Do not modify the input image while signing.

scripts/image_signing/sign_official_build.sh

 #!/bin/bash
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Sign the final build image using the "official" keys.
 #
 # Prerequisite tools needed in the system path:
 #
@@ skipping 320 matching lines @@
   echo -n "With SSD Key (Recovery Mode OFF, Dev Mode ON): " && \
   { load_kernel_test "${INPUT_IMAGE}" "${try_key}" -b 1 >/dev/null 2>&1 && \
     echo "YES"; } || echo "NO"
   set -e
 
   verify_image_rootfs "${INPUT_IMAGE}"
 
   # TODO(gauravsh): Check embedded firmware AU signatures.
 }
 
+# Sign the kernel partition on an image using the given keys. Modifications are
+# made in-place.
+# Args: src_bin kernel_datakey kernel_keyblock kernel_version
+sign_image_inplace() {
+  src_bin=$1
+  kernel_datakey=$2
+  kernel_keyblock=$3
+  kernel_version=$4
+
+  temp_kimage=$(make_temp_file)
+  extract_image_partition ${src_bin} 2 ${temp_kimage}
+  updated_kimage=$(make_temp_file)
+
+  vbutil_kernel --repack "${updated_kimage}" \
+  --keyblock "${kernel_keyblock}" \
+  --signprivate "${kernel_datakey}" \
+  --version "${kernel_version}" \
+  --oldblob "${temp_kimage}"
+  replace_image_partition ${src_bin} 2 ${updated_kimage}
+}
+
 # Generate the SSD image
+# Args: image_bin
 sign_for_ssd() {
-  ${SCRIPT_DIR}/resign_image.sh ${INPUT_IMAGE} ${OUTPUT_IMAGE} \
-    ${KEY_DIR}/kernel_data_key.vbprivk \
+  image_bin=$1
+  sign_image_inplace ${image_bin} ${KEY_DIR}/kernel_data_key.vbprivk \
     ${KEY_DIR}/kernel.keyblock \
     "${KERNEL_VERSION}"
-  echo "Signed SSD image output to ${OUTPUT_IMAGE}"
+  echo "Signed SSD image output to ${image_bin}"
 }
 
 # Generate the USB image (direct boot)
 sign_for_usb() {
-  ${SCRIPT_DIR}/resign_image.sh ${INPUT_IMAGE} ${OUTPUT_IMAGE} \
-    ${KEY_DIR}/recovery_kernel_data_key.vbprivk \
+  image_bin=$1
+  sign_image_inplace ${image_bin} ${KEY_DIR}/recovery_kernel_data_key.vbprivk \
     ${KEY_DIR}/recovery_kernel.keyblock \
     "${KERNEL_VERSION}"
 
   # Now generate the installer vblock with the SSD keys.
   # The installer vblock is for KERN-A on direct boot images.
   temp_kimagea=$(make_temp_file)
   temp_out_vb=$(make_temp_file)
-  extract_image_partition ${OUTPUT_IMAGE} 2 ${temp_kimagea}
+  extract_image_partition ${image_bin} 2 ${temp_kimagea}
   ${SCRIPT_DIR}/resign_kernel_partition.sh ${temp_kimagea} ${temp_out_vb} \
     ${KEY_DIR}/kernel_data_key.vbprivk \
     ${KEY_DIR}/kernel.keyblock \
     "${KERNEL_VERSION}"
 
   # Copy the installer vblock to the stateful partition.
   local stateful_dir=$(make_temp_dir)
-  mount_image_partition ${OUTPUT_IMAGE} 1 ${stateful_dir}
+  mount_image_partition ${image_bin} 1 ${stateful_dir}
   sudo cp ${temp_out_vb} ${stateful_dir}/vmlinuz_hd.vblock
 
-  echo "Signed USB image output to ${OUTPUT_IMAGE}"
+  echo "Signed USB image output to ${image_bin}"
 }
 
