1#!/bin/bash
2set -eo pipefail
3
4help=$(cat <<EOF
5Generate Tarball with Bios image and MANIFEST Script
6
7Generates a Bios image tarball from given file as input.
8Creates a MANIFEST for image verification and recreation
9Packages the image and MANIFEST together in a tarball
10
11usage: gen-bios-tar [OPTION] <Bios FILE>...
12
13Options:
14   -o, --out <file>       Specify destination file. Defaults to
15                          $(pwd)/obmc-bios.tar.gz if unspecified.
16   -s, --sign <path>      Sign the image. The optional path argument specifies
17                          the private key file. Defaults to the bash variable
18                          PRIVATE_KEY_PATH if available, or else uses the
19                          open-source private key in this script.
20   -m, --machine <name>   Optionally specify the target machine name of this
21                          image.
22   -v, --version <name>   Specify the version of bios image file
23   -e, --extended <name>  Specify the extended version of bios image file
24   -h, --help             Display this help text and exit.
25EOF
26)
27
28#################################################################
29# It's the OpenBMC "public" private key (currently under
30# meta-phosphor/recipes-phosphor/flash/files/OpenBMC.priv):
31# https://gerrit.openbmc-project.xyz/c/openbmc/openbmc/+/8949/15/
32# meta-phosphor/common/recipes-phosphor/flash/files/OpenBMC.priv
33#
34#################################################################
35private_key=$'-----BEGIN PRIVATE KEY-----
36MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDO7vWM6ZOylO6T
37lxDiRWgKCFauAxMVM4A7NmgZxfV73xqTzAtIzzF9CIKUEhqMT4LhNy1rU2oUUivH
384BZO2oC6yFafEPVla2oYAeWtXJmQTixYgJplKQCtLzFtb57DQJpl9Od0RVFC61yg
394LihsiENnRjncLPP7OkL68ssiELu+WxazDtewmVYQEHOMWQa2zDh9yrWsblLAyo4
40gsG9rdwWjqIUnZkoeJuT7zks4Jes4qAtQUuZhCxMcvwvOq8od3e4nLVFnyUOGMpE
41jdDDGddKh5e+9BJGqkfsLCT9UFTYi62Ifuxl1Gp963cZLapJS0CneHIrG3gapiCO
42ea4TH/xySfts2jpl7DnEIUo3Qs0rZrOLQDLVVXvRJvHdsVoZcSRCD8Jf0YTQ6tT7
43j3ejUOH8j3DGkgKRHGtH7yyCgmDyPYVQdEu3q4E1NBwODAyxppYGBqkwpSGRnf6q
44E6i5rQJuoPCm3rb9ZmoHVzeb8HW3ofYfNnZNuae/2LdEtJ/cFs8ILXP5AKiaKpmS
45H4GB8GUcgRMITGI1pcXhevO2wHi0ReJkme+m5GpuVIg9LpTs6YvvNoFeu6ux7up/
46TjTa+Zdy3tLUZvvIIlS2Asu32uiGBFjZ2WiLeHq+ScaDsSyEJQkoYLqv+3MoPKhy
47iX4yanZCwG3yx68RDe9qQBt6WXqAEwIDAQABAoICAA6OxAqKQiA9lv0eEwuAC34t
48MP/j6ntC2MIRpUgu44K34tRD9gVEwjwEFb+Z+HEnhNMYQSM8RomwcDELBDa+63B4
49eJOPK1xbrqaKt6A3E/yRa1A8l+AG/uuwFr+WqyocSOBkVsYYvEtDaIxO0t5ZPDcL
50dr2NcbDuf0Sd7XiwC1lphaRrmr+jWGLZfmellN/IzMsQytw4u4rZ6aX5GO0hpoqV
51tTRTE/vDZFqHaVPNZw48ET2tysY9hKpKKpCeBcWIhg0gRSZlOEOiHdStz2JyVnGB
52UX0XCZQcFZw5TM7fUGC9jtM77qCJTYaXQpUsX77xQtalRA7hS1VAm6i6SbNBvE4j
53le2JWBmOCbh9A/Dqnxh/3R2ZpsbffMG3O4KLkObquP8QGsItxwZYm4Bo37/HS6ki
541Ilym014DUT1+mTybi+2TjlPgh2LeECo1lbgFRJ/p9Vs7TJV2jeVPKDHF72cVvp2
