Add transitional flag for enabling arm kernel signing

bin/cros_make_image_bootable

 #!/bin/bash
 #
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 #
 # Script which ensures that a given image has an up-to-date
 # kernel partition, rootfs integrity hashes, and legacy bootloader configs.
 
 # --- BEGIN COMMON.SH BOILERPLATE ---
@@ skipping 99 matching lines @@
 DEFINE_string rootfs_mountpoint "/tmp/rootfs" \
   "Path where the rootfs can be safely mounted"
 DEFINE_string statefulfs_mountpoint "/tmp/statefulfs" \
   "Path where the statefulfs can be safely mounted"
 DEFINE_string espfs_mountpoint "/tmp/espfs" \
   "Path where the espfs can be safely mounted"
 
 DEFINE_boolean use_dev_keys ${FLAGS_FALSE} \
   "Use developer keys for signing. (Default: false)"
 
+# TODO(clchiou): Remove this flag after arm verified boot is stable
+DEFINE_boolean crosbug12352_arm_kernel_signing ${FLAGS_FALSE} \
+  "Sign kernel partition for ARM images (temporary hack)."
+
 # TODO(sosa):  Remove once known images no longer use this in their config.
 DEFINE_string arm_extra_bootargs "" "DEPRECATED FLAG.  Do not use."
 
 # Parse the boot.desc and any overrides
 eval set -- "${BOOT_DESC} ${FLAG_OVERRIDES}"
 FLAGS "${@}" || exit 1
 
 # Only now can we die on error.  shflags functions leak non-zero error codes,
 # so will die prematurely if 'set -e' is specified before now.
 set -e -u
 
+if [[ ${FLAGS_crosbug12352_arm_kernel_signing} -eq ${FLAGS_TRUE} ]]; then
+  crosbug12352_flag="--crosbug12352_arm_kernel_signing"
+else
+  crosbug12352_flag="--nocrosbug12352_arm_kernel_signing"
+fi
+
 # $1 - Directory where developer rootfs is mounted.
 # $2 - Directory where developer stateful_partition is mounted.
 # $3 - Directory where the ESP partition is mounted.
 mount_gpt_cleanup() {
   local rootfs="${1-$FLAGS_rootfs_mountpoint}"
   local statefs="${2-$FLAGS_statefulfs_mountpoint}"
   local espfs="${3-$FLAGS_espfs_mountpoint}"
   "${SCRIPTS_DIR}/mount_gpt_image.sh" \
     -u -r "${rootfs}" -s "${statefs}" -e "${espfs}"
 }
@@ skipping 45 matching lines @@
     --boot_args="${FLAGS_boot_args}" \
     --keep_work \
     --rootfs_image=${root_dev} \
     --rootfs_hash=${FLAGS_rootfs_hash} \
     --verity_hash_alg=${FLAGS_verity_algorithm} \
     --verity_tree_depth=${FLAGS_verity_depth} \
     --verity_max_ios=${FLAGS_verity_max_ios} \
     --verity_error_behavior=${FLAGS_verity_error_behavior} \
     --root=${cros_root} \
     --keys_dir="${FLAGS_keys_dir}" \
+    ${crosbug12352_flag} \
     ${use_dev_keys}
 
   local rootfs_hash_size=$(stat -c '%s' ${FLAGS_rootfs_hash})
   info "Appending rootfs.hash (${rootfs_hash_size} bytes) to the root fs"
   if [[ ${rootfs_hash_size} -gt $((FLAGS_rootfs_hash_pad * 1024 * 1024)) ]]
   then
     die "--rootfs_hash_pad reserves less than the needed ${rootfs_hash_size}"
   fi
   # Unfortunately, mount_gpt_image uses mount and not losetup to create the
   # loop devices.  This means that they are not the correct size.  We have to
@@ skipping 92 matching lines @@
 mkdir -p ${FLAGS_espfs_mountpoint}
 
 make_image_bootable "${IMAGE}"
 verify_image_rootfs "${IMAGE}"
 
 if [ ${FLAGS_cleanup_dirs} -eq ${FLAGS_TRUE} ]; then
   rmdir ${FLAGS_rootfs_mountpoint}
   rmdir ${FLAGS_statefulfs_mountpoint}
   rmdir ${FLAGS_espfs_mountpoint}
 fi