vboot_reference: allow using recovery_key in make_dev_ssd.

scripts/image_signing/make_dev_ssd.sh

 #!/bin/sh
 #
 # Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 #
 # This script can change key (usually developer keys) and kernel config
 # of a kernels on SSD.
 
 SCRIPT_BASE="$(dirname "$0")"
@@ skipping 12 matching lines @@
 DEFINE_boolean remove_rootfs_verification \
   $FLAGS_FALSE "Modify kernel boot config to disable rootfs verification" ""
 DEFINE_string backup_dir \
   "$DEFAULT_BACKUP_FOLDER" "Path of directory to store kernel backups" ""
 DEFINE_string save_config "" \
   "Base filename to store kernel configs to, instead of resigning." ""
 DEFINE_string set_config "" \
   "Base filename to load kernel configs from" ""
 DEFINE_string partitions "$DEFAULT_PARTITIONS" \
  "List of partitions to examine" ""
+DEFINE_boolean recovery_key "$FLAGS_FALSE" \
+ "Use recovery key to sign image (to boot from USB" ""
 
 # Parse command line
 FLAGS "$@" || exit 1
 eval set -- "$FLAGS_ARGV"
 
 # Globals
 # ----------------------------------------------------------------------------
 set -e
 
 # a log file to keep the output results of executed command
@@ skipping 205 matching lines @@
 
   return $resigned_kernels
 }
 
 # Main
 # ----------------------------------------------------------------------------
 main() {
   local num_signed=0
   local num_given=$(echo "$FLAGS_partitions" | wc -w)
   # Check parameters
-  KERNEL_KEYBLOCK="$FLAGS_keys/kernel.keyblock"
-  KERNEL_DATAKEY="$FLAGS_keys/kernel_data_key.vbprivk"
-  KERNEL_PUBKEY="$FLAGS_keys/kernel_subkey.vbpubk"
+  if [ "$FLAGS_recovery_key" = "$FLAGS_TRUE" ]; then
+    KERNEL_KEYBLOCK="$FLAGS_keys/recovery_kernel.keyblock"
+    KERNEL_DATAKEY="$FLAGS_keys/recovery_kernel_data_key.vbprivk"
+    KERNEL_PUBKEY="$FLAGS_keys/recovery_key.vbpubk"
+  else
+    KERNEL_KEYBLOCK="$FLAGS_keys/kernel.keyblock"
+    KERNEL_DATAKEY="$FLAGS_keys/kernel_data_key.vbprivk"
+    KERNEL_PUBKEY="$FLAGS_keys/kernel_subkey.vbpubk"
+  fi
 
   debug_msg "Prerequisite check"
   ensure_files_exist \
     "$KERNEL_KEYBLOCK" \
     "$KERNEL_DATAKEY" \
     "$KERNEL_PUBKEY" \
     "$FLAGS_image" ||
     exit 1
 
   resign_ssd_kernel "$FLAGS_image" || num_signed=$?
 
   debug_msg "Complete."
   if [ $num_signed -gt 0 -a $num_signed -le $num_given ]; then
     # signed something at least
     echo "Successfully re-signed $num_signed of $num_given kernel(s)" \
       " on device $FLAGS_image".
   else
     err_die "Failed re-signing kernels."
   fi
 }
 
 main