#!/bin/bash

# option to use a lock to ensure that we run a single instance of the script.
# If set to true, it would prevent accidentally running multiple instances of
# this script concurrently to provision the same vehicle, but, as a consequence
# it would also prevent provisioning more than one vehicle at a time using this
# script on the same provisioning machine.
ENABLE_LOCKING="false"
SCRIPT_NAME="${0##*/}"
if [ "$ENABLE_LOCKING" = "true" ]; then
    FLOCK_TOOL="/usr/bin/flock"
    if ! test -f "$FLOCK_TOOL"; then
        echo "'flock' not found on the provisioner machine at $FLOCK_TOOL"
        exit 1
    fi
    SCRIPT_LOCK="/tmp/$SCRIPT_NAME.lock"
    exec 200> "$SCRIPT_LOCK"
    "$FLOCK_TOOL" -n -x 200 || { echo "$SCRIPT_NAME is already running." && exit 1; }
fi

# vehicle birth certificate generation directory for keeping intermediate artifacts; modify if corresponding directorly layout on the vehicle is changed.
# note: do not use a generic and world-accessible gen dir (such as /tmp) for security reasons.
BIRTH_GEN_DIR="/home/zoox/.identity/birth/gen"

# vehicle birth cert storage and sealed (or unsealed) key storage directory.
BIRTH_STORE_DIR="/home/zoox/.identity/birth/current"

# indicates if intermediate artifacts should be removed once the script exits or is terminated, set to 'false' for debugging
ENABLE_CLEANUP="true"

# is the script running locally on the vehicle? Or is it running on a provisioning machine?
IS_LOCAL="false"

# vehicle parameters
VEHICLE_NAME=
VEHICLE_ADDR=
VEHICLE_USER="zoox"
VEHICLE_TPM="true"
VEHICLE_BIRTH_CERT=

# vehicle CSR configuration details; may be over-written or modified by Vault upon cert issuance
VEHICLE_CSR_COUNTRY="US"
VEHICLE_CSR_STATE="CA"
VEHICLE_CSR_LOCALITY="Foster\ City"
VEHICLE_CSR_ORG="Zoox"
VEHICLE_CSR_ORG_UNIT="ProdSec"

# vehicle birth certificate cryptographic parameters
VEHICLE_BIRTH_KEY_ALG="rsa"
VEHICLE_BIRTH_KEY_SIZE="2048"
VEHICLE_BIRTH_KEY_NOTPM_OPTIONS="rsa_keygen_bits:2048"

# vehicle birth certificate generation artifact extensions; used to specify unsealed private key (.key), sealed keys (.bin), CSR (.csr), JSON CSR (.json) file, and the birth certificate (.crt, .der).
BIRTH_GEN_EXTENSIONS="{*.key,*.bin,*.csr,*.json,*.crt,*.der}"
# vehicle birth storage artifact extensions. used to specify unsealed private key (.key), sealed keys (.bin), and certificate (.crt, .der)
BIRTH_STORE_EXTENSIONS="{*.key,*.bin,*.crt,*.der}"

# vehicle tpm-specific parameters: modify if corresponding directorly layout on the vehicle is changed, or new tpm device or tpm software stack is used
TPM2TSS_ENGINE="/usr/local/zoox/tpm/tpm2-tss-engine-1.0.1/lib/engines"
TPM2DEVICE="/dev/tpmrm0"
VEHICLE_TPM2TSSENGINE_TCTI="device:$TPM2DEVICE"
TPM2TSS_GENKEY="/usr/local/zoox/tpm/tpm2-tss-engine-1.0.1/bin/tpm2tss-genkey"
TPM2_NV_DEFINE="/usr/local/zoox/tpm/tpm2-tools-4.1.3/bin/tpm2_nvdefine"
TPM2_NV_UNDEFINE="/usr/local/zoox/tpm/tpm2-tools-4.1.3/bin/tpm2_nvundefine"
TPM2_NV_WRITE="/usr/local/zoox/tpm/tpm2-tools-4.1.3/bin/tpm2_nvwrite"
TPM2_NV_READ="/usr/local/zoox/tpm/tpm2-tools-4.1.3/bin/tpm2_nvread"
VEHICLE_TPM2_BIRTH_CERT_INDEX="0x01800000"
VEHICLE_TPM2_BIRTH_SEALEDKEY_INDEX="0x01800001"

# vehicle invocations
VEHICLE_MKDIR="/bin/mkdir"
VEHICLE_RM="/bin/rm"
VEHICLE_CAT="/bin/cat"
VEHICLE_CP="/bin/cp"
VEHICLE_WC="/usr/bin/wc"
VEHICLE_JQ="/usr/bin/jq"
VEHICLE_CURL="/usr/local/zoox/tpm/curl-7.71.0/bin/curl"
VEHICLE_OPENSSL="/usr/local/zoox/tpm/openssl-1.1.1g/bin/openssl"

# vault parameters
VAULT_TOKEN=
USING_ONE_TIME_TOKEN="false"
VAULT_ADDR="https://vault-rsi.zooxlabs.com:8200"
VAULT_TOKEN_TTL_FOR_BIRTH_CERT_LOGINS="3600"

# provisioner parameters
OP_CERT=
OP_KEY=
OP_NAME=
OP_TPM="false"

# provisioner invocations
OP_CURL="/usr/bin/curl"
OP_JQ="/usr/bin/jq"
OP_SSH="/usr/bin/ssh"

# testing parameters (the following are used to test birth cert login when a vehicle tpm is used. If vehicle tpm is not used, we directly use the stored cert and key)
TEST_BIRTH_CERT_DER="$BIRTH_GEN_DIR/test-birth-cert.der"
TEST_BIRTH_CERT_CRT="$BIRTH_GEN_DIR/test-birth-cert.crt"
TEST_BIRTH_SEALED_KEY="$BIRTH_GEN_DIR/test-birth-cert.bin"
