From 39086358bfd314538e13176819f31d196c2f72f1 Mon Sep 17 00:00:00 2001
From: Michael Marineau <michael.marineau@coreos.com>
Date: Thu, 27 Mar 2014 16:59:19 -0700
Subject: [PATCH 1/5] refactor(build_image): Build dev and prod images
 independently

We need some more control over exactly what lands in dev vs prod images
which will require letting them diverge in what is currently the common
base image step. There isn't any real need for the base image in the
first place other than to speed up building both dev and prod images at
the same time but that isn't common enough to worry about.

As part of this cleanup also remove references to CHROMEOS_* variables
and the recovery image that never actually existed in CoreOS.
---
 build_image                       |  58 +++++-----------
 build_library/build_image_util.sh |  65 -----------------
 common.sh                         |  10 +--
 image_to_vm.sh                    |   2 +-
 security_test_image               | 112 ------------------------------
 5 files changed, 21 insertions(+), 226 deletions(-)
 delete mode 100755 security_test_image

diff --git a/build_image b/build_image
index de058d63b3..8b7c7ec0b7 100755
--- a/build_image
+++ b/build_image
@@ -74,7 +74,7 @@ DEFINE_string version "" \
 # Parse command line.
 FLAGS "$@" || exit 1
 
-eval set -- "${FLAGS_ARGV}"
+eval set -- "${FLAGS_ARGV:-dev}"
 
 # Only now can we die on error.  shflags functions leak non-zero error codes,
 # so will die prematurely if 'switch_to_strict_mode' is specified before now.
@@ -92,14 +92,18 @@ check_gsutil_opts
 . "${BUILD_LIBRARY_DIR}/dev_image_util.sh" || exit 1
 . "${BUILD_LIBRARY_DIR}/test_image_content.sh" || exit 1
 
-parse_build_image_args
+PROD_IMAGE=0
+DEV_IMAGE=0
+for arg in "$@"; do
+  case "${arg}" in
+    prod) PROD_IMAGE=1 ;;
+    dev)  DEV_IMAGE=1 ;;
+    *)    die_notrace "Unknown image type ${arg}" ;;
+  esac
+done
 
 BASE_PACKAGE="coreos-base/coreos"
 
-PRISTINE_IMAGE_NAME=${CHROMEOS_BASE_IMAGE_NAME}
-
-DEVKEYSDIR="/usr/share/vboot/devkeys"
-
 eclean-$BOARD -d packages
 
 if [[ ${skip_blacklist_check} -ne 1 ]]; then
@@ -134,31 +138,14 @@ mkdir -p "${BUILD_DIR}"
 
 DISK_LAYOUT="${FLAGS_disk_layout:-base}"
 
-# Create the base image.
-create_base_image "${PRISTINE_IMAGE_NAME}" "${DISK_LAYOUT}" "${FLAGS_group}"
-if should_build_image ${PRISTINE_IMAGE_NAME}; then
-  upload_image "${BUILD_DIR}/${PRISTINE_IMAGE_NAME}"
+if [[ "${DEV_IMAGE}" -eq 1 ]]; then
+  create_base_image ${COREOS_DEVELOPER_IMAGE_NAME} ${DISK_LAYOUT} ${FLAGS_group}
+  install_dev_packages ${COREOS_DEVELOPER_IMAGE_NAME} ${DISK_LAYOUT}
+  upload_image "${BUILD_DIR}/${COREOS_DEVELOPER_IMAGE_NAME}"
 fi
 
-# Running board-specific setup if any exists.
-if type board_setup &>/dev/null; then
-  board_setup "${BUILD_DIR}/${PRISTINE_IMAGE_NAME}"
-fi
-
-# Create a developer image if an image that is based on it is requested.
-if should_build_image ${CHROMEOS_DEVELOPER_IMAGE_NAME}; then
-  if should_build_image ${COREOS_PRODUCTION_IMAGE_NAME}; then
-    cp "${BUILD_DIR}/${PRISTINE_IMAGE_NAME}" \
-        "${BUILD_DIR}/${CHROMEOS_DEVELOPER_IMAGE_NAME}"
-  else
-    copy_image ${PRISTINE_IMAGE_NAME} ${CHROMEOS_DEVELOPER_IMAGE_NAME}
-  fi
-  install_dev_packages ${CHROMEOS_DEVELOPER_IMAGE_NAME} ${DISK_LAYOUT}
-  upload_image "${BUILD_DIR}/${CHROMEOS_DEVELOPER_IMAGE_NAME}"
-fi
-
-if should_build_image ${COREOS_PRODUCTION_IMAGE_NAME}; then
-  copy_image ${CHROMEOS_BASE_IMAGE_NAME} ${COREOS_PRODUCTION_IMAGE_NAME}
+if [[ "${PROD_IMAGE}" -eq 1 ]]; then
+  create_base_image ${COREOS_PRODUCTION_IMAGE_NAME} ${DISK_LAYOUT} ${FLAGS_group}
   setup_prod_image ${COREOS_PRODUCTION_IMAGE_NAME} ${DISK_LAYOUT}
   upload_image "${BUILD_DIR}/${COREOS_PRODUCTION_IMAGE_NAME}"
   if [[ ${FLAGS_generate_update} -eq ${FLAGS_TRUE} ]]; then
@@ -166,10 +153,6 @@ if should_build_image ${COREOS_PRODUCTION_IMAGE_NAME}; then
   fi
 fi
 
