gen_uinitramfs.sh

#!/bin/bash
vma-cacl(){
	#$1=file/input string $2=image_end $3=SectionAlignment $4 is file/input switch
	local hfs
	[ $4 ]&&hfs=$(echo -n "$1"|wc -c)||hfs=$(stat -c%s "$1")
	printf "0x%x\n" $(( ((hfs % 0x$3 == 0) ? hfs : (hfs - hfs % 0x$3 + 0x$3)) + $2 ))
}
uki_builder(){ 
	if [ ! -e "$linux" ];then msg "\e[31mlinux:$linux is not exist\e[0m";exit;fi
	local stub_info="$(objdump -x "$top_dir/source/efi-stubs/$platform.efi.stub")"
	local stub_end=$((16#$(echo "$stub_info"|grep ImageBase|awk '{print $2}')+16#$(echo "$stub_info"|grep SizeOfImage|awk '{print $2}')))
	local stub_SA=$(echo "$stub_info"|grep SectionAlignment|awk '{print $2}')
	#TODO USE FOR TO PROCESS OBJ ARGS,BUT NOW,IT IS MEANINGLESS
	local cmdline_vma=$stub_end
	stub_end=$(vma-cacl "$cmdline" $stub_end $stub_SA 0)
	local linux_vma=$stub_end
	stub_end=$(vma-cacl $linux $stub_end $stub_SA)
	local initrd_vma=$stub_end
	stub_end=$(vma-cacl $build_dir/initramfs $stub_end $stub_SA)
	echo -n "$cmdline"|objcopy --add-section .linux=$linux --add-section .cmdline=/dev/stdin --add-section .initrd=$build_dir/initramfs --change-section-vma .cmdline=$cmdline_vma --change-section-vma .initrd=$initrd_vma --change-section-vma .linux=$linux_vma --set-section-flags .linux=code,readonly "$top_dir/source/efi-stubs/$platform.efi.stub" "$1"
}
get_file_handler(){
	case "$(detect_file "$1")" in
		gz)echo "gzip -dc";;
		xz)echo "xz -dc";;
		zst)echo "zstd -dc";;
		bin)echo "cat";;
	esac
}
detect_file(){
	local magic_num=$(xxd -l 6 -p "$1")||return 255
	case "$magic_num" in
		1f8b*)echo "gz";;
		4d5a*)echo "efi";;
		27051956*)echo "legacy-uimage";;
		Fd377a585a00)echo "xz";;
		28b52ffd*)echo "zst";;
		425a68*)echo "bz2";;
		504b0304*|504b0506*|504b0708*)echo "zip";;
		04224d18*)echo "lz4";;
		5d000080*)echo "lzma";;
		303730373031)echo "cpio";;
		*)echo "bin";;
	esac
}
append_file(){ dd if="$1" of="$2" oflag=append conv=notrunc;}
gen_cpio_comment(){ find $1 -mindepth 1 -type d -printf 'dir %P 755 0 0\n';find $1 -type f -printf 'file %P %p 755 0 0\n';find $1 -type l -printf 'slink %P %l 777 0 0\n';}
umsg(){ msg "[$util]$@";};msg(){ echo -e "\e[32m$@\e[0m";};smsg(){ msg "==>$@";}
esl2auth(){ $tools_dir/efiutils/sign-efi-sig-list $7 -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')"  -g $2 -k /dev/stdin -c $3 $4 $5 $6>/dev/null<<<"$1";}
cert2esl(){ openssl x509 -outform DER -in $2 -out $3;$tools_dir/efiutils/cert-to-efi-sig-list -g $1 $2 $4;}
cert_generate(){ openssl req -newkey rsa:4096 -nodes -keyout $1 -new -x509 -sha256 -days $cert_days -subj "/CN=Qbit UKI image/" -out $2>/dev/null 2>&1;echo "$(cat $1)";}
