install/verify_bundle.sh

#!/bin/bash
#
# Attempts to verify a Bloom bundle with all verification keys in the
# bundle key directory. If any succeeds, returns 0. Else, prints the errors
# from all attmepts.
set -euo pipefail

AUDIT_MODE=false
while [[ "$#" -gt 0 ]]; do
  case "$1" in
    --audit)
      AUDIT_MODE=true
      shift
      ;;
    *)
      echo "Unknown option: $1" >&2
      exit 1
      ;;
  esac
done

readonly BUNDLE_KEY_DIR="/usr/share/google-bundle-key/"
readonly INSTALLER_MAIN="/usr/bin/installer_main"
declare -a FAILED_LOGS
SUCCESS=false

DEV_KEYS_ALLOWED=false
# installer_main returns 1 or 2 on expected failure states.
# We must temporarily disable bail-on-error (set -e) to capture the exit code
# properly instead of instantly failing the script.
set +e
dev_check_output=$("${INSTALLER_MAIN}" --mode check_dev_keys_enabled 2>&1)
dev_check_status=$?
set -e

if [[ "${dev_check_status}" == 0 ]]; then
  DEV_KEYS_ALLOWED=true
elif [[ "${dev_check_status}" == 2 ]]; then
  echo "Error checking owner configuration."
  echo "--- LOGS ---"
  echo "${dev_check_output}"
fi

for key in "${BUNDLE_KEY_DIR}"*.pem; do
  if [[ ! -f "${key}" ]]; then
    continue
  fi

  # Skip dev keys if they aren't enabled.
  if [[ "${key}" == *"_bringup.pem" || "${key}" == *"_dev.pem" ]]; then
    if [[ "${DEV_KEYS_ALLOWED}" != "true" ]]; then
      echo "Skipping dev key because dev verification is not enabled: ${key}"
      continue
    fi
  fi

  # Attempt to verify the signature with the current key.
  if output=$("${INSTALLER_MAIN}" --mode signature_check --public_key_file "${key}" 2>&1); then
    echo "Signature verification succeeded with key: ${key}"
    SUCCESS=true
    break
  else
    FAILED_LOGS+=("--- Log for key ${key} ---
${output}")
  fi
done

if [[ "${SUCCESS}" == "true" ]]; then
  exit 0
fi

# If we reach here, no key worked. Print all logs.
echo "Signature verification failed for all keys."
for log in "${FAILED_LOGS[@]}"; do
  printf "%b\n" "${log}"
done

if [[ "${AUDIT_MODE}" == "true" ]]; then
  echo "Audit mode enabled, exiting with 0 despite failures."
  exit 0
fi

exit 1