sbu-sign-files.sh.in

#!/usr/bin/env bash

usage () {
	local old_xtrace
	old_xtrace="$(shopt -po xtrace || :)"
	set +o xtrace
	{
		echo "${script_name} - Sign EFI program files for use with EFI secure boot."
		echo "Usage: ${script_name} [flags] in-file [in-file]..."
		echo "Option flags:"
		echo "  -k --signing-key - Signing key file. Default: '${signing_key}'."
		echo "  -c --certificate - Certificate file. Default: '${cert_file}'."
		echo "  -o --out-dir     - Output directory. Default: '${out_dir}'."
#		echo "  -A --opt-A       - opt_A. Default: '${opt_A}'."
		echo "  -h --help        - Show this help and exit."
		echo "  -v --verbose     - Verbose execution."
		echo "  -g --debug       - Extra verbose execution."
		echo "Info:"
		echo '  @PACKAGE_NAME@ v@PACKAGE_VERSION@'
		echo '  @PACKAGE_URL@'
		echo "  Send bug reports to: Geoff Levand <geoff@infradead.org>."
	} >&2
	eval "${old_xtrace}"
}

process_opts() {
	local short_opts="k:c:o:A:hvg"
	local long_opts="signing-key:,certificate:,out-dir:,opt-A:,help,verbose,debug"

	local opts
	opts=$(getopt --options ${short_opts} --long ${long_opts} -n "${script_name}" -- "$@")

	eval set -- "${opts}"

	while true ; do
		# echo "${FUNCNAME[0]}: (${#}) '${*}'"
		case "${1}" in
		-k | --signing-key)
			signing_key="${2}"
			shift 2
			;;
		-c | --certificate)
			cert_file="${2}"
			shift 2
			;;
		-o | --out-dir)
			out_dir="${2}"
			shift 2
			;;
		-A | --opt-A)
			opt_A="${2}"
			shift 2
			;;
		-h | --help)
			usage=1
			shift
			;;
		-v | --verbose)
			verbose=1
			shift
			;;
		-g | --debug)
			verbose=1
			debug=1
			set -x
			shift
			;;
		--)
			shift
			in_files=("$@")
			break
			;;
		*)
			echo "${script_name}: ERROR: Internal opts: '${*}'" >&2
			exit 1
			;;
		esac
	done
}


#===============================================================================
export PS4='\[\e[0;33m\]+ ${BASH_SOURCE##*/}:${LINENO}:(${FUNCNAME[0]:-main}):\[\e[0m\] '


script_name="${0##*/}"
base_name="${script_name%.sh}"

real_source="$(realpath "${BASH_SOURCE}")"
SCRIPT_TOP="$(realpath "${SCRIPT_TOP:-${real_source%/*}}")"

start_time="$(date +%Y.%m.%d-%H.%M.%S)"
SECONDS=0

trap "on_exit 'Failed'" EXIT
trap 'on_err ${FUNCNAME[0]:-main} ${LINENO} ${?}' ERR
set -eE
set -o pipefail
set -o nounset

source "${SCRIPT_TOP}/sbu-lib.sh"
source "${SCRIPT_TOP}/tdd-lib/util.sh"

signing_key=''
cert_file=''
usage=''

process_opts "${@}"

out_dir="${out_dir:-/tmp/${base_name}-${start_time}}"
out_dir="$(realpath --canonicalize-missing "${out_dir}")"

if [[ ${usage} ]]; then
	usage
	trap - EXIT
	exit 0
fi

check_sb_progs

check_opt 'signing-key' "${signing_key}"
check_file "${signing_key}" ' (signing-key)' ''
check_if_signing_key "${signing_key}"

check_opt 'certificate' "${cert_file}"
check_file "${cert_file}" ' (certificate)' ''
check_if_certificate "${cert_file}"

check_in_files "${in_files[@]}"

mkdir -p "${out_dir}"

echo "${script_name} (Secure Boot Utils) - ${start_time}"
echo 'https://github.com/glevand/secure-boot-utils'
echo ''

for in_file in "${in_files[@]}"; do
	out_file="${out_dir}/${in_file##*/}.signed"

	echo '=================='
	echo "Processing '${in_file}'"
	echo '=================='
	echo ''
	"${sbsign}" --key "${signing_key}" --cert "${cert_file}" --output "${out_file}" "${in_file}"
	echo '------------------'
	"${sha256sum}" --tag "${out_file}"
	echo '------------------'
	"${sbverify}" --list "${out_file}"
	echo '------------------'
	"${sbverify}" --cert "${cert_file}" "${out_file}"
	echo '=================='
done
echo ''

echo "INFO: Signed files in '${out_dir}'" >&2

trap "on_exit 'Success.'" EXIT
exit 0