key_test(){ openssl rsa  -text>/dev/null 2>&1<<<"$1"&&openssl req -new -key /dev/stdin -out $2 -x509 -sha256 -days $cert_days -subj "/CN=Qbit UKI image/"<<<"$1"||(rm $2;echo -e "\e[31m=!!!=>bad costomer ${x%%=*}:${x#*=},new ${x%%=*} will generate automatically\e[0m");}
#cert_test(){ }
secure_boot(){ [ -z $secure_boot ]&&return;mkdir -p secureboot;cd secureboot;echo $keypair_guid>guid
[[ ! -f $temp_DB || -z $keypair_db ]]&&smsg "automatic generate db cert and key"&&keypair_db=$(cert_generate db.key db.cert)||mv $temp_DB db.cert&&mkdir -p db
[[ ! -f $temp_KEK || -z $keypair_kek ]]&&smsg "automatic generate kek cert and key"&&keypair_kek=$(cert_generate kek.key kek.cert)||mv $temp_KEK kek.cert&&mkdir -p KEK
[[ ! -f $temp_PK || -z $keypair_pk ]]&&smsg "automatic generate pk cert and key"&&keypair_pk=$(cert_generate pk.key pk.cert)||mv $temp_PK pk.cert
[ $keypair_dbx ]&&mv $temp_DBX dbx.cert&&mkdir -p dbx&&cert2esl guid dbx.cert dbx.der dbx.esl&&esl2auth "$keypair_kek" guid kek.cert dbx dbx.esl dbx/dbx.auth
cert2esl guid db.cert db.der db.esl;esl2auth "$keypair_kek" guid kek.cert db db.esl db/db.auth;cert2esl guid kek.cert kek.der kek.esl;esl2auth "$keypair_pk" guid pk.cert KEK kek.esl KEK/kek.auth;cert2esl guid pk.cert pk.der pk.esl;esl2auth "$keypair_pk" guid pk.cert PK pk.esl pk.auth 
$tools_dir/sbsigntools/sbsign --key /dev/stdin --cert db.cert --output ../linux.EFI ../linux.EFI<<<"$keypair_db"&&$tools_dir/sbsigntools/sbverify --cert db.cert ../linux.EFI||smsg "\e[31mFaile to verify signed efi file(WHY)!!!\e[0m"
for x in db KEK dbx;do for y in costomer-$x/*;do prf=${y%.*};pof=${y##*.};[[ $x == db* ]]&&key="$keypair_kek"&&crt=kek.cert||[ $x == KEK ]&&key="$keypair_pk"&&crt=pk.cert;[ -f costomer-$x/$prf.guid ]&&guid=costomer-$x/$prf.guid||guid=guid;[ $pof == cert ]&&cert2esl $guid $y $prf.der $prf.esl;esl2auth "$key" $guid $crt $x  $prf.esl $prf.auth -a;done&&mv costomer-$x/*.auth $x;done
[ "$sb_local_install" == y ]&&for v in PK KEK db dbx;do $tools_dir/efiutils/efi-readvar -v $v -o $v-old.esl;done&&sbbackup=$top_dir/sbbackup-$(date --date='1 second' +'%Y-%m-%d-%H:%M:%S').tar.zst&&tar --remove-files -cf - *-old.esl|zstd -T$(nproc) -19 -o $sbbackup&&smsg "backup uefi secureboot vars to $sbbackup"&&smsg "ready to install uefi vras,this operation need root access"&&chattr -i /sys/firmware/efi/efivars/{PK,KEK,db}*&&$tools_dir/sbsigntools/sbkeysync --no-default-keystores --keystore .&&$tools_dir/efiutils/efi-updatevar -f pk.auth PK;chattr +i /sys/firmware/efi/efivars/{PK,KEK,db}*;}
patch_util(){ 
	local status=0
	local utils_dir="$top_dir/source/utils"
	if [ ! -e "$utils_dir/$1" ];then
		msg "\e[31m$1 IS MISS!\e[0m"
		return 1
	fi
