mirror-ublue-os-akmods/fetch-kernel.sh

#!/usr/bin/bash

set ${CI:+-x} -euo pipefail

# ensures we pass a known dir for volume mount of output rpm files
KCWD=/tmp/kernel-cache
find "${KCWD}"

#shellcheck disable=SC2153
kernel_name="${KERNEL_NAME}"
#shellcheck disable=SC2153
kernel_version="${KERNEL_VERSION}"
#shellcheck disable=SC2153
kernel_flavor="${KERNEL_FLAVOR}"
build_tag="${KERNEL_BUILD_TAG:-latest}"

ARCH=$(uname -m)

dnf install -y --setopt=install_weak_deps=False dnf-plugins-core openssl
dnf -y install --setopt=install_weak_deps=False dracut rpmrebuild sbsigntools

case "$kernel_flavor" in
    "coreos"*|"main")
        ;;
    "longterm"*)
        dnf -y copr enable kwizart/kernel-"${kernel_flavor}"
        ;;
    "ogc"|"ogc-lts")
        ;;
    *)
        echo "unexpected kernel_flavor ${kernel_flavor} for query" >&2
        exit 1
        ;;
esac

if [[ "${kernel_flavor}" =~ "longterm" ]]; then
    dnf download -y --enablerepo="copr:copr.fedorainfracloud.org:kwizart:kernel-${kernel_flavor}" \
        kernel-longterm-"${kernel_version}" \
        kernel-longterm-core-"${kernel_version}" \
        kernel-longterm-modules-"${kernel_version}" \
        kernel-longterm-modules-core-"${kernel_version}" \
        kernel-longterm-modules-extra-"${kernel_version}" \
        kernel-longterm-devel-"${kernel_version}" \
        kernel-longterm-devel-matched-"${kernel_version}"
elif [[ "${kernel_flavor}" =~ ^ogc ]]; then
    ogc_image="${OGC_IMAGE:?OGC_IMAGE env var must be set}"
    dnf install -y --setopt=install_weak_deps=False jq skopeo

    # Fetch the OCI artifact and parse its manifest for kernel RPM filenames
    tmpdir=$(mktemp -d)
    skopeo copy "docker://${ogc_image}" "dir:${tmpdir}"
    manifest=$(<"${tmpdir}/manifest.json")
    needed_prefixes="^kernel-[0-9]+\.[0-9]|^kernel-core-|^kernel-devel-|^kernel-devel-matched-|^kernel-modules-[0-9]"

    while read -r layer; do
        title=$(echo "$layer" | jq -r '.annotations["org.opencontainers.image.title"]')
        digest=$(echo "$layer" | jq -r '.digest')
        if echo "$title" | grep -qE "$needed_prefixes"; then
            echo "Fetching ${title}..."
            blob_path="${tmpdir}/${digest#*:}"
            # Layer may be a tar wrapping the RPM, or the RPM itself
            if file "$blob_path" | grep -q "POSIX tar"; then
                tar xf "$blob_path" -C /
            else
                mv "$blob_path" "/${title}"
            fi
        fi
    done < <(echo "$manifest" | jq -c '.layers[]')
    rm -rf "$tmpdir"
else
    KERNEL_MAJOR_MINOR_PATCH=$(echo "$kernel_version" | cut -d '-' -f 1)
    KERNEL_RELEASE="$(echo "$kernel_version" | cut -d - -f 2 | rev | cut -d . -f 2- | rev)"
    BASE_URL="https://kojipkgs.fedoraproject.org//packages/kernel/${KERNEL_MAJOR_MINOR_PATCH}/${KERNEL_RELEASE}/${ARCH}"
    # Using curl instead of dnf download for https links
    for pkg in \
        kernel \
        kernel-core \
        kernel-modules \
        kernel-modules-core \
        kernel-modules-extra \
        kernel-devel \
        kernel-devel-matched \
        kernel-uki-virt; do
        curl -#fLO "${BASE_URL}/${pkg}-${kernel_version}.rpm"
    done
fi

if [[ ! -s "${KCWD}"/certs/private_key.priv ]]; then
    echo "WARNING: Using test signing key."
    cp "${KCWD}"/certs/private_key.priv{.test,}
    cp "${KCWD}"/certs/public_key.der{.test,}
fi

trap 'rm -rf "${KCWD}/certs" /etc/pki/kernel/private/private_key*.priv /etc/pki/kernel/public/public_key*.crt' EXIT SIGINT

