From 8651f8f3700892c4e6febc7bfc1e87ce90ee1101 Mon Sep 17 00:00:00 2001
From: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
Date: Tue, 20 Sep 2022 14:59:58 +0200
Subject: [PATCH] vboot: add resign and generate_keys scripts

Signed-off-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
---
 .gitignore          |  2 ++
 common.sh           | 13 +++++++++++++
 vboot/generate_keys | 35 +++++++++++++++++++++++++++++++++++
 vboot/resign        | 43 +++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 93 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 common.sh
 create mode 100755 vboot/generate_keys
 create mode 100755 vboot/resign

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..bad1f5b
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+keys/
+*.rom
diff --git a/common.sh b/common.sh
new file mode 100644
index 0000000..5f66d9e
--- /dev/null
+++ b/common.sh
@@ -0,0 +1,13 @@
+#/usr/bin/env bash
+
+errorExit() {
+    errorMessage="$1"
+    echo "$errorMessage"
+    exit 1
+}
+
+errorCheck() {
+    errorCode=$?
+    errorMessage="$1"
+    [ "$errorCode" -ne 0 ] && errorExit "$errorMessage : ($errorCode)"
+}
diff --git a/vboot/generate_keys b/vboot/generate_keys
new file mode 100755
index 0000000..1566598
--- /dev/null
+++ b/vboot/generate_keys
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+source "${SCRIPT_DIR}/../common.sh"
+
+usage() {
+cat <<EOF
+
+This script generates keys for Verified Boot in the KEYS_DIRECTORY. Please refer
+to the Dasharo documentation for more information:
+https://docs.dasharo.com/common-coreboot-docs/vboot_signing/
+
+Usage: $0 KEYS_DIRECTORY
+
+  Arguments:
+    KEYS_DIRECTORY     path to directory where generated keys should be located
+
+Example usage:
+    $0 keys
+EOF
+  exit 0
+}
+
+KEYS_DIRECTORY="$(readlink -f $1)"
+
+[ -z "$KEYS_DIRECTORY" ] && echo "KEYS_DIRECTORY not given" && usage
+
+docker run --rm -it -v $PWD:$PWD -w $PWD \
+  ghcr.io/dasharo/dasharo-sdk:latest \
+  /vboot/scripts/keygeneration/create_new_keys.sh --output "$KEYS_DIRECTORY"
+
+errorCheck "Failed to generate keys"
+
+echo "The Verified Boot keys were generated into following directory: $KEYS_DIRECTORY"
diff --git a/vboot/resign b/vboot/resign
new file mode 100755
index 0000000..5d0ec9c
--- /dev/null
+++ b/vboot/resign
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+source "${SCRIPT_DIR}/../common.sh"
+
+usage() {
+cat <<EOF
+
+This script resigns (for Verified Boot) already signed INPUT_ROM with keys from
+KEYS_DIRECTORY for Verified Boot. Please refer to the Dasharo documentation for
+more information:
+https://docs.dasharo.com/common-coreboot-docs/vboot_signing/
+
+Usage: $0 INPUT_ROM KEYS_DIRECTORY
+
+  Arguments:
+    INPUT_ROM          path to the input firmware file
+    KEYS_DIRECTORY     path to directory where generated keys should be located
+
+Example usage:
+    $0 protectli_vault_cml_v1.0.16.rom keys
+EOF
+  exit 0
+}
+
+INPUT_ROM="$(readlink -f $1)"
+KEYS_DIRECTORY="$(readlink -f $2)"
+OUTPUT_ROM="${INPUT_ROM%.*}_resigned.rom"
+
+[ -z "$INPUT_ROM" ] && echo "INPUT_ROM not given" && usage
+[ -z "$KEYS_DIRECTORY" ] && echo "KEYS_DIRECTORY not given" && usage
+
+docker run --rm -it -v $PWD:$PWD -w $PWD \
+  ghcr.io/dasharo/dasharo-sdk:latest \
+  /vboot/scripts/image_signing/sign_firmware.sh \
+  "$INPUT_ROM" \
+  "$KEYS_DIRECTORY" \
+  "$OUTPUT_ROM"
+
+errorCheck "Failed to resign firmware file"
+
+echo "The $INPUT_ROM was resigned and saved as: $OUTPUT_ROM"