gyroidos · aevykk · May 26, 2026 · May 19, 2026 · May 19, 2026 · May 20, 2026
diff --git a/cml_tools/cml_build_guestos.sh b/cml_tools/cml_build_guestos.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # This file is part of GyroidOS
 # Copyright(c) 2013 - 2021 Fraunhofer AISEC
@@ -22,7 +22,7 @@
 # Fraunhofer AISEC <gyroidos@aisec.fraunhofer.de>
 #
 
-set -e
+set -euo pipefail
 
 PROGNAME="$(basename "$0")"
 SCRIPTS_DIR=# Path to cml-tools folder (set on installation)
@@ -41,13 +41,15 @@ WORKDIR=$(pwd) # default: current directory
 PROTO_FILE=""
 DEFAULT_PROTO_PATH="/usr/share/cml"
 CERT_DIR=""
+GYROIDOS_VERSION="1"
+DEBUG="${DEBUG:-}"
 
 usage () {
 cat << _EOF_
 usage:
     ${PROGNAME} -h
     ${PROGNAME} init [-h] [--proto <path>] [--pki <path>] [--dir <directory>] <imagename>
-    ${PROGNAME} build [-h] [--proto <path>] [--pki <path>] [--dir <directory>] <imagename>
+    ${PROGNAME} build [-h] [--proto <path>] [--pki <path>] [--dir <directory>] [--version <guestos_version>] <imagename>
     ${PROGNAME} sign [-h] [--proto <path>] [--pki <path>] [--dir <directory>] <path to config>
 
 -h/--help: print this help
@@ -59,6 +61,7 @@ OPTIONAL:
     --pki <path>:   specify path to pki, if not specified a new one is generated
                     and placed in <dir>
     --dir <directory>: path to working directory
+    --version <guestos_version>: The version number to set in the output guestos config
 
 _EOF_
 }
@@ -76,7 +79,7 @@ exit_failure_with_usage () {
 
 ### parse and validate cli args
 ## parse first arg
-case "$1" in
+case "${1:-}" in
     -h | --help)
         # print usage and exit
         usage
@@ -99,7 +102,7 @@ esac
 
