Produce the correct vvmlinuz_hd.vblock when signing for direct USB.

scripts/image_signing/sign_official_build.sh

 #!/bin/bash
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Sign the final build image using the "official" keys.
 #
 # Prerequisite tools needed in the system path:
 #
@@ skipping 304 matching lines @@
     ${KEY_DIR}/kernel_data_key.vbprivk \
     ${KEY_DIR}/kernel.keyblock
   echo "Signed SSD image output to ${OUTPUT_IMAGE}"
 }
 
 # Generate the USB image (direct boot)
 sign_for_usb() {
   ${SCRIPT_DIR}/resign_image.sh ${INPUT_IMAGE} ${OUTPUT_IMAGE} \
     ${KEY_DIR}/recovery_kernel_data_key.vbprivk \
     ${KEY_DIR}/recovery_kernel.keyblock
+
+  # Now generate the installer vblock with the SSD keys.
+  # The installer vblock is for KERN-A on direct boot images.
+  temp_kimagea=$(make_temp_file)
+  temp_out_vb=$(make_temp_file)
+  extract_image_partition ${OUTPUT_IMAGE} 2 ${temp_kimagea}
+  ${SCRIPT_DIR}/resign_kernel_partition.sh ${temp_kimagea} ${temp_out_vb} \
+    ${KEY_DIR}/kernel_data_key.vbprivk \
+    ${KEY_DIR}/kernel.keyblock
+
+  # Copy the installer vblock to the stateful partition.
+  local stateful_dir=$(make_temp_dir)
+  mount_image_partition ${OUTPUT_IMAGE} 1 ${stateful_dir}
+  sudo cp ${temp_out_vb} ${stateful_dir}/vmlinuz_hd.vblock
+
   echo "Signed USB image output to ${OUTPUT_IMAGE}"
 }
 
 # Generate the USB (recovery + install) image
 sign_for_recovery() {
   # Update the Kernel B hash in Kernel A command line
   temp_kimageb=$(make_temp_file)
   extract_image_partition ${INPUT_IMAGE} 4 ${temp_kimageb}
   local kern_a_config=$(grab_kernel_config "${INPUT_IMAGE}" 2)
   local kern_b_hash=$(sha1sum ${temp_kimageb} | cut -f1 -d' ')
@@ skipping 20 matching lines @@
 
   # Now generate the installer vblock with the SSD keys.
   # The installer vblock is for KERN-B on recovery images.
   temp_out_vb=$(make_temp_file)
   extract_image_partition ${OUTPUT_IMAGE} 4 ${temp_kimageb}
   ${SCRIPT_DIR}/resign_kernel_partition.sh ${temp_kimageb} ${temp_out_vb} \
     ${KEY_DIR}/kernel_data_key.vbprivk \
     ${KEY_DIR}/kernel.keyblock
 
   # Copy the installer vblock to the stateful partition.
-  # TODO(gauravsh): Remove this after we get rid of the need to overwrite
-  # the vblock during installs. Kenrn B could directly be signed by the
+  # TODO(gauravsh): Remove this if we get rid of the need to overwrite
+  # the vblock during installs. Kern B could directly be signed by the
   # SSD keys.
   local stateful_dir=$(make_temp_dir)
   mount_image_partition ${OUTPUT_IMAGE} 1 ${stateful_dir}
   sudo cp ${temp_out_vb} ${stateful_dir}/vmlinuz_hd.vblock
 
   echo "Signed recovery image output to ${OUTPUT_IMAGE}"
 }
 
 # Generate the factory install image.
 sign_for_factory_install() {
@@ skipping 46 matching lines @@
   resign_firmware_payload ${INPUT_IMAGE}
   update_rootfs_hash ${INPUT_IMAGE} \
     ${KEY_DIR}/installer_kernel.keyblock \
     ${KEY_DIR}/recovery_kernel_data_key.vbprivk \
     2
   sign_for_factory_install
 else
   echo "Invalid type ${TYPE}"
   exit 1
 fi