR key pair, backup, and signed recovery UKI first. See docs/tpm-unlock.md.' >&2 + /boot/EFI/Linux/arch-linux-hardened.efi >/dev/null 2>&1; then + echo 'Check the PCR key pair, root-only backup, and signed main UKI. See docs/tpm-unlock.md.' >&2 exit 1 fi if [ "$(sudo stat -c %U:%G:%a /etc/systemd/tpm2-pcr-private-key.pem)" != root:root:600 ] || -- cgit v1.3.1