blob: fa200837e5118598c4453efc651c42bb5c8155c7 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
#!/bin/bash
# Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
# Wrapper script for re-signing a firmware image.
# Determine script directory.
SCRIPT_DIR=$(dirname "$0")
# Load common constants and variables.
. "${SCRIPT_DIR}/common_minimal.sh"
# Abort on error.
set -e
usage() {
cat<<EOF
Usage: $0 <input_firmware> <key_dir> <output_firmware> [firmware_version] \
[loem_output_dir]
Signs <input_firmware> with keys in <key_dir>, setting firmware version
to <firmware_version>. Outputs signed firmware to <output_firmware>.
If no firmware version is specified, it is set as 1.
EOF
exit 1
}
# Sign a single firmware image.
# ARGS: [loem_key] [loemid]
sign_one() {
local loem_key="$1"
local loemid="$2"
# Resign the firmware with new keys.
"${SCRIPT_DIR}/resign_firmwarefd.sh" \
"${in_firmware}" \
"${temp_fw}" \
"${key_dir}/firmware_data_key${loem_key}.vbprivk" \
"${key_dir}/firmware${loem_key}.keyblock" \
"${key_dir}/dev_firmware_data_key${loem_key}.vbprivk" \
"${key_dir}/dev_firmware${loem_key}.keyblock" \
"${key_dir}/kernel_subkey.vbpubk" \
"${firmware_version}" \
"" \
"${loem_output_dir}" \
"${loemid}"
# Replace the root and recovery key in the Google Binary Block of the
# firmware. Note: This needs to happen after calling resign_firmwarefd.sh
# since it needs to be able to verify the firmware using the root key to
# determine the preamble flags.
local rootkey="${key_dir}/root_key${loem_key}.vbpubk"
local gbb_args=( -s --recoverykey="${key_dir}/recovery_key.vbpubk" )
if [[ -z ${loemid} ]]; then
gbb_args+=( --rootkey="${rootkey}" "${temp_fw}" )
else
gbb_args+=( "${in_firmware}" )
cp "${rootkey}" "${loem_output_dir}/rootkey.${loemid}"
fi
gbb_utility "${gbb_args[@]}" "${out_firmware}"
}
# Process all the keysets in the loem.ini file.
sign_loems() {
local line loem_section=false loem_index loemid
while read line; do
# Find the [loem] section.
if ! ${loem_section}; then
if grep -q "^ *\[loem\] *$" <<<"${line}"; then
loem_section=true
fi
continue
# Abort when we hit the next section.
elif [[ ${line} == *"["* ]]; then
break
fi
# Strip comments/whitespace.
line=$(sed -e 's:#.*::' -e 's:^ *::' -e 's: *$::' <<<"${line}")
loem_index=$(cut -d= -f1 <<<"${line}" | sed 's: *$::')
loemid=$(cut -d= -f2 <<<"${line}" | sed 's:^ *::')
echo "### Processing LOEM ${loem_index} ${loemid}"
sign_one ".loem${loem_index}" "${loemid}"
echo
done <"${key_dir}/loem.ini"
}
main() {
if [[ $# -lt 3 || $# -gt 5 ]]; then
usage
fi
local in_firmware=$1
local key_dir=$2
local out_firmware=$3
local firmware_version=${4:-1}
local loem_output_dir=${5:-}
local temp_fw=$(make_temp_file)
if [[ -e ${key_dir}/loem.ini ]]; then
if [[ -z ${loem_output_dir} ]]; then
err_die "need loem_output_dir w/loem keysets"
fi
sign_loems
else
sign_one
fi
}
main "$@"
|
