delta/coreboot/vboot.git/scripts, branch release-R114-15437.B

scripts: Support compressed about_os_credits.html.

2023-04-25T00:20:57+00:00

BUG=b:187790036
BRANCH=none
TEST=ensure_not_tainted_license.sh /path/to/chromiumos_test_image.bin

Signed-off-by: Miriam Zimmerman 
Change-Id: Id3ad6535b1bc9635050d467208614f97e0aeca35
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4467627
Commit-Queue: Miriam Zimmerman 
Tested-by: Miriam Zimmerman 
Reviewed-by: Mike Frysinger

sign_official_build: Add support for a second miniOS key

2023-04-21T10:41:09+00:00

For recovery images, if minios_kernel.v1.keyblock exists, sign
- MINIOS-A with minios_kernel.v1.keyblock
- MINIOS-B with minios_kernel.keyblock
Otherwise, sign both with minios_kernel.keyblock.

BRANCH=None
BUG=b:266502803
TEST=- Run replace_recovery_key.sh in devkeys directory to get test keys
- Run sign_official_build.sh on a nissa recovery image
- Set recovery_key.v1.vbpubk in GBB and run recovery. After recovery
  completes, check NBR still works.
- Repeat with recovery_key.vbpubk.

Change-Id: I2336e5261ef24114c5fee302ed95b4dfa1f67c11
Signed-off-by: Reka Norman 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4452079
Tested-by: Reka Norman 
Commit-Queue: Reka Norman 
Reviewed-by: Julius Werner

sign_official_build: Fix is-reven check

2023-03-23T16:43:02+00:00

The `get_is_reven` function added in https://crrev.com/c/4206907 was too
restrictive. When run by the signer, the board name has been modified
from "reven" to "reven-signed-mp-v2keys". Change the condition to accept
either `reven` or `reven-signed*` (note the glob). Allowing plain
"reven" is not strictly necessary, but useful for local testing.

Tested the updated function by building a reven base image, then making
variants with different CHROMEOS_RELEASE_BOARD values: "reven",
"reven-signed-mp-v2keys", and "revenator". Running
`sign_official_build.sh` on them shows that the first two are identified
as reven, and the last one is not. This can be seen by checking if
boot*.efi is signed or not, since that should not happen for reven.

BRANCH=none
BUG=b:274648121
TEST=See above
TEST=FEATURES=test emerge-reven vboot_reference

Change-Id: I099abf372b71ea3e064e91a57c5e8888de298028
Signed-off-by: Nicholas Bishop 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4358400
Reviewed-by: Mike Frysinger

sign_official_build: Don't sign miniOS kernels in factory shims

2023-03-09T07:08:43+00:00

Factory shims contain miniOS kernels, but they are not used, so don't
sign them. They will remain in the image signed with dev keys.

BRANCH=None
BUG=None
TEST=Run sign_official_build.sh on factory shim. Logs show miniOS
kernels are not signed, and shim still boots.

Change-Id: I4a1b72726edb7d780a3f2c2fe783f568a012ee77
Signed-off-by: Reka Norman 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4321706
Tested-by: Reka Norman 
Reviewed-by: Julius Werner 
Commit-Queue: Reka Norman

sign_official_build: Support a second recovery key

2023-03-08T03:25:08+00:00

Some devices have a second recovery key, which is used to sign:
- a second recovery kernel KERN-C in recovery images
- a second installer kernel KERN-B in factory images

If a device has a second recovery key, use it to sign the second
recovery and installer kernels. Otherwise, don't sign the second
kernels. If they are present, they'll remain in the image signed with
dev keys.

BRANCH=None
BUG=b:266502803
TEST=- Run replace_recovery_key.sh in devkeys directory to get keys for
testing.
- Run sign_official_build.sh on a recovery image with KERN-C present.
- Set recovery_key.vbpubk in GBB - recovery succeeds using KERN-A.
- Set recovery_key.v1.vbpubk in GBB - recovery succeeds using KERN-C.
- Run sign_official_build.sh on a factory shim with KERN-B present.
- Set recovery_key.vbpubk in GBB - factory shim boots using KERN-A.
- Set recovery_key.v1.vbpubk in GBB - factory shim boots using KERN-B.
- Run sign_official_build.sh on a base image and check it boots.

