Compare commits
No commits in common. "03f5c95b33365f04e9e358e452db2f42cbd74c12" and "94105c2c4963daa0970c0d8e3c16733da046df66" have entirely different histories.
03f5c95b33
...
94105c2c49
3 changed files with 14 additions and 11 deletions
|
@ -18,10 +18,11 @@ fi
|
||||||
# Display usage information if input is from a terminal
|
# Display usage information if input is from a terminal
|
||||||
if [ -t 0 ]; then
|
if [ -t 0 ]; then
|
||||||
exec >&2
|
exec >&2
|
||||||
echo "$summary"
|
|
||||||
echo
|
echo
|
||||||
echo "Usage: \"zlevis-decrypt < file.jwe\""
|
echo "Usage: \"zlevis-decrypt < file.jwe\""
|
||||||
echo "Usage ZFS: \"zfs list -Ho tpm:jwe <pool> | zlevis-decrypt\""
|
echo "Usage ZFS: \"zfs list -Ho tpm:jwe <pool> | zlevis-decrypt\""
|
||||||
|
echo
|
||||||
|
echo "$summary"
|
||||||
exit 2
|
exit 2
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
@ -54,10 +55,9 @@ trap 'on_exit' EXIT
|
||||||
|
|
||||||
# Read the JWE protected header
|
# Read the JWE protected header
|
||||||
read -r -d . hdr
|
read -r -d . hdr
|
||||||
echo "$hdr" > "$tmp"/hdr
|
|
||||||
|
|
||||||
# Decode the JWE protected header
|
# Decode the JWE protected header
|
||||||
if ! jhd="$(jose b64 dec -i- < "$tmp"/hdr)"; then
|
if ! jhd="$(jose b64 dec -i- < <(echo "$hdr"))"; then
|
||||||
echo "Error decoding JWE protected header" >&2
|
echo "Error decoding JWE protected header" >&2
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
|
@ -21,6 +21,12 @@ fi
|
||||||
# Display usage information if input is from a terminal
|
# Display usage information if input is from a terminal
|
||||||
if [ -t 0 ]; then
|
if [ -t 0 ]; then
|
||||||
exec >&2
|
exec >&2
|
||||||
|
echo
|
||||||
|
echo "Usage: \"zlevis-encrypt '{\"property\":\"value\"}' < file.key > file.jwe\""
|
||||||
|
echo
|
||||||
|
echo "Usage ZFS: \"zfs set tpm:jwe=\$(zlevis-encrypt '{\"property\":\"value\"}' < tank.key) <pool>\""
|
||||||
|
echo
|
||||||
|
echo
|
||||||
echo "$summary"
|
echo "$summary"
|
||||||
echo
|
echo
|
||||||
echo "This command uses the following configuration properties:"
|
echo "This command uses the following configuration properties:"
|
||||||
|
@ -29,9 +35,6 @@ if [ -t 0 ]; then
|
||||||
echo " pcr_bank: <string> -> PCR algorithm bank to use for policy (default: first supported by TPM)."
|
echo " pcr_bank: <string> -> PCR algorithm bank to use for policy (default: first supported by TPM)."
|
||||||
echo " pcr_ids: <string> -> PCR list used for policy. If not present, no policy is used."
|
echo " pcr_ids: <string> -> PCR list used for policy. If not present, no policy is used."
|
||||||
echo " pcr_digest: <string> -> Binary PCR hashes encoded in base64. If not present, the hash values are looked up."
|
echo " pcr_digest: <string> -> Binary PCR hashes encoded in base64. If not present, the hash values are looked up."
|
||||||
echo
|
|
||||||
echo "Usage: \"zlevis-encrypt '{\"property\":\"value\"}' < file.key > file.jwe\""
|
|
||||||
echo "Usage ZFS: \"zfs set tpm:jwe=\$(zlevis-encrypt '{\"property\":\"value\"}' < tank.key) <pool>\""
|
|
||||||
exit 2
|
exit 2
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
@ -230,8 +233,8 @@ fi
|
||||||
jwe="$(jose fmt -j "$jwe" -g protected -g clevis -g tpm2 -q "$jwk_pub" -s jwk_pub -UUUUo-)"
|
jwe="$(jose fmt -j "$jwe" -g protected -g clevis -g tpm2 -q "$jwk_pub" -s jwk_pub -UUUUo-)"
|
||||||
jwe="$(jose fmt -j "$jwe" -g protected -g clevis -g tpm2 -q "$jwk_priv" -s jwk_priv -UUUUo-)"
|
jwe="$(jose fmt -j "$jwe" -g protected -g clevis -g tpm2 -q "$jwk_priv" -s jwk_priv -UUUUo-)"
|
||||||
|
|
||||||
# Output the final JWE
|
# Clean up the temporary directory at the end of the script
|
||||||
(echo "$jwe$jwk"; /bin/cat) | jose jwe enc -i- -k- -I- -c
|
[ -d "${tmp}" ] && rm -rf "${tmp}"
|
||||||
|
|
||||||
# Exit with the status of the last command
|
# Output the final JWE
|
||||||
exit $?
|
exec jose jwe enc -i- -k- -I- -c < <(echo -n "$jwe$jwk"; /bin/cat)
|
|
@ -17,7 +17,7 @@ zfs list -Ho name,encryption,keystatus,encryptionroot,tpm:jwe | while IFS=$'\t'
|
||||||
if echo -n "$jwe" | zlevis-decrypt | zfs load-key -L prompt "$ds"; then
|
if echo -n "$jwe" | zlevis-decrypt | zfs load-key -L prompt "$ds"; then
|
||||||
echo "Unlocked $ds"
|
echo "Unlocked $ds"
|
||||||
else
|
else
|
||||||
echo "Failed to unlock $ds" >&2
|
echo "FAILED TO UNLOCK $ds" >&2
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
Loading…
Reference in a new issue