55Ly6dGQVtBPz7/HpvxwYA5TJstNWgiU1sZPwgVzhgeZEKt5DO3Da6DVoXt96/tHk4
56577MA9P4qYLJldq5rfFW3IeyGUjLZ1yLmmDWj2Hz2IQe/YqrHHQH5UO6xxhrjuCa
57FrAOv7wJxmmbhZ9AptmR0PnmTU79LM8gxyNY9nn0R+XMJd/3UvrrjzJWw+LUGdhC
58zG0pF0JGMb71wHwlmmUpAoIBAQDyUHAcpgWtCl70qVpHnAG6WnsRP6ZS0dtBjqnN
59l9GachlNLOyQHfKcs7Vj7dkrcumSTbZ7zzgsazQcwfJMEvVq2RS8iTrtKAq+yYmj
60uejaJ3gAuiaU5Shv9PL+P25zGlwJtqEADYjiSrzO1ZRgM1M31tlH7f0wjYIrV6LP
615P5HYFVDFujsiWY9oUZ+PFaCWPRQ2P47zF3ocbiqD9TbFSwNfq5B2WPLCURExQAh
62XT/GH8Devz2M79CWKjvDMQutZ8dcLZx6JNhpre5JoNbAxE2u9jIM++srSb41zArE
632lcy2tqNAWJV5jhFz5DZ451kvz7AKLaehWYj7D+TvX4V4UwpAoIBAQDanvWQCoop
64Loh5s5tYwHB/iFE+jzVvyrytfRcDIjrBaCDCQrObgh/fllk44h9DpKHbM4nYlMpU
65GXOsQCVkE/SiJakzeXfoecCJ3ebp+mlBILs79AWlfETJFLx1FKJQOQoraoICVFxx
66jcI/OvGlABRLvRYhNnq22//IgLlyKWfO0yS6FASIjriIjDwibKZqHt+DJ98Lv2d+
671fsOw/Ai7e2e3nK0+2vmXusZAwpcPuTYb+5LOnHE7GbPecuM22BSTiUAekoHq3/k
68fdYw+od4B4BJB0bAnRVu7y+TQXRkZ462RvP05AYXUzudjknv48mFuBslrybr3f50
69aIwtFADeJrHbAoIBAQCYcEwnabaWZrjX+BZoiFd58eQMNNugrI7fzi06vrDJFdCf
70AY0NGRoAxPlvFTmTIOaZ+LO9bd5r60FMeiLBAwhLoKdv+HEOsysXXVhunM1FOKFA
7169rLvuJSlGmt0x/b35BZOABPNTSRD+15vVlrr75BmbL1kl2/BrcGJ0qwuOHS62KY
72IziDXejpCqV7UuAlfmqs1eYSnn3RdoFy0yTYcphVIQXlPSqPl5PQI5LyamRtcpp2
73Rx8ko9W4MneIUzmCbJA5iCQxny5aRWZsAXg4qwYn9JAGJRGMGQdFdsirkKRcxNvK
746zz+xydNm8gHmy7wK3QBlVtVnJxmKwDQI9zHTQYJAoIBAQDVKrXJ81zv9r1/3U8V
755N5MnACL/VtfW9FJYHU1ywR7XSrEAAHdGa42dwUcX++YJ0ji0YgRNFNsWTzesdVD
76lemsyQgIduIiPcUtKL9lWZOTu3SVasSurVLstllj1/DERDnUR4/o8ZUJ6+2Bddn0
77xvUDPKX9UH+rGSx4tnscA5+CnYJsJeSdunvYONTRxBsn0l6iJhhn/gPOOpsHtKnL
78hS9y/vfd3GFDST33L23EsFa3a7xwgdY460D8AIgnGij7V9Lgel0AyYp0ovZc34uD
79z9yYWI32dbRWbMZ40RPKaudOeDSbjlMaH0A7ymfxjqwKxI9D2VscFWNs4hv8QErw
80Uc6NAoIBAQCmWWyARU/x4m7K4vNAWjD2Qx6R7PAdLs/6ZBqWw0RSpRHlYr73Qggw
81dCK+LrsR0O7y1KW2WUfrJmzHEdFQEYcZ1vZWeN85dMLVhYmazSXlaIegRE4FmMUa
82DbzViUJA60Y4D/l6QWqdhxdZZe81QgqyLPXAv/e5esxRIi8yvEYhCx4pq7QtWYBm
83tvQnPaZd8emlKARivF2ecGDlWzhf4NotDDtFRT4jOHZKUC58uVjbiXJ445Vimqlb
84Da7noVGwDQ93Ib1qyAilzFY5gWDeMyCnSQpnlVRHQ/8vlwLDsZs1kVau6k8WlcpM
85JbmuCRNy7YvALVTzyQsQ4yw87BoONt1L
86-----END PRIVATE KEY-----
87'
88
89do_sign=false
90PRIVATE_KEY_PATH=${PRIVATE_KEY_PATH:-}
91private_key_path="${PRIVATE_KEY_PATH}"
92outfile=""
93machine=""
94version=""
95
96while [[ $# -gt 0 ]]; do
97  key="$1"
98  case $key in
99    -o|--out)
100      outfile="$2"
101      shift 2
102      ;;
103    -s|--sign)
104      do_sign=true
105      if [[ -n "${2}"  && "${2}" != -* ]]; then
106        private_key_path="$2"
107        shift 2
108      else
109        shift 1
110      fi
111      ;;
112    -m|--machine)
113      machine="$2"
114      shift 2
115      ;;
116    -v|--version)
117      version="$2"
118      shift 2
119      ;;
120    -e|--extended)
121      extended="$2"
122      shift 2
123      ;;
124    -h|--help)
125      echo "$help"
