pxe - verify hash of squashfs when live booting
@@ -5,6 +5,9 @@ type info >/dev/null 2>&1 || . /lib/dracut-lib.sh
type warn >/dev/null 2>&1 || . /lib/dracut-lib.sh
+shaFile="/root.squashfs.sha256sum"
+squashFile="/tmp/root.squashfs"
+
# download squashfs
url=$(getarg gl.url=)
@@ -13,20 +16,33 @@ if [ -z "${url#gl.url=}" ]; then
exit 0
fi
-if ! (cd /tmp; curl --globoff --location --retry 3 --fail --show-error "${url}" --output rootfs.squash); then
+if ! curl --globoff --location --retry 3 --fail --show-error "${url}" --output "${squashFile}"; then
warn "can't fetch the squashfs from ${url#gl.url=}"
exit 1
fi
+# FIXME: consider removing this, or check the 0x73717368 magic number, will also make initrd smaller
# check if the file is a squashfs
-if ! file -m /usr/lib/file/magic.mgc -b /tmp/rootfs.squash | grep -q "Squashfs filesystem" ; then
+if ! file -m /usr/lib/file/magic.mgc -b "${squashFile}" | grep -q "Squashfs filesystem" ; then
warn "the provided image via gl.url is not a valid squashfs image"
exit 1
fi
-# TODO add check for contents
+# verify sha256
+if [ ! -f "${shaFile}" ]; then
+ warn "no sha256sum file exists - exiting"
+ exit 1
+fi
+
+if ! echo "$(grep . ${shaFile}) ${squashFile}" | sha256sum --status --check; then
+ warn "the hash verification of the squashfs has failed - exiting"
+ exit 1
+fi
# move image to proper place
-mv /tmp/rootfs.squash /run/rootfs
+mv "${squashFile}" /run/rootfs
+
+# load kernel modules
+modprobe loop squashfs
exit 0
