冰朔
b7c8642057
Parameterize the raw recovery beacon, add one-time JD resident preparation and return verification, and provide an external ICMP peer for HLDP login, code, branch, and recovery commands.
68 lines
2.4 KiB
Shell
Executable file
68 lines
2.4 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
[[ $# -eq 2 ]] || {
|
|
echo "usage: clear-jd-native-probe-proof.sh <world-root> <recovery-root>" >&2
|
|
exit 64
|
|
}
|
|
[[ ${EUID} -eq 0 ]] || exit 77
|
|
|
|
world_root=$(readlink -f "$1")
|
|
recovery_root=$(readlink -f "$2")
|
|
grep -q '^node_id: JD-FD-PRIMARY$' "${world_root}/CURRENT.hldp"
|
|
grep -Eq '^status: (PASS_100|FAIL_0)$' \
|
|
"${recovery_root}/RETURN-RECEIPT.hldp"
|
|
grep -q '^ proof_lba: 134$' "${recovery_root}/RETURN-RECEIPT.hldp"
|
|
/guanghu/bin/ghctl authorize "${world_root}" \
|
|
write_bootloader_and_system_partitions >/dev/null
|
|
|
|
proof=${recovery_root}/lba134.native-proof.bin
|
|
expected_sha=$(awk '/^ proof_sha256:/ {print $2}' \
|
|
"${recovery_root}/RETURN-RECEIPT.hldp")
|
|
[[ ${expected_sha} =~ ^[0-9a-f]{64}$ ]]
|
|
[[ $(sha256sum "${proof}" | awk '{print $1}') == "${expected_sha}" ]]
|
|
candidate_sha=$(awk '/^ sha256:/ {print $2; exit}' \
|
|
"${recovery_root}/PREPARE-RECEIPT.hldp")
|
|
[[ ${candidate_sha} =~ ^[0-9a-f]{64}$ ]]
|
|
[[ $(dd if=/dev/vda bs=512 skip=105 count=29 status=none | sha256sum |
|
|
awk '{print $1}') == "${candidate_sha}" ]]
|
|
|
|
current_proof_sha=$(dd if=/dev/vda bs=512 skip=134 count=1 status=none |
|
|
sha256sum | awk '{print $1}')
|
|
zero_sector_sha=$(head -c 512 /dev/zero | sha256sum | awk '{print $1}')
|
|
if [[ ${current_proof_sha} != "${expected_sha}" ]]; then
|
|
grep -q "^ sealed_sha256: ${expected_sha}$" \
|
|
"${recovery_root}/PROOF-CLEAR-RECEIPT.hldp"
|
|
[[ ${current_proof_sha} == "${zero_sector_sha}" ]]
|
|
fi
|
|
|
|
dd if=/dev/zero of=/dev/vda bs=512 seek=105 count=30 conv=notrunc,fsync \
|
|
status=none
|
|
zero_range_sha=$(head -c $((30 * 512)) /dev/zero | sha256sum |
|
|
awk '{print $1}')
|
|
readback_sha=$(dd if=/dev/vda bs=512 skip=105 count=30 status=none |
|
|
sha256sum | awk '{print $1}')
|
|
[[ ${readback_sha} == "${zero_range_sha}" ]]
|
|
|
|
observed_at=$(date --iso-8601=seconds)
|
|
cat >"${recovery_root}/PROOF-CLEAR-RECEIPT.hldp" <<EOF
|
|
schema: guanghu.jd-native-probe-proof-clear/v1
|
|
receipt_id: GH-OS-JD-FD-PRIMARY-001-PROBE-PROOF-CLEAR
|
|
status: PASS_100
|
|
observed_at: ${observed_at}
|
|
node_id: JD-FD-PRIMARY
|
|
proof:
|
|
lba: 134
|
|
sealed_sha256: ${expected_sha}
|
|
candidate:
|
|
lba_start: 105
|
|
sector_count: 29
|
|
sealed_sha256: ${candidate_sha}
|
|
cleared_range:
|
|
lba_start: 105
|
|
sector_count: 30
|
|
zero_readback_sha256: ${readback_sha}
|
|
reason: SEALED_BINARY_PROBE_RESULT_CONSUMED_BEFORE_NEXT_NATIVE_GATE
|
|
EOF
|
|
chmod 0400 "${recovery_root}/PROOF-CLEAR-RECEIPT.hldp"
|
|
cat "${recovery_root}/PROOF-CLEAR-RECEIPT.hldp"
|