#!/bin/sh
# Blackbox: bind this boot's SSH host key to an SEV-SNP attestation report.
#
# The initramfs is public and identical for every customer, so it cannot carry
# a host key. One is generated here, fresh for every boot, and its SHA-256 is
# placed in REPORT_DATA of a report signed by the CPU. A customer's SSH client
# shows that same SHA-256 as the host key fingerprint, so comparing the two,
# after checking the report's signature and measurement, proves the machine
# holding the key is a genuine SNP guest running exactly this image. Only then
# is it safe to type a passphrase into it.
PREREQ="udev"
prereqs() { echo "$PREREQ"; }
case "$1" in prereqs) prereqs; exit 0 ;; esac
. /scripts/functions

mkdir -p /run/bb
chmod 700 /run/bb
BB_KEY=""; BB_REL="unknown"; BB_HOST="blackbox"
for x in $(cat /proc/cmdline); do
    case "$x" in
        bb.key=*)     BB_KEY="${x#bb.key=}" ;;
        bb.release=*) BB_REL="${x#bb.release=}" ;;
        bb.host=*)    BB_HOST="${x#bb.host=}" ;;
    esac
done

# The only key allowed into this shell is the one on the measured command line.
mkdir -p /root-bb/.ssh
chmod 700 /root-bb /root-bb/.ssh
: > /root-bb/.ssh/authorized_keys
chmod 600 /root-bb/.ssh/authorized_keys
if [ -n "$BB_KEY" ]; then
    printf '%s' "$BB_KEY" | base64 -d > /root-bb/.ssh/authorized_keys 2>/dev/null || : > /root-bb/.ssh/authorized_keys
    echo >> /root-bb/.ssh/authorized_keys
fi

modprobe sev-guest 2>/dev/null || true
rm -f /etc/dropbear/dropbear_*_host_key
mkdir -p /etc/dropbear
dropbearkey -t ed25519 -f /etc/dropbear/dropbear_ed25519_host_key >/dev/null 2>&1
PUB=$(dropbearkey -y -f /etc/dropbear/dropbear_ed25519_host_key 2>/dev/null | grep '^ssh-ed25519 ' | head -1)
printf '%s' "$(printf '%s' "$PUB" | cut -d' ' -f2)" | base64 -d > /run/bb/hostkey.bin 2>/dev/null

STATUS="ok"
if [ -c /dev/sev-guest ]; then
    FP=$(snpreport /run/bb/hostkey.bin /run/bb/report.bin 2>/run/bb/snpreport.err) || { STATUS="report_failed"; FP=$(snpreport --fp /run/bb/hostkey.bin); }
else
    STATUS="not_confidential"
    FP=$(snpreport --fp /run/bb/hostkey.bin)
fi
REPORT=""
[ -s /run/bb/report.bin ] && REPORT=$(base64 /run/bb/report.bin | tr -d '\n')
CMDLINE=$(sed 's/\\/\\\\/g; s/"/\\"/g' /proc/cmdline | tr -d '\n')

cat > /run/bb/attest.json <<JSON
{"version": 1, "release": "$BB_REL", "status": "$STATUS", "hostkey": "$PUB", "fingerprint": "$FP", "report_b64": "$REPORT", "cmdline": "$CMDLINE"}
JSON
chmod 644 /run/bb/attest.json

{
    echo ""
    echo "== Blackbox measured boot =="
    echo "release: $BB_REL    status: $STATUS"
    echo "host key fingerprint: $FP"
    echo "  (must equal the fingerprint your SSH client just showed you)"
    echo "SEV-SNP attestation report, REPORT_DATA = SHA-256 of that host key:"
    if [ -n "$REPORT" ]; then echo "$REPORT" | fold -w 76; else echo "  NONE: this VM did not produce a report. Do not enter a passphrase."; fi
    echo ""
    echo "Verify before typing anything:  ssh root@$BB_HOST attest | blackbox-verify"
    echo ""
} > /run/bb/banner
chmod 644 /run/bb/banner
