install/verify_bundle.sh

#!/bin/bash
#
# Attempts to verify a Bloom bundle with all verification keys in the
# bundle key directory. If any succeeds, returns 0. Else, prints the errors
# from all attmepts.
set -euo pipefail

AUDIT_MODE=false
while [[ "$#" -gt 0 ]]; do
  case "$1" in
    --audit)
      AUDIT_MODE=true
      shift
      ;;
    *)
      echo "Unknown option: $1" >&2
      exit 1
      ;;
  esac
done

readonly BUNDLE_KEY_DIR="/usr/share/google-bundle-key/"
readonly INSTALLER_MAIN="/usr/bin/installer_main"
declare -a CANDIDATE_KEYS=()
declare -a DEV_KEYS=()

DEV_KEYS_ALLOWED=false
# installer_main returns 1 or 2 on expected failure states.
# We must temporarily disable bail-on-error (set -e) to capture the exit code
# properly instead of instantly failing the script.
set +e
dev_check_output=$("${INSTALLER_MAIN}" --mode check_dev_keys_enabled 2>&1)
dev_check_status=$?
set -e

if [[ "${dev_check_status}" == 0 ]]; then
  DEV_KEYS_ALLOWED=true
elif [[ "${dev_check_status}" == 2 ]]; then
  echo "Error checking owner configuration."
  echo "--- LOGS ---"
  echo "${dev_check_output}"
fi

for key in "${BUNDLE_KEY_DIR}"*.pem; do
  if [[ ! -f "${key}" ]]; then
    continue
  fi

  # Collect production keys first; defer or skip dev/bringup keys.
  if [[ "${key}" == *"_bringup.pem" || "${key}" == *"_dev.pem" ]]; then
    if [[ "${DEV_KEYS_ALLOWED}" == "true" ]]; then
      DEV_KEYS+=("${key}")
    else
      echo "Skipping dev key because dev verification is not enabled: ${key}"
    fi
  else
    echo "Found candidate production key: ${key}"
    CANDIDATE_KEYS+=("${key}")
  fi
done

if [[ "${DEV_KEYS_ALLOWED}" == "true" && "${#DEV_KEYS[@]}" -gt 0 ]]; then
  for key in "${DEV_KEYS[@]}"; do
    echo "Found candidate dev key: ${key}"
    CANDIDATE_KEYS+=("${key}")
  done
fi

if [[ "${#CANDIDATE_KEYS[@]}" -gt 0 ]]; then
  keys_csv=$(IFS=,; echo "${CANDIDATE_KEYS[*]}")
  if output=$("${INSTALLER_MAIN}" --mode signature_check --public_key_file "${keys_csv}" 2>&1); then
    echo "Bundle signature verified successfully"
    exit 0
  fi
else
  output="No candidate verification keys found in ${BUNDLE_KEY_DIR}"
fi

# If we reach here, no key worked. Print all logs.
echo "Signature verification failed for all keys."
echo "${output}"

if [[ "${AUDIT_MODE}" == "true" ]]; then
  echo "Audit mode enabled, exiting with 0 despite failures."
  exit 0
fi

exit 1