Change-Id: I39b209e1efd4669128a12751f1c4ee94bb722d67
Signed-off-by: Reka Norman 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4242686
Reviewed-by: Mike Frysinger 
Commit-Queue: Reka Norman 
Tested-by: Reka Norman 
Reviewed-by: Julius Werner

scripts/../{g,s}et_gbb_flags.sh: Add delay

2023-03-03T12:35:52+00:00

Give some time to the user to reconsider and ween users off a
unsupported ABI.

BUG=b:260531154
TEST=none

Change-Id: I9cfbd032f56d7aa3ba1f19abdd26c15a785cc876
Signed-off-by: Edward O'Callaghan 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4269751
Auto-Submit: Edward O'Callaghan 
Commit-Queue: Edward O'Callaghan 
Reviewed-by: Otabek Kasimov 
Reviewed-by: Hung-Te Lin 
Tested-by: Edward O'Callaghan 
Reviewed-by: Yu-Ping Wu

sign_uefi: Add support for crdyboot

2023-03-02T06:24:27+00:00

The crdyboot bootloader (see
https://chromium.googlesource.com/chromiumos/platform/crdyboot) for the
reven board requires some additional handling for signing:
* A public key for verifying the kernel must be injected into the
  `.vbpubk` section.
* Then the file must be signed with `sbsign` in the usual way.

Testing commands:
```
scripts/keygeneration/make_arv_root.sh arv
scripts/keygeneration/create_new_keys.sh \
    --arv-root-path arv --uefi --output reven

scripts/image_signing/sign_official_build.sh recovery \
    ~/chromiumos/src/build/images/reven/latest/chromiumos_image.bin \
    reven \
    ~/chromiumos/src/build/images/reven/latest/chromiumos_image.signed

Then boot the image in a UEFI VM.
```

BRANCH=none
BUG=b:256176281
TEST=make runtests
TEST=See testing notes above

Change-Id: Id454ff0677c397b2c399f39981862ac18c2c9985
Signed-off-by: Nicholas Bishop 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4250562
Reviewed-by: Mike Frysinger 
Commit-Queue: Mike Frysinger

scripts/image_signing/make_dev_ssd.sh: Replace flashrom call

2023-02-24T09:11:05+00:00

Just use futility directly.

BUG=b:260531154
TEST=```
localhost ~ # futility gbb -g --flash --rootkey=/tmp/rkey >/dev/null 2>&1
localhost ~ # od /tmp/rkey | head -130 | md5sum | sed 's/ .*$//'
a13642246ef93daaf75bd791446fec9b
```

Change-Id: I1aa3b52f568a5e78255b52a15d68258cc9d9aa44
Signed-off-by: Edward O'Callaghan 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4269750
Reviewed-by: Yu-Ping Wu 
Commit-Queue: Yu-Ping Wu 
Tested-by: Edward O'Callaghan 
Reviewed-by: Sam McNally 
Auto-Submit: Edward O'Callaghan

{g,s}et_gbb_flags.sh: Fix removal notice message

2023-02-16T09:14:24+00:00

Fix the futility command in the removal notice message, by adding the
missing `--flash` option.

BUG=b:260531154
TEST=Ran set_gbb_flags.sh
BRANCH=none

Change-Id: Ic1846929661a47c40b65e67ea76f776493ee2d9c
Signed-off-by: Yu-Ping Wu 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4251505
Reviewed-by: Edward O'Callaghan 
Commit-Queue: Matthew Blecker 
Reviewed-by: Matthew Blecker 
Reviewed-by: Alexandru Stan

sign_official_build: Silence shellcheck sed lints

2023-02-14T09:00:14+00:00

Silence all current instances of "SC2001 (style): See if you can use
${variable//search/replace} instead." Replacing complicated `sed` calls
without tests in place would likely lead to mistakes, so leave them
alone for now. The lint is not disabled globally though, so new uses can
still be flagged.

BRANCH=none
BUG=None
TEST=cros lint scripts/image_signing/sign_official_build.sh
TEST=scripts/image_signing/sign_official_build.sh recovery \
TEST=  ~/chromiumos/src/build/images/reven/latest/chromiumos_image.bin
TEST=  tests/devkeys
TEST=  ~/chromiumos/src/build/images/reven/latest/chromiumos_image.signed

Change-Id: I228e78033f891ee09db40b937b4d7a7750de8c18
Signed-off-by: Nicholas Bishop 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4245621
Reviewed-by: Mike Frysinger