blob: 8cd60e4a7a3a73cf0ae8b9bedac824fbe21ba1c5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
#!/bin/bash
# Copyright 2017 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
# Load common constants and variables.
. "$(dirname "$0")/common.sh"
load_shflags || exit 1
FLAGS_HELP="Usage: ${PROG} <image.bin|rootfs_dir> <public_key.pem>
Installs the container verification public key <public_key.pem> to
<image.bin|rootfs_dir>.
"
# Parse command line.
FLAGS "$@" || exit 1
eval set -- "${FLAGS_ARGV}"
# Abort on error.
set -e
main() {
if [[ $# -ne 2 ]]; then
flags_help
exit 1
fi
local image="$1"
local pub_key="$2"
local rootfs
local key_location="/usr/share/misc/"
if [[ -d "${image}" ]]; then
rootfs="${image}"
else
rootfs=$(make_temp_dir)
mount_image_partition "${image}" 3 "${rootfs}"
fi
# Imageloader likes DER as a runtime format as it's easier to read.
local tmpfile=$(mktemp)
trap "rm -f '${tmpfile}'" EXIT
openssl pkey -pubin -in "${pub_key}" -out "${tmpfile}" -pubout -outform DER
sudo install \
-D -o root -g root -m 644 \
"${tmpfile}" "${rootfs}/${key_location}/oci-container-key-pub.der"
info "Container verification key was installed." \
"Do not forget to resign the image!"
}
main "$@"
|