 # Generate the USB (recovery + install) image
+# Args: image_bin
 sign_for_recovery() {
+  image_bin=$1
   # Update the Kernel B hash in Kernel A command line
   temp_kimageb=$(make_temp_file)
-  extract_image_partition ${INPUT_IMAGE} 4 ${temp_kimageb}
-  local kern_a_config=$(grab_kernel_config "${INPUT_IMAGE}" 2)
+  extract_image_partition ${image_bin} 4 ${temp_kimageb}
+  local kern_a_config=$(grab_kernel_config "${image_bin}" 2)
   local kern_b_hash=$(sha1sum ${temp_kimageb} | cut -f1 -d' ')
 
   temp_configa=$(make_temp_file)
   echo "$kern_a_config" |
     sed -e "s#\(kern_b_hash=\)[a-z0-9]*#\1${kern_b_hash}#" > ${temp_configa}
   echo "New config for kernel partition 2 is"
   cat $temp_configa
 
-  # Make a copy of the input image
-  cp "${INPUT_IMAGE}" "${OUTPUT_IMAGE}"
   local temp_kimagea=$(make_temp_file)
-  extract_image_partition ${OUTPUT_IMAGE} 2 ${temp_kimagea}
+  extract_image_partition ${image_bin} 2 ${temp_kimagea}
   # Re-calculate kernel partition signature and command line.
   local updated_kimagea=$(make_temp_file)
   vbutil_kernel --repack ${updated_kimagea} \
     --keyblock ${KEY_DIR}/recovery_kernel.keyblock \
     --signprivate ${KEY_DIR}/recovery_kernel_data_key.vbprivk \
     --version "${KERNEL_VERSION}" \
     --oldblob ${temp_kimagea} \
     --config ${temp_configa}
 
-  replace_image_partition ${OUTPUT_IMAGE} 2 ${updated_kimagea}
+  replace_image_partition ${image_bin} 2 ${updated_kimagea}
 
   # Now generate the installer vblock with the SSD keys.
   # The installer vblock is for KERN-B on recovery images.
   temp_out_vb=$(make_temp_file)
-  extract_image_partition ${OUTPUT_IMAGE} 4 ${temp_kimageb}
+  extract_image_partition ${image_bin} 4 ${temp_kimageb}
   ${SCRIPT_DIR}/resign_kernel_partition.sh ${temp_kimageb} ${temp_out_vb} \
     ${KEY_DIR}/kernel_data_key.vbprivk \
     ${KEY_DIR}/kernel.keyblock \
     "${KERNEL_VERSION}"
 
   # Copy the installer vblock to the stateful partition.
   # TODO(gauravsh): Remove this if we get rid of the need to overwrite
   # the vblock during installs. Kern B could directly be signed by the
   # SSD keys.
   # Note: This vblock is also needed for the ability to convert a recovery
   # image into the equivalent SSD image (convert_recovery_to_ssd.sh)
   local stateful_dir=$(make_temp_dir)
-  mount_image_partition ${OUTPUT_IMAGE} 1 ${stateful_dir}
+  mount_image_partition ${image_bin} 1 ${stateful_dir}
   sudo cp ${temp_out_vb} ${stateful_dir}/vmlinuz_hd.vblock
 
-  echo "Signed recovery image output to ${OUTPUT_IMAGE}"
+  echo "Signed recovery image output to ${image_bin}"
 }
 
 # Generate the factory install image.
+# Args: image_bin
 sign_for_factory_install() {
-  ${SCRIPT_DIR}/resign_image.sh ${INPUT_IMAGE} ${OUTPUT_IMAGE} \
-    ${KEY_DIR}/installer_kernel_data_key.vbprivk \
+  image_bin=$1
+  sign_image_inplace ${image_bin} ${KEY_DIR}/installer_kernel_data_key.vbprivk \
     ${KEY_DIR}/installer_kernel.keyblock \
     "${KERNEL_VERSION}"
-  echo "Signed factory install image output to ${OUTPUT_IMAGE}"
+  echo "Signed factory install image output to ${image_bin}"
 }
 
