# `Aker.InstallKey.Tpm`
[🔗](https://github.com/udin-io/aker/blob/v0.1.0/lib/aker/install_key/tpm.ex#L1)

The install key inside the machine's TPM 2.0 chip. The chip
makes the P-256 keypair and never lets the private half out, so a copied
disk cannot prove it is the licensed machine.

The library drives the chip through `tpm2-tools`, each call under `timeout`, so
a chip that hangs costs a refusal, not a stuck boot. The licence folder
keeps `key.pub` and `key.priv`, the key as the chip exported it:
the private part is sealed by the chip's own storage key, so it is useless
on any other chip. They sit in the folder `tpm_key`, which appears whole
by one rename after both are synced to disk. Each call recreates the chip's primary key, which the
chip derives from its own seed and so is the same every time, loads the
key under it, does its work in a fresh temporary folder, and flushes
what it loaded.

`opts`:

  * `:dir`: the licence folder (required);
  * `:tcti`: how to reach the chip (default `device:/dev/tpmrm0`; the
    tests pass `swtpm:port=<n>`);
  * `:tools`: the folder holding the `tpm2_*` programs (default: the
    `PATH`);
  * `:timeout_s`: the limit on each call, 1 to 60 seconds (default 10).

Every failure answers an atom and logs the tool's output; no output ever
holds key material, since the chip never releases it.

# `made_here?`

```elixir
@spec made_here?(Path.t()) :: boolean()
```

Whether the licence folder `dir` holds a key the chip made.

---

*Consult [api-reference.md](api-reference.md) for complete listing*