#!/usr/bin/bash
#
# Script for injecting revocation certificates for a given
# package. Parts of this lifted from pesign

main() {
    local keyname="" || :
    local keyver=0 || :

    while [[ $# -ge 2 ]] ; do
	case " ${1} " in
	" --keyname ")
	    keyname="${2}"
	    ;;
	" --keyver ")
	    keyver="${2}"
	    ;;
	*)
	    break
	    ;;
	esac
	shift
	shift
    done

    if [[ $# -ge 1 ]] ; then
	echo "$# extra unparsed arguments!" >&2
	exit 1
    fi
    if [ -z "${keyname}" ] ; then
	echo "Missing --keyname argument" >&2
	exit 1
    fi

    if [ "${keyver}" -eq 0 ] 2>/dev/null ; then
	echo "Missing or invalid --keyver argument" >&2
	exit 1
    fi

    [ "${keyver}" -eq "${keyver}" ] 2>/dev/null
    if [ $? -ne 0 ] ; then
	echo "--keyver argument is not a number" >&2
	exit 1
    fi

    echo "Checking Secure Boot revocations..."

    local secure_boot
    secure_boot=$(efivar -p -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot -d)
    if [ $? -ne 0 ] ; then
	echo "Not a UEFI instance"
	exit 0
    fi
    if [ $secure_boot -ne 1 ] ; then
	echo "Secure Boot not enabled"
	exit 0
    fi

    # We can't inject an empty revocation, and this trips a kernel/UEFI issue
    # that locks the `db` completely until the next reboot if we try, so
    # check if the non-auth .esl file is empty first
    dbx_base="/usr/share/amazon-linux-sb-keys/dbx-updates/${keyname}-${keyver}.esl"
    if [ -s "$dbx_base" ] ; then
	echo "Injecting revocations for key ${keyname} version ${keyver}"
	# Note: efivar -a doesn't work when the variable doesn't exist so
	#       we use -w with the append flag set in the attributes
	if ! efivar -A 103 -n d719b2cb-3d3a-4596-a3bc-dad00e67656f-dbx -w -f "${dbx_base}.auth"; then
	    echo "Injection failed, revocations might already be present for that key"
	fi
    else
	echo "Skipping empty revocation update for key ${keyname} version ${keyver}"
    fi
}

main "${@}"