blob: 2890cb33a2b5bf43aa03d44108795ce7b05b03fc [file] [log] [blame]
Vijay Khemka18918692020-02-12 14:23:40 -08001#!/bin/bash
2set -eo pipefail
3
4help=$'Generate Tarball with Bios image and MANIFEST Script
5
6Generates a Bios image tarball from given file as input.
7Creates a MANIFEST for image verification and recreation
8Packages the image and MANIFEST together in a tarball
9
10usage: gen-bios-tar [OPTION] <Bios FILE>...
11
12Options:
13 -o, --out <file> Specify destination file. Defaults to
14 `pwd`/obmc-bios.tar.gz if unspecified.
15 -s, --sign <path> Sign the image. The optional path argument specifies
16 the private key file. Defaults to the bash variable
17 PRIVATE_KEY_PATH if available, or else uses the
18 open-source private key in this script.
19 -m, --machine <name> Optionally specify the target machine name of this
20 image.
21 -v, --version <name> Specify the version of bios image file
22 -h, --help Display this help text and exit.
23'
24
25#################################################################
26# It's the OpenBMC "public" private key (currently under
27# meta-phosphor/recipes-phosphor/flash/files/OpenBMC.priv):
28# https://gerrit.openbmc-project.xyz/c/openbmc/openbmc/+/8949/15/
29# meta-phosphor/common/recipes-phosphor/flash/files/OpenBMC.priv
30#
31#################################################################
32private_key=$'-----BEGIN PRIVATE KEY-----
33MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAPvSDLu6slkP1gri
34PaeQXL9ysD69J/HjbBCIQ0RPfeWBb75US1tRTjPP0Ub8CtH8ExVf8iF1ulsZA78B
35zIjBYZVp9pyD6LbpZ/hjV7rIH6dTNhoVpdA+F8LzmQ7cyhHG8l2JMvdunwF2uX5k
36D4WDcZt/ITKZNQNavPtmIyD5HprdAgMBAAECgYEAuQkTSi5ZNpAoWz76xtGRFSwU
37zUT4wQi3Mz6tDtjKTYXasiQGa0dHC1M9F8fDu6BZ9W7W4Dc9hArRcdzEighuxoI/
38nZI/0uL89iUEywnDEIHuS6D5JlZaj86/nx9YvQnO8F/seM+MX0EAWVrd5wC7aAF1
39h6Fu7ykZB4ggUjQAWwECQQD+AUiDOEO+8btLJ135dQfSGc5VFcZiequnKWVm6uXt
40rX771hEYjYMjLqWGFg9G4gE3GuABM5chMINuQQUivy8tAkEA/cxfy19XkjtqcMgE
41x/UDt6Nr+Ky/tk+4Y65WxPRDas0uxFOPk/vEjgVmz1k/TAy9G4giisluTvtmltr5
42DCLocQJBAJnRHx9PiD7uVhRJz6/L/iNuOzPtTsi+Loq5F83+O6T15qsM1CeBMsOw
43cM5FN5UeMcwz+yjfHAsePMkcmMaU7jUCQHlg9+N8upXuIo7Dqj2zOU7nMmkgvSNE
445yuNImRZabC3ZolwaTdd7nf5r1y1Eyec5Ag5yENV6JKPe1Xkbb1XKJECQDngA0h4
456ATvfP1Vrx4CbP11eKXbCsZ9OGPHSgyvVjn68oY5ZP3uPsIattoN7dE2BRfuJm7m
46F0nIdUAhR0yTfKM=
47-----END PRIVATE KEY-----
48'
49
50do_sign=false
Isaac Kurtha1d2f862022-01-31 14:10:31 -060051PRIVATE_KEY_PATH=${PRIVATE_KEY_PATH:-}
Vijay Khemka18918692020-02-12 14:23:40 -080052private_key_path="${PRIVATE_KEY_PATH}"
53outfile=""
54machine=""
55version=""
56
57while [[ $# -gt 0 ]]; do
58 key="$1"
59 case $key in
60 -o|--out)
61 outfile="$2"
62 shift 2
63 ;;
64 -s|--sign)
65 do_sign=true
Isaac Kurtha1d2f862022-01-31 14:10:31 -060066 if [[ -n "${2}" && "${2}" != -* ]]; then
Vijay Khemka18918692020-02-12 14:23:40 -080067 private_key_path="$2"
68 shift 2
69 else
70 shift 1
71 fi
72 ;;
73 -m|--machine)
74 machine="$2"
75 shift 2
76 ;;
77 -v|--version)
78 version="$2"
79 shift 2
80 ;;
81 -h|--help)
82 echo "$help"
83 exit
84 ;;
85 -*)
86 echo "Unrecognised option $1"
87 echo "$help"
88 exit
89 ;;
90 *)
91 file="$1"
92 shift 1
93 ;;
94 esac
95done
96
97if [ ! -f "${file}" ]; then
98 echo "${file} not found, Please enter a valid Bios image file"
99 echo "$help"
100 exit 1
101fi
102
103if [[ -z $version ]]; then
104 echo "Please provide version of image with -v option"
105 exit 1
106fi
107
108if [[ -z $outfile ]]; then
Isaac Kurtha1d2f862022-01-31 14:10:31 -0600109 outfile=$(pwd)/obmc-bios.tar.gz
Vijay Khemka18918692020-02-12 14:23:40 -0800110else
111 if [[ $outfile != /* ]]; then
Isaac Kurtha1d2f862022-01-31 14:10:31 -0600112 outfile=$(pwd)/$outfile
Vijay Khemka18918692020-02-12 14:23:40 -0800113 fi
114fi
115
Isaac Kurtha1d2f862022-01-31 14:10:31 -0600116scratch_dir=$(mktemp -d)
Vijay Khemka18918692020-02-12 14:23:40 -0800117# Remove the temp directory on exit.
