diff --git a/man/systemd-pcrlock.xml b/man/systemd-pcrlock.xml
index 521f3a8bde..0a80d2488b 100644
--- a/man/systemd-pcrlock.xml
+++ b/man/systemd-pcrlock.xml
@@ -443,6 +443,14 @@
The following options are understood:
+
+
+
+ Show full hash value instead of abbreviating to 7 characters.
+
+
+
+
diff --git a/src/pcrlock/pcrlock.c b/src/pcrlock/pcrlock.c
index bdee629bc0..0effdd09e1 100644
--- a/src/pcrlock/pcrlock.c
+++ b/src/pcrlock/pcrlock.c
@@ -94,6 +94,8 @@ static BootEntryTokenType arg_entry_token_type = BOOT_ENTRY_TOKEN_AUTO;
static char *arg_entry_token = NULL;
static bool arg_varlink = false;
static bool arg_quiet = false;
+/* abbreviate to 7 chars, just like git */
+static size_t arg_abbreviate_hash = 7;
STATIC_DESTRUCTOR_REGISTER(arg_components, strv_freep);
STATIC_DESTRUCTOR_REGISTER(arg_pcrlock_path, freep);
@@ -2274,6 +2276,9 @@ static int show_log_table(EventLog *el, sd_json_variant **ret_variant) {
if (!hex)
return log_oom();
+ if (!sd_json_format_enabled(arg_json_format_flags))
+ strshorten(hex, arg_abbreviate_hash);
+
r = table_add_cell(table, NULL, TABLE_STRING, hex);
} else
r = table_add_cell(table, NULL, TABLE_EMPTY, NULL);
@@ -2422,6 +2427,9 @@ static int show_pcr_table(EventLog *el, sd_json_variant **ret_variant) {
if (!hex)
return log_oom();
+ if (!sd_json_format_enabled(arg_json_format_flags))
+ strshorten(hex, arg_abbreviate_hash);
+
r = table_add_many(table,
TABLE_STRING, hex,
TABLE_SET_COLOR, color);
@@ -2441,6 +2449,9 @@ static int show_pcr_table(EventLog *el, sd_json_variant **ret_variant) {
if (!hex)
return log_oom();
+ if (!sd_json_format_enabled(arg_json_format_flags))
+ strshorten(hex, arg_abbreviate_hash);
+
color = !hash_match ? ansi_highlight_red() :
is_unset_pcr(el->registers[pcr].banks[i].observed.buffer, el->registers[pcr].banks[i].observed.size) ? ansi_grey() : NULL;
@@ -5334,6 +5345,11 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
return r;
break;
+ OPTION_LONG("full", NULL,
+ "Print full hash in measurement log"):
+ arg_abbreviate_hash = SIZE_MAX;
+ break;
+
OPTION_LONG("raw-description", NULL,
"Show raw firmware record data as description in table"):
arg_raw_description = true;