#!/usr/bin/env bash
# ─────────────────────────────────────────────────────────────────────────────
# Arcline OS — secure boot: MOK key generation
#
#   scripts/secureboot/gen-keys.sh [--keydir build/keys]
#
# Generates a Machine Owner Key (MOK) signing keypair for self-signing the
# kernel and EFI boot chain. MOK is the pragmatic secure-boot path for a
# self-hosted distro: you enroll the key once (one-time prompt at first boot)
# and then every Arcline update is verified against it. No third-party CA.
#
# Outputs (default build/keys/):
#   MOK.priv   — private signing key (keep this secret, back it up)
#   MOK.pem    — certificate in PEM form (for sbsign)
#   MOK.der    — certificate in DER form (for mokutil enrollment)
#
# Requires openssl. Enrollment on a target system is handled by
# arcline-mok-enroll.service (see overlays/base).
# ─────────────────────────────────────────────────────────────────────────────
set -euo pipefail
source "$(dirname "${BASH_SOURCE[0]}")/../../scripts/common.sh"

KEYDIR="${1:-$BUILD_DIR/keys}"
[[ "${1:-}" == "--keydir" ]] && KEYDIR="${2:?usage: gen-keys.sh [--keydir <dir>]}"

command -v openssl >/dev/null || die "openssl not found"

if [[ -f "$KEYDIR/MOK.priv" && -f "$KEYDIR/MOK.pem" && -f "$KEYDIR/MOK.der" ]]; then
  log "MOK keypair already exists in $KEYDIR — keeping it (delete to regenerate)"
  exit 0
fi

mkdir -p "$KEYDIR"
log "generating MOK signing keypair in $KEYDIR"
openssl req -new -x509 -newkey rsa:3072 -sha256 -nodes \
  -keyout "$KEYDIR/MOK.priv" \
  -outform DER -out "$KEYDIR/MOK.der" \
  -subj "/CN=Arcline OS MOK/OU=Secure Boot/O=Arcline IT LLC" \
  -days 3650
openssl x509 -in "$KEYDIR/MOK.der" -inform DER -out "$KEYDIR/MOK.pem" -outform PEM

chmod 600 "$KEYDIR/MOK.priv"
log "generated: MOK.priv (keep secret), MOK.pem, MOK.der"
log "to enroll on a running system:"
log "  sudo mokutil --import $KEYDIR/MOK.der"