Only sign kernel for x86 for now. Leave ARM unsigned.

src/scripts/build_image

 #!/bin/bash
 
 # Copyright (c) 2009 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Script to build a bootable keyfob-based chromeos system image from within
 # a chromiumos setup. This assumes that all needed packages have been built into
 # the given target's root with binary packages turned on. This script will
 # build the Chrome OS image using only pre-built binary packages.
@@ skipping 417 matching lines @@
 menuentry "local image A" {
   linux $grubpartA/boot/vmlinuz quiet console=tty2 init=/sbin/init boot=local rootwait root=/dev/$linuxpartA ro noresume noswap i915.modeset=1 loglevel=1
 }
 
 menuentry "local image B" {
   linux $grubpartB/boot/vmlinuz quiet console=tty2 init=/sbin/init boot=local rootwait root=/dev/$linuxpartB ro noresume noswap i915.modeset=1 loglevel=1
 }
 
 EOF
 
-# Legacy BIOS will use the kernel in the rootfs (via syslinux), as will
-# standard EFI BIOS (via grub, from the EFI System Partition). Chrome OS BIOS
-# will use a separate signed kernel partition, which we'll create now.
-# FIXME: remove serial output, debugging messages
-cat <<'EOF' > "${OUTPUT_DIR}/config.txt"
+# FIXME: At the moment, we're working on signed images for x86 only. ARM will
+# support this before shipping, but at the moment they don't.
+if [[ "$ARCH" = "x86" ]]; then
+  
+  # Legacy BIOS will use the kernel in the rootfs (via syslinux), as will
+  # standard EFI BIOS (via grub, from the EFI System Partition). Chrome OS BIOS
+  # will use a separate signed kernel partition, which we'll create now.
+  # FIXME: remove serial output, debugging messages
+  cat <<'EOF' > "${OUTPUT_DIR}/config.txt"
 earlyprintk=serial,ttyS0,115200
 console=ttyS0,115200
 init=/sbin/init
 add_efi_memmap
 boot=local
 rootwait
 root=/dev/sd%D%P
 ro
 noresume
 noswap
 i915.modeset=1
 loglevel=7
 Hi_Mom
 EOF
+  
+  # FIXME: We need to specify the real keys and certs here!
+  SIG_DIR="${SRC_ROOT}/platform/vboot_reference/tests/testkeys"
+  
+  # Create the kernel partition image.
+  kernel_utility --generate \
+      --firmware_key "${SIG_DIR}/key_rsa4096.pem" \
+      --kernel_key "${SIG_DIR}/key_rsa1024.pem" \
+      --kernel_key_pub "${SIG_DIR}/key_rsa1024.keyb" \
+      --firmware_sign_algorithm 8 \
+      --kernel_sign_algorithm 2 \
+      --kernel_key_version 1 \
+      --kernel_version 1 \
+      --config "${OUTPUT_DIR}/config.txt" \
+      --bootloader /lib64/bootstub/bootstub.efi \
+      --vmlinuz "${ROOT_FS_DIR}/boot/vmlinuz" \
+      --out "${OUTPUT_DIR}/vmlinuz.image"
+  
+else
+  # FIXME: For now, ARM just uses the unsigned kernel by itself.
+  cp -f "${ROOT_FS_DIR}/boot/vmlinuz" "${OUTPUT_DIR}/vmlinuz.image"
+fi
 
-# FIXME: We need to specify the real keys and certs here!
-SIG_DIR="${SRC_ROOT}/platform/vboot_reference/tests/testkeys"
-
-# Create the kernel partition image.
-kernel_utility --generate \
-    --firmware_key "${SIG_DIR}/key_rsa4096.pem" \
-    --kernel_key "${SIG_DIR}/key_rsa1024.pem" \
-    --kernel_key_pub "${SIG_DIR}/key_rsa1024.keyb" \
-    --firmware_sign_algorithm 8 \
-    --kernel_sign_algorithm 2 \
-    --kernel_key_version 1 \
-    --kernel_version 1 \
-    --config "${OUTPUT_DIR}/config.txt" \
-    --bootloader /lib64/bootstub/bootstub.efi \
-    --vmlinuz "${ROOT_FS_DIR}/boot/vmlinuz" \
-    --out "${OUTPUT_DIR}/vmlinuz.image"
 
 # Perform any customizations on the root file system that are needed.
 "${SCRIPTS_DIR}/customize_rootfs" \
   --root="$ROOT_FS_DIR" \
   --target="$ARCH" \
   --board="$BOARD"
 
 # Don't test the factory install shim.
 if [[ $FLAGS_factory_install -eq ${FLAGS_FALSE} ]] ; then
   # Check that the image has been correctly created.
@@ skipping 44 matching lines @@
 echo "Done.  Image created in ${OUTPUT_DIR}"
 echo "Chromium OS image created as $PRISTINE_IMAGE_NAME"
 if [ "$FLAGS_withdev" -eq "$FLAGS_TRUE" ]; then
   echo "Developer image created as $DEVELOPER_IMAGE_NAME"
 fi
 echo "To copy to USB keyfob, OUTSIDE the chroot, do something like:"
 echo "  ./image_to_usb.sh --from=${OUTSIDE_OUTPUT_DIR} --to=/dev/sdX"
 echo "To convert to VMWare image, OUTSIDE the chroot, do something like:"
 echo "  ./image_to_vmware.sh --from=${OUTSIDE_OUTPUT_DIR}"
 echo "from the scripts directory where you entered the chroot."