126      exit
127      ;;
128    -*)
129      echo "Unrecognised option $1"
130      echo "$help"
131      exit
132      ;;
133    *)
134      file="$1"
135      shift 1
136      ;;
137  esac
138done
139
140if [ ! -f "${file}" ]; then
141  echo "${file} not found, Please enter a valid Bios image file"
142  echo "$help"
143  exit 1
144fi
145
146if [[ -z $version ]]; then
147  echo "Please provide version of image with -v option"
148  exit 1
149fi
150
151if [[ -z $outfile ]]; then
152  outfile=$(pwd)/obmc-bios.tar.gz
153else
154  if [[ $outfile != /* ]]; then
155    outfile=$(pwd)/$outfile
156  fi
157fi
158
159scratch_dir=$(mktemp -d)
160# Remove the temp directory on exit.
161# The files in the temp directory may contain read-only files, so add
162# --interactive=never to skip the prompt.
163trap '{ rm -r --interactive=never ${scratch_dir}; }' EXIT
164
165if [[ "${do_sign}" == true ]]; then
166  if [[ -z "${private_key_path}" ]]; then
167    private_key_path=${scratch_dir}/OpenBMC.priv
168    echo "${private_key}" > "${private_key_path}"
169    echo "Image is NOT secure!! Signing with the open private key!"
170  else
171    if [[ ! -f "${private_key_path}" ]]; then
172      echo "Couldn't find private key ${private_key_path}."
173      exit 1
174    fi
175
176    echo "Signing with ${private_key_path}."
177  fi
178
179  public_key_file=publickey
180  public_key_path=${scratch_dir}/$public_key_file
181  openssl pkey -in "${private_key_path}" -pubout -out "${public_key_path}"
182fi
183
184manifest_location="MANIFEST"
185files_to_sign="$manifest_location $public_key_file"
186
187# Go to scratch_dir
188cp "${file}" "${scratch_dir}"
189cd "${scratch_dir}"
190files_to_sign+=" $(basename "${file}")"
191
192echo "Creating MANIFEST for the image"
193echo -e "purpose=xyz.openbmc_project.Software.Version.VersionPurpose.Host\n\
194version=$version" > $manifest_location
195
196if [[ -n "${extended}" ]]; then
197    echo -e "ExtendedVersion=\"${extended}\"" >> $manifest_location
198fi
199
200if [[ -n "${machine}" ]]; then
201    echo -e "MachineName=${machine}" >> $manifest_location
202fi
203
204if [[ "${do_sign}" == true ]]; then
205  private_key_name=$(basename "${private_key_path}")
206  key_type="${private_key_name%.*}"
207  echo KeyType="${key_type}" >> $manifest_location
208  echo HashType="RSA-SHA256" >> $manifest_location
209
210  for file in $files_to_sign; do
211    openssl dgst -sha256 -sign "${private_key_path}" -out "${file}.sig" "$file"
212  done
213
214  additional_files="*.sig"
215fi
216
217# shellcheck disable=SC2086
218# Do not quote the files variables since they list multiple files
219# and tar would assume to be a single file name within quotes
220tar -czvf $outfile $files_to_sign $additional_files
221echo "Bios image tarball is at $outfile"
222