#!/bin/bash

set -eux

os="${1:-fedora}"
cd "${0%/*}"

../common/check-config

if [ "${os}" != 'fedora' ]; then
    echo '*** only fedora is supported'
    false
fi

cargo build --release

cp ../../target/release/cfsctl .
cp ../../target/release/composefs-setup-root extra/usr/lib/dracut/modules.d/37composefs/
CFSCTL='./cfsctl --repo tmp/sysroot/composefs'

rm -rf tmp
rm -rf tmp/efi tmp/sysroot/composefs/images
${CFSCTL} init --algorithm=fsverity-sha256-12 --erofs-version 1

# See: https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot
# Alternative to generate keys for testing: `sbctl create-keys`
if [[ ! -d "secureboot" ]]; then
    echo "Generating test Secure Boot keys"
    mkdir secureboot
    pushd secureboot > /dev/null
    uuidgen --random > GUID.txt
    openssl req -newkey rsa:4096 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Platform Key/" -out PK.crt
    openssl x509 -outform DER -in PK.crt -out PK.cer
    openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Key Exchange Key/" -out KEK.crt
    openssl x509 -outform DER -in KEK.crt -out KEK.cer
    openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Signature Database key/" -out db.crt
    openssl x509 -outform DER -in db.crt -out db.cer
    popd > /dev/null
fi

# For debugging, add --no-cache to podman command
mkdir -p tmp/internal-sysroot
podman build \
    --iidfile=tmp/iid \
    -v "${PWD}/tmp/internal-sysroot:/tmp/sysroot:z,U" \
    --secret=id=key,src=secureboot/db.key \
    --secret=id=cert,src=secureboot/db.crt \
    .

IMAGE_ID="$(cat tmp/iid)"
${CFSCTL} oci pull containers-storage:"${IMAGE_ID}"
${CFSCTL} oci prepare-boot "@${IMAGE_ID}" --bootdir tmp/efi

# install a signed copy of systemd-boot
mkdir -p tmp/efi/loader
echo 'timeout 1' > tmp/efi/loader/loader.conf
mkdir -p tmp/efi/EFI/BOOT tmp/efi/EFI/systemd
sbsign --key secureboot/db.key --cert secureboot/db.crt \
    /usr/lib/systemd/boot/efi/systemd-bootx64.efi \
    --output tmp/efi/EFI/systemd/systemd-bootx64.efi
cp tmp/efi/EFI/{systemd/systemd-bootx64.efi,BOOT/BOOTX64.EFI}

../common/make-image fedora-unified-secureboot-efi.qcow2