 ## parse remaining args
 shift
-while [[ -n "$1" ]]; do
+while (( $# > 0 )); do
     case "$1" in
         -h | --help)
             # print usage and exit
@@ -109,51 +112,60 @@ while [[ -n "$1" ]]; do
         --proto)
             # evaluate path arg
             shift
-            if [[ -z "$1" || "$1" =~ ^"-".*$ ]]; then
+            if [[ -z "${1:-}" || "${1:-}" =~ ^"-".*$ ]]; then
                 exit_failure_with_usage "No path to protofile specified, exiting..."
             elif [[ -f "$1" ]]; then
-                if [[ "${1}" =~ ^.*".proto"$ ]]; then
-                    PROTO_FILE="$(readlink -f "${1}")" # store absolute path
+                if [[ "$1" =~ ^.*".proto"$ ]]; then
+                    PROTO_FILE="$(readlink -f "$1")" # store absolute path
                     [[ -n "$DEBUG" ]] && echo "PROTO_FILE=$PROTO_FILE" # DEBUG
                 else
-                    exit_failure "${1} contains no guestos.proto file, exiting..."
+                    exit_failure "$1 contains no guestos.proto file, exiting..."
                 fi
             else
-                exit_failure "${1} does not exist or is not a directory, exiting..."
+                exit_failure "$1 does not exist or is not a directory, exiting..."
             fi
             ;;
         --pki)
             # evaluate path arg
             shift
-            if [[ -z "$1" || "$1" =~ ^"-".*$ ]]; then
+            if [[ -z "${1:-}" || "${1:-}" =~ ^"-".*$ ]]; then
                 exit_failure_with_usage "No path to pki specified, exiting..."
             elif [[ -d "$1" ]]; then
-                CERT_DIR="$(readlink -f "${1}")" # store absolute path
+                CERT_DIR="$(readlink -f "$1")" # store absolute path
                 [[ -n "$DEBUG" ]] && echo "CERT_DIR=$CERT_DIR" # DEBUG
             else
-                exit_failure "${1} does not exist or is not a directory, exiting..."
+                exit_failure "$1 does not exist or is not a directory, exiting..."
             fi
             ;;
         --dir)
             # evaluate path arg
             shift
-            if [[ -z "$1" || "$1" =~ ^"-".*$ ]]; then
+            if [[ -z "${1:-}" || "${1:-}" =~ ^"-".*$ ]]; then
                 exit_failure_with_usage "No path to working directory specified, exiting..."
             elif [[ -d "$1" ]]; then
-                WORKDIR="$(readlink -f "${1}")" # store absolute path
+                WORKDIR="$(readlink -f "$1")" # store absolute path
                 [[ -n "$DEBUG" ]] && echo "WORKDIR=$WORKDIR" # DEBUG
             else
-                exit_failure "${1} does not exist or is not a directory, exiting..."
+                exit_failure "$1 does not exist or is not a directory, exiting..."
             fi
             ;;
+        --version)
+            # evaluate guestos version arg
+            shift
+            re='^[0-9]+$'
+            if ! [[ "${1:-}" =~ $re ]] ; then
+                exit_failure_with_usage "Given version is not a numerical value, exiting..."
+            fi
+            GYROIDOS_VERSION="$1"
+            ;;
         -*)
             exit_failure_with_usage "Unknown Flag, exiting..."
             ;;
         *)
             if [[ -z "$IMAGENAME" ]]; then
                 # TODO: sanitize
-                IMAGENAME="${1}"
-                [[ -n "$DEBUG" ]] && echo "IMAGENAME=${1}" # DEBUG
+                IMAGENAME="$1"
+                [[ -n "$DEBUG" ]] && echo "IMAGENAME=$1" # DEBUG
             else
                 exit_failure_with_usage "Too many positional arguments, exiting..."
             fi
@@ -177,12 +189,12 @@ if [[ -z "$PROTO_FILE" ]]; then
         PROTO_FILE="${DEFAULT_PROTO_PATH}/guestos.proto"
     elif [[ -e "${WORKDIR}/guestos.proto" ]];then
         echo "Use guestos.proto at ${WORKDIR}/guestos.proto"
-        PROTO_FILE=="${WORKDIR}/guestos.proto"
+        PROTO_FILE="${WORKDIR}/guestos.proto"
     else
         echo "guestos.proto is not installed on this system."
-        # prombt user
+        # prompt user
         while true; do
-            read -p "Download guestos.proto from GitHub? [y/n]: "
+            read -r -p "Download guestos.proto from GitHub? [y/n]: "
             if [[ "$REPLY" == "y" ]]; then
                 # try to download it
                 echo "Try to download latest guestos.proto..."
@@ -217,10 +229,10 @@ if [[ -z "${CERT_DIR}" ]]; then
         echo "Using PKI at ${WORKDIR}/test_pki"
         CERT_DIR="${WORKDIR}/test_pki"
     else
-        # prombt user
+        # prompt user
         echo "No PKI specified."
         while true; do
-            read -p "Generate new PKI? [y/n]: "
+            read -r -p "Generate new PKI? [y/n]: "
             if [[ "$REPLY" == "y" ]]; then
                 # generate new one
                 CERT_DIR="${WORKDIR}/test_pki"
@@ -244,22 +256,22 @@ fi
 ### MODE-related functions
 ## initialise the working directory
 init_wdir() {
-    mkdir -p ${WORKDIR}/conf
-    mkdir -p ${WORKDIR}/rootfs
-    mkdir -p ${WORKDIR}/out
-    cp ${SCRIPTS_DIR}/sampleos.conf ${WORKDIR}/conf/${IMAGENAME}os.conf
-    cp ${SCRIPTS_DIR}/samplecontainer.conf ${WORKDIR}/conf/${IMAGENAME}container.conf
-    sed -i "s:sampleos:${IMAGENAME}os:" ${WORKDIR}/conf/${IMAGENAME}os.conf ${WORKDIR}/conf/${IMAGENAME}container.conf
-    sed -i "1s:samplecontainer:${IMAGENAME}container:" ${WORKDIR}/conf/${IMAGENAME}container.conf
+    mkdir -p "${WORKDIR}/conf"
+    mkdir -p "${WORKDIR}/rootfs"
+    mkdir -p "${WORKDIR}/out"
+    cp "${SCRIPTS_DIR}/sampleos.conf" "${WORKDIR}/conf/${IMAGENAME}os.conf"
+    cp "${SCRIPTS_DIR}/samplecontainer.conf" "${WORKDIR}/conf/${IMAGENAME}container.conf"
+    sed -i "s:sampleos:${IMAGENAME}os:" "${WORKDIR}/conf/${IMAGENAME}os.conf" "${WORKDIR}/conf/${IMAGENAME}container.conf"
+    sed -i "1s:samplecontainer:${IMAGENAME}container:" "${WORKDIR}/conf/${IMAGENAME}container.conf"
 }
 
