chromeos-base/infineon-firmware-updater/files/tpm-firmware-check.sh

#!/bin/sh
#
# Copyright 2017 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

set -e

TPM_FIRMWARE_UPDATE_LOCATION="/run/tpm_firmware_update_location"
TPM_FIRMWARE_UPDATE_SRK_VULNERABLE_ROCA="/run/tpm_firmware_update_srk_vulnerable_roca"

main() {
  # Record whether the SRK is vulnerable to ROCA.
  if tpm-manager get_srk_status | grep -q '^srk_vulnerable_roca 1$'; then
    touch "${TPM_FIRMWARE_UPDATE_SRK_VULNERABLE_ROCA}"
  fi

  # Write to temp file and move so the correct state appears atomically.
  local tpm_version_info="$(tpm-manager get_version_info)"
  local ifx_upgrade_info="$(tpm-manager get_ifx_field_upgrade_info)"
  if tpm-firmware-locate-update "${tpm_version_info}" "${ifx_upgrade_info}" \
                                > "${TPM_FIRMWARE_UPDATE_LOCATION}.tmp"; then
    mv "${TPM_FIRMWARE_UPDATE_LOCATION}.tmp" "${TPM_FIRMWARE_UPDATE_LOCATION}"
  else
    # If there's no update or an error, create an empty file to signal to
    # consumers that the check has completed without finding an update.
    touch "${TPM_FIRMWARE_UPDATE_LOCATION}"
  fi
}

main "$@"