1#!/bin/bash 2set -eo pipefail 3 4help=$(cat <<EOF 5Generate Tarball with Bios image and MANIFEST Script 6 7Generates a Bios image tarball from given file as input. 8Creates a MANIFEST for image verification and recreation 9Packages the image and MANIFEST together in a tarball 10 11usage: gen-bios-tar [OPTION] <Bios FILE>... 12 13Options: 14 -o, --out <file> Specify destination file. Defaults to 15 $(pwd)/obmc-bios.tar.gz if unspecified. 16 -s, --sign <path> Sign the image. The optional path argument specifies 17 the private key file. Defaults to the bash variable 18 PRIVATE_KEY_PATH if available, or else uses the 19 open-source private key in this script. 20 -m, --machine <name> Optionally specify the target machine name of this 21 image. 22 -v, --version <name> Specify the version of bios image file 23 -e, --extended <name> Specify the extended version of bios image file 24 -h, --help Display this help text and exit. 25EOF 26) 27 28################################################################# 29# It's the OpenBMC "public" private key (currently under 30# meta-phosphor/recipes-phosphor/flash/files/OpenBMC.priv): 31# https://gerrit.openbmc-project.xyz/c/openbmc/openbmc/+/8949/15/ 32# meta-phosphor/common/recipes-phosphor/flash/files/OpenBMC.priv 33# 34################################################################# 35private_key=$'-----BEGIN PRIVATE KEY----- 36MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDO7vWM6ZOylO6T 37lxDiRWgKCFauAxMVM4A7NmgZxfV73xqTzAtIzzF9CIKUEhqMT4LhNy1rU2oUUivH 384BZO2oC6yFafEPVla2oYAeWtXJmQTixYgJplKQCtLzFtb57DQJpl9Od0RVFC61yg 394LihsiENnRjncLPP7OkL68ssiELu+WxazDtewmVYQEHOMWQa2zDh9yrWsblLAyo4 40gsG9rdwWjqIUnZkoeJuT7zks4Jes4qAtQUuZhCxMcvwvOq8od3e4nLVFnyUOGMpE 41jdDDGddKh5e+9BJGqkfsLCT9UFTYi62Ifuxl1Gp963cZLapJS0CneHIrG3gapiCO 42ea4TH/xySfts2jpl7DnEIUo3Qs0rZrOLQDLVVXvRJvHdsVoZcSRCD8Jf0YTQ6tT7 43j3ejUOH8j3DGkgKRHGtH7yyCgmDyPYVQdEu3q4E1NBwODAyxppYGBqkwpSGRnf6q 44E6i5rQJuoPCm3rb9ZmoHVzeb8HW3ofYfNnZNuae/2LdEtJ/cFs8ILXP5AKiaKpmS 45H4GB8GUcgRMITGI1pcXhevO2wHi0ReJkme+m5GpuVIg9LpTs6YvvNoFeu6ux7up/ 46TjTa+Zdy3tLUZvvIIlS2Asu32uiGBFjZ2WiLeHq+ScaDsSyEJQkoYLqv+3MoPKhy 47iX4yanZCwG3yx68RDe9qQBt6WXqAEwIDAQABAoICAA6OxAqKQiA9lv0eEwuAC34t 48MP/j6ntC2MIRpUgu44K34tRD9gVEwjwEFb+Z+HEnhNMYQSM8RomwcDELBDa+63B4 49eJOPK1xbrqaKt6A3E/yRa1A8l+AG/uuwFr+WqyocSOBkVsYYvEtDaIxO0t5ZPDcL 50dr2NcbDuf0Sd7XiwC1lphaRrmr+jWGLZfmellN/IzMsQytw4u4rZ6aX5GO0hpoqV 51tTRTE/vDZFqHaVPNZw48ET2tysY9hKpKKpCeBcWIhg0gRSZlOEOiHdStz2JyVnGB 52UX0XCZQcFZw5TM7fUGC9jtM77qCJTYaXQpUsX77xQtalRA7hS1VAm6i6SbNBvE4j 53le2JWBmOCbh9A/Dqnxh/3R2ZpsbffMG3O4KLkObquP8QGsItxwZYm4Bo37/HS6ki 541Ilym014DUT1+mTybi+2TjlPgh2LeECo1lbgFRJ/p9Vs7TJV2jeVPKDHF72cVvp2 