Initcpio TPM attestation hook

Verify system integrity after start (before decrypting the system partition).

Intended to be used with the associated android app.

Setup

1. Clone this repository
2. Build and install this package using makepkg -si
3. Enable this initcpio hook in /etc/mkinitcpio.conf and regenerate the initrd using mkinitcpio
4. Run ./enroll.sh
5. Add the displayed public key to the android app

Enabling the hook

The following is an example of how to enable the hook in /etc/mkinitcpio.conf. It must be added after the keyboard and keymap hooks (they need to be added if they are not already enabled).

- HOOKS=(base udev autodetect microcode modconf kms keyboard keymap block filesystems fsck)
+ HOOKS=(base udev autodetect microcode modconf kms keyboard keymap block attest filesystems fsck)