	[ -e "$utils_dir/$1/$platform" ]&&cp -rd "$utils_dir/$1/$platform"/. "$rootfs"
	[ -e "$utils_dir/$1/generic" ]&&cp -rd "$utils_dir/$1/generic"/. "$rootfs"
	umsg "Copying file successed"
	if [ -x "$utils_dir/$1/build.sh" ];then
		source "$utils_dir/$1/build.sh"
	fi
	if [[ -d "$utils_dir/$1/patch" && $status == 0 ]];then
		for p in "$utils_dir/$1/patch/"*.patch;do
			umsg "Applying patch file:$p"
			patch --no-backup-if-mismatch -flF5 -p1 -i"$p">/dev/null
		done
	elif [ $status == 128 ];then
		umsg "\e[33mSkip patch\e[0m"
	fi
}
itest(){ if [ -e "$1" ];then cat "$1";else echo "$1";return 1;fi;}
modules(){
	[ -z "$modules" ]&&return
	local kmodcmp vcount tmp
	local -a dkmodsub_version
	if [ "$kernel_version" ];then
		if ! [[ -e "$imodules_dir/$kernel_version" || -e "$fmodules_dir/$kernel_version" ]];then
			msg "\e[31mKernel version is invaild!\e[0m"
			return 1
		fi
		dkmodsub_version+=("$kernel_version")
	fi
	if [ "$1" == cpio ];then local process="\"$early_cpio_dir/usr\" -o \"$rootfs/usr\"";early_modules_dir="$early_cpio_dir/usr/lib/modules";else local process="\"$rootfs/usr\"";early_modules_dir="$rootfs/usr/lib/modules";fi
	mkdir -p "$early_modules_dir"
	if [ -e "$imodules_dir" ];then
		if [ "$unpack_modules" ];then
			local -a files
			tmp="$pwd";cd "$imodules_dir";mapfile -t files< <(find . -mindepth 2 -type f);cd "$tmp"
			if [ -z $trick ];then
				[ ${#files[@]} -gt 5 ]&&vcount=5||vcount=$((${#file[@]}/2))
				kmodcmp=0
				for((i=0;i<$vcount;i++));do
					uncompress_cmd="$(get_file_handler "$imodules_dir/${files[$i]}")"
					[ "$uncompress_cmd" == "cat" ]&&((kmodcmp++))
					[ $kmodcmp -gt $i ]&&continue
					if [ $kmodcmp -gt 0 ];then
						msg "\e[31mOops,is all modules (un)compressed?\nTry to use option:no trick,or disable this function!\e[0m"
						return 1
					fi
				done
			fi
			for i in "$files" ;do
				[ -e "$(dirname "$early_modules_dir/$i")" ]||mkdir -p "$(dirname "$early_modules_dir/$i")"
				[ $trick ]&&uncompress_cmd="$(get_file_handler "$i")"
				$uncompress_cmd "$i">"$early_modules_dir/${i%%.*}"&
			done
			for i in "$imodules_dir"/*;do
				[ ! -d "$i" ]||continue
				cp "$i"/{modules.order,modules.builtin,modules.builtin.modinfo} "$early_modules_dir/$(basename "$i")"
			done
		else
			[ "$kernel_version" ]||mapfile -t dkmodsub_version< <(find -L "$imodules_dir" -maxdepth 1 -mindepth 1 -type d -exec basename {} \;)
			for i in "${dkmodsub_version[@]}";do
				[ -e "$imodules_dir/$i/module.order" ]||continue
				cp "$imodules_dir/$i" "$early_modules_dir"
			done
		fi
	fi
	if [ -e "$fmodules_dir" ];then
		[ "$kernel_version" ]||mapfile -t dkmodsub_version< <(find -L "$fmodules_dir" -maxdepth 1 -mindepth 1 -type d -exec basename {} \;)