 ## generate guestos
 build_guestos () {
-    ROOTFS_OUT=${WORKDIR}/rootfs
-    PROTO_FILE_DIR=${WORKDIR}
-    TMP_SCRIPTS_DIR=${WORKDIR}/.cml-tools
+    local ROOTFS_OUT="${WORKDIR}/rootfs"
+    local PROTO_FILE_DIR="${WORKDIR}"
+    local TMP_SCRIPTS_DIR="${WORKDIR}/.cml-tools"
 
-    cp -r ${SCRIPTS_DIR} ${TMP_SCRIPTS_DIR}
+    cp -r "${SCRIPTS_DIR}" "${TMP_SCRIPTS_DIR}"
 
     bash "${TMP_SCRIPTS_DIR}/gen_guestos.sh" \
         "${WORKDIR}/conf/${IMAGENAME}os.conf" \
@@ -268,9 +280,10 @@ build_guestos () {
         "${TMP_SCRIPTS_DIR}" \
         "${PROTO_FILE_DIR}" \
         "${CERT_DIR}" \
-        "${WORKDIR}"
+        "${WORKDIR}" \
+        "${GYROIDOS_VERSION}"
 
-    rm -r ${TMP_SCRIPTS_DIR}
+    rm -r "${TMP_SCRIPTS_DIR}"
 }
 
 ## sign a guestos

diff --git a/cml_tools/cml_gen_dev_certs_wrapper.sh b/cml_tools/cml_gen_dev_certs_wrapper.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # This file is part of GyroidOS
 # Copyright(c) 2013 - 2021 Fraunhofer AISEC
@@ -22,6 +22,8 @@
 # Fraunhofer AISEC <gyroidos@aisec.fraunhofer.de>
 #
 
+set -euo pipefail
+
 SCRIPTS_DIR=# Path to cml-tools folder (set on installation)
 
 # check if SCRIPTS_DIR is set
@@ -30,31 +32,31 @@ if [[ -z $SCRIPTS_DIR || ! -e $SCRIPTS_DIR/device_provisioning ]]; then
     exit 1
 fi
 
-if [ -z "$1" ];then
+if [ -z "${1:-}" ];then
     echo "No directory given, exiting..."
     exit 1
 fi
 
 SELF_DIR=$(pwd)
-WORKDIR=${SELF_DIR}/.device_provisioning
+WORKDIR="${SELF_DIR}/.device_provisioning"
 
-if [[ -d "WORKDIR" ]]; then
-    echo "Error: ${WORKDIR} already exists!" >&2 
+if [[ -d "${WORKDIR}" ]]; then
+    echo "Error: ${WORKDIR} already exists!" >&2
     exit 1
 fi
 
-# make temporary copy of devise_provisioning inside SELF_DIR
-mkdir -p ${WORKDIR}
-cp -r ${SCRIPTS_DIR}/device_provisioning/* ${WORKDIR}
+# make temporary copy of device_provisioning inside SELF_DIR
+mkdir -p "${WORKDIR}"
+cp -r "${SCRIPTS_DIR}/device_provisioning/"* "${WORKDIR}"
 
 # generate certificates
 if (( $# == 0 )); then
-    bash ${WORKDIR}/gen_dev_certs.sh \
+    bash "${WORKDIR}/gen_dev_certs.sh" \
         "${SELF_DIR}"
 else
-    bash ${WORKDIR}/gen_dev_certs.sh \
+    bash "${WORKDIR}/gen_dev_certs.sh" \
         "$@"
 fi
 
-# remove temporary devise_provisioning
-rm -r ${WORKDIR}
+# remove temporary device_provisioning
+rm -r "${WORKDIR}"
diff --git a/cml_tools/cml_sign_config_wrapper.sh b/cml_tools/cml_sign_config_wrapper.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # This file is part of GyroidOS
 # Copyright(c) 2013 - 2021 Fraunhofer AISEC
@@ -22,6 +22,8 @@
 # Fraunhofer AISEC <gyroidos@aisec.fraunhofer.de>
 #
 
+set -euo pipefail
+
 SCRIPTS_DIR=# Path to cml-tools folder (set on installation)
 
 # check if SCRIPTS_DIR is set
@@ -30,5 +32,4 @@ if [[ -z $SCRIPTS_DIR || ! -e $SCRIPTS_DIR/device_provisioning ]]; then
     exit 1
 fi
 
-bash ${SCRIPTS_DIR}/device_provisioning/oss_enrollment/config_creator/\
-sign_config.sh "$@"
+bash "${SCRIPTS_DIR}/device_provisioning/oss_enrollment/config_creator/sign_config.sh" "$@"
diff --git a/cml_tools/gen_guestos.sh b/cml_tools/gen_guestos.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 #
 # This file is part of GyroidOS
 # Copyright(c) 2013 - 2021 Fraunhofer AISEC
@@ -22,18 +22,16 @@
 # Fraunhofer AISEC <gyroidos@aisec.fraunhofer.de>
 #
 
