#!/usr/bin/env bash
set -euo pipefail

CONFIG=/etc/cachyos-updater/secureboot.conf
if [[ -r "$CONFIG" ]]; then
    # Le fichier est installé et contrôlé par root.
    # shellcheck source=/dev/null
    source "$CONFIG"
fi

KEY=${SECURE_BOOT_KEY:-/root/secureboot-mok/MOK.key}
CERT=${SECURE_BOOT_CERT:-/root/secureboot-mok/MOK.crt}
ESP=${SECURE_BOOT_ESP:-/boot/efi}
SBAT=${SECURE_BOOT_SBAT:-/usr/share/grub/sbat.csv}
GRUB_MODULES="all_video bli boot chain configfile echo efi_gop efi_uga ext2 fat font gettext gfxmenu gfxterm gzio linux loadenv normal part_gpt part_msdos png search search_fs_uuid search_label terminal video video_bochs video_cirrus"

die() {
    echo "Secure Boot : $*" >&2
    exit 1
}

[[ $EUID -eq 0 ]] || die "le signer doit être exécuté en root"

for command in findmnt grub-install install sbverify sbsign; do
    command -v "$command" >/dev/null 2>&1 \
        || die "commande requise introuvable : $command"
done

[[ -r "$KEY" ]] || die "clé privée introuvable : $KEY"
[[ -r "$CERT" ]] || die "certificat introuvable : $CERT"
[[ -r "$SBAT" ]] || die "fichier SBAT introuvable : $SBAT"

if ! findmnt --mountpoint "$ESP" >/dev/null 2>&1; then
    echo "Secure Boot : montage de $ESP"
    mount "$ESP"
fi

ESP_FS=$(findmnt --noheadings --output FSTYPE --mountpoint "$ESP" | tr -d '[:space:]')
[[ "$ESP_FS" == "vfat" ]] \
    || die "$ESP n'est pas une partition EFI vfat montée (type : ${ESP_FS:-inconnu})"

if [[ ${1:-} == "--prepare" ]]; then
    echo "Secure Boot : pré-vérification réussie sur $ESP"
    exit 0
elif [[ $# -gt 0 ]]; then
    die "option inconnue : $1"
fi

sign_if_needed() {
    local file=$1
    local tmp

    [[ -f "$file" ]] || return 0
    if sbverify --cert "$CERT" "$file" >/dev/null 2>&1; then
        return 0
    fi

    tmp="${file}.signed.$$"
    trap 'rm -f "$tmp"' RETURN
    sbsign --key "$KEY" --cert "$CERT" --output "$tmp" "$file" >/dev/null
    chown --reference="$file" "$tmp"
    chmod --reference="$file" "$tmp"
    mv "$tmp" "$file"
    trap - RETURN
}

verify_signature() {
    local file=$1
    sbverify --cert "$CERT" "$file" >/dev/null 2>&1 \
        || die "signature MOK invalide : $file"
}

grub-install \
    --target=x86_64-efi \
    --efi-directory="$ESP" \
    --bootloader-id=CACHYOS \
    --modules="$GRUB_MODULES" \
    --sbat="$SBAT" \
    --no-nvram

install -d "$ESP/EFI/CACHYOS" "$ESP/EFI/BOOT"
for component in shimx64.efi mmx64.efi fbx64.efi; do
    [[ -r "/usr/share/shim-signed/$component" ]] \
        || die "composant shim introuvable : $component"
    install -m 0644 \
        "/usr/share/shim-signed/$component" \
        "$ESP/EFI/CACHYOS/${component^^}"
    install -m 0644 \
        "/usr/share/shim-signed/$component" \
        "$ESP/EFI/BOOT/${component^^}"
done

sign_if_needed "$ESP/EFI/CACHYOS/GRUBX64.EFI"
install -m 0644 \
    "$ESP/EFI/CACHYOS/GRUBX64.EFI" \
    "$ESP/EFI/BOOT/GRUBX64.EFI"

shopt -s nullglob
kernels=(/boot/vmlinuz-*)
[[ ${#kernels[@]} -gt 0 ]] || die "aucun noyau trouvé dans /boot"
for kernel in "${kernels[@]}"; do
    sign_if_needed "$kernel"
done

verify_signature "$ESP/EFI/CACHYOS/GRUBX64.EFI"
verify_signature "$ESP/EFI/BOOT/GRUBX64.EFI"
for kernel in "${kernels[@]}"; do
    verify_signature "$kernel"
done

sync
echo "Secure Boot : GRUB et ${#kernels[@]} noyau(x) signés et vérifiés"