		if [ ! "$dkmodsub_version" ];then
			msg "\e[31mfull_modules_dir not exist!\e[0m"
			exit
		fi
		for i in "${dkmodsub_version[@]}";do
			[ -e "$fmodules_dir/$i/modules.dep.bin" ]||continue
			mapfile -t files< <("$tools_dir"/get_mod_deps  -d"$fmodules_dir/$i" $modules)
			if [ -z $trick ];then
				[ ${#files[@]} -gt 5 ]&&vcount=5||vcount=$((${#file[@]}/2))
				kmodcmp=0
				for((c=0;c<$vcount;c++));do
					uncompress_cmd="$(get_file_handler "$fmodules_dir/$i/${files[$c]}")"
					[ "$uncompress_cmd" == "cat" ]&&((kmodcmp++))
					[ $kmodcmp -gt $c ]&&continue
					if [ $kmodcmp -gt 0 ];then
						msg "\e[31mOops,is all modules (un)compressed?\nTry to use option:no trick,or disable this function!\e[0m"
						return 1
					fi
				done
			fi
			eval mkdir -p "'$early_modules_dir/$i'/{$(dirname ${files[@]}|sort -u|tr '\n' ','|sed 's/,$//')}"
			for m in "${files[@]}";do
				if [ $unpack_modules ];then
 					[ $trick ]&&uncompress_cmd="$(get_file_handler "$fmodules_dir/$i/$m")"
 					$uncompress_cmd "$fmodules_dir/$i/$m">"$early_modules_dir/$i/${m%%.*}.ko"&
				else
					cp "$fmodules_dir/$i/$m" "$early_modules_dir/$i/$m"&
				fi
			done
			eval cp -n "'$fmodules_dir/$i'/{modules.order,modules.builtin,modules.builtin.modinfo} '$early_modules_dir/$i'"
		done
	else
		msg "\e[31mfull_modules_dir $fmodules_dir not exist\e[0m"
		exit 1
	fi
	{ for i in "${dkmodsub_version[@]}";do
		[[ -e "$imodules_dir/$i/modules.order" || -e "$fmodules_dir/$i/modules.order" ]]||continue
		eval depmod -a "$i" -b "$process"&
	done
	wait
	find "$early_modules_dir" -maxdepth 2 -type f ! -name '*.bin' ! -name "modules.dep" -delete;}&
	#TODO busybox use module.dep to resolve modules,It's time to change it!
	: "${user_md_dir:="$top_dir/modprobe.d"}"
	[ -e $user_md_dir ]&&cp -rd $user_md_dir $rootfs/usr/lib/modprobe.d||true
}
firmware(){
	[ -z $firmware ]&&return
	local -a files
	local dest_path uncompress_cmd fwcmp rfirmware_dir tmp tricked vcount
	[ -e "$firmware_dir" ]||return 1
	tmp="$PWD";cd "$firmware_dir";mapfile -t files< <(find $rfirmware_dir -mindepth 1 -type f);cd "$tmp"
	[ "$1" == cpio ]&&dest_path="$early_cpio_dir/usr/lib"||dest_path="$rootfs/usr/lib"
	mkdir -p "$dest_path"
	if [ $unpack_firmware ];then
		fwcmp=0
		[ ${#file[@]} -gt 5 ]&&vcount=5||vcount=$((${#file[@]}/2))
		[ -z $trick ]&&for((i=0;i<$vcount;i++));do
			uncompress_cmd="$(get_file_handler "$firmware_dir/${files[$i]}")"
			[ "$uncompress_cmd" == "cat" ]&&((fwcmp++))
			[ $fwcmp -gt $i ]&&continue
			if [ $fwcmp -gt 0 ];then
				msg "Oops,is all firmware (un)compressed?\nTry to use option:no trick,or disable this function!"
