setup-tdx-common

# This file is part of Canonical's TDX repository which includes tools
# to setup and configure a confidential computing environment
# based on Intel TDX technology.
# See the LICENSE file in the repository for the license text.

# Copyright 2024 Canonical Ltd.
# SPDX-License-Identifier: GPL-3.0-only

# This program is free software: you can redistribute it and/or modify it
# under the terms of the GNU General Public License version 3,
# as published by the Free Software Foundation.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranties
# of MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR PURPOSE.
# See the GNU General Public License for more details.

# Pinning the packages of specific PPA
#
# unattended-upgrade:
# unattended-upgrade will temporarily set APT pinning for the archives
# it will ignore the pinning configuration for PPAs that are not listed
# in the Allowed-Origins list
# we have to add the PPA into this list to prevent unattended from
# setting its pinning priority to -32768
# we also need to tell unattended-upgrade to allow the downgrade
# in case the packages in the PPA have older versions than the ones
# from Ubuntu archive
add_kobuk_ppa() {
  ppa_id=$1
  distro_id=LP-PPA-kobuk-team-${ppa_id}
  distro_codename=noble

  add-apt-repository -y ppa:kobuk-team/${ppa_id}

  cat <<EOF | tee /etc/apt/preferences.d/kobuk-team-${ppa_id}-pin-4000
Package: *
Pin: release o=${distro_id}
Pin-Priority: 4000
EOF

  cat <<EOF | tee /etc/apt/apt.conf.d/99unattended-upgrades-kobuk-${ppa_id}
Unattended-Upgrade::Allowed-Origins {
  "${distro_id}:${distro_codename}";
};
Unattended-Upgrade::Allow-downgrade "true";
EOF
}

# Add all kobuk given PPAs
add_kobuk_ppas() {
  for ppa in "$@"; do
    add_kobuk_ppa "$ppa"
  done
}

# get the current kernel version from the kernel flavour/type
# we are using
# the input will be the kernel meta package name of type : linux-image-<flavour|type>
# examples : linux-image-intel, linux-image-generic, linux-image-aws, ...
get_kernel_version() {
    local kernel_flavour=$1
    local kernel_version
    kernel_version=$(apt show ${kernel_flavour} 2>&1 | gawk 'match($0, /Depends:.* linux-image-([^, ]+)/, a) {print a[1]}')
    echo $kernel_version
}

# grub: switch to kernel version
grub_switch_kernel() {
    KERNELVER=$1
    MID=$(awk '/Advanced options for Ubuntu/{print $(NF-1)}' /boot/grub/grub.cfg | cut -d\' -f2)
    KID=$(awk "/with Linux $KERNELVER/"'{print $(NF-1)}' /boot/grub/grub.cfg | cut -d\' -f2 | head -n1)
    cat > /etc/default/grub.d/99-tdx-kernel.cfg <<EOF
GRUB_DEFAULT=saved
GRUB_SAVEDEFAULT=true
EOF
    grub-editenv /boot/grub/grubenv set saved_entry="${MID}>${KID}"
    update-grub
}

# select the kernel release for next boot
# NB : this function will read/write the global variable KERNEL_RELEASE
# if KERNEL_RELEASE is specified, we use it
# if not, select the latest generic kernel available on the system and update the KERNEL_RELEASE var
grub_set_kernel() {
    if [ -z "${KERNEL_RELEASE}" ]; then
      KERNEL_RELEASE=$(find /boot/vmlinuz-*-generic 2>&1 | \
                      /usr/lib/grub/grub-sort-version -r 2>&1 | \
                      gawk 'match($0 , /^\/boot\/vmlinuz-(.*)/, a) {print a[1];exit}')
    fi
    if [ -z "${KERNEL_RELEASE}" ]; then
      echo "ERROR : unable to determine kernel release"
      exit 1
    fi
    grub_switch_kernel "${KERNEL_RELEASE}"
}