#!/bin/sh

case "${1}" in
	start)
		printf 'Loading firmware signing key from Coreboot CBFS: '
		mkdir -p /.gnupg
		cbfs -r heads/initrd/.gnupg/pubring.kbx > /.gnupg/pubring.kbx
		cbfs -r heads/initrd/.gnupg/trustdb.gpg > /.gnupg/trustdb.gpg
		fingerprint=$( \
			gpg \
				--list-keys \
				--list-options no-show-unusable-uids \
				--with-colons \
			| awk -F: '$1 == "fpr" {print $10;}' \
			| head -n1 \
		)
		echo "export HEADS_KEY=${fingerprint}" >> /etc/environment
		if [ $? -eq 0 ]; then
			echo "OK"
		else
			echo "FAIL"
		fi
		;;
	*)
		echo "Usage: ${0} {start}"
		exit 1
		;;
esac