#!/bin/sh

# Exit immediately if a command exits with a non-zero status
set -e

# Summary of the script's functionality
summary="Decrypts a ZFS root pool with a TPM2.0 chip."

# Display summary if requested
if [ "$1" = "--summary" ]; then
	echo "$summary"
	exit 0
fi

# Check if zlevis-decrypt is present
if ! command -v zlevis-decrypt > /dev/null; then
	echo "Script zlevis-decrypt is not present"
	exit 1
fi

# Read ZFS dataset information.
zfs list -Ho name,encryption,keystatus,encryptionroot,tpm:jwe | while IFS=$'\t' read -r ds enc keystatus encroot jwe; do
	# Check if the dataset is the encryption root.
    if [ "$ds" = "$encroot" ] && [ "$enc" != "off" ] && [ "$jwe" != "-" ]; then
        if [ "$keystatus" = "available" ]; then
            echo "Pool $ds already unlocked"
        else
            echo "Loading key for $ds"
            if echo -n "$jwe" | zlevis-decrypt | zfs load-key -L prompt "$ds"; then
                echo "Unlocked $ds"
            else
                echo "Failed to unlock $ds" >&2
		        exit 1
            fi
        fi
    fi
done