factory_test_tools: provide more helpful debug messages

gft_verify_keys.sh

 #!/bin/sh
 # Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 #
 # Derived from dev_debug_vboot.
 #
 # This script checks if system firmware and SSD images are ready for verified
 # booting.
 #
 
+alert() {
+  echo "$*" 1>&2
+}
+
 if [ "$#" != "2" ]; then
-  echo "ERROR: Usage: $0 kernel_device main_firmware" 1>&2
+  alert "ERROR: Usage: $0 kernel_device main_firmware"
   exit 1
 fi
 
+DEVKEYS="/usr/share/vboot/devkeys"
 TMPDIR="$(mktemp -d)"
 KERN_DEV="$(readlink -f "$1")"
 FIRMWARE_IMAGE="$(readlink -f "$2")"
 RETURN=0
 
 invoke() {
   # Usage: invoke "message" "shell-command"
   result=0
   message="$1"
   shift
   eval "$@" >_stdout 2>_stderr || result=$?
   if [ "$result" != 0 ]; then
-    echo "ERROR: Failed to $message" 1>&2
-    echo "Command detail: $@" 1>&2
+    alert "ERROR: Failed to $message"
+    alert "Command detail: $@"
     cat _stdout _stderr 1>&2
     RETURN=1
   fi
 }
 
 detect_section_name() {
   # Usage: detect_section_name official_name alias_name
   if [ -f "$2" ]; then
     echo "$2"
   else
     echo "$1"
   fi
 }
 
 verify_keys() {
   # Usage: verify_keys kernel_device main_firmware
 
   # Define section names
   GBB="$(detect_section_name GBB GBB_Area)"
   FW_MAIN_A="$(detect_section_name FW_MAIN_A Firmware_A_Data)"
   FW_MAIN_B="$(detect_section_name FW_MAIN_B Firmware_B_Data)"
   VBLOCK_A="$(detect_section_name VBLOCK_A Firmware_A_Key)"
   VBLOCK_B="$(detect_section_name VBLOCK_B Firmware_B_Key)"
 
   invoke "dump kernel" dd if="$1" bs=1M count=64 of=hd_kern.blob
   invoke "extract firmware" dump_fmap -x "$2"
   invoke "get keys from firmware" \
-    gbb_utility -g --rootkey rootkey.vbpubk "$GBB"
+    gbb_utility -g --rootkey rootkey.vbpubk \
+                   --recoverykey recoverykey.vbpubk "$GBB"
   invoke "unpack rootkey" \
     vbutil_key --unpack rootkey.vbpubk
+  invoke "unpack recovery key" \
+    vbutil_key --unpack recoverykey.vbpubk
+
+  # check if rootkey is developer key. 130 is the magic number for DEV key
+  local key
+  local rootkey_hash="$(od "rootkey.vbpubk" |
+                        head -130 |
+                        md5sum |
+                        sed 's/ .*$//' 2>/dev/null || true)"
+  if [ "$rootkey_hash" = "a13642246ef93daaf75bd791446fec9b" ]; then
+    alert "ERROR: YOU ARE TRYING TO FINALIZE WITH DEV ROOTKEY."
+  fi
 
   # Verify firmware A/B with root key
   invoke "verify VBLOCK_A with FW_MAIN_A" \
     vbutil_firmware --verify "$VBLOCK_A" --signpubkey rootkey.vbpubk \
     --fv "$FW_MAIN_A" --kernelkey kernel_subkey_a.vbpubk
   invoke "verify VBLOCK_B with FW_MAIN_B" \
     vbutil_firmware --verify "$VBLOCK_B" --signpubkey rootkey.vbpubk \
     --fv "$FW_MAIN_B" --kernelkey kernel_subkey_b.vbpubk
 
   # Unpack keys and keyblocks
   for key in kernel_subkey_a.vbpubk kernel_subkey_b.vbpubk; do
     invoke "unpack $key" vbutil_key --unpack $key
   done
   for keyblock in *kern*.blob; do
     invoke "unpack $keyblock" vbutil_keyblock --unpack $keyblock
   done
 
   # Test each kernel by each key
   for key in kernel_subkey_a.vbpubk kernel_subkey_b.vbpubk
   do
     for kern in *kern*.blob; do
       invoke "verify $kern by $key" \
         vbutil_kernel --verify $kern --signpubkey $key
     done
   done
+
+  if [ "$RETURN" != "0" ]; then
+    # Error encountered. Let's try if we can provide more information.
+    key="recoverykey.vbpubk"
+    vbutil_kernel --verify "$kern" --signpubkey "$key" >/dev/null 2>&1 &&
+      alert "ERROR: YOU ARE USING A RECOVERY KEY SIGNED IMAGE." ||
+      true
+    for key in recovery_key.vbpubk kernel_subkey.vbpubk; do
+      if [ -f "$DEVKEYS/$key" ]; then
+        vbutil_kernel --verify "$kern" \
+                      --signpubkey "$DEVKEYS/$key" >/dev/null 2>&1 &&
+          alert "ERROR: YOU ARE FINALIZING WITH DEV-SIGNED IMAGE ($key)." ||
+          true
+      fi
+    done
+  fi
+
   return $RETURN
 }
 
 # verify_keys is run inside a sub-shell, so we need to check its return value
 # instead of reading the global variable RETURN.
 ( cd "$TMPDIR"
   verify_keys "$KERN_DEV" "$FIRMWARE_IMAGE" ) || RETURN=1
 /bin/rm -rf "$TMPDIR"
 exit $RETURN