				return 1
			fi
		done
		for i in "$files";do
			[ $trick ]&&uncompress_cmd="$(get_file_handler "$i")"
			[ -e $(dirname $dest_path/$i) ]||mkdir -p $(dirname $dest_path/$i)
			uncompress_cmd "$firmware_dir/$i">"$dest_path/${i%%.*}"
		done
	else
		cp -a "$firmware_dir" "$dest_path"
	fi
}
ucode(){ 
	[ $deucode ]||return 0
	[ $early_cpio ]&&ucode_decpio=y&&cd "$early_cpio_dir"
	for i in $ucode;do
		if [ $ucode_decpio ];then
			cpio -id -F $i
		else
			append_file "$i" "$build_dir/initramfs"
		fi
	done
	[ -d kernel ]&&find kernel -name ".*" -delete
	[[ -d $early_cpio_dir && $rucode  ]]||[ ${#rucode_list[@]} -ge 3 ]||return 0
	mkdir -p $early_cpio_dir/kernel/$arch/microcode
	if [ "$rucode" ];then
		for i in $rucode;do
			#gen_init_cpio not support "blank space" so,I don't want to add "" becase it is "safe",lol
			append_file $i $early_cpio_dir/kernel/$arch/microcode/$(basename $i)
		done
	else
		local vendor_name raw_mode
		for i in ${rucode_list[@]};do
			if [ "${i: -1}" != "/" ];then
				[ $vendor_name == "" ]&&append_file $i $early_cpio_dir/kernel/$arch/microcode/$i||append_file $i $early_cpio_dir/kernel/$arch/microcode/$vendor_name
			else
				[ ${i%%:*} != "" ]&&vendor_name=${i%%:*}
			fi
		done
	fi
}
package(){
	rm -f "$build_dir/initramfs"
	if [ "$1" == 0 ];then
		if [ $early_cpio ];then
			mkdir $early_cpio_dir
			cd $early_cpio_dir
			touch early_cpio
			ucode
			[ $early_modules ]&&modules cpio||modules
			[ $early_firmware ]&&firmware cpio||firmware
			wait
			gen_cpio_comment|$tools_dir/gen_init_cpio ->>../initramfs
		else
			ucode
			modules
			firmware
		fi
	fi
	cd $rootfs
	wait
	{ gen_cpio_comment;echo "nod /dev/null 666 0 0 c 1 3";}|$tools_dir/gen_init_cpio -|zstd -19 -T$(nproc) -n>>../initramfs;cd $top_dir
	if [ "$package" == ramdisk ];then mkimage -A $arch -O linux -T ramdisk -C zstd -d initramfs ramdisk.img
	elif [ "$package" == uki ];then uki_builder ${efioutput:-$top_dir/linux.efi};secure_boot;fi
}
set -eE;shopt -s dotglob;self="$(realpath "$0")";top_dir="$(dirname "$self")"
tools_dir="$top_dir/tools"
cert_days=3650
build_dir="$top_dir/build_dir"
rootfs="$build_dir/rootfs"
early_cpio_dir="$build_dir/early_cpio"
imodules_dir="$top_dir/modules"
firmware_dir="$top_dir/firmware"
declare -a rucode_list;cd $top_dir;trap 'rm -rf $temp_DB $temp_KEK $temp_PK $temp_DBX;exit 1' ERR SIGINT SIGTERM
for x in "$@";do
case $x in
	unpack)
		raw="$(realpath $2)"
		type=$(detect_file "$raw")
		[ -d cpio ]&&oput=$(mktemp -udp $top_dir cpio-XXXXXX)||oput=cpio
		[ -z "$3" ]||oput="$(realpath $3)";mkdir "$oput";cd "$oput"
		if [ "$type" == "cpio" ];then
			cpio -idmI"$raw";$tools_dir/skipcpio "$raw"|zstd -d|cpio -id>/dev/null
		elif [ "$type" == "legacy-uimage" ];then
			dd if="$raw" skip=1 bs=64|zstd -d|cpio -id>/dev/null
		elif [ "$type" == "efi" ];then
			objcopy -O binary "$raw" -j.linux linux
			objcopy -O binary "$raw" -j.initrd initramfs 2>/dev/null
			objcopy -O binary "$raw" -j.cmdline cmdline 2>/dev/null
			exec "$self" unpack "$PWD/initramfs" "$PWD/initramfs-unpacked"
		else
			zstd -d -c $raw|cpio -id
		fi;exit
	;;
	help | -h | --help)echo -e\
	"args:
	package=(uki,ramdisk(uinitrd for uboot bootchain),initramfs)
	ARCH=(x86_64,aarch64)
	mode=(standard,tiny,minimum)
	modules=(any value to enable,but when full_modules_dir prived,use it as specify modules.)
	firmware=(y/N)
	firmware_dir=(\$dir_path,append to initramfs directly,default:firmware.)
	early_cpio_mode=(firmware,modules)
	include_modules_dir=(\$dir_path,append to initramfs directly,default:modules.)
	full_modules_dir=(\$dir_path,module decteder will find specified modules in this path,default:"".)
	modprobe.d=(\$dir_path,default:modprobe.d.)
	efi_output=(\$path,default:linux.efi,must writeable.)
	utils=(\$utilsname(spilt by ','))
	ucode_vendor=(intel,amd(pre_process)......(raw),only work when ucode format not is cpio.)
	ucode=(\$file(if it not is cpio,will enable early_cpio automatically.))
	secure-boot=(y/N)
	package:package build_dir.
	unpack:(file output),unpack initramfs,uki image,cpio.