 # Verification
 if [ "${TYPE}" == "verify" ]; then
   verify_image
   exit 0
 fi
 
 # Signing requires an output image name
 if [ -z "${OUTPUT_IMAGE}" ]; then
   usage
   exit 1
 fi
 
 # If a version file was specified, read the firmware and kernel
 # versions from there.
 if [ -n "${VERSION_FILE}" ]; then
   FIRMWARE_VERSION=$(sed -n 's#^firmware_version=\(.*\)#\1#pg' ${VERSION_FILE})
   KERNEL_VERSION=$(sed -n 's#^kernel_version=\(.*\)#\1#pg' ${VERSION_FILE})
 fi
 echo "Using firmware version: ${FIRMWARE_VERSION}"
 echo "Using kernel version: ${KERNEL_VERSION}"
 
+# Make all modifications on output copy.
 if [ "${TYPE}" == "ssd" ]; then
-  resign_firmware_payload ${INPUT_IMAGE}
-  update_rootfs_hash ${INPUT_IMAGE} \
+  cp ${INPUT_IMAGE} ${OUTPUT_IMAGE}
+  resign_firmware_payload ${OUTPUT_IMAGE}
+  update_rootfs_hash ${OUTPUT_IMAGE} \
     ${KEY_DIR}/kernel.keyblock \
     ${KEY_DIR}/kernel_data_key.vbprivk \
     2
-  sign_for_ssd
+  sign_for_ssd ${OUTPUT_IMAGE}
 elif [ "${TYPE}" == "usb" ]; then
-  resign_firmware_payload ${INPUT_IMAGE}
-  update_rootfs_hash ${INPUT_IMAGE} \
+  cp ${INPUT_IMAGE} ${OUTPUT_IMAGE}
+  resign_firmware_payload ${OUTPUT_IMAGE}
+  update_rootfs_hash ${OUTPUT_IMAGE} \
     ${KEY_DIR}/recovery_kernel.keyblock \
     ${KEY_DIR}/recovery_kernel_data_key.vbprivk \
     2
-  sign_for_usb
+  sign_for_usb ${OUTPUT_IMAGE}
 elif [ "${TYPE}" == "recovery" ]; then
-  resign_firmware_payload ${INPUT_IMAGE}
+  cp ${INPUT_IMAGE} ${OUTPUT_IMAGE}
+  resign_firmware_payload ${OUTPUT_IMAGE}
   # Both kernel command lines must have the correct rootfs hash
-  update_rootfs_hash ${INPUT_IMAGE} \
+  update_rootfs_hash ${OUTPUT_IMAGE} \
     ${KEY_DIR}/recovery_kernel.keyblock \
     ${KEY_DIR}/recovery_kernel_data_key.vbprivk \
     4
-  update_rootfs_hash ${INPUT_IMAGE} \
+  update_rootfs_hash ${OUTPUT_IMAGE} \
     ${KEY_DIR}/recovery_kernel.keyblock \
     ${KEY_DIR}/recovery_kernel_data_key.vbprivk \
     2
-  sign_for_recovery
+  sign_for_recovery ${OUTPUT_IMAGE}
 elif [ "${TYPE}" == "install" ]; then
-  resign_firmware_payload ${INPUT_IMAGE}
-  update_rootfs_hash ${INPUT_IMAGE} \
+  cp ${INPUT_IMAGE} ${OUTPUT_IMAGE}
+  resign_firmware_payload ${OUTPUT_IMAGE}
+  update_rootfs_hash ${OUTPUT_IMAGE} \
     ${KEY_DIR}/installer_kernel.keyblock \
     ${KEY_DIR}/installer_kernel_data_key.vbprivk \
     2
-  sign_for_factory_install
+  sign_for_factory_install ${OUTPUT_IMAGE}
 else
   echo "Invalid type ${TYPE}"
   exit 1
 fi