From 1b5546a3ee21e83d8195630ed42337a98ae12dc5 Mon Sep 17 00:00:00 2001
From: Silvan Calarco <silvan.calarco@mambasoft.it>
Date: Sat, 23 Nov 2024 17:10:42 +0100
Subject: [PATCH] livecd-light-root,livecd: review EFI support for x86 target
 after changes for secure boot support

---
 platforms/livecd-light-root/Makefile |  2 +-
 platforms/livecd/Makefile            |  1 +
 platforms/livecd/post.inc.sh         | 37 ++++++++++++++++++++++------
 3 files changed, 32 insertions(+), 8 deletions(-)

diff --git a/platforms/livecd-light-root/Makefile b/platforms/livecd-light-root/Makefile
index f555068..d87da0c 100644
--- a/platforms/livecd-light-root/Makefile
+++ b/platforms/livecd-light-root/Makefile
@@ -25,7 +25,7 @@ $(MAKEDIST_TARGET)-livecd-light-root: \
                   mambatray \
                   $(MAKEDIST_TARGET)-livecd-light
 
-$(MAKEDIST_TARGET)-livecd-light-root-x86_64: VirtualBox-guest
+$(MAKEDIST_TARGET)-livecd-light-root-x86_64: VirtualBox-guest sbsigntools shim-signed
 
 # Localization targets
 $(MAKEDIST_TARGET)-livecd-light-root-de: langpacks-de firefox-langpack-de
diff --git a/platforms/livecd/Makefile b/platforms/livecd/Makefile
index 7c0bc5d..bf9a7a8 100644
--- a/platforms/livecd/Makefile
+++ b/platforms/livecd/Makefile
@@ -1,5 +1,6 @@
 $(MAKEDIST_TARGET)-livecd: openmamba-release breeze-grub-theme memtest86+ \
     memtest86+-efi dracut grub-efi-x86_64 shim-signed sbsigntools
+$(MAKEDIST_TARGET)-livecd-i586: grub-efi
 # Localized targets
 $(MAKEDIST_TARGET)-livecd-en:
 $(MAKEDIST_TARGET)-livecd-it:
diff --git a/platforms/livecd/post.inc.sh b/platforms/livecd/post.inc.sh
index b888d98..82c8b6b 100644
--- a/platforms/livecd/post.inc.sh
+++ b/platforms/livecd/post.inc.sh
@@ -156,22 +156,42 @@ fi
 
 # create EFI grub 32 and 64 bit images
 mkdir -p $MOUNTDIR/boot/efi/EFI/openmamba/
+if [ "${ARCH}" == "x86_64" ]; then
+   GRUB_ADD="--sbat /usr/share/grub/sbat.csv \
+all_video bli boot chain configfile cpuid echo efifwsetup efi_gop efi_uga efinet ext2 \
+fat font gettext gfxmenu gfxterm gfxterm gfxterm_background gzio halt help hfsplus \
+iso9660 jpeg keystatus linux loadenv loopback ls lsefi lsefimmap lsefisystab lssal \
+memdisk minicmd normal ntfs ntfscomp part_apple part_gpt part_msdos password_pbkdf2 \
+play png probe reboot regexp search search_fs_file search_fs_uuid search_label sleep \
+smbios squash4 test tpm true video video_bochs video_cirrus xfs zfs zfscrypt zfsinfo"
+else
+   # FIXME: i586 provides grub 204 which does not support --sbat and other modules for SB
+   GRUB_ADD="\
+part_gpt part_msdos ntfs ntfscomp hfsplus fat ext2 normal chain boot linux echo \
+help gfxterm gettext png efi_gop efi_uga search search_label search_fs_uuid \
+iso9660 configfile"
+fi
+
 chroot $MOUNTDIR grub-mkimage -o /boot/efi/EFI/openmamba/grubx64.efi -O x86_64-efi \
-   -p /boot/grub --sbat /usr/share/grub/sbat.csv \
-   all_video bli boot chain configfile cpuid echo efifwsetup efi_gop efi_uga efinet ext2 \
-   fat font gettext gfxmenu gfxterm gfxterm gfxterm_background gzio halt help hfsplus \
-   iso9660 jpeg keystatus linux loadenv loopback ls lsefi lsefimmap lsefisystab lssal \
-   memdisk minicmd normal ntfs ntfscomp part_apple part_gpt part_msdos password_pbkdf2 \
-   play png probe reboot regexp search search_fs_file search_fs_uuid search_label sleep \
-   smbios squash4 test tpm true video video_bochs video_cirrus xfs zfs zfscrypt zfsinfo || {
+   -p /boot/grub ${GRUB_ADD} || {
    echo $"Error: unable to create GRUB x86_64-efi image"
    exit 1
 }
 
+if [ "${ARCH}" == "i586" ]; then
+# 32 bit image
+chroot $MOUNTDIR grub-mkimage -o /boot/efi/EFI/openmamba/grubia32.efi -O i386-efi \
+   -p /boot/grub ${GRUB_ADD} || {
+   echo $"Error: unable to create GRUB i386-efi image"
+   exit 1
+}
+fi
+
 # Sign EFI image for secure boot
 chroot $MOUNTDIR openssl req -newkey rsa:2048 -nodes -keyout /root/MOK.key -new -x509 -sha256 -days 3650 -subj "/CN=openmamba Machine Owner Key/" -out /root/MOK.crt
 chroot $MOUNTDIR openssl x509 -outform DER -in /root/MOK.crt -out /root/MOK.cer
 chroot $MOUNTDIR sbsign --key /root/MOK.key --cert /root/MOK.crt --output /boot/efi/EFI/openmamba/grubx64.efi /boot/efi/EFI/openmamba/grubx64.efi
+chroot $MOUNTDIR sbsign --key /root/MOK.key --cert /root/MOK.crt --output /boot/efi/EFI/openmamba/grubia32.efi /boot/efi/EFI/openmamba/grubia32.efi
 ISOID=
 for K in $KERNEL_EXTRAVER $KERNEL_MORE_EXTRAVER; do
    chroot $MOUNTDIR sbsign --key /root/MOK.key --cert /root/MOK.crt --output /boot/vmlinuz-${KERNEL_MAJVER}${K} /boot/vmlinuz-${KERNEL_MAJVER}${K}
@@ -183,6 +203,9 @@ done
 mkdir -p $MOUNTDIR2/EFI/BOOT/
 cp $MOUNTDIR/root/MOK.cer $MOUNTDIR2/EFI/
 cp $MOUNTDIR/boot/efi/EFI/openmamba/grubx64.efi $MOUNTDIR2/EFI/BOOT/grubx64.efi
+if [ "${ARCH}" == "i586" ]; then
+   cp $MOUNTDIR/boot/efi/EFI/openmamba/grubia32.efi $MOUNTDIR2/EFI/BOOT/bootia32.efi
+fi
 
 # Install shim-signed
 cp $MOUNTDIR/usr/share/shim-signed/shimx64.efi $MOUNTDIR2/EFI/BOOT/bootx64.efi