diff options
| -rwxr-xr-x | scripts/image_signing/sign_official_build.sh | 10 | ||||
| -rwxr-xr-x | scripts/image_signing/sign_uefi.sh | 10 |
2 files changed, 14 insertions, 6 deletions
diff --git a/scripts/image_signing/sign_official_build.sh b/scripts/image_signing/sign_official_build.sh index d96250d1..d35db6f7 100755 --- a/scripts/image_signing/sign_official_build.sh +++ b/scripts/image_signing/sign_official_build.sh @@ -711,6 +711,7 @@ resign_android_image_if_exists() { # Args: LOOPDEV sign_uefi_binaries() { local loopdev="$1" + local efi_glob="*.efi" if [[ ! -d "${KEY_DIR}/uefi" ]]; then return 0 @@ -727,13 +728,18 @@ sign_uefi_binaries() { # in the signing repo. This is a temporary fix to unblock reven-release. if [[ "${KEY_DIR}" != *"Reven"* ]]; then "${SCRIPT_DIR}/install_gsetup_certs.sh" "${esp_dir}" "${KEY_DIR}/uefi" + else + # b/205145491: the reven board's boot*.efi files are already signed, + # change the glob so that they don't get resigned. + efi_glob="grub*.efi" fi - "${SCRIPT_DIR}/sign_uefi.sh" "${esp_dir}" "${KEY_DIR}/uefi" + "${SCRIPT_DIR}/sign_uefi.sh" "${esp_dir}" "${KEY_DIR}/uefi" "${efi_glob}" sudo umount "${esp_dir}" local rootfs_dir="$(make_temp_dir)" mount_loop_image_partition "${loopdev}" 3 "${rootfs_dir}" - "${SCRIPT_DIR}/sign_uefi.sh" "${rootfs_dir}/boot" "${KEY_DIR}/uefi" + "${SCRIPT_DIR}/sign_uefi.sh" "${rootfs_dir}/boot" "${KEY_DIR}/uefi" \ + "${efi_glob}" sudo umount "${rootfs_dir}" info "Signed UEFI binaries" diff --git a/scripts/image_signing/sign_uefi.sh b/scripts/image_signing/sign_uefi.sh index 6deb2804..a053a4a0 100755 --- a/scripts/image_signing/sign_uefi.sh +++ b/scripts/image_signing/sign_uefi.sh @@ -9,7 +9,7 @@ set -e usage() { cat <<EOF -Usage: $PROG /path/to/target/dir /path/to/uefi/keys/dir +Usage: $PROG /path/to/target/dir /path/to/uefi/keys/dir efi_glob Sign the UEFI binaries in the target directory. The target directory can be either the root of ESP or /boot of root filesystem. @@ -47,9 +47,10 @@ sign_efi_file() { main() { local target_dir="$1" local key_dir="$2" + local efi_glob="$3" - if [[ $# -ne 2 ]]; then - usage "command takes exactly 2 args" + if [[ $# -ne 3 ]]; then + usage "command takes exactly 3 args" fi if ! type -P sbattach &>/dev/null; then @@ -84,7 +85,8 @@ main() { local working_dir="$(make_temp_dir)" local efi_file - for efi_file in "${bootloader_dir}"/*.efi; do + # Leave ${efi_glob} unquoted so that globbing occurs. + for efi_file in "${bootloader_dir}"/${efi_glob}; do if [[ ! -f "${efi_file}" ]]; then continue fi |