Skip to content

Commit

Permalink
readme: move pcr calculation section to the end
Browse files Browse the repository at this point in the history
Signed-off-by: Paul Meyer <[email protected]>
  • Loading branch information
katexochen committed Sep 5, 2024
1 parent b7edeef commit 85df120
Showing 1 changed file with 29 additions and 29 deletions.
58 changes: 29 additions & 29 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,35 +37,6 @@ uplosi upload image.raw -i
- `-i`,`--increment-version`: increment version number after upload
- `-v`: version for uplosi

# Calculating TPM PCR Values

> [!WARNING]
> This command is highly experimental. It does not account for all PCRs and all possibilities of their measurements,
> is only tested in a very specific environment and should not be used in production use-cases.
Uplosi can also, from a given raw disk image, calculate TPM PCR values (Namely PCRs 4, 9, and 11)
ahead of the image boot to allow to craft remote attestation policies for images.
It requires `systemd-dissect` to be present in `$PATH`.

## Usage

```shell-session
sudo uplosi measurements <image> [flags]
```

### Examples

```shell-session
sudo uplosi measurements image.raw --output-file pcrs.json
```

### Flags

- `--output-file` string: path to a JSON file the output should be written to
- `--uki-path` string: path to the unified kernel image (UKI) within the ESP of the image (default: `/boot/EFI/BOOT/BOOTX64.EFI`)
- `-h`,`--help`: help for uplosi
- `-v`: version for uplosi

# Configuration

Uplosi requires configuration files in [TOML format](https://toml.io/en/) to be present in the user's workspace (CWD).
Expand Down Expand Up @@ -468,3 +439,32 @@ If set, prevents accidential deletion of the image.
- Required: no

Extra key-value pairs attached to the image. Example: `{"hw_firmware_type" = "uefi", "os_type" = "linux"}`.

# Calculating TPM PCR Values

> [!WARNING]
> This command is highly experimental. It does not account for all PCRs and all possibilities of their measurements,
> is only tested in a very specific environment and should not be used in production use-cases.
Uplosi can also, from a given raw disk image, calculate TPM PCR values (Namely PCRs 4, 9, and 11)
ahead of the image boot to allow to craft remote attestation policies for images.
It requires `systemd-dissect` to be present in `$PATH`.

## Usage

```shell-session
sudo uplosi measurements <image> [flags]
```

### Examples

```shell-session
sudo uplosi measurements image.raw --output-file pcrs.json
```

### Flags

- `--output-file` string: path to a JSON file the output should be written to
- `--uki-path` string: path to the unified kernel image (UKI) within the ESP of the image (default: `/boot/EFI/BOOT/BOOTX64.EFI`)
- `-h`,`--help`: help for uplosi
- `-v`: version for uplosi

0 comments on commit 85df120

Please sign in to comment.