The install key inside the machine's TPM 2.0 chip. The chip makes the P-256 keypair and never lets the private half out, so a copied disk cannot prove it is the licensed machine.

The library drives the chip through tpm2-tools, each call under timeout, so a chip that hangs costs a refusal, not a stuck boot. The licence folder keeps key.pub and key.priv, the key as the chip exported it: the private part is sealed by the chip's own storage key, so it is useless on any other chip. They sit in the folder tpm_key, which appears whole by one rename after both are synced to disk. Each call recreates the chip's primary key, which the chip derives from its own seed and so is the same every time, loads the key under it, does its work in a fresh temporary folder, and flushes what it loaded.

opts:

• :dir: the licence folder (required);
• :tcti: how to reach the chip (default device:/dev/tpmrm0; the tests pass swtpm:port=<n>);
• :tools: the folder holding the tpm2_* programs (default: the PATH);
• :timeout_s: the limit on each call, 1 to 60 seconds (default 10).

Every failure answers an atom and logs the tool's output; no output ever holds key material, since the chip never releases it.