|
| 1 | +use anyhow::Result; |
| 2 | +use chrono::{DateTime, TimeDelta, Utc}; |
| 3 | +use clap::Parser; |
| 4 | +use compute_pcrs_lib::*; |
| 5 | +use k8s_openapi::api::core::v1::ConfigMap; |
| 6 | +use kube::api::{ObjectMeta, PostParams}; |
| 7 | +use kube::{Api, Client}; |
| 8 | +use log::info; |
| 9 | +use serde::{Serialize, Serializer}; |
| 10 | +use std::collections::BTreeMap; |
| 11 | + |
| 12 | +fn primitive_date_time_to_str<S>(d: &DateTime<Utc>, s: S) -> Result<S::Ok, S::Error> |
| 13 | +where |
| 14 | + S: Serializer, |
| 15 | +{ |
| 16 | + s.serialize_str(&d.format("%Y-%m-%dT%H:%M:%SZ").to_string()) |
| 17 | +} |
| 18 | + |
| 19 | +/// Sync with Trustee |
| 20 | +/// reference_value_provider_service::reference_value::ReferenceValue |
| 21 | +/// (cannot import directly because its expiration doesn't serialize |
| 22 | +/// right) |
| 23 | +#[derive(Serialize)] |
| 24 | +struct ReferenceValue { |
| 25 | + pub version: String, |
| 26 | + pub name: String, |
| 27 | + #[serde(serialize_with = "primitive_date_time_to_str")] |
| 28 | + pub expiration: DateTime<Utc>, |
| 29 | + pub value: serde_json::Value, |
| 30 | +} |
| 31 | + |
| 32 | +#[derive(Parser)] |
| 33 | +#[command(version, about)] |
| 34 | +struct Args { |
| 35 | + /// Path to the kernel modules directory |
| 36 | + #[arg(short, long)] |
| 37 | + kernels: String, |
| 38 | + /// Path to the ESP directory |
| 39 | + #[arg(short, long)] |
| 40 | + esp: String, |
| 41 | + /// Path to the directory storing EFIVar files |
| 42 | + #[arg(short = 's', long)] |
| 43 | + efivars: String, |
| 44 | + /// Path to directory storing MokListRT, MokListTrustedRT and MokListXRT |
| 45 | + #[arg(short, long)] |
| 46 | + mokvars: String, |
| 47 | + /// ConfigMap name to write to |
| 48 | + #[arg(short, long)] |
| 49 | + configmap: String, |
| 50 | + /// Namespace to write ConfigMap to |
| 51 | + #[arg(short, long)] |
| 52 | + namespace: String, |
| 53 | +} |
| 54 | + |
| 55 | +#[tokio::main] |
| 56 | +async fn main() -> Result<()> { |
| 57 | + let args = Args::parse(); |
| 58 | + |
| 59 | + let mut pcrs: Vec<_> = [ |
| 60 | + compute_pcr4(&args.kernels, &args.esp, false, true), |
| 61 | + compute_pcr7(Some(&args.efivars), &args.esp, true), |
| 62 | + compute_pcr14(&args.mokvars), |
| 63 | + ] |
| 64 | + .iter() |
| 65 | + .map(|pcr| (format!("pcr{}", pcr.id), pcr.value.clone())) |
| 66 | + .collect(); |
| 67 | + pcrs.push(("svn".to_string(), "1".to_string())); |
| 68 | + |
| 69 | + let reference_values: Vec<_> = pcrs |
| 70 | + .iter() |
| 71 | + .map(|(name, value)| ReferenceValue { |
| 72 | + version: "0.1.0".to_string(), |
| 73 | + name: format!("tpm_{name}"), |
| 74 | + expiration: Utc::now() + TimeDelta::days(365), |
| 75 | + value: serde_json::Value::Array(vec![serde_json::Value::String(value.to_string())]), |
| 76 | + }) |
| 77 | + .collect(); |
| 78 | + let reference_values_json = serde_json::to_string(&reference_values)?; |
| 79 | + let data = BTreeMap::from([( |
| 80 | + "reference-values.json".to_string(), |
| 81 | + reference_values_json.to_string(), |
| 82 | + )]); |
| 83 | + |
| 84 | + let config_map = ConfigMap { |
| 85 | + metadata: ObjectMeta { |
| 86 | + name: Some(args.configmap.clone()), |
| 87 | + namespace: Some(args.namespace.clone()), |
| 88 | + ..Default::default() |
| 89 | + }, |
| 90 | + data: Some(data), |
| 91 | + ..Default::default() |
| 92 | + }; |
| 93 | + |
| 94 | + let client = Client::try_default().await?; |
| 95 | + let config_maps: Api<ConfigMap> = Api::namespaced(client, &args.namespace); |
| 96 | + match config_maps |
| 97 | + .create(&PostParams::default(), &config_map) |
| 98 | + .await |
| 99 | + { |
| 100 | + Ok(_) => info!("Create ConfigMap {}", args.configmap), |
| 101 | + Err(kube::Error::Api(ae)) if ae.code == 409 => { |
| 102 | + info!("ConfigMap {} already exists", args.configmap) |
| 103 | + } |
| 104 | + Err(e) => return Err(e.into()), |
| 105 | + } |
| 106 | + |
| 107 | + Ok(()) |
| 108 | +} |
0 commit comments