118# The files in the temp directory may contain read-only files, so add
119# --interactive=never to skip the prompt.
Isaac Kurtha1d2f862022-01-31 14:10:31 -0600120trap '{ rm -r --interactive=never ${scratch_dir}; }' EXIT
Vijay Khemka18918692020-02-12 14:23:40 -0800121
122if [[ "${do_sign}" == true ]]; then
123 if [[ -z "${private_key_path}" ]]; then
124 private_key_path=${scratch_dir}/OpenBMC.priv
125 echo "${private_key}" > "${private_key_path}"
126 echo "Image is NOT secure!! Signing with the open private key!"
127 else
128 if [[ ! -f "${private_key_path}" ]]; then
129 echo "Couldn't find private key ${private_key_path}."
130 exit 1
131 fi
132
133 echo "Signing with ${private_key_path}."
134 fi
135
136 public_key_file=publickey
137 public_key_path=${scratch_dir}/$public_key_file
Isaac Kurtha1d2f862022-01-31 14:10:31 -0600138 openssl pkey -in "${private_key_path}" -pubout -out "${public_key_path}"
Vijay Khemka18918692020-02-12 14:23:40 -0800139fi
140
141manifest_location="MANIFEST"
142files_to_sign="$manifest_location $public_key_file"
143
144# Go to scratch_dir
Isaac Kurtha1d2f862022-01-31 14:10:31 -0600145cp "${file}" "${scratch_dir}"
Vijay Khemka18918692020-02-12 14:23:40 -0800146cd "${scratch_dir}"
Isaac Kurtha1d2f862022-01-31 14:10:31 -0600147files_to_sign+=" $(basename "${file}")"
Vijay Khemka18918692020-02-12 14:23:40 -0800148
149echo "Creating MANIFEST for the image"
150echo -e "purpose=xyz.openbmc_project.Software.Version.VersionPurpose.Host\n\
151version=$version" > $manifest_location
152
Isaac Kurtha1d2f862022-01-31 14:10:31 -0600153if [[ -n "${machine}" ]]; then
Vijay Khemka18918692020-02-12 14:23:40 -0800154 echo -e "MachineName=${machine}" >> $manifest_location
155fi
156
157if [[ "${do_sign}" == true ]]; then
158 private_key_name=$(basename "${private_key_path}")
159 key_type="${private_key_name%.*}"
160 echo KeyType="${key_type}" >> $manifest_location
161 echo HashType="RSA-SHA256" >> $manifest_location
162
163 for file in $files_to_sign; do
Isaac Kurtha1d2f862022-01-31 14:10:31 -0600164 openssl dgst -sha256 -sign "${private_key_path}" -out "${file}.sig" "$file"
Vijay Khemka18918692020-02-12 14:23:40 -0800165 done
166
167 additional_files="*.sig"
168fi
169
Glukhov Mikhail124e63b2022-08-04 10:16:29 +0300170# shellcheck disable=SC2086
171# Do not quote the files variables since they list multiple files
172# and tar would assume to be a single file name within quotes
173tar -czvf $outfile $files_to_sign $additional_files
Vijay Khemka18918692020-02-12 14:23:40 -0800174echo "Bios image tarball is at $outfile"