Compare commits

...

2 commits

Author SHA1 Message Date
Luc
e2135379d8 src/zlevis-encrypt: update 2025-02-14 23:48:04 +01:00
Luc
17eb015918 src/zlevis: restructured argument path structure 2025-02-14 23:46:19 +01:00
2 changed files with 54 additions and 21 deletions

View file

@ -12,31 +12,64 @@ if [ "$1" = "--summary" ]; then
exit 0 exit 0
fi fi
# Function to display usage information when called # Function to display usage information of zlevis
info() { info() {
exec >&2 exec >&2
echo "Usage: \"zlevis {decrypt|encrypt} {pool|key} [options]\"" echo "Usage: \"zlevis {decrypt|encrypt} {pool|key}\""
exit 2 exit 2
} }
# Case statement to handle the argument path # Function to display usage information of zlevis encrypt pool
case "$1" in encrypt_pool_info() {
"decrypt") exec >&2
case "$2" in echo "Usage: \"zlevis encrypt pool <pool> '{\"property\":\"value\"}' < file.key\""
"pool") zfs list -Ho tpm:jwe "$3" | zlevis-decrypt;; echo
"key") zlevis-decrypt;; echo "This command uses the following configuration properties:"
*) info;; echo " hash: <string> -> Hash algorithm used in the computation of the object name (default: sha256)."
esac echo " key: <string> -> Algorithm type for the generated key (default: ecc)."
;; echo " pcr_bank: <string> -> PCR algorithm bank to use for policy (default: first supported by TPM)."
"encrypt") echo " pcr_ids: <string> -> PCR list used for policy. If not present, no policy is used."
case "$2" in echo " pcr_digest: <string> -> Binary PCR hashes encoded in base64. If not present, the hash values are looked up."
"pool") read -r -d . key && zfs set tpm:jwe=$(printf "%s" "$key" | zlevis-encrypt "$4") "$3";; exit 2
"key") zlevis-encrypt "$3";; }
*) info;;
esac # Determine the argument path and execute the relevant script or function
;; if [ -t 0]; then
*) info;; case "$1" in
esac "decrypt")
case "$2" in
"pool") zfs list -Ho tpm:jwe "$3" | zlevis-decrypt;;
"key") zlevis-decrypt;;
*) info;;
esac
;;
"encrypt")
case "$2" in
"pool") encrypt_pool_info;;
"key") zlevis-encrypt;;
*) info;;
esac
;;
*) info;;
esac
else
case "$1" in
"decrypt")
case "$2" in
"key") zlevis-decrypt;;
*) info;;
esac
;;
"encrypt")
case "$2" in
"pool") read -r -d . key || zfs set tpm:jwe=$(printf "%s" "$key" | zlevis-encrypt "$4") "$3";;
"key") zlevis-encrypt "$3";;
*) info;;
esac
;;
*) info;;
esac
fi
# Exit with the status of the last command # Exit with the status of the last command
exit $? exit $?

View file

@ -66,7 +66,7 @@ fi
# Validate the configuration input # Validate the configuration input
if ! cfg="$(jose fmt -j "$1" -Oo- 2>/dev/null)"; then if ! cfg="$(jose fmt -j "$1" -Oo- 2>/dev/null)"; then
echo "Configuration '{\"property\":\"value\"}' is malformed" >&2 echo "Configuration '{\"property\":\"value\"}' is not present or malformed" >&2
exit 1 exit 1
fi fi