47 lines
1.7 KiB
Shell
47 lines
1.7 KiB
Shell
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
[[ $# -eq 2 ]] || {
|
||
|
|
echo "usage: clear-jd-native-probe-proof.sh <world-root> <recovery-root>" >&2
|
||
|
|
exit 64
|
||
|
|
}
|
||
|
|
[[ ${EUID} -eq 0 ]] || exit 77
|
||
|
|
|
||
|
|
world_root=$(readlink -f "$1")
|
||
|
|
recovery_root=$(readlink -f "$2")
|
||
|
|
grep -q '^node_id: JD-FD-PRIMARY$' "${world_root}/CURRENT.hldp"
|
||
|
|
grep -q '^status: FAIL_0$' "${recovery_root}/RETURN-RECEIPT.hldp"
|
||
|
|
grep -q '^ proof_lba: 134$' "${recovery_root}/RETURN-RECEIPT.hldp"
|
||
|
|
/guanghu/bin/ghctl authorize "${world_root}" \
|
||
|
|
write_bootloader_and_system_partitions >/dev/null
|
||
|
|
|
||
|
|
proof=${recovery_root}/lba134.native-proof.bin
|
||
|
|
expected_sha=$(awk '/^ proof_sha256:/ {print $2}' \
|
||
|
|
"${recovery_root}/RETURN-RECEIPT.hldp")
|
||
|
|
[[ ${expected_sha} =~ ^[0-9a-f]{64}$ ]]
|
||
|
|
[[ $(sha256sum "${proof}" | awk '{print $1}') == "${expected_sha}" ]]
|
||
|
|
[[ $(dd if=/dev/vda bs=512 skip=134 count=1 status=none | sha256sum |
|
||
|
|
awk '{print $1}') == "${expected_sha}" ]]
|
||
|
|
|
||
|
|
dd if=/dev/zero of=/dev/vda bs=512 seek=134 count=1 conv=notrunc,fsync \
|
||
|
|
status=none
|
||
|
|
zero_sha=$(head -c 512 /dev/zero | sha256sum | awk '{print $1}')
|
||
|
|
readback_sha=$(dd if=/dev/vda bs=512 skip=134 count=1 status=none |
|
||
|
|
sha256sum | awk '{print $1}')
|
||
|
|
[[ ${readback_sha} == "${zero_sha}" ]]
|
||
|
|
|
||
|
|
observed_at=$(date --iso-8601=seconds)
|
||
|
|
cat >"${recovery_root}/PROOF-CLEAR-RECEIPT.hldp" <<EOF
|
||
|
|
schema: guanghu.jd-native-probe-proof-clear/v1
|
||
|
|
receipt_id: GH-OS-JD-FD-PRIMARY-001-PROBE-PROOF-CLEAR
|
||
|
|
status: PASS_100
|
||
|
|
observed_at: ${observed_at}
|
||
|
|
node_id: JD-FD-PRIMARY
|
||
|
|
proof:
|
||
|
|
lba: 134
|
||
|
|
sealed_sha256: ${expected_sha}
|
||
|
|
zero_readback_sha256: ${readback_sha}
|
||
|
|
reason: SEALED_FAIL_0_CONSUMED_BEFORE_EXACT_HARDWARE_ADAPTER_RETRY
|
||
|
|
EOF
|
||
|
|
chmod 0400 "${recovery_root}/PROOF-CLEAR-RECEIPT.hldp"
|
||
|
|
cat "${recovery_root}/PROOF-CLEAR-RECEIPT.hldp"
|