54 lines
1.6 KiB
Shell
54 lines
1.6 KiB
Shell
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
[[ $# -eq 2 ]] || {
|
||
|
|
echo "usage: arm-native-physical-once.sh <world-root> <recovery-root>" >&2
|
||
|
|
exit 64
|
||
|
|
}
|
||
|
|
[[ ${EUID} -eq 0 ]] || {
|
||
|
|
echo "must run as root" >&2
|
||
|
|
exit 77
|
||
|
|
}
|
||
|
|
|
||
|
|
world_root=$(readlink -f "$1")
|
||
|
|
recovery_root=$(readlink -f "$2")
|
||
|
|
/guanghu/bin/ghctl authorize "${world_root}" reboot_and_recover_bs_sh_005 \
|
||
|
|
>/dev/null
|
||
|
|
grep -q "menuentry 'Guanghu OS native one-time proof'.*'guanghu-native-once'" \
|
||
|
|
/boot/grub/grub.cfg
|
||
|
|
|
||
|
|
proof_before=$(mktemp)
|
||
|
|
trap 'rm -f "${proof_before}"' EXIT
|
||
|
|
dd if=/dev/vda of="${proof_before}" bs=512 skip=50 count=1 status=none
|
||
|
|
cmp -s "${proof_before}" <(head -c 512 /dev/zero)
|
||
|
|
|
||
|
|
grub-editenv /boot/grub/grubenv unset initrdfail prev_entry next_entry
|
||
|
|
grub-reboot guanghu-native-once
|
||
|
|
grub_state=$(grub-editenv /boot/grub/grubenv list)
|
||
|
|
grep -q '^next_entry=guanghu-native-once$' <<<"${grub_state}"
|
||
|
|
if grep -Eq '^(initrdfail|prev_entry)=' <<<"${grub_state}"; then
|
||
|
|
echo "stale GRUB fallback state remains" >&2
|
||
|
|
exit 65
|
||
|
|
fi
|
||
|
|
|
||
|
|
previous_boot_id=$(cat /proc/sys/kernel/random/boot_id)
|
||
|
|
observed_at=$(date --iso-8601=seconds)
|
||
|
|
cat >"${recovery_root}/ARMED-RECEIPT.hldp" <<EOF
|
||
|
|
schema: guanghu.native-physical-arm/v1
|
||
|
|
receipt_id: GH-OS-LAB-001-NATIVE-PHYSICAL-ARM-001
|
||
|
|
status: ARMED
|
||
|
|
observed_at: ${observed_at}
|
||
|
|
node_id: BS-SH-005
|
||
|
|
previous_linux_boot_id: ${previous_boot_id}
|
||
|
|
disk_proof_before:
|
||
|
|
lba: 50
|
||
|
|
state: EMPTY
|
||
|
|
grub:
|
||
|
|
entry_id: guanghu-native-once
|
||
|
|
next_entry: VERIFIED
|
||
|
|
stale_initrd_fallback_state: CLEARED
|
||
|
|
next_action: SYNC_AND_REBOOT
|
||
|
|
EOF
|
||
|
|
chmod 0400 "${recovery_root}/ARMED-RECEIPT.hldp"
|
||
|
|
sync
|
||
|
|
cat "${recovery_root}/ARMED-RECEIPT.hldp"
|