Use new kernel-signing tools.

build_image

 #!/bin/bash
 
 # Copyright (c) 2009 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Script to build a bootable keyfob-based chromeos system image from within
 # a chromiumos setup. This assumes that all needed packages have been built into
 # the given target's root with binary packages turned on. This script will
 # build the Chrome OS image using only pre-built binary packages.
@@ skipping 469 matching lines @@
 ro
 noresume
 noswap
 i915.modeset=1
 loglevel=7
 Hi_Mom
 EOF
   
   # FIXME: We need to specify the real keys and certs here!
   SIG_DIR="${SRC_ROOT}/platform/vboot_reference/tests/testkeys"
+
+  # Wrap the public keys with VbPublicKey headers
+  vbutil_key --pack \
+    --in "${SIG_DIR}/key_rsa2048.keyb" \
+    --version 1 --algorithm 4 \
+    --out "${OUTPUT_DIR}/key_alg4.vbpubk"
+
+  vbutil_key --pack \
+    --in "${SIG_DIR}/key_rsa4096.keyb" \
+    --version 1 --algorithm 8 \
+    --out "${OUTPUT_DIR}/key_alg8.vbpubk"
+
+  vbutil_keyblock --pack "${OUTPUT_DIR}/data4_sign8.keyblock" \
+    --datapubkey "${OUTPUT_DIR}/key_alg4.vbpubk" \
+    --signprivate "${SIG_DIR}/key_rsa4096.pem" \
+    --algorithm 8 --flags 3
+    
+  # Verify the keyblock
+  vbutil_keyblock --unpack "${OUTPUT_DIR}/data4_sign8.keyblock" \
+    --signpubkey "${OUTPUT_DIR}/key_alg8.vbpubk"
+
+  # Sign the kernel:
+  vbutil_kernel --pack "${OUTPUT_DIR}/vmlinuz.image" \
+    --keyblock "${OUTPUT_DIR}/data4_sign8.keyblock" \
+    --signprivate "${SIG_DIR}/key_rsa2048.pem" \
+    --version 1 \
+    --config "${OUTPUT_DIR}/config.txt" \
+    --bootloader /lib64/bootstub/bootstub.efi \
+    --vmlinuz "${ROOT_FS_DIR}/boot/vmlinuz"
   
-  # Create the kernel partition image.
-  kernel_utility --generate \
-      --firmware_key "${SIG_DIR}/key_rsa4096.pem" \
-      --kernel_key "${SIG_DIR}/key_rsa1024.pem" \
-      --kernel_key_pub "${SIG_DIR}/key_rsa1024.keyb" \
-      --firmware_sign_algorithm 8 \
-      --kernel_sign_algorithm 2 \
-      --kernel_key_version 1 \
-      --kernel_version 1 \
-      --config "${OUTPUT_DIR}/config.txt" \
-      --bootloader /lib64/bootstub/bootstub.efi \
-      --vmlinuz "${ROOT_FS_DIR}/boot/vmlinuz" \
-      --out "${OUTPUT_DIR}/vmlinuz.image"
-  
+  # And verify it
+  vbutil_kernel --verify "${OUTPUT_DIR}/vmlinuz.image" \
+    --signpubkey "${OUTPUT_DIR}/key_alg8.vbpubk"
+
 else
   # FIXME: For now, ARM just uses the unsigned kernel by itself.
   cp -f "${ROOT_FS_DIR}/boot/vmlinuz" "${OUTPUT_DIR}/vmlinuz.image"
 fi
 
 
 # Perform any customizations on the root file system that are needed.
 "${SCRIPTS_DIR}/customize_rootfs" \
   --root="$ROOT_FS_DIR" \
   --target="$ARCH" \
@@ skipping 25 matching lines @@
 # Create the GPT-formatted image
 ${SCRIPTS_DIR}/build_gpt.sh \
   --arch=${ARCH} \
   --board=${FLAGS_board} \
   --arm_extra_bootargs="${FLAGS_arm_extra_bootargs}" \
   --rootfs_partition_size=${FLAGS_rootfs_partition_size} \
   ${RECOVERY} \
   "${OUTPUT_DIR}" \
   "${OUTPUT_IMG}"
 
-# Clean up temporary files.
-rm -f "${ROOT_FS_IMG}" "${STATEFUL_IMG}" "${OUTPUT_DIR}/vmlinuz.image" \
-  "${ESP_IMG}"
-rmdir "${ROOT_FS_DIR}" "${STATEFUL_DIR}" "${ESP_DIR}"
-
-OUTSIDE_OUTPUT_DIR="../build/images/${FLAGS_board}/${IMAGE_SUBDIR}"
-
 # Create a recovery image based on the chromium os base image
 [ "$FLAGS_recovery" -eq "$FLAGS_TRUE" ] && create_mod_image "recovery"
 trap - EXIT
 
 # Create a developer image based on the chromium os base image
 [ "$FLAGS_withdev" -eq "$FLAGS_TRUE" ] && create_mod_image "dev"
 trap - EXIT
 
-# be quiet again
-set +x
+# FIXME: only signing things for x86 right now.
+if [[ "$ARCH" = "x86" ]]; then
+  # Verify the final image
+  load_kernel2_test "${PRISTINE_IMAGE_NAME}" "${OUTPUT_DIR}/key_alg8.vbpubk"

[Randall Spangler, 2010/06/16 22:50:45]

renamed to load_kernel_test, after my latest cl.

+fi
+
+# Clean up temporary files.
+rm -f "${ROOT_FS_IMG}" "${STATEFUL_IMG}" "${OUTPUT_DIR}/vmlinuz.image" \
+  "${ESP_IMG}" "${OUTPUT_DIR}/data4_sign8.keyblock" \
+  "${OUTPUT_DIR}/key_alg4.vbpubk" "${OUTPUT_DIR}/key_alg8.vbpubk" 
+rmdir "${ROOT_FS_DIR}" "${STATEFUL_DIR}" "${ESP_DIR}"
+
+OUTSIDE_OUTPUT_DIR="../build/images/${FLAGS_board}/${IMAGE_SUBDIR}"
 
 echo "Done.  Image created in ${OUTPUT_DIR}"
 echo "Chromium OS image created as $PRISTINE_IMAGE_NAME"
 if [ "$FLAGS_recovery" -eq "$FLAGS_TRUE" ]; then
   echo "Recovery image created as $PRISTINE_IMAGE_NAME"
 fi
 if [ "$FLAGS_withdev" -eq "$FLAGS_TRUE" ]; then
   echo "Developer image created as $DEVELOPER_IMAGE_NAME"
 fi
 
 print_time_elapsed
 
 echo "To copy to USB keyfob, OUTSIDE the chroot, do something like:"
 echo "  ./image_to_usb.sh --from=${OUTSIDE_OUTPUT_DIR} --to=/dev/sdX"
 echo "To convert to VMWare image, OUTSIDE the chroot, do something like:"
 echo "  ./image_to_vmware.sh --from=${OUTSIDE_OUTPUT_DIR}"
 echo "from the scripts directory where you entered the chroot."