From 603033a86104bb7aaa2df8411d54e60eb00d38f6 Mon Sep 17 00:00:00 2001
From: tastytea <tastytea@tastytea.de>
Date: Wed, 30 Sep 2015 00:24:56 +0200
Subject: [PATCH] Parse header of ${DIGEST_FILE} to set correct hash calculator

---
 hashboot.sh | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/hashboot.sh b/hashboot.sh
index c6e993e..2083f61 100755
--- a/hashboot.sh
+++ b/hashboot.sh
@@ -16,6 +16,7 @@ HASHER=""
 BOOT_MOUNTED=0
 CONFIG_FILE="/etc/hashboot.cfg"
 
+
 #Umount /boot if we mounted it, exit with given exit code
 function die
 {
@@ -28,24 +29,12 @@ function die
     exit ${1}
 }
 
-
 #If we're not root: exit
 if [ ${UID} -ne 0 ]
 then
     die 4 "You have to be root"
 fi
 
-#Try different hashers, use the most secure
-HASHER=$(/usr/bin/which --skip-dot sha512sum 2> /dev/null)
-test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha384sum 2> /dev/null)
-test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha256sum 2> /dev/null)
-test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha224sum 2> /dev/null)
-#It gets insecure below here, but better than nothing?
-test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha1sum 2> /dev/null)
-test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot md5sum 2> /dev/null)
-#If we found no hasher: exit
-[ -z ${HASHER} ] && die 5 "No hash calculator found"
-
 #If /boot is in fstab but not mounted: mount, mark as mounted
 if grep -q '/boot.*noauto' /etc/fstab && ! grep -q /boot /etc/mtab
 then
@@ -53,8 +42,20 @@ then
     BOOT_MOUNTED=1
 fi
 
+
 if [ "${1}" == "index" ]
 then
+    #Try different hashers, use the most secure
+    HASHER=$(/usr/bin/which --skip-dot sha512sum 2> /dev/null)
+    test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha384sum 2> /dev/null)
+    test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha256sum 2> /dev/null)
+    test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha224sum 2> /dev/null)
+    #It gets insecure below here, but better than nothing?
+    test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot sha1sum 2> /dev/null)
+    test -z ${HASHER} && HASHER=$(/usr/bin/which --skip-dot md5sum 2> /dev/null)
+    #If we found no hasher: exit
+    [ -z ${HASHER} ] && die 5 "No hash calculator found"
+
     #Look for config file and set ${MBR_DEVICE}.
     if [ -f ${CONFIG_FILE} ]
     then
@@ -74,7 +75,7 @@ then
     #Write MBR of MBR_DEVICE to ${DIGEST_FILE}
     dd if=${MBR_DEVICE} of=${MBR_TMP} bs=1M count=1 status=none || die 8
     #Write hashes of all regular files to ${DIGEST_FILE}
-    ${HASHER} ${MBR_TMP} > ${DIGEST_FILE}
+    ${HASHER} ${MBR_TMP} >> ${DIGEST_FILE}
     find /boot -type f -exec ${HASHER} --binary {} >> ${DIGEST_FILE} +
     if [ $? == 0 ]
     then
@@ -94,6 +95,8 @@ then
 elif [ "${1}" == "check" ]
 then
     COUNTER=0
+    HASHER=$(head -n1 ${DIGEST_FILE} | awk '{print $5}')
+
     dd if=${MBR_DEVICE} of=${MBR_TMP} bs=1M count=1 status=none  || die 8
     if $(grep ${MBR_TMP} ${DIGEST_FILE} | ${HASHER} --check --warn --quiet --strict > ${LOG_FILE})
     then