Don't forget to umount rootfs in case we bail on firmware re-signing.

scripts/image_signing/sign_official_build.sh

Index: scripts/image_signing/sign_official_build.sh
diff --git a/scripts/image_signing/sign_official_build.sh b/scripts/image_signing/sign_official_build.sh
index 6d66ce921626f0a7f7cf22abc525d08e5196e89a..29d2c759797fec62b48ba29ba3a6c8b4d39c80f3 100755
--- a/scripts/image_signing/sign_official_build.sh
+++ b/scripts/image_signing/sign_official_build.sh
@@ -125,16 +125,19 @@ update_rootfs_hash() {
   local rootfs_image=$(make_temp_file)
   extract_image_partition ${image} 3 ${rootfs_image}
   local kernel_config=$(grab_kernel_config "${image}")
+  echo "got: $kernel_config"
   local hash_image=$(make_temp_file)
 
   local new_kernel_config=$(calculate_rootfs_hash "${rootfs_image}" \
     "${kernel_config}" "${hash_image}")
+  echo "changing to: $new_kernel_config"
 
   local rootfs_blocks=$(sudo dumpe2fs "${rootfs_image}" 2> /dev/null |
     grep "Block count" |
     tr -d ' ' |
     cut -f2 -d:)
   local rootfs_sectors=$((rootfs_blocks * 8))
+  echo "rootfs sectors = $rootfs_blocks"
 
   # Overwrite the appended hashes in the rootfs
   local temp_config=$(make_temp_file)
@@ -178,7 +181,9 @@ resign_firmware_payload() {
   # Grab firmware image from the autoupdate shellball.
   local rootfs_dir=$(make_temp_dir)
   mount_image_partition ${image} 3 ${rootfs_dir}
-
+  # Force unmount of the rootfs on function exit as it is needed later.
+  trap "sudo umount -d ${rootfs_dir}" RETURN
+  
   local shellball_dir=$(make_temp_dir)
   # get_firmwarebin_from_shellball can fail if the image has no 
   # firmware update.
@@ -227,14 +232,13 @@ resign_firmware_payload() {
     sed -e '/^begin .*firmware_package/,/end/D' | \
     cat - ${new_fwblob} >${new_shellball}
   sudo cp ${new_shellball} ${rootfs_dir}/usr/sbin/chromeos-firmwareupdate
-  # Force unmount of the image as it is needed later.
-  sudo umount -d ${rootfs_dir}
   echo "Re-signed firmware AU payload in $image"
 }
 
 # Verify an image including rootfs hash using the specified keys.
 verify_image() {
   local kernel_config=$(grab_kernel_config ${INPUT_IMAGE})
+  echo "got $kernel_config"
   local rootfs_image=$(make_temp_file)
   extract_image_partition ${INPUT_IMAGE} 3 ${rootfs_image}
   local hash_image=$(make_temp_file)