Hide packaged firmware AU signing behind a flag for now.

scripts/image_signing/sign_official_build.sh

 #!/bin/bash
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Sign the final build image using the "official" keys.
 #
 # Prerequisite tools needed in the system path:
 #
@@ skipping 20 matching lines @@
              ssd  (sign an SSD image)
              recovery (sign a USB recovery image)               
              install (sign a factory install image) 
 EOF
   exit 1
 fi
 
 # Abort on errors.
 set -e
 
+# Make sure the tools we need are available.
+for prereqs in gbb_utility vbutil_kernel cgpt dump_kernel_config verity; do
+  type -P "${prereqs}" &>/dev/null || \
+    { echo "${prereqs} tool not found."; exit 1; }
+done
+
 TYPE=$1
 INPUT_IMAGE=$2
 KEY_DIR=$3
 OUTPUT_IMAGE=$4
 
 # Re-calculate rootfs hash, update rootfs and kernel command line.
 # Args: IMAGE KEYBLOCK PRIVATEKEY
 recalculate_rootfs_hash() {
   local image=$1  # Input image.
   local keyblock=$2  # Keyblock for re-generating signed kernel partition
@@ skipping 147 matching lines @@
 }
 
 # Generate the factory install image.
 sign_for_factory_install() {
   ${SCRIPT_DIR}/resign_image.sh ${INPUT_IMAGE} ${OUTPUT_IMAGE} \
     ${KEY_DIR}/recovery_kernel_data_key.vbprivk \
     ${KEY_DIR}/installer_kernel.keyblock
   echo "Output signed factory install image to ${OUTPUT_IMAGE}"
 }
 
-if [ ! "${FW_NOUPDATE}" == "1" ]; then
+# Firmware payload signing hidden behind a flag until it actually makes
+# it into the image.
+if [ ! "${FW_UPDATE}" == "1" ]; then
   resign_firmware_payload ${INPUT_IMAGE}
 fi
 
 if [ "${TYPE}" == "ssd" ]; then
   recalculate_rootfs_hash ${INPUT_IMAGE} \
     ${KEY_DIR}/kernel.keyblock \
     ${KEY_DIR}/kernel_data_key.vbprivk
   sign_for_ssd
 elif [ "${TYPE}" == "recovery" ]; then
   recalculate_rootfs_hash ${INPUT_IMAGE} \
     ${KEY_DIR}/recovery_kernel.keyblock \
     ${KEY_DIR}/recovery_kernel_data_key.vbprivk
   sign_for_recovery
 elif [ "${TYPE}" == "install" ]; then
   recalculate_rootfs_hash ${INPUT_IMAGE} \
     ${KEY_DIR}/installer_kernel.keyblock \
     ${KEY_DIR}/recovery_kernel_data_key.vbprivk
   sign_for_factory_install
 else
   echo "Invalid type ${TYPE}"
   exit 1
 fi