Script to check for blacklisted files as described in chrome-os-partner:1991

Script to check for blacklisted files as described in chrome-os-partner:1991

Change-Id: Iad5578031e4d62435a27c92651b1c91075987078

BUG=chrome-os-partner:1991
TEST=Ran manually against current mario images, 'base' img passes, 'test' fails, as expected

Committed: http://chrome-svn/viewvc/chromeos?view=rev&revision=387b91f

[jimhebert, 2011-01-28 01:17:38]

This script covers cmasone's suggestions #1-2 and gauravsh's suggestion #5 from
chrome-os-partner:1991. (The crosh code keys off of /root/.dev_mode to decide
whether to offer 'shell', so that's why this check covers that last item.)

Thanks in advance for your review. I (hopefully) incorporated all the style
fixes from the ensure_secure_kernelparams review.

[gauravsh, 2011-01-28 01:22:41]

lgtm with a nit (or 2)

http://codereview.chromium.org/6264023/diff/1/scripts/image_signing/ensure_no...
File scripts/image_signing/ensure_no_nonrelease_files.sh (right):

http://codereview.chromium.org/6264023/diff/1/scripts/image_signing/ensure_no...
scripts/image_signing/ensure_no_nonrelease_files.sh:23: if [[ $# -ne 1 ]] && [[
$# -ne 2 ]]; then
[ ], not [[ ]]

http://codereview.chromium.org/6264023/diff/1/scripts/image_signing/ensure_no...
scripts/image_signing/ensure_no_nonrelease_files.sh:43: for file in
${RELEASE_FILE_BLACKLIST[@]}; do :
is the colon at the end necessary? (i am not familiar with the construct)

[gauravsh, 2011-01-28 01:27:04]

http://codereview.chromium.org/6264023/diff/1/scripts/image_signing/ensure_no...
File scripts/image_signing/ensure_no_nonrelease_files.config (right):

http://codereview.chromium.org/6264023/diff/1/scripts/image_signing/ensure_no...
scripts/image_signing/ensure_no_nonrelease_files.config:9:
RELEASE_FILE_BLACKLIST=(
also, it might be nice if you could add comments on why each of these are bad in
a release image. This will be useful as the list grows in the future and or we
make modifications.

http://codereview.chromium.org/6264023/diff/1/scripts/image_signing/ensure_no...
scripts/image_signing/ensure_no_nonrelease_files.config:13: )
Another blacklist (fine to do it in a separate CL) are the list of files that
should exist or not exist for a final signed image.

Some examples: 
/usr/bin/crosh-workarounds must always exist
/root/.force_update_firmware must always exist

We can run this on the final signed image. This will serve as a final sanity
check and help us catch regressions in the signer.

[jimhebert, 2011-01-28 01:39:38]

On Thu, Jan 27, 2011 at 5:22 PM, <gauravsh@chromium.org> wrote:

> lgtm with a nit (or 2)
>
>
>
>
http://codereview.chromium.org/6264023/diff/1/scripts/image_signing/ensure_no...
> File scripts/image_signing/ensure_no_nonrelease_files.sh (right):
>
>
>
http://codereview.chromium.org/6264023/diff/1/scripts/image_signing/ensure_no...
> scripts/image_signing/ensure_no_nonrelease_files.sh:23: if [[ $# -ne 1
> ]] && [[ $# -ne 2 ]]; then
> [ ], not [[ ]]
>

Fixed with patchset 2.


>
>
>
http://codereview.chromium.org/6264023/diff/1/scripts/image_signing/ensure_no...
> scripts/image_signing/ensure_no_nonrelease_files.sh:43: for file in
> ${RELEASE_FILE_BLACKLIST[@]}; do :
> is the colon at the end necessary? (i am not familiar with the
> construct)


Removed in patchset 2.  It's unnecessary syntactic sugar -- ":" is the shell
no-op and I'd developed a personal habit of using it after "do" but it is
probably not consistent with the project style guide so I've removed it.

[jimhebert, 2011-01-28 01:40:36]

On Thu, Jan 27, 2011 at 5:27 PM, <gauravsh@chromium.org> wrote:

>
>
>
http://codereview.chromium.org/6264023/diff/1/scripts/image_signing/ensure_no...
> File scripts/image_signing/ensure_no_nonrelease_files.config (right):
>
>
>
http://codereview.chromium.org/6264023/diff/1/scripts/image_signing/ensure_no...
> scripts/image_signing/ensure_no_nonrelease_files.config:9:
> RELEASE_FILE_BLACKLIST=(
> also, it might be nice if you could add comments on why each of these
> are bad in a release image. This will be useful as the list grows in the
> future and or we make modifications.
>

Fixed in patchset 3.


>
>
>
http://codereview.chromium.org/6264023/diff/1/scripts/image_signing/ensure_no...
> scripts/image_signing/ensure_no_nonrelease_files.config:13: )
> Another blacklist (fine to do it in a separate CL) are the list of files
> that should exist or not exist for a final signed image.
>
> Some examples:
> /usr/bin/crosh-workarounds must always exist
> /root/.force_update_firmware must always exist
>
> We can run this on the final signed image. This will serve as a final
> sanity check and help us catch regressions in the signer.


I'll add this to the list in task 1991 so we don't forget.


>
>
> http://codereview.chromium.org/6264023/
>

[gauravsh, 2011-01-28 01:52:52]

LGTM still