Gets Google OVMF firmware based on MRTD

mrtd-to-firmware.py

#!/usr/bin/env python3
import sys, os, subprocess, tempfile, urllib.request

with tempfile.TemporaryDirectory() as d:
    # Download proto files
    urllib.request.urlretrieve("https://raw.githubusercontent.com/google/gce-tcb-verifier/refs/heads/main/proto/endorsement.proto", f"{d}/endorsement.proto")
    os.makedirs(f"{d}/google/protobuf", exist_ok=True)
    urllib.request.urlretrieve("https://raw.githubusercontent.com/protocolbuffers/protobuf/main/src/google/protobuf/timestamp.proto", f"{d}/google/protobuf/timestamp.proto")
    
    # Download binarypb
    subprocess.run(['gsutil', 'cp', f'gs://gce_tcb_integrity/ovmf_x64_csm/tdx/{sys.argv[1]}.binarypb', f'{d}/m.pb'], check=True)
    
    # Compile proto and extract digest
    subprocess.run(['protoc', f'--proto_path={d}', f'--python_out={d}', f'{d}/endorsement.proto'], check=True)
    sys.path.insert(0, d)
    import endorsement_pb2
    e = endorsement_pb2.VMLaunchEndorsement()
    e.ParseFromString(open(f'{d}/m.pb', 'rb').read())
    g = endorsement_pb2.VMGoldenMeasurement()
    g.ParseFromString(e.serialized_uefi_golden)
    
    # Download firmware
    subprocess.run(['gsutil', 'cp', f'gs://gce_tcb_integrity/ovmf_x64_csm/{g.digest.hex()}.fd', 'firmware.fd'], check=True)