diff options
| -rw-r--r-- | scripts/keygeneration/common.sh | 2 | ||||
| -rwxr-xr-x | scripts/keygeneration/create_new_keys.sh | 37 |
2 files changed, 37 insertions, 2 deletions
diff --git a/scripts/keygeneration/common.sh b/scripts/keygeneration/common.sh index 07a7b2c6..2d24deea 100644 --- a/scripts/keygeneration/common.sh +++ b/scripts/keygeneration/common.sh @@ -5,7 +5,7 @@ # Common key generation functions. -SCRIPT_DIR="$(dirname "$0")" +SCRIPT_DIR="$(dirname "$(readlink -f -- "$0")")" # Algorithm ID mappings: RSA1024_SHA1_ALGOID=0 diff --git a/scripts/keygeneration/create_new_keys.sh b/scripts/keygeneration/create_new_keys.sh index 6db6218b..5e6c9eee 100755 --- a/scripts/keygeneration/create_new_keys.sh +++ b/scripts/keygeneration/create_new_keys.sh @@ -21,6 +21,8 @@ Options: --4k-recovery Use 4k key size for the recovery key --4k-recovery-kernel Use 4k key size for the recovery kernel data --4k-installer-kernel Use 4k key size for the installer kernel data + --key-name <name> Name of the keyset (for key.versions) + --output <dir> Where to write the keys (default is cwd) EOF if [[ $# -ne 0 ]]; then @@ -41,6 +43,8 @@ main() { local recovery_key_algoid=${RECOVERY_KEY_ALGOID} local recovery_kernel_algoid=${RECOVERY_KERNEL_ALGOID} local installer_kernel_algoid=${INSTALLER_KERNEL_ALGOID} + local keyname + local output_dir="${PWD}" setperms="false" while [[ $# -gt 0 ]]; do case $1 in @@ -73,6 +77,21 @@ main() { installer_kernel_algoid=${RSA4096_SHA512_ALGOID} ;; + --key-name) + keyname="$2" + shift + ;; + + --output) + output_dir="$2" + setperms="true" + if [[ -d "${output_dir}" ]]; then + echo "ERROR: output dir (${output_dir}) already exists" >&2 + exit 1 + fi + shift + ;; + -h|--help) usage ;; @@ -83,9 +102,20 @@ main() { shift done + mkdir -p "${output_dir}" + cd "${output_dir}" + if [[ "${setperms}" == "true" ]]; then + chmod 700 . + fi + if [[ ! -e "${VERSION_FILE}" ]]; then echo "No version file found. Creating default ${VERSION_FILE}." - printf '%s_version=1\n' {firmware,kernel}{_key,} > "${VERSION_FILE}" + ( + if [[ -n "${keyname}" ]]; then + echo "name=${keyname}" + fi + printf '%s_version=1\n' {firmware,kernel}{_key,} + ) > "${VERSION_FILE}" fi local eckey_version fkey_version ksubkey_version kdatakey_version @@ -140,6 +170,11 @@ main() { "${SCRIPT_DIR}"/create_new_android_keys.sh android fi + if [[ "${setperms}" == "true" ]]; then + find -type f -exec chmod 400 {} + + find -type d -exec chmod 500 {} + + fi + # CAUTION: The public parts of most of these blobs must be compiled into the # firmware, which is built separately (and some of which can't be changed after # manufacturing). If you update these keys, you must coordinate the changes |