Skip to content

Commit 239b48e

Browse files
butler54claude
andcommitted
fix: correct initial_pcr to have 64 zeros (32 bytes)
SHA-256 produces 256 bits = 32 bytes = 64 hex characters. The initial PCR value was missing one zero. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1 parent 0123233 commit 239b48e

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

ansible/init-data-gzipper.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,15 +54,15 @@
5454
# This block runs a shell script that calculates a hash value (PCR8_HASH) derived from the contents of 'initdata.toml'.
5555
# The script performs the following steps:
5656
# 1. hash=$(sha256sum initdata.toml | cut -d' ' -f1): Computes the sha256 hash of 'initdata.toml' and assigns it to $hash.
57-
# 2. initial_pcr=000000000000000000000000000000000000000000000000000000000000000: Initializes a string of zeros as the initial PCR value.
57+
# 2. initial_pcr=0000000000000000000000000000000000000000000000000000000000000000: Initializes a string of zeros as the initial PCR value.
5858
# 3. PCR8_HASH=$(echo -n "$initial_pcr$hash" | xxd -r -p | sha256sum | cut -d' ' -f1): Concatenates initial_pcr and $hash, converts from hex to binary, computes its sha256 hash, and stores the result as PCR8_HASH.
5959
# 4. echo $PCR8_HASH: Outputs the PCR hash value.
6060
# The important part: The 'register: pcr8_hash' registers the **stdout of the command**, which is the value output by 'echo $PCR8_HASH', as 'pcr8_hash.stdout' in Ansible.
6161
# It does NOT register an environment variable, but rather the value actually printed by 'echo'.
6262
- name: Register init data pcr into a var
6363
ansible.builtin.shell: |
6464
hash=$(sha256sum "{{ rendered_path }}" | cut -d' ' -f1)
65-
initial_pcr=000000000000000000000000000000000000000000000000000000000000000
65+
initial_pcr=0000000000000000000000000000000000000000000000000000000000000000
6666
PCR8_HASH=$(echo -n "$initial_pcr$hash" | xxd -r -p | sha256sum | cut -d' ' -f1) && echo $PCR8_HASH
6767
register: pcr8_hash
6868

0 commit comments

Comments
 (0)