From 207ef83d4292140a27d684a16aeae815cffce261 Mon Sep 17 00:00:00 2001
From: Daniil Klimuk <daniil.klimuk@3mdeb.com>
Date: Thu, 22 Jan 2026 09:22:36 +0100
Subject: [PATCH] scripts: dasharo-deploy: quote variables in romhole_migration

Signed-off-by: Daniil Klimuk <daniil.klimuk@3mdeb.com>
---
 scripts/dasharo-deploy.sh | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/scripts/dasharo-deploy.sh b/scripts/dasharo-deploy.sh
index fd80e6e..6e147cc 100644
--- a/scripts/dasharo-deploy.sh
+++ b/scripts/dasharo-deploy.sh
@@ -571,26 +571,26 @@ romhole_migration() {
 
   # For Dasharo (coreboot+UEFI) ROMHOLE is located in flashmap. This covers
   # initial deployments and updates:
-  $CBFSTOOL layout_mock $BIOS_UPDATE_FILE layout -w 2>>"$ERR_LOG_FILE" | grep "ROMHOLE" &>>"$ERR_LOG_FILE"
+  $CBFSTOOL layout_mock "$BIOS_UPDATE_FILE" layout -w 2>>"$ERR_LOG_FILE" | grep "ROMHOLE" &>>"$ERR_LOG_FILE"
   [ $? -eq 0 ] && _romhole_destination="flashmap"
   # Sometimes ROMHOLE may be inside COREBOOT region (e.g. Dasharo
   # (coreboot+Heads)):
-  $CBFSTOOL layout_mock $BIOS_UPDATE_FILE print -r COREBOOT 2>>"$ERR_LOG_FILE" | grep msi_romhole.bin &>>"$ERR_LOG_FILE"
+  $CBFSTOOL layout_mock "$BIOS_UPDATE_FILE" print -r COREBOOT 2>>"$ERR_LOG_FILE" | grep msi_romhole.bin &>>"$ERR_LOG_FILE"
   [ $? -eq 0 ] && _romhole_destination="cbfs"
 
   # Read currently installed firmware for ROMHOLE dump.
-  $FLASHROM read_firm_mock -p "$PROGRAMMER_BIOS" ${FLASH_CHIP_SELECT} -r $_current_firm --ifd -i bios >>$FLASHROM_LOG_FILE 2>>$ERR_LOG_FILE
+  $FLASHROM read_firm_mock -p "$PROGRAMMER_BIOS" ${FLASH_CHIP_SELECT} -r "$_current_firm" --ifd -i bios >>$FLASHROM_LOG_FILE 2>>$ERR_LOG_FILE
   error_check "Failed to read current firmware to migrate ROMHOLE."
 
   if check_if_dasharo; then
     # Update of Dasharo firmware case:
 
     # Check if there is a ROMHOLE to be migrated in flashmap:
-    $CBFSTOOL layout_mock $_current_firm layout -w 2>>"$ERR_LOG_FILE" | grep "ROMHOLE" &>>"$ERR_LOG_FILE"
+    $CBFSTOOL layout_mock "$_current_firm" layout -w 2>>"$ERR_LOG_FILE" | grep "ROMHOLE" &>>"$ERR_LOG_FILE"
     if [ $? -ne 0 ]; then
       # In case the ROMHOLE is inside COREBOOT region - fail, because we do not
       # support ROMHOLE migration from CBFS:
-      $CBFSTOOL layout_mock $_current_firm print -r COREBOOT 2>>"$ERR_LOG_FILE" | grep msi_romhole.bin &>>"$ERR_LOG_FILE"
+      $CBFSTOOL layout_mock "$_current_firm" print -r COREBOOT 2>>"$ERR_LOG_FILE" | grep msi_romhole.bin &>>"$ERR_LOG_FILE"
       [ $? -eq 0 ] && error_exit "ROMHOLE migration from CBFS is not supported yet. Cannot migrate ROMHOLE."
 
       # If there is no ROMHOLE in flashmap and CBFS - then there is nothing to
@@ -600,11 +600,11 @@ romhole_migration() {
 
     # Dump ROMHOLE from currently installed firmware. Only dump from flashmap is
     # handled currently.
-    $CBFSTOOL read_romhole_mock $_current_firm read -r ROMHOLE -f $_romhole 2>>"$ERR_LOG_FILE"
+    $CBFSTOOL read_romhole_mock "$_current_firm" read -r ROMHOLE -f "$_romhole" 2>>"$ERR_LOG_FILE"
     error_check "Failed to migrate ROMHOLE."
   else
     # Initial deployment case:
-    dd if=$_current_firm of=$_romhole skip=$((0x17C0000)) bs=128K count=1 iflag=skip_bytes >/dev/null 2>>"$ERR_LOG_FILE"
+    dd if="$_current_firm" of="$_romhole" skip=$((0x17C0000)) bs=128K count=1 iflag=skip_bytes >/dev/null 2>>"$ERR_LOG_FILE"
   fi
 
   # If there is ROMHOLE to be migrated - we need to check if there is a region
@@ -616,19 +616,19 @@ romhole_migration() {
 
   # Migrate ROMHOLE depending on destination:
   if [[ "$_romhole_destination" == "flashmap" ]]; then
-    $CBFSTOOL "$BIOS_UPDATE_FILE" write -r ROMHOLE -f $_romhole -u 2>>"$ERR_LOG_FILE"
+    $CBFSTOOL "$BIOS_UPDATE_FILE" write -r ROMHOLE -f "$_romhole" -u 2>>"$ERR_LOG_FILE"
     error_check "Failed to migrate ROMHOLE."
   elif [[ "$_romhole_destination" == "cbfs" ]]; then
     # For CBFS case the ROMHOLE must be firstly deleted from the COREBOOT
     # regions and then written.
     $CBFSTOOL "$BIOS_UPDATE_FILE" remove -r COREBOOT -n msi_romhole.bin 2>>"$ERR_LOG_FILE"
     error_check "Failed to migrate ROMHOLE."
-    $CBFSTOOL "$BIOS_UPDATE_FILE" add -r COREBOOT -n msi_romhole.bin -f $_romhole -b 0xff7c0000 -t raw 2>>"$ERR_LOG_FILE"
+    $CBFSTOOL "$BIOS_UPDATE_FILE" add -r COREBOOT -n msi_romhole.bin -f "$_romhole" -b 0xff7c0000 -t raw 2>>"$ERR_LOG_FILE"
     error_check "Failed to migrate ROMHOLE."
   fi
 
   # Cleanup
-  rm -f $_romhole $_current_firm
+  rm -f "$_romhole" "$_current_firm"
 
   return 0
 }