#!/bin/bash

SB_CERTS_DIR=Secure_Boot_Certs
trap "exit" INT

if [ -d "$SB_CERTS_DIR" ]; then rm -fr "$SB_CERTS_DIR"; fi
mkdir -p $SB_CERTS_DIR;cd $SB_CERTS_DIR

function while_true {
while true; do
echo -e "\n  #   #   #      $*       #   #   #\n"
eval "$*" &> /dev/null
if [ $? == 0 ]
then
break
else
echo -e "\n   #     #       #       WRONG PASSWORD OR PASSWORDS DO NOT MUTCH! ! ! Try again!    #   #   #       \n"
fi
done
}

while_true "openssl genrsa -out PK-priv.key -aes-256-cfb -rand /var/log/messages 4096"
while_true "openssl genrsa -out KEK-priv.key -aes-256-cfb -rand /var/log/messages 4096"
while_true "openssl genrsa -out ISK-priv.key -aes-256-cfb -rand /var/log/messages 4096"
while_true "openssl req -x509 -subj \"/CN=PK pub auth/\" -key PK-priv.key -out PK-cert.x509 -days 3650"
while_true "openssl req -x509 -subj \"/CN=KEK pub auth/\" -key KEK-priv.key -out KEK-cert.x509 -days 3650"
while_true "openssl req -x509 -subj \"/CN=db auth/\" -key ISK-priv.key -out ISK-cert.x509 -days 3650"

cert-to-efi-sig-list PK-cert.x509 PK-cert.esl
cert-to-efi-sig-list KEK-cert.x509 KEK-cert.esl
cert-to-efi-sig-list ISK-cert.x509 ISK-cert.esl
#cat ISK-pub.esl MsWin0-pub.esl MsWin1-pub.esl > db.esl
cp ISK-cert.esl db.esl

echo "Teper' podpisyvaem PK samim soboj(PK-priv.key pass):"
while_true "sign-efi-sig-list -k PK-priv.key -c PK-cert.x509 PK PK-cert.esl PK-cert.auth"

echo "Podpisyvaem KEK.esl kljuchom PK(PK-priv.key pass):"
while_true "sign-efi-sig-list -k PK-priv.key -c PK-cert.x509 KEK KEK-cert.esl KEK-cert.auth"

echo "Podpisyvaem db.esl kljuchom KEK(KEK-priv.key pass):"
while_true "sign-efi-sig-list -k KEK-priv.key -c KEK-cert.x509 db db.esl db.auth"

#mount -o remount,rw /sys/firmware/efi/efivars
#efi-updatevar -f db.auth db
#efi-updatevar -f KEK-cert.auth KEK
#efi-updatevar -f PK-cert.auth PK
#echo "Ostalos' podpisat' kakoj-nibud' ispolnjaemyj fajl kljuchom ISK:"
#sbsign --key $SD_CERTS_DIR/ISK-priv.key --cert $SD_CERTS_DIR/ISK-cert.x509 --output /boot/EFI/BOOT/BOOTX64.EFI /usr/src/linux/arch/x86_64/boot/bzImage
#sbsign --key $SD_CERTS_DIR/ISK-priv.key --cert $SD_CERTS_DIR/ISK-cert.x509 --output /tmp/winbootef00/EFI/Microsoft/Boot/bootmgfw.efi /tmp/winbootef00/EFI/Microsoft/Boot/bootmgfw.efi      ##WINDOWS