-OSTMPL=$1
-OSNAME=$2
+set -euo pipefail
+
+OSTMPL="$1"
+OSNAME="$2"
 ROOTFS_TARBALL="$3"
-GYROIDOS_VERSION="1"
 
 SCRIPT_DIR="$4"
 DEPLOY_DIR_IMAGE="$7/out"
-GYROIDOS_HARDWARE="x86"
-
+GYROIDOS_VERSION="${8:-1}"
 
-CFG_OVERLAY_DIR="${SCRIPT_DIR}/config_overlay"
-CONFIG_CREATOR_DIR="${SCRIPT_DIR}/config_creator"
 PROTO_FILE_DIR="$5"
 PROVISIONING_DIR="${SCRIPT_DIR}/device_provisioning"
 ENROLLMENT_DIR="${PROVISIONING_DIR}/oss_enrollment"
@@ -43,17 +41,18 @@ GUESTOS_OUT="${DEPLOY_DIR_IMAGE}/gyroidos-guests"
 
 
 do_sign_guestos () {
-    name=${1}
-    rootfs=${2}
-    protoc --python_out=${ENROLLMENT_DIR}/config_creator \
-        -I${PROTO_FILE_DIR} ${PROTO_FILE_DIR}/guestos.proto
-    if [ ! -d ${GUESTOS_OUT} ]; then
-        mkdir -p ${GUESTOS_OUT}
+    local name="${1}"
+    local rootfs="${2}"
+    protoc "--python_out=${ENROLLMENT_DIR}/config_creator" \
+        "-I${PROTO_FILE_DIR}" "${PROTO_FILE_DIR}/guestos.proto"
+    if [ ! -d "${GUESTOS_OUT}" ]; then
+        mkdir -p "${GUESTOS_OUT}"
     fi
-    if [ ! -d ${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION} ]; then
-        mkdir -p ${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}/
+    if [ ! -d "${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}" ]; then
+        mkdir -p "${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}/"
     fi
 
+    local tmpdir
     tmpdir=$(mktemp -u -d)
     fakeroot -- bash -c "\
         mkdir -p ${tmpdir} &&\
@@ -64,28 +63,29 @@ do_sign_guestos () {
 
         echo "${OSTMPL}"
 
-        dd if=/dev/zero of=${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}/root.hash.img bs=1M count=10
+        dd if=/dev/zero of="${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}/root.hash.img" bs=1M count=10
 
-        root_hash=$(veritysetup format ${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}/root.img \
-                    ${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}/root.hash.img | \
+        local root_hash
+        root_hash=$(veritysetup format "${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}/root.img" \
+                    "${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}/root.hash.img" | \
                     grep 'Root hash:' | \
                     cut -d ":" -f2 | \
                     tr -d '[:space:]')
 
-    python3 ${ENROLLMENT_DIR}/config_creator/guestos_config_creator.py \
-        -b ${OSTMPL} -v ${GYROIDOS_VERSION} \
-        -c ${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}.conf \
-        -i ${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}/ -n ${name}os \
-        -d ${root_hash}
+    python3 "${ENROLLMENT_DIR}/config_creator/guestos_config_creator.py" \
+        -b "${OSTMPL}" -v "${GYROIDOS_VERSION}" \
+        -c "${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}.conf" \
+        -i "${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}/" -n "${name}os" \
+        -d "${root_hash}"
     cml_sign_config \
-        ${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}.conf \
-        ${TEST_CERT_DIR}/ssig_cml.key ${TEST_CERT_DIR}/ssig_cml.cert
+        "${GUESTOS_OUT}/${name}os-${GYROIDOS_VERSION}.conf" \
+        "${TEST_CERT_DIR}/ssig_cml.key" "${TEST_CERT_DIR}/ssig_cml.cert"
 
-    rm ${ENROLLMENT_DIR}/config_creator/guestos_pb2.py*
+    rm "${ENROLLMENT_DIR}/config_creator/guestos_pb2.py"*
 }
 
-mkdir -p ${DEPLOY_DIR_IMAGE}
-mkdir -p ${PROTO_FILE_DIR}
+mkdir -p "${DEPLOY_DIR_IMAGE}"
+mkdir -p "${PROTO_FILE_DIR}"
 
-echo do_sign_guestos ${OSNAME} ${ROOTFS_TARBALL}
-do_sign_guestos ${OSNAME} ${ROOTFS_TARBALL}
+echo "do_sign_guestos ${OSNAME} ${ROOTFS_TARBALL}"
+do_sign_guestos "${OSNAME}" "${ROOTFS_TARBALL}"