diff options
Diffstat (limited to 'scripts')
-rwxr-xr-x | scripts/image_signing/sign_firmware.sh | 18 |
1 files changed, 11 insertions, 7 deletions
diff --git a/scripts/image_signing/sign_firmware.sh b/scripts/image_signing/sign_firmware.sh index 1d20e10c..364a8c75 100755 --- a/scripts/image_signing/sign_firmware.sh +++ b/scripts/image_signing/sign_firmware.sh @@ -31,17 +31,21 @@ OUT_FIRMWARE=$3 temp_fw=$(mktemp) trap "rm ${temp_fw}" EXIT -# Replace the root and recovery key in the Google Binary Block of the firmware. -gbb_utility -s \ - --rootkey=${KEY_DIR}/root_key.vbpubk \ - --recoverykey=${KEY_DIR}/recovery_key.vbpubk \ - ${IN_FIRMWARE} ${temp_fw} - # Resign the firmware with new keys -${SCRIPT_DIR}/resign_firmwarefd.sh ${temp_fw} ${OUT_FIRMWARE} \ +${SCRIPT_DIR}/resign_firmwarefd.sh ${IN_FIRMWARE} ${temp_fw} \ ${KEY_DIR}/firmware_data_key.vbprivk \ ${KEY_DIR}/firmware.keyblock \ ${KEY_DIR}/dev_firmware_data_key.vbprivk \ ${KEY_DIR}/dev_firmware.keyblock \ ${KEY_DIR}/kernel_subkey.vbpubk \ ${FIRMWARE_VERSION} + +# Replace the root and recovery key in the Google Binary Block of the firmware. +# Note: This needs to happen after calling resign_firmwarefd.sh since it needs +# to be able to verify the firmware using the root key to determine the preamble +# flags. +gbb_utility -s \ + --rootkey=${KEY_DIR}/root_key.vbpubk \ + --recoverykey=${KEY_DIR}/recovery_key.vbpubk \ + ${temp_fw} ${OUT_FIRMWARE} + |