Fail verification if the rootfs hash is empty.

scripts/image_signing/sign_official_build.sh

 #!/bin/bash
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Sign the final build image using the "official" keys.
 #
 # Prerequisite tools needed in the system path:
 #
@@ skipping 283 matching lines @@
   local hash_image=$(make_temp_file)
   local type=""
 
   # First, perform RootFS verification
   echo "Verifying RootFS hash..."
   local new_kernel_config=$(calculate_rootfs_hash "${rootfs_image}" \
     "${kernel_config}" "${hash_image}")
   local expected_hash=$(get_hash_from_config "${new_kernel_config}")
   local got_hash=$(get_hash_from_config "${kernel_config}")
 
+  if [ -z "${expected_hash}" ]; then
+    echo "FAILED: RootFS hash is empty!"
+    exit 1
+  fi
   if [ ! "${got_hash}" = "${expected_hash}" ]; then
     cat <<EOF
 FAILED: RootFS hash is incorrect.
 Expected: ${expected_hash}
 Got: ${got_hash}
 EOF
+    exit 1
   else
     echo "PASS: RootFS hash is correct (${expected_hash})"
   fi
 
   # Now try and verify kernel partition signature.
   set +e
   local try_key=${KEY_DIR}/recovery_key.vbpubk
   echo "Testing key verification..."
   # The recovery key is only used in the recovery mode.
   echo -n "With Recovery Key (Recovery Mode ON, Dev Mode OFF): " && \
@@ skipping 191 matching lines @@
   resign_firmware_payload ${OUTPUT_IMAGE}
   update_rootfs_hash ${OUTPUT_IMAGE} \
     ${KEY_DIR}/installer_kernel.keyblock \
     ${KEY_DIR}/installer_kernel_data_key.vbprivk \
     2
   sign_for_factory_install ${OUTPUT_IMAGE}
 else
   echo "Invalid type ${TYPE}"
   exit 1
 fi