#!/bin/bash
set -u

KEY=/etc/raveos/secureboot/machine.key
CERT=/etc/raveos/secureboot/machine.pem
SIGNFILE=/usr/local/bin/raveos-sign-file
[[ -f "$KEY" && -f "$CERT" ]] || exit 0
command -v sbsign >/dev/null 2>&1 || exit 0

signed=0

for f in /boot/vmlinuz-* /boot/memtest86+/memtest.efi /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI; do
    [[ -f "$f" ]] || continue
    case "$f" in *.signed) continue ;; esac
    if sbverify --cert "$CERT" "$f" >/dev/null 2>&1; then
        continue
    fi
    if sbsign --key "$KEY" --cert "$CERT" --output "${f}.signed" "$f" 2>/dev/null; then
        mv "${f}.signed" "$f"
        signed=$((signed + 1))
    fi
done

if [[ -x "$SIGNFILE" ]]; then
    for d in /usr/lib/modules/*/; do
        for sub in extramodules updates/dkms extras; do
            [[ -d "${d}${sub}" ]] || continue
            while IFS= read -r -d '' f; do
                modinfo -F signer "$f" 2>/dev/null | grep -q "RaveOS Machine Key" && continue
                case "$f" in
                    *.ko)
                        "$SIGNFILE" sha512 "$KEY" "$CERT" "$f" >/dev/null 2>&1 && signed=$((signed + 1))
                        ;;
                    *.ko.zst)
                        tmp="$(mktemp -d)"
                        if zstd -q -d -c "$f" > "$tmp/m.ko" 2>/dev/null &&
                           "$SIGNFILE" sha512 "$KEY" "$CERT" "$tmp/m.ko" >/dev/null 2>&1 &&
                           zstd -q -f -o "$f" "$tmp/m.ko" 2>/dev/null; then
                            signed=$((signed + 1))
                        fi
                        rm -rf "$tmp"
                        ;;
                esac
            done < <(find "${d}${sub}" -type f \( -name '*.ko' -o -name '*.ko.zst' \) -print0 2>/dev/null)
        done
    done
fi

[ "$signed" -gt 0 ] && echo "[raveos-sb] $signed fajl ujraalairva"
exit 0