From c1f7133be790a972400ba63ca40f92ed699d216e Mon Sep 17 00:00:00 2001
From: sommerfeld <sommerfeld@sommerfeld.dev>
Date: Wed, 30 Sep 2026 08:54:59 +0100
Subject: Enable signed initrd and NvPCR measurements

---
 run_onchange_after_deploy-etc.sh.tmpl | 38 +++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

(limited to 'run_onchange_after_deploy-etc.sh.tmpl')

diff --git a/run_onchange_after_deploy-etc.sh.tmpl b/run_onchange_after_deploy-etc.sh.tmpl
index 50b0d98..021d81d 100755
--- a/run_onchange_after_deploy-etc.sh.tmpl
+++ b/run_onchange_after_deploy-etc.sh.tmpl
@@ -8,6 +8,41 @@
 set -eu
 
 cd "$CHEZMOI_SOURCE_DIR"
+if [ -f etc/kernel/uki.conf ]; then
+  systemd_version=$(pacman -Q systemd | awk '{ print $2 }')
+  ukify_version=$(pacman -Q systemd-ukify | awk '{ print $2 }')
+  if [ "$systemd_version" != "$ukify_version" ] || ! command -v ukify >/dev/null 2>&1; then
+    echo 'Install a systemd-ukify version that matches systemd before deploying NvPCR support.' >&2
+    exit 1
+  fi
+  if ! command -v sbverify >/dev/null 2>&1; then
+    echo 'Install sbsigntools before deploying NvPCR support.' >&2
+    exit 1
+  fi
+  if ! sudo test -s /etc/systemd/tpm2-pcr-private-key.pem ||
+     ! sudo test -s /etc/systemd/tpm2-pcr-public-key.pem ||
+     ! sudo test -s /boot/EFI/Linux/arch-linux-hardened-nvpcr-recovery.efi ||
+     ! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/etc.tar ||
+     ! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/arch-linux-hardened.efi ||
+     ! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/arch-linux-hardened-fallback.efi ||
+     ! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/arch-linux-lts.efi ||
+     ! sudo test -s /var/lib/dotfiles/tpm-nvpcr/backup/arch-linux-lts-fallback.efi ||
+     ! sudo sbverify --cert /var/lib/sbctl/keys/db/db.pem \
+       /boot/EFI/Linux/arch-linux-hardened-nvpcr-recovery.efi >/dev/null 2>&1; then
+    echo 'Create the PCR key pair, backup, and signed recovery UKI first. See docs/tpm-unlock.md.' >&2
+    exit 1
+  fi
+  if [ "$(sudo stat -c %U:%G:%a /etc/systemd/tpm2-pcr-private-key.pem)" != root:root:600 ] ||
+     ! sudo openssl pkey -in /etc/systemd/tpm2-pcr-private-key.pem -pubout 2>/dev/null |
+       sudo cmp -s /etc/systemd/tpm2-pcr-public-key.pem -; then
+    echo 'The root-owned PCR signing key pair is invalid or has unsafe permissions.' >&2
+    exit 1
+  fi
+  if sudo test -e /var/lib/dotfiles/tpm-nvpcr/rollback; then
+    echo 'NvPCR rollback is active. Restore the previous repo revision before applying.' >&2
+    exit 1
+  fi
+fi
 find etc -type f ! -name .ignore | while IFS= read -r src; do
   case "$src" in
     *.tmpl)
@@ -23,6 +58,9 @@ find etc -type f ! -name .ignore | while IFS= read -r src; do
     etc/systemd/system-sleep/*)
       sudo install -D -m 0755 -o root -g root "$src" "/${src}"
       ;;
+    etc/initcpio/install/*)
+      sudo install -D -m 0755 -o root -g root "$src" "/${src}"
+      ;;
     *)
       sudo install -D -m 0644 -o root -g root "$src" "/${src}"
       ;;
-- 
cgit v1.3.1