src/meson.build

@@ -2,13 +2,16 @@
 main = find_program('zlevis')
 encrypt = find_program('zlevis-encrypt')
 decrypt = find_program('zlevis-decrypt')
+fetch = find_program('zlevis-fetch')
 
 # Test the scripts
 test('zlevis', main, args: '--summary')
 test('zlevis-encrypt', encrypt, args: '--summary')
 test('zlevis-decrypt', decrypt, args: '--summary')
+test('zlevis-fetch', fetch, args: '--summary')
 
 # Add paths of scripts to bins
 bins += join_paths(meson.current_source_dir(), 'zlevis')
 bins += join_paths(meson.current_source_dir(), 'zlevis-encrypt')
 bins += join_paths(meson.current_source_dir(), 'zlevis-decrypt')
+bins += join_paths(meson.current_source_dir(), 'zlevis-fetch')

src/zlevis-fetch

@@ -0,0 +1,37 @@
+#!/bin/sh
+
+# Exit immediately if a command exits with a non-zero status
+set -e
+
+# Summary of the script's functionality
+summary="Decrypts a ZFS root pool with a TPM2.0 chip."
+
+# Display summary if requested
+if [ "$1" = "--summary" ]; then
+	echo "$summary"
+	exit 0
+fi
+
+# Check if zlevis-decrypt is present
+if ! command -v zlevis-decrypt > /dev/null; then
+	echo "Script zlevis-decrypt is not present"
+	exit 1
+fi
+
+# Read ZFS dataset information.
+zfs list -Ho name,encryption,keystatus,encryptionroot,tpm:jwe | while IFS=$'\t' read -r ds enc keystatus encroot jwe; do
+	# Check if the dataset is the encryption root.
+    if [ "$ds" = "$encroot" ] && [ "$enc" != "off" ] && [ "$jwe" != "-" ]; then
+        if [ "$keystatus" = "available" ]; then
+            echo "Pool $ds already unlocked"
+        else
+            echo "Loading key for $ds"
+            if echo -n "$jwe" | zlevis-decrypt | zfs load-key -L prompt "$ds"; then
+                echo "Unlocked $ds"
+            else
+                echo "Failed to unlock $ds" >&2
+		        exit 1
+            fi
+        fi
+    fi
+done