The tmpea is a small go package that provides simple to use API to create and use mutable TPM policies. Mutable TPM policies allow you to store a secret in TPM with dynamic authorization policies instead of a fixed set of policies (for example static PCR values). The process work by binding polices with a asymmetric key and storing the key name (basically a hash the loaded public key object in TPM) as the Authorization Policy Digest filed of a TPM object (e.g. NV Index). Later on it is possible to read back the secret stored in the TPM object, using a policy that first) is signed with the authorization key and second) when evaluated in the TPM, it matches the current run-time state of the system.
A common way to store secrets in TPM is to bind a secret with a PCR policy and store in a TPM object, such a way that secret is revealed only when PCR values at run-time match the value of the good-know-state that is store the TPM object. This method stores the combined hash of PCR values of the good-know-state as the Authorization Policy Digest and therefore when there is PCR mismatch at run-time, it is not possible to neither read the secret nor update Authorization Policy Digest without destroying the object and losing access to its content.
This strict policy comes with a problem, for example during a system update some PCR values might change and therefore as expected TPM refuses to reveal the secret. In this scenario using mutable policies, we can simply generate a new policy (for example with predicted PCR values that we know system will end up with, after applying the update) and sign it with the authorization key. After a system update, using the new policy we can still read back the secret as long as the new policy is validly signed by the authorization key and holds true when evaluated at runtime (meaning predicted update PCR values in the policy match the current state of the system).
For more information read the documents on usage and testing.