55Ly6dGQVtBPz7/HpvxwYA5TJstNWgiU1sZPwgVzhgeZEKt5DO3Da6DVoXt96/tHk4 56577MA9P4qYLJldq5rfFW3IeyGUjLZ1yLmmDWj2Hz2IQe/YqrHHQH5UO6xxhrjuCa 57FrAOv7wJxmmbhZ9AptmR0PnmTU79LM8gxyNY9nn0R+XMJd/3UvrrjzJWw+LUGdhC 58zG0pF0JGMb71wHwlmmUpAoIBAQDyUHAcpgWtCl70qVpHnAG6WnsRP6ZS0dtBjqnN 59l9GachlNLOyQHfKcs7Vj7dkrcumSTbZ7zzgsazQcwfJMEvVq2RS8iTrtKAq+yYmj 60uejaJ3gAuiaU5Shv9PL+P25zGlwJtqEADYjiSrzO1ZRgM1M31tlH7f0wjYIrV6LP 615P5HYFVDFujsiWY9oUZ+PFaCWPRQ2P47zF3ocbiqD9TbFSwNfq5B2WPLCURExQAh 62XT/GH8Devz2M79CWKjvDMQutZ8dcLZx6JNhpre5JoNbAxE2u9jIM++srSb41zArE 632lcy2tqNAWJV5jhFz5DZ451kvz7AKLaehWYj7D+TvX4V4UwpAoIBAQDanvWQCoop 64Loh5s5tYwHB/iFE+jzVvyrytfRcDIjrBaCDCQrObgh/fllk44h9DpKHbM4nYlMpU 65GXOsQCVkE/SiJakzeXfoecCJ3ebp+mlBILs79AWlfETJFLx1FKJQOQoraoICVFxx 66jcI/OvGlABRLvRYhNnq22//IgLlyKWfO0yS6FASIjriIjDwibKZqHt+DJ98Lv2d+ 671fsOw/Ai7e2e3nK0+2vmXusZAwpcPuTYb+5LOnHE7GbPecuM22BSTiUAekoHq3/k 68fdYw+od4B4BJB0bAnRVu7y+TQXRkZ462RvP05AYXUzudjknv48mFuBslrybr3f50 69aIwtFADeJrHbAoIBAQCYcEwnabaWZrjX+BZoiFd58eQMNNugrI7fzi06vrDJFdCf 70AY0NGRoAxPlvFTmTIOaZ+LO9bd5r60FMeiLBAwhLoKdv+HEOsysXXVhunM1FOKFA 7169rLvuJSlGmt0x/b35BZOABPNTSRD+15vVlrr75BmbL1kl2/BrcGJ0qwuOHS62KY 72IziDXejpCqV7UuAlfmqs1eYSnn3RdoFy0yTYcphVIQXlPSqPl5PQI5LyamRtcpp2 73Rx8ko9W4MneIUzmCbJA5iCQxny5aRWZsAXg4qwYn9JAGJRGMGQdFdsirkKRcxNvK 746zz+xydNm8gHmy7wK3QBlVtVnJxmKwDQI9zHTQYJAoIBAQDVKrXJ81zv9r1/3U8V 755N5MnACL/VtfW9FJYHU1ywR7XSrEAAHdGa42dwUcX++YJ0ji0YgRNFNsWTzesdVD 76lemsyQgIduIiPcUtKL9lWZOTu3SVasSurVLstllj1/DERDnUR4/o8ZUJ6+2Bddn0 77xvUDPKX9UH+rGSx4tnscA5+CnYJsJeSdunvYONTRxBsn0l6iJhhn/gPOOpsHtKnL 78hS9y/vfd3GFDST33L23EsFa3a7xwgdY460D8AIgnGij7V9Lgel0AyYp0ovZc34uD 79z9yYWI32dbRWbMZ40RPKaudOeDSbjlMaH0A7ymfxjqwKxI9D2VscFWNs4hv8QErw 80Uc6NAoIBAQCmWWyARU/x4m7K4vNAWjD2Qx6R7PAdLs/6ZBqWw0RSpRHlYr73Qggw 81dCK+LrsR0O7y1KW2WUfrJmzHEdFQEYcZ1vZWeN85dMLVhYmazSXlaIegRE4FmMUa 82DbzViUJA60Y4D/l6QWqdhxdZZe81QgqyLPXAv/e5esxRIi8yvEYhCx4pq7QtWYBm 83tvQnPaZd8emlKARivF2ecGDlWzhf4NotDDtFRT4jOHZKUC58uVjbiXJ445Vimqlb 84Da7noVGwDQ93Ib1qyAilzFY5gWDeMyCnSQpnlVRHQ/8vlwLDsZs1kVau6k8WlcpM 85JbmuCRNy7YvALVTzyQsQ4yw87BoONt1L 86-----END PRIVATE KEY----- 87' 88 89do_sign=false 90PRIVATE_KEY_PATH=${PRIVATE_KEY_PATH:-} 91private_key_path="${PRIVATE_KEY_PATH}" 92outfile="" 93machine="" 94version="" 95 96while [[ $# -gt 0 ]]; do 97 key="$1" 98 case $key in 99 -o|--out) 100 outfile="$2" 101 shift 2 102 ;; 103 -s|--sign) 104 do_sign=true 105 if [[ -n "${2}" && "${2}" != -* ]]; then 106 private_key_path="$2" 107 shift 2 108 else 109 shift 1 110 fi 111 ;; 112 -m|--machine) 113 machine="$2" 114 shift 2 115 ;; 116 -v|--version) 117 version="$2" 118 shift 2 119 ;; 120 -e|--extended) 121 extended="$2" 122 shift 2 123 ;; 124 -h|--help) 125 echo "$help" 126 exit 127 ;; 128 -*) 129 echo "Unrecognised option $1" 130 echo "$help" 131 exit 132 ;; 133 *) 134 file="$1" 135 shift 1 136 ;; 137 esac 138done 139 140if [ ! -f "${file}" ]; then 141 echo "${file} not found, Please enter a valid Bios image file" 142 echo "$help" 143 exit 1 144fi 145 146if [[ -z $version ]]; then 147 echo "Please provide version of image with -v option" 148 exit 1 149fi 150 151if [[ -z $outfile ]]; then 152 outfile=$(pwd)/obmc-bios.tar.gz 153else 154 if [[ $outfile != /* ]]; then 155 outfile=$(pwd)/$outfile 156 fi 157fi 158 159scratch_dir=$(mktemp -d) 160# Remove the temp directory on exit. 161# The files in the temp directory may contain read-only files, so add 162# --interactive=never to skip the prompt. 163trap '{ rm -r --interactive=never ${scratch_dir}; }' EXIT 164 165if [[ "${do_sign}" == true ]]; then 166 if [[ -z "${private_key_path}" ]]; then 167 private_key_path=${scratch_dir}/OpenBMC.priv 168 echo "${private_key}" > "${private_key_path}" 169 echo "Image is NOT secure!! Signing with the open private key!" 170 else 171 if [[ ! -f "${private_key_path}" ]]; then 172 echo "Couldn't find private key ${private_key_path}." 173 exit 1 174 fi 175 176 echo "Signing with ${private_key_path}." 177 fi 178 179 public_key_file=publickey 180 public_key_path=${scratch_dir}/$public_key_file 181 openssl pkey -in "${private_key_path}" -pubout -out "${public_key_path}" 182fi 183 184manifest_location="MANIFEST" 185files_to_sign="$manifest_location $public_key_file" 186 187# Go to scratch_dir 188cp "${file}" "${scratch_dir}" 189cd "${scratch_dir}" 190files_to_sign+=" $(basename "${file}")" 191 192echo "Creating MANIFEST for the image" 193echo -e "purpose=xyz.openbmc_project.Software.Version.VersionPurpose.Host\n\ 194version=$version" > $manifest_location 195 196if [[ -n "${extended}" ]]; then 197 echo -e "ExtendedVersion=\"${extended}\"" >> $manifest_location 198fi 199 200if [[ -n "${machine}" ]]; then 201 echo -e "MachineName=${machine}" >> $manifest_location 202fi 203 204if [[ "${do_sign}" == true ]]; then 205 private_key_name=$(basename "${private_key_path}") 206 key_type="${private_key_name%.*}" 207 echo KeyType="${key_type}" >> $manifest_location 208 echo HashType="RSA-SHA256" >> $manifest_location 209 210 for file in $files_to_sign; do 211 openssl dgst -sha256 -sign "${private_key_path}" -out "${file}.sig" "$file" 212 done 213 214 additional_files="*.sig" 215fi 216 217# shellcheck disable=SC2086 218# Do not quote the files variables since they list multiple files 219# and tar would assume to be a single file name within quotes 220tar -czvf $outfile $files_to_sign $additional_files 221echo "Bios image tarball is at $outfile" 222