New utility to tag/stamp image

scripts/image_signing/sign_official_build.sh

 #!/bin/bash
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Sign the final build image using the "official" keys.
 #
 # Prerequisite tools needed in the system path:
 #
@@ skipping 104 matching lines @@
 }
 
 # Re-calculate rootfs hash, update rootfs and kernel command line.
 # Args: IMAGE KEYBLOCK PRIVATEKEY
 update_rootfs_hash() {
   echo "Recalculating rootfs"
   local image=$1  # Input image.
   local keyblock=$2  # Keyblock for re-generating signed kernel partition
   local signprivate=$3  # Private key to use for signing.
 
+  # check and clear need_to_resign tag
+  local rootfs_dir=$(make_temp_dir)
+  mount_image_partition_ro "${image}" 3 "${rootfs_dir}"
+  if has_needs_to_be_resigned_tag "${rootfs_dir}"; then
+    # remount as RW
+    sudo umount -d "${rootfs_dir}"
+    mount_image_partition "${image}" 3 "${rootfs_dir}"
+    sudo rm -f "${rootfs_dir}/${TAG_NEEDS_TO_BE_SIGNED}"
+  fi
+  sudo umount -d "${rootfs_dir}"
+
   local rootfs_image=$(make_temp_file)
   extract_image_partition ${image} 3 ${rootfs_image}
   local kernel_config=$(grab_kernel_config "${image}")
   local hash_image=$(make_temp_file)
 
   local new_kernel_config=$(calculate_rootfs_hash "${rootfs_image}" \
     "${kernel_config}" "${hash_image}")
 
   local rootfs_blocks=$(sudo dumpe2fs "${rootfs_image}" 2> /dev/null |
     grep "Block count" |
@@ skipping 38 matching lines @@
 # Re-sign the firmware AU payload inside the image rootfs with a new keys.
 # Args: IMAGE
 resign_firmware_payload() {
   local image=$1
 
   # Grab firmware image from the autoupdate shellball.
   local rootfs_dir=$(make_temp_dir)
   mount_image_partition ${image} 3 ${rootfs_dir}
   # Force unmount of the rootfs on function exit as it is needed later.
   trap "sudo umount -d ${rootfs_dir}" RETURN
-  
+
   local shellball_dir=$(make_temp_dir)
   # get_firmwarebin_from_shellball can fail if the image has no 
   # firmware update.
   get_firmwarebin_from_shellball \
     ${rootfs_dir}/usr/sbin/chromeos-firmwareupdate ${shellball_dir} || \
     { echo "Didn't find a firmware update. Not signing firmware."
     return; }
   echo "Found a valid firmware update shellball."
 
   temp_outfd=$(make_temp_file)
@@ skipping 155 matching lines @@
 elif [ "${TYPE}" == "install" ]; then
   resign_firmware_payload ${INPUT_IMAGE}
   update_rootfs_hash ${INPUT_IMAGE} \
     ${KEY_DIR}/installer_kernel.keyblock \
     ${KEY_DIR}/recovery_kernel_data_key.vbprivk
   sign_for_factory_install
 else
   echo "Invalid type ${TYPE}"
   exit 1
 fi