#!/bin/bash
# #############################################################################
# Simple shell script to 'test' that the measurement generated by the
# measurement_utility.exe binary is reasonable. We can't verify the actual
# hash-value, but here is what we do:
#
# - Run the utility on --input file. Collect measurement-1
# - Run the utility on --input file with --policy_key argument, using the stub
#   Python policy_key.py file. Collect measurement-2
# - Re-run utility with same arguments, after re-generating the policy_key.py
#   using the embed_policy_key.exe. Collect measurement-3
# Verify that measurement-1 != measurement-2 != measurement-3
#
# This simplistic test ensures that we are, indeed, including the new
# generated policy_key's contents while computing measurement-3.
# #############################################################################

set -Eeuo pipefail

# Setup script globals, to establish curdir and root path to Certifier code base
Me=$(basename "$0")

# Establish directory locations
pushd "$(dirname "$0")" > /dev/null 2>&1

# shellcheck disable=SC2046
CERT_ROOT="$(dirname $(pwd))"

popd > /dev/null 2>&1

CERT_UTILS=${CERT_ROOT}/utilities
rv=0

work_dir=${CERT_ROOT}/sample_apps/simple_app_python/provisioning
if [ ! -d "${work_dir}" ]; then mkdir "${work_dir}"; fi

pushd "${work_dir}" > /dev/null 2>&1

mode=no_policy_key
"${CERT_UTILS}"/measurement_utility.exe --type=hash \
        --input=../example_app.py \
        --output=example_app.measurement.${mode} \
        > ${mode}.out

measurement_no_policy_key=$(cat ${mode}.out | cut -f2 -d' ')

mode=stub_policy_key
"${CERT_UTILS}"/measurement_utility.exe --type=hash \
        --input=../example_app.py \
        --other_files=../policy_key.py \
        --output=example_app.measurement.${mode} \
        > ${mode}.out

measurement_stub_policy_key=$(cat ${mode}.out | cut -f2 -d' ')

# Generate policy_cert_file.bin only once; re-used for re-runs ...
if [ ! -f ./policy_cert_file.bin ]; then
    outfile="cert_utility.out"
    "$CERT_UTILS"/cert_utility.exe                       \
                   --operation=generate-policy-key-and-test-keys    \
                   --policy_key_output_file=policy_key_file.bin     \
                   --policy_cert_output_file=policy_cert_file.bin   \
                   --platform_key_output_file=platform_key_file.bin \
                   --attest_key_output_file=attest_key_file.bin \
                   > ${outfile}
fi

# Update policy_key using policy-generator utility
"${CERT_UTILS}"/embed_policy_key.exe \
        --array_name=INITIALIZED_CERT \
        --input=policy_cert_file.bin \
        --output=../policy_key.py \
        --python

mode=with_policy_key
"${CERT_UTILS}"/measurement_utility.exe --type=hash \
        --input=../example_app.py \
        --other_files=../policy_key.py \
        --output=example_app.measurement.${mode} \
        > ${mode}.out

measurement_with_policy_key=$(cat ${mode}.out | cut -f2 -d' ')

popd > /dev/null 2>&1

if [ "${measurement_no_policy_key}" = "${measurement_stub_policy_key}" ]; then
    rv=1
fi

if [ "${measurement_no_policy_key}" = "${measurement_with_policy_key}" ]; then
    rv=1
fi

if [ "${measurement_stub_policy_key}" = "${measurement_with_policy_key}" ]; then
    echo "Omitting check of stub and policy measurement equality"
fi

if [ ${rv} -ne 0 ]; then
    echo "${Me}: Error: Generated measurements should all be different:"
    echo "measurement_no_policy_key  : ${measurement_no_policy_key}"
    echo "measurement_stub_policy_key: ${measurement_stub_policy_key}"
    echo "measurement_with_policy_key: ${measurement_with_policy_key}"
else
    echo "${Me}: Basic unit-testing of measurement_utility.exe, with --policy_key support, succeeded."
fi
exit ${rv}
