ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2025-01-29 15:44:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

initrd/bin/flash.sh: Remove '-s' "SHA-256" mode

Browse Source 
flash.sh had a special mode to read (like -r) and then sha256sum the
resulting file.  This is no different from just a read followed by a
sha256sum, and the only caller also had logic to sha256sum a cached
file anyway.

Just use flash.sh -r and sha256sum the result.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
This commit is contained in:
Jonathon Hall 2023-07-03 16:59:23 -04:00
parent 048bec6ebb
commit 75cb8a070f
No known key found for this signature in database
GPG Key ID: 1E9C3CA91AE25114
4 changed files with 8 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
initrd/bin/flash.sh
View File

@ -119,10 +119,6 @@ flash_rom() {
if [ "$READ" -eq 1 ]; then
flashrom $CONFIG_FLASHROM_OPTIONS -r "${ROM}" \
|| die "Backup to $ROM failed"
elif [ "$SHA" -eq 1 ]; then
flashrom $CONFIG_FLASHROM_OPTIONS -r "${ROM}" 1&>2 >/dev/null \
|| die "$ROM: Read failed"
sha256sum ${ROM} | cut -f1 -d ' '
else
cp "$ROM" /tmp/${CONFIG_BOARD}.rom
sha256sum /tmp/${CONFIG_BOARD}.rom
@ -154,24 +150,15 @@ flash_rom() {
if [ "$1" == "-c" ]; then
CLEAN=1
READ=0
SHA=0
ROM="$2"
elif [ "$1" == "-r" ]; then
CLEAN=0
READ=1
SHA=0
ROM="$2"
touch $ROM
elif [ "$1" == "-s" ]; then
CLEAN=0
READ=0
SHA=1
ROM="$2"
touch $ROM
else
CLEAN=0
READ=0
SHA=0
ROM="$1"
fi

2
initrd/bin/seal-hotpkey
View File

@ -39,7 +39,7 @@ if [ "$CONFIG_TPM" = "y" ]; then
|| fatal_error "Unable to unseal HOTP secret"
else
# without a TPM, use the first 20 characters of the ROM SHA256sum
secret_from_rom_hash > "$HOTP_SECRET"
secret_from_rom_hash > "$HOTP_SECRET" || die "Reading ROM failed"
fi
# Store counter in file instead of TPM for now, as it conflicts with Heads

2
initrd/bin/unseal-hotp
View File

@ -42,7 +42,7 @@ if [ "$CONFIG_TPM" = "y" ]; then
tpmr unseal 4d47 0,1,2,3,4,7 312 "$HOTP_SECRET"
else
# without a TPM, use the first 20 characters of the ROM SHA256sum
secret_from_rom_hash > "$HOTP_SECRET"
secret_from_rom_hash > "$HOTP_SECRET" || die "Reading ROM failed"
fi
if ! hotp $counter_value < "$HOTP_SECRET"; then

11
initrd/etc/functions
View File

@ -354,12 +354,13 @@ secret_from_rom_hash() {
local ROM_IMAGE="/tmp/coreboot-notpm.rom"
echo -e "\nTPM not detected; measuring ROM directly\n" 1>&2
# use a previously-copied image if it exists
if [ -f ${ROM_IMAGE} ]; then
sha256sum ${ROM_IMAGE} | cut -f1 -d ' ' | cut -c 1-20 | tr -d '\n'
else
flash.sh -s ${ROM_IMAGE} | cut -c 1-20 | tr -d '\n'
# Read the ROM if we haven't read it yet
if [ ! -f "${ROM_IMAGE}" ]; then
flash.sh -r "${ROM_IMAGE}" >/dev/null 2>&1 || return 1
fi
sha256sum ${ROM_IMAGE} | cut -f1 -d ' ' | cut -c 1-20 | tr -d '\n'
}
update_checksums()