PUBLIC_KEY_PATH="/etc/pki/kernel/public/public_key.crt"
PRIVATE_KEY_PATH="/etc/pki/kernel/private/private_key.priv"

openssl x509 -in "${KCWD}"/certs/public_key.der -out "${KCWD}"/certs/public_key.crt

install -Dm644 "${KCWD}"/certs/public_key.crt "$PUBLIC_KEY_PATH"
install -Dm644 "${KCWD}"/certs/private_key.priv "$PRIVATE_KEY_PATH"

ls -la /
if [[ "${kernel_flavor}" =~ ^ogc ]]; then
  dnf install -y \
      /"${kernel_name}-$kernel_version.rpm" \
      /"${kernel_name}-core-$kernel_version.rpm" \
      /"${kernel_name}-modules-$kernel_version.rpm"
else
  dnf install -y \
      /"${kernel_name}-$kernel_version.rpm" \
      /"${kernel_name}-core-$kernel_version.rpm" \
      /"${kernel_name}-modules-$kernel_version.rpm" \
      /"${kernel_name}-modules-core-$kernel_version.rpm" \
      /"${kernel_name}-modules-extra-$kernel_version.rpm"
fi

# Strip Signatures from non-fedora Kernels
if [[ ${kernel_flavor} =~ main|coreos ]]; then
    echo "Will not strip Fedora signature(s) from ${kernel_flavor} kernel."
else
    EXISTING_SIGNATURES="$(sbverify --list /usr/lib/modules/"$kernel_version"/vmlinuz | grep '^signature \([0-9]\+\)$' | sed 's/^signature \([0-9]\+\)$/\1/')" || true
    if [[ -n "$EXISTING_SIGNATURES" ]]; then
        for SIGNUM in $EXISTING_SIGNATURES; do
            echo "Found existing signature at signum $SIGNUM, removing..."
            sbattach --remove /usr/lib/modules/"${kernel_version}"/vmlinuz
        done
    fi
fi

# Sign Kernel with Key
sbsign --cert "$PUBLIC_KEY_PATH" --key "$PRIVATE_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz --output /usr/lib/modules/"${kernel_version}"/vmlinuz

# Verify Signatures
sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
if ! sbverify --cert "$PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
    exit 1
fi

rm -f "$PRIVATE_KEY_PATH"

if [[ ${DUAL_SIGN:-} == "true" ]]; then
    SECOND_PUBLIC_KEY_PATH="/etc/pki/kernel/public/public_key_2.crt"
    SECOND_PRIVATE_KEY_PATH="/etc/pki/kernel/private/public_key_2.priv"
    if [[ ! -s "${KCWD}"/certs/private_key_2.priv ]]; then
        echo "WARNING: Using test signing key."
        cp "${KCWD}"/certs/private_key_2.priv{.test,}
        cp "${KCWD}"/certs/public_key_2.der{.test,}
        find "${KCWD}"/certs/
    fi
    openssl x509 -in "${KCWD}"/certs/public_key_2.der -out "${KCWD}"/certs/public_key_2.crt
    install -Dm644 "${KCWD}"/certs/public_key_2.crt "$SECOND_PUBLIC_KEY_PATH"
    install -Dm644 "${KCWD}"/certs/private_key_2.priv "$SECOND_PRIVATE_KEY_PATH"
    sbsign --cert "$SECOND_PUBLIC_KEY_PATH" --key "$SECOND_PRIVATE_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz --output /usr/lib/modules/"${kernel_version}"/vmlinuz
    sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
    if ! sbverify --cert "$SECOND_PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
        exit 1
    fi
    rm -f "$SECOND_PRIVATE_KEY_PATH"
fi

ln -s / /tmp/buildroot

# Rebuild RPMs and Verify
rpmrebuild --notest-install --additional=--buildroot=/tmp/buildroot --batch "${kernel_name}-core-${kernel_version}"
rm -f /usr/lib/modules/"${kernel_version}"/vmlinuz
find /tmp
find /root
dnf reinstall -y /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm

# Verify Again
sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
if ! sbverify --cert "$PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
    exit 1
fi
if [[ "${DUAL_SIGN:-}" == "true" ]] && ! sbverify --cert "${SECOND_PUBLIC_KEY_PATH:-}" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
    exit 1
fi

# Make Temp Dir
mkdir -p "${KCWD}"/rpms

# Move RPMs over
mv /kernel-*.rpm "${KCWD}"/rpms
if [ -d /root/rpmbuild/RPMS/"$(uname -m)" ]; then
  mv /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm "${KCWD}"/rpms
fi

# Delete keys in /tmp if we decide to publish this later
rm -rf "${KCWD}"/certs