OLD | NEW |
1 #!/bin/bash | 1 #!/bin/bash |
2 | 2 |
3 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved. | 3 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved. |
4 # Use of this source code is governed by a BSD-style license that can be | 4 # Use of this source code is governed by a BSD-style license that can be |
5 # found in the LICENSE file. | 5 # found in the LICENSE file. |
6 | 6 |
7 # Sign the final build image using the "official" keys. | 7 # Sign the final build image using the "official" keys. |
8 # | 8 # |
9 # Prerequisite tools needed in the system path: | 9 # Prerequisite tools needed in the system path: |
10 # | 10 # |
11 # gbb_utility (from src/platform/vboot_reference) | 11 # gbb_utility (from src/platform/vboot_reference) |
12 # vbutil_kernel (from src/platform/vboot_reference) | 12 # vbutil_kernel (from src/platform/vboot_reference) |
13 # cgpt (from src/platform/vboot_reference) | 13 # cgpt (from src/platform/vboot_reference) |
14 # dump_kernel_config (from src/platform/vboot_reference) | 14 # dump_kernel_config (from src/platform/vboot_reference) |
15 # verity (from src/platform/verity) | 15 # verity (from src/platform/verity) |
16 # load_kernel_test (from src/platform/vboot_reference) | 16 # load_kernel_test (from src/platform/vboot_reference) |
| 17 # dumpe2fs |
17 | 18 |
18 # Load common constants and variables. | 19 # Load common constants and variables. |
19 . "$(dirname "$0")/common.sh" | 20 . "$(dirname "$0")/common.sh" |
20 | 21 |
21 # Print usage string | 22 # Print usage string |
22 usage() { | 23 usage() { |
23 cat <<EOF | 24 cat <<EOF |
24 Usage: $PROG <type> input_image /path/to/keys/dir [output_image] | 25 Usage: $PROG <type> input_image /path/to/keys/dir [output_image] |
25 where <type> is one of: | 26 where <type> is one of: |
26 ssd (sign an SSD image) | 27 ssd (sign an SSD image) |
27 recovery (sign a USB recovery image) | 28 recovery (sign a USB recovery image) |
28 install (sign a factory install image) | 29 install (sign a factory install image) |
29 verify (verify an image including rootfs hashes) | 30 verify (verify an image including rootfs hashes) |
30 | 31 |
31 If you are signing an image, you must specify an [output_image]. | 32 If you are signing an image, you must specify an [output_image]. |
32 EOF | 33 EOF |
33 } | 34 } |
34 | 35 |
35 if [ $# -ne 3 ] && [ $# -ne 4 ]; then | 36 if [ $# -ne 3 ] && [ $# -ne 4 ]; then |
36 usage | 37 usage |
37 exit 1 | 38 exit 1 |
38 fi | 39 fi |
39 | 40 |
40 # Abort on errors. | 41 # Abort on errors. |
41 set -e | 42 set -e |
42 | 43 |
43 # Make sure the tools we need are available. | 44 # Make sure the tools we need are available. |
44 for prereqs in gbb_utility vbutil_kernel cgpt dump_kernel_config verity \ | 45 for prereqs in gbb_utility vbutil_kernel cgpt dump_kernel_config verity \ |
45 load_kernel_test; | 46 load_kernel_test dumpe2fs; |
46 do | 47 do |
47 type -P "${prereqs}" &>/dev/null || \ | 48 type -P "${prereqs}" &>/dev/null || \ |
48 { echo "${prereqs} tool not found."; exit 1; } | 49 { echo "${prereqs} tool not found."; exit 1; } |
49 done | 50 done |
50 | 51 |
51 TYPE=$1 | 52 TYPE=$1 |
52 INPUT_IMAGE=$2 | 53 INPUT_IMAGE=$2 |
53 KEY_DIR=$3 | 54 KEY_DIR=$3 |
54 OUTPUT_IMAGE=$4 | 55 OUTPUT_IMAGE=$4 |
55 | 56 |
(...skipping 66 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
122 local signprivate=$3 # Private key to use for signing. | 123 local signprivate=$3 # Private key to use for signing. |
123 | 124 |
124 local rootfs_image=$(make_temp_file) | 125 local rootfs_image=$(make_temp_file) |
125 extract_image_partition ${image} 3 ${rootfs_image} | 126 extract_image_partition ${image} 3 ${rootfs_image} |
126 local kernel_config=$(grab_kernel_config "${image}") | 127 local kernel_config=$(grab_kernel_config "${image}") |
127 local hash_image=$(make_temp_file) | 128 local hash_image=$(make_temp_file) |
128 | 129 |
129 local new_kernel_config=$(calculate_rootfs_hash "${rootfs_image}" \ | 130 local new_kernel_config=$(calculate_rootfs_hash "${rootfs_image}" \ |
130 "${kernel_config}" "${hash_image}") | 131 "${kernel_config}" "${hash_image}") |
131 | 132 |
132 local rootfs_blocks=$(dumpe2fs "${rootfs_image}" 2> /dev/null | | 133 local rootfs_blocks=$(sudo dumpe2fs "${rootfs_image}" 2> /dev/null | |
133 grep "Block count" | | 134 grep "Block count" | |
134 tr -d ' ' | | 135 tr -d ' ' | |
135 cut -f2 -d:) | 136 cut -f2 -d:) |
136 local rootfs_sectors=$((rootfs_blocks * 8)) | 137 local rootfs_sectors=$((rootfs_blocks * 8)) |
137 | 138 |
138 # Overwrite the appended hashes in the rootfs | 139 # Overwrite the appended hashes in the rootfs |
139 local temp_config=$(make_temp_file) | 140 local temp_config=$(make_temp_file) |
140 echo ${new_kernel_config} >${temp_config} | 141 echo ${new_kernel_config} >${temp_config} |
141 dd if=${hash_image} of=${rootfs_image} bs=512 \ | 142 dd if=${hash_image} of=${rootfs_image} bs=512 \ |
142 seek=${rootfs_sectors} conv=notrunc | 143 seek=${rootfs_sectors} conv=notrunc |
(...skipping 191 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
334 sign_for_recovery | 335 sign_for_recovery |
335 elif [ "${TYPE}" == "install" ]; then | 336 elif [ "${TYPE}" == "install" ]; then |
336 update_rootfs_hash ${INPUT_IMAGE} \ | 337 update_rootfs_hash ${INPUT_IMAGE} \ |
337 ${KEY_DIR}/installer_kernel.keyblock \ | 338 ${KEY_DIR}/installer_kernel.keyblock \ |
338 ${KEY_DIR}/recovery_kernel_data_key.vbprivk | 339 ${KEY_DIR}/recovery_kernel_data_key.vbprivk |
339 sign_for_factory_install | 340 sign_for_factory_install |
340 else | 341 else |
341 echo "Invalid type ${TYPE}" | 342 echo "Invalid type ${TYPE}" |
342 exit 1 | 343 exit 1 |
343 fi | 344 fi |
OLD | NEW |