Make signing script re-sign Firmware AU payload, and update rootfs hash.

scripts/image_signing/resign_firmwarefd.sh

 #!/bin/bash
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Script to resign a firmware image using a different set of keys
 # for use on signing servers.
 #
 # arguments: src_fd, dst_fd, firmware_datakey, and firmware_keyblock
@@ skipping 29 matching lines @@
 # area_offset="0x000aa000" area_size="0x0002e000" area_name="Firmware B Data" \
 #  area_flags_raw="0x03" area_flags="static,compressed"
 # area_offset="0x00005200" area_size="0x00001000" area_name="RW VPD" \
 #  area_flags_raw="0x00" area_flags=""
 #
 # This shows that Firmware A Data is at offset 0x0000a0000 in the .fd image
 # and is of size 0x0009e000 bytes. This can be extracted to generate new vblocks
 # which can then replace old vblock for Firmware A ("Firmware A Key" region at
 # offset 0x00008000 and size 0x00002000).
 
+# Load common constants and variables.
+. "$(dirname "$0")/common.sh"
+
 # Abort on error
 set -e
 
 # Check arguments
 if [ $# -ne 5 ] ; then
   echo \
     "Usage: $0 src_fd dst_fd firmware_datakey firmware_keyblock kernel_subkey"
   exit 1
 fi
 
@@ skipping 28 matching lines @@
   match_str="$i Data"
   line=$(fmap_decode $1 | grep "$match_str")
   offset="$(echo $line | sed -e 's/.*area_offset=\"\([a-f0-9x]*\)\".*/\1/')"
   eval let \
     fw${i}_offset="$offset"
   size="$(echo $line | sed -e 's/.*area_size=\"\([a-f0-9x]*\)\".*/\1/')"
   eval let \
     fw${i}_size="$size"
 done
 
-temp_fwimage=$(mktemp)
-temp_out_vb=$(mktemp)
-trap "rm -f ${temp_fwimage} ${temp_out_vb}" EXIT
+temp_fwimage=$(make_temp_file)
+temp_out_vb=$(make_temp_file)
 
 # Extract out Firmware A data and generate signature using the right keys
 dd if="${src_fd}" of="${temp_fwimage}" skip="${fwA_offset}" bs=1 \
   count="${fwA_size}"
 
 echo "Re-calculating Firmware A vblock"
 vbutil_firmware \
   --vblock "${temp_out_vb}" \
   --keyblock "${firmware_keyblock}" \
   --signprivate "${firmware_datakey}" \
@@ skipping 16 matching lines @@
   --signprivate "${firmware_datakey}" \
   --version "${VERSION}" \
   --fv "${temp_fwimage}" \
   --kernelkey "${kernel_subkey}"
 
 # Destination image has already been created.
 dd if="${temp_out_vb}" of="${dst_fd}" seek="${fwB_vblock_offset}" bs=1 \
   count="${fwB_vblock_size}" conv=notrunc
 
 echo "New signed image was output to ${dst_fd}"