extra options:
	kernel_vserion:(define a kernel version,some behavior will be change e.g:module.)
	trick:(use unstable optimize,mostly it is fine,any value to disable.)
	uki:(linux=,ucode=,cmdline=(support file,or splilt by '\,'.))
	utils:(utilsoptions=(spilt by ','.))
	modules:(unpack_modules=(y/N):uncompress modules(kernel feature \"MODULE_DECOMPRESS\" disabled or pursure faster boot time.))
	initramfs:delaytime:(set a number,change tty delaytime.)

secure-boot's chlid options:
	To add costomer KEK/db/dbx els/crt,put in secureboot/costomer-{KEK/db/dbx}(don't use pk/kek/db/dbx prefix name!),to use another guid,rename it as same as *.esl/*.crt/*.guid.
	local-install=(y/N)
	keypair-pk=(select a key file/cert file or type in(spilt worlds by '\,',spilt line by ','),otherwise it will generate automatic,all of crt will pull to secureboot dir.),(default days 3650,subj:/CN:Qbit UKI image)
	keypair-kek=(^)
	keypair-db=(^)
	keypair-pk=(^)
	keypair-guid=(^,must type in,even it is miss,messy.)";exit;;
	ARCH=*[![:space:]])platform="${x#ARCH=}";;package=*[![:space:]])package="${x#package=}";;mode=*[![:space:]])mode="${x#mode=}";;firmware=y)firmware=y;;
	clean)rm -rf rm ramdisk.img $build_dir initramfs linux.efi $early_cpio_dir cpio*;exit;;
	early_cpio_mode=*[![:space:]])
		for z in $(sed 's/,/ /g'<<<"${x#early_cpio_mode=}");do
			case $z  in firmware)early_firmware=y;;
			modules)early_modules=y;;esac;done
		[ -z $early_cpio ]&&early_cpio=y;;
	modules=*[![:space:]])modules=$(sed -e 's/,/ /g'< <(itest "${x#modules=}"));;
	unpack_modules=y)unpack_modules=y;;
	full_modules_dir=*[![:space:]])fmodules_dir=$(realpath "${x#full_modules_dir=}");;
	include_modules_dir=*[![:space:]])imodules_dir="$(realpath ${x#modules_dir=})";;
	modprobe.d=*[![:space:]])user_md_dir="$(realpath ${x#modprobe.d=})";;
	firmware=y);;
	unpack_firmware=y);;
	firmware_dir=*[![:space:]])firmware_dir="$(realpath "${x#firmware_dir=}")";;
	linux=*[![:space:]])linux="${x#linux=}";;
	efi_output=*[![:space:]])efioutput="${x#efi_output=}";[ ! -w $(dirname $efioutput) ]&&msg "\e[31mefi_output path is't writeable!\e[0m"&&exit 1;;
	ucode_vendor=*[![:space:]])ucode_vendor="${x#ucode_vendor=}"
		#Arrary structure:[ / vendor_name:/ name name name name / vendor_name:/ name name ]
		if [ "$ucode_vendor" == amd ];then
			ucode_vendor="AuthenticAMD.bin:/"
		elif [ "$ucode_vendor" == intel ];then
			ucode_vendor="GenuineIntel.bin:/"
		elif [ "$ucode_vendor" == raw ];then
			ucode_vendor=":/"
		fi
		rucode_list+=("/")
		rucode_list+=("$ucode_vendor:/")
		[ -z $rucode ]||for i in $rucode;do rucode_list+=($i);done;rucode=""
	;;
	ucode=*[![:space:]])
		[ -e ${x#ucode=} ]&&iucode="$(realpath ${x#ucode=})"||exit
