Add a script for standalone signing of Chrome OS images.

scripts/image_signing/cros_resign_image_standalone.sh

Index: scripts/image_signing/cros_resign_image_standalone.sh
diff --git a/scripts/image_signing/cros_resign_image_standalone.sh b/scripts/image_signing/cros_resign_image_standalone.sh
new file mode 100755
index 0000000000000000000000000000000000000000..523d5120950078178038e819de58b815f35f796a
--- /dev/null
+++ b/scripts/image_signing/cros_resign_image_standalone.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+
+# Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Standalone version of cros_resign_image.sh script from
+# from chromeos/src/scripts/bin/ for use on signing servers.
+
+# Both the cgpt tool and vbutil_kernel should be in the system path. 
+

[vb, 2010/07/14 19:20:29]

this script is oblivious to any of the errors which might happen while
executing. Maybe add `set -e' at the top at least?

+# Check arguments
+if [ $# -ne 4 ] ; then
+  echo "usage: $0 src_bin dst_bin kernel_datakey kernel_keyblock" 
+  exit 1
+fi
+
+# Make sure the tools we need are available.
+type -P cgpt &>/dev/null || \
+  { echo "cgpt tool not found."; exit 1; }
+type -P vbutil_kernel &>/dev/null || \
+  { echo "vbutil_kernel tool not found."; exit 1; }
+
+sector_size=512  # sector size in bytes
+num_sectors_vb=128  # number of sectors in kernel verification blob
+src_bin=$1
+dst_bin=$2
+datakey=$3
+keyblock=$4
+
+koffset="$(cgpt show -b -i 2 $1)"
+ksize="$(cgpt show -s -i 2 $1)"
+
+echo "Re-signing image ${src_bin} and outputting ${dst_bin}"
+temp_kimage=$(mktemp)
+trap "rm -f ${temp_kimage}" EXIT
+temp_out_vb=$(mktemp)
+trap "rm -f ${temp_out_vb}" EXIT
+
+# Grab the kernel image in preparation for resigning
+dd if="${src_bin}" of="${temp_kimage}" skip=$koffset bs=$sector_size \
+  count=$ksize
+vbutil_kernel \
+  --repack "${temp_out_vb}" \
+  --vblockonly \
+  --keyblock "${kernel_keyblock}" \
+  --signprivate "${kernel_datakey}" \
+  --oldblob "${temp_kimage}"
+
+# Create a copy of the input image and put in the new vblock
+cp "${src_bin}" "${dst_bin}"
+dd if="${temp_out_vb}" of="${dst_bin}" seek=$koffset bs=$sector_size \
+  count=$num_sectors_vb conv=notrunc
+
+echo "New signed image was output to ${dst_bin}"
+
+# Clean up temporary files
+rm -f ${temp_kimage}

[vb, 2010/07/14 19:20:29]

aren't these taken care of by the traps in lines 36 and 38?

+rm -f ${temp_out_vb}