Add a script that will generate a new vblock given a kernel partition.

Add a script that will generate a new vblock given a kernel partition.

For use on our signing servers. May merge this with other scripts once we drill down the right workflow.

BUG=3496
TEST=Just a wrapper around vbutil_kernel and works as intended.

[gauravsh, 2010-07-23 22:29:55]

Just making sure this doesn't fall off your radar. It's just a wrapper
around vbutil_kernel, and part of the standalone tools we need for
setting up our signing servers.

On Thu, Jul 22, 2010 at 12:54 PM,  <gauravsh@chromium.org> wrote:
> Reviewers: vb,
>
> Description:
> Add a script that will generate a new vblock given a kernel partition.
>
> For use on our signing servers. May merge this with other scripts once we
> drill
> down the right workflow.
>
> BUG=3496
> TEST=Just a wrapper around vbutil_kernel and works as intended.
>
> Please review this at http://codereview.chromium.org/3020023/show
>
> SVN Base: ssh://git@gitrw.chromium.org:9222/vboot_reference.git
>
> Affected files:
>  A scripts/image_signing/resign_kernel_partition.sh
>
>
> Index: scripts/image_signing/resign_kernel_partition.sh
> diff --git a/scripts/image_signing/resign_kernel_partition.sh
> b/scripts/image_signing/resign_kernel_partition.sh
> new file mode 100755
> index
>
0000000000000000000000000000000000000000..fe2428eaf944a32f1bc4bc9bffa6a1b02d46c938
> --- /dev/null
> +++ b/scripts/image_signing/resign_kernel_partition.sh
> @@ -0,0 +1,38 @@
> +#!/bin/bash
> +
> +# Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
> +# Use of this source code is governed by a BSD-style license that can be
> +# found in the LICENSE file.
> +
> +# Script that just takes in a kernel partition and outputs a new vblock
> +# signed with the specific keys. For use on signing servers.
> +
> +# vbutil_kernel must be in the system path.
> +
> +# Abort on error
> +set -e
> +
> +# Check arguments
> +if [ $# -ne 4 ] ; then
> +  echo "usage: $0 src_kpart dst_vblock kernel_datakey kernel_keyblock"
> +  exit 1
> +fi
> +
> +# Make sure the tools we need are available.
> +type -P vbutil_kernel &>/dev/null || \
> +  { echo "vbutil_kernel tool not found."; exit 1; }
> +
> +src_kpart=$1
> +dst_vblock=$2
> +kernel_datakey=$3
> +kernel_keyblock=$4
> +
> +vbutil_kernel \
> +  --repack "${dst_vblock}" \
> +  --vblockonly \
> +  --keyblock "${kernel_keyblock}" \
> +  --signprivate "${kernel_datakey}" \
> +  --oldblob "${src_kpart}"
> +
> +echo "New kernel vblock was output to ${dst_vblock}"
> +
>
>
>



-- 
-g

[vb, 2010-07-27 00:22:16]

LGTM

after fixing the bracket style.

Did you try to use the generated output to see if it works as expected - would
be nice to add this to the test procedure.

http://codereview.chromium.org/3020023/diff/1/2
File scripts/image_signing/resign_kernel_partition.sh (right):

http://codereview.chromium.org/3020023/diff/1/2#newcode23
scripts/image_signing/resign_kernel_partition.sh:23: { echo "vbutil_kernel tool
not found."; exit 1; }
parens instead of curly brackets

[gauravsh, 2010-07-27 00:56:07]

Thanks, fixed and submitted.

On Mon, Jul 26, 2010 at 5:22 PM,  <vbendeb@chromium.org> wrote:
> LGTM
>
> after fixing the bracket style.
>
> Did you try to use the generated output to see if it works as expected -
> would
> be nice to add this to the test procedure.

It's a wrapper around vbutil_kernel. There isn't much to testing it
assuming vbutil_kernel works as advertised.

>
>
>
> http://codereview.chromium.org/3020023/diff/1/2
> File scripts/image_signing/resign_kernel_partition.sh (right):
>
> http://codereview.chromium.org/3020023/diff/1/2#newcode23
> scripts/image_signing/resign_kernel_partition.sh:23: { echo
> "vbutil_kernel tool not found."; exit 1; }
> parens instead of curly brackets
>
> http://codereview.chromium.org/3020023/show
>



-- 
-g