		if [ "$(file --mime-type -b $iucode)" == "application/octet-stream" ];then
			[ -z $early_cpio ]&&early_cpio=y
			[ -z $ucode_decpio ]&&ucode_decpio=y
			if [ $ucode_vendor ];then
				for i in $rucode $iucode;do rucode_list+=($i);done
				rucode=""
			else
				rucode=" $iucode$rucode"
			fi
		else
			ucode=" $iucode$ucode"
		fi
		deucode=y
	;;
	delaytime=*)[[ "${x#delaytime=}" =~ ^-?[0-9]*\.?[0-9]+$ ]]&&delaytime=${x#delaytime=}||msg "\e[33m=!!!=>delaytime not is a number,using default value!\e[0m";;
	cmdline=*[![:space:]])cmdline="$(itest ${x#cmdline=})"||cmdline="$(sed 's/\,/ /g'<<<$cmdline)";;
	utils=*[![:space:]])utils=$(sed 's/,/ /g'<<<"${x#utils=}");patched_utils=;skip_utils=;;
	utilsoptions=*[![:space:]])utilsoptions="${x#utilsoptions=}";;
	secure-boot=y)secure_boot=y;;
	keypair-pk=*[![:space:]])keypair_pk=$(itest "$(sed -e 's/\\,/ /g' -e 's/,/\n/g')<<<${x#keypair-pk=}")||true;temp_PK=$(mktemp);key_test "$keypair_pk" $temp_PK;;
	keypair-guid=[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})keypair_guid=$(itest ${x#keypair-guid=})||true;keypair_guid=$(uuidgen)&&[ $keypair_guid != $(itest ${x#keypair-guid=})  ]&&msg "\e[31m=!!!=>bad costomer keypair-guid:${x#keypair-guid=},new keypair_guid is $keypair_guid\e[0m";;
	keypair-kek=*[![:space:]])keypair_kek=$(itest "$(sed -e 's/\\,/ /g' -e 's/,/\n/g'<<< ${x#keypair-kek=})")||true;temp_KEK=$(mktemp);key_test "$keypair_kek" $temp_KEK;;
	keypair-dbx=*[![:space:]])keypair_dbx=$(itest "$(sed -e 's/\\,/ /g' -e 's/,/\n/g'<<<${x#keypair-dbx=})")||true;temp_DBX=$(mktemp);key_test "$keypair_dbx" $temp_DBX;;
	keypair-db=*[![:space:]])keypair_db=$(itest "$(sed -e 's/\\,/ /g' -e 's/,/\n/g'<<<${x#keypair-db=})")||true;temp_DB=$(mktemp);key_test "$keypair_db" $temp_DB;;
	local-install=y)sb_local_install=y;;
	trick=*)trick=n;;
	kernel_version=*[![:space:]])kernel_version="${x#kernel_version=}";;
	package)package 1;exit;;esac;done
unset  ucode_vendor iucode
mkdir -p "$build_dir"
rm -rf "$rootfs" "$early_cpio_dir"
[ "$platform" == aarch64 ]&&arch=arm;[ "$platform" == x86_64 ]&&arch=x86
cp -a source/busybox/busybox-$platform-$mode "$rootfs"
cp -a source/lib/generic/. source/lib/$platform/. "$rootfs/usr/lib"
cp -a source/init "$rootfs/usr/bin/init"
ln -s usr/bin/init "$rootfs/init"
cd "$rootfs";for util in $utils;do [[ $skip_utils =~ $util ]]&&continue||patch_util $util;patched_utils+=$util;done;wait;cd "$top_dir"
if [ $delaytime ];then
	[ $delaytime != 0 ]||sed -i -e '$!N' -e '/read -sn 1 -t.*&&exec sh -i/{N;d;}' -e 'P;D' "$rootfs/usr/bin/init"&&sed -i "s/read -sn 1 -t 0.4&&exec sh -i/read -sn 1 -t $delaytime \&\&exec sh -i/g" "$rootfs/usr/bin/init"
fi
package 0