#compdef ukify
# SPDX-License-Identifier: LGPL-2.1-or-later

_ukify_at_file() {
    compset -P '@' && _files
}

_ukify_section_file() {
    compset -P 1 '*:' || return
    if [[ $PREFIX == text@* ]]; then
        compset -P text
    elif [[ $PREFIX == binary@* ]]; then
        compset -P binary
    fi
    _ukify_at_file
}

_ukify_verb() {
    local -a verbs=(build genkey inspect completion) shells=(bash zsh)
    if (( CURRENT == 1 )); then
        _describe -t commands 'ukify verb' verbs
    elif [[ $words[1] == completion ]] && (( CURRENT == 2 )); then
        _describe 'shell' shells
    elif [[ $words[1] == inspect ]]; then
        _files
    fi
}

_arguments -s -S \
    '(--version)--version[show program'"'"'s version number and exit]' \
    '(--summary)--summary[print parsed config and exit]' \
    '(--config -c)--config=[configuration file]:argument:_files' \
    '(--config -c)-c+[configuration file]:argument:_files' \
    '(--linux)--linux=[vmlinuz file \[.linux section\]]:argument:_files' \
    '(--os-release)--os-release=[path to os-release file \[.osrel section\]]:argument:_ukify_at_file' \
    '(--cmdline)--cmdline=[kernel command line \[.cmdline section\]]:argument:_ukify_at_file' \
    '*--initrd=[initrd file \[part of .initrd section\]]:argument:_files' \
    '*--efifw=[Directory with efi firmware binary file \[.efifw section\]]:argument:_files -/' \
    '(--microcode)--microcode=[microcode file \[.ucode section\]]:argument:_files' \
    '(--splash)--splash=[splash image bitmap file \[.splash section\]]:argument:_files' \
    '(--devicetree)--devicetree=[Device Tree file \[.dtb section\]]:argument:_files' \
    '*--devicetree-auto=[DeviceTree file for automatic selection \[.dtbauto section\]]:argument:_files' \
    '(--hwids)--hwids=[Directory with HWID text files \[.hwids section\]]:argument:_files -/' \
    '(--uname)--uname=["uname -r" information \[.uname section\]]:argument:' \
    '*--sbat=[SBAT policy \[.sbat section\]]:argument:_ukify_at_file' \
    '(--pcrpkey)--pcrpkey=[embedded public key to seal secrets to \[.pcrpkey section\]]:argument:_files' \
    '*--section=[section as name and contents \[NAME section\] or section to print]:argument:_ukify_section_file' \
    '(--profile)--profile=[Profile information \[.profile section\]]:argument:_ukify_at_file' \
    '*--join-profile=[A PE binary containing an additional profile to add to the UKI]:argument:_files' \
    '*--sign-profile=[Which profiles to sign expected PCR measurements for]:argument:' \
    '(--pcrsig)--pcrsig=[Signed PCR policy JSON \[.pcrsig section\] to append to an existing UKI]:argument:_ukify_at_file' \
    '(--join-pcrsig)--join-pcrsig=[A PE binary containing a UKI without a .pcrsig to join with --pcrsig]:argument:_files' \
    '(--efi-arch)--efi-arch=[target EFI architecture]:argument:(ia32 x64 arm aa64 riscv32 riscv64 loongarch32 loongarch64)' \
    '(--stub)--stub=[path to the sd-stub file \[.text,.data,… sections\]]:argument:_files' \
    '(--pcr-banks)--pcr-banks=[]:argument:' \
    '(--signing-engine)--signing-engine=[OpenSSL engine to use for signing]:argument:' \
    '(--signing-provider)--signing-provider=[OpenSSL provider to use for signing]:argument:' \
    '(--certificate-provider)--certificate-provider=[OpenSSL provider to load certificate from]:argument:' \
    '(--signtool)--signtool=[whether to use sbsign or pesign. It will also be inferred by the other parameters given: when using --secureboot-{private-key/certificate}, sbsign will be used, otherwise pesign will be used]:argument:(sbsign pesign systemd-sbsign)' \
    '(--secureboot-private-key)--secureboot-private-key=[required by --signtool=sbsign|systemd-sbsign. Path to key file or engine/provider designation for SB signing]:argument:_files' \
    '(--secureboot-certificate)--secureboot-certificate=[required by --signtool=sbsign. sbsign needs a path to certificate file or engine-specific designation for SB signing]:argument:_files' \
    '(--secureboot-certificate-common-name)--secureboot-certificate-common-name=[common name of a certificate created by '"'"'genkey'"'"']:argument:' \
    '(--secureboot-certificate-dir)--secureboot-certificate-dir=[required by --signtool=pesign. Path to nss certificate database directory for PE signing. Default is /etc/pki/pesign]:argument:_files -/' \
    '(--secureboot-certificate-name)--secureboot-certificate-name=[required by --signtool=pesign. pesign needs a certificate nickname of nss certificate database entry to use for PE signing]:argument:' \
    '(--secureboot-certificate-validity)--secureboot-certificate-validity=[period of validity (in days) for a certificate created by '"'"'genkey'"'"']:argument:' \
    '(--sign-kernel --no-sign-kernel)--sign-kernel[Sign the embedded kernel]' \
    '(--sign-kernel --no-sign-kernel)--no-sign-kernel[Sign the embedded kernel]' \
    '(--sign-initrd-pcrs --no-sign-initrd-pcrs)--sign-initrd-pcrs[additionally sign PCR policies that can only be satisfied from the initrd]' \
    '(--sign-initrd-pcrs --no-sign-initrd-pcrs)--no-sign-initrd-pcrs[additionally sign PCR policies that can only be satisfied from the initrd]' \
    '*--pcr-private-key=[private part of the keypair or engine/provider designation for signing PCR signatures]:argument:_files' \
    '*--pcr-public-key=[public part of the keypair or engine/provider designation for signing PCR signatures]:argument:_files' \
    '*--pcr-certificate=[certificate part of the keypair or engine/provider designation for signing PCR signatures]:argument:_files' \
    '*--phases=[phase-paths to create signatures for]:argument:' \
    '*--policyref=[policy references to bind signatures to]:argument:' \
    '*--tools=[Directories to search for tools (systemd-measure, …)]:argument:_files -/' \
    '(--output -o)--output=[output file path]:argument:_files' \
    '(--output -o)-o+[output file path]:argument:_files' \
    '(--measure --no-measure)--measure[print systemd-measure output for the UKI]' \
    '(--measure --no-measure)--no-measure[print systemd-measure output for the UKI]' \
    '(--policy-digest --no-policy-digest)--policy-digest[print systemd-measure policy digests for the UKI]' \
    '(--policy-digest --no-policy-digest)--no-policy-digest[print systemd-measure policy digests for the UKI]' \
    '(--json)--json=[generate JSON output]:argument:(pretty short off)' \
    '(-j)-j[equivalent to --json=pretty]' \
    '(--all)--all[print all sections]' \
    '(-h --help)-h[show this help message and exit]' \
    '(-h --help)--help[show this help message and exit]' \
    '*::ukify verb:_ukify_verb'