-if ! should_build_image ${PRISTINE_IMAGE_NAME}; then
-  rm -f "${BUILD_DIR}/${PRISTINE_IMAGE_NAME}"
-fi
-
 # Write out a version.txt file, this will be used by image_to_vm.sh
 tee "${BUILD_DIR}/version.txt" <<EOF
 COREOS_BUILD=${COREOS_BUILD}
@@ -203,15 +186,12 @@ EOF
 }
 
 # Print out the images we generated.
-if should_build_image ${COREOS_PRODUCTION_IMAGE_NAME}; then
+if [[ "${PROD_IMAGE}" -eq 1 ]]; then
   echo "CoreOS Production image created as ${COREOS_PRODUCTION_IMAGE_NAME}"
   print_image_to_vm "prod"
 fi
-if should_build_image ${CHROMEOS_BASE_IMAGE_NAME}; then
-  echo "Non-developer CoreOS image created as ${PRISTINE_IMAGE_NAME}"
-fi
-if should_build_image ${CHROMEOS_DEVELOPER_IMAGE_NAME}; then
-  echo "Developer image created as ${CHROMEOS_DEVELOPER_IMAGE_NAME}"
+if [[ "${DEV_IMAGE}" -eq 1 ]]; then
+  echo "Developer image created as ${COREOS_DEVELOPER_IMAGE_NAME}"
   print_image_to_vm
 fi
 
diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh
index a8b2bd8b30..1122799801 100755
--- a/build_library/build_image_util.sh
+++ b/build_library/build_image_util.sh
@@ -18,7 +18,6 @@ else
 fi
 BUILD_DIR="${FLAGS_output_root}/${BOARD}/${IMAGE_SUBDIR}"
 OUTSIDE_OUTPUT_DIR="../build/images/${BOARD}/${IMAGE_SUBDIR}"
-IMAGES_TO_BUILD=
 
 set_build_symlinks() {
     local build=$(basename ${BUILD_DIR})
@@ -29,70 +28,6 @@ set_build_symlinks() {
     done
 }
 
-# Populates list of IMAGES_TO_BUILD from args passed in.
-# Arguments should be the shortnames of images we want to build.
-get_images_to_build() {
-  local image_to_build
-  for image_to_build in $*; do
-    # Shflags leaves "'"s around ARGV.
-    case ${image_to_build} in
-      \'prod\' )
-        IMAGES_TO_BUILD="${IMAGES_TO_BUILD} ${COREOS_PRODUCTION_IMAGE_NAME}"
-        ;;
-      \'base\' )
-        IMAGES_TO_BUILD="${IMAGES_TO_BUILD} ${CHROMEOS_BASE_IMAGE_NAME}"
-        ;;
-      \'dev\' )
-        IMAGES_TO_BUILD="${IMAGES_TO_BUILD} ${CHROMEOS_DEVELOPER_IMAGE_NAME}"
-        ;;
-      * )
-        die "${image_to_build} is not an image specification."
-        ;;
-    esac
-  done
-
-  # Set default if none specified.
-  if [ -z "${IMAGES_TO_BUILD}" ]; then
-    IMAGES_TO_BUILD=${CHROMEOS_DEVELOPER_IMAGE_NAME}
-  fi
-
-  info "The following images will be built ${IMAGES_TO_BUILD}."
-}
-
-# Look at flags to determine which image types we should build.
-parse_build_image_args() {
-  get_images_to_build ${FLAGS_ARGV}
-}
-
-should_build_image() {
-  # Fast pass back if we should build all incremental images.
-  local image_name
-  local image_to_build
-
-  for image_name in "$@"; do
-    for image_to_build in ${IMAGES_TO_BUILD}; do
-      [ "${image_to_build}" = "${image_name}" ] && return 0
-    done
-  done
-
-  return 1
-}
-
-# Utility function for creating a copy of an image prior to
-# modification from the BUILD_DIR:
-#  $1: source filename
-#  $2: destination filename
-copy_image() {
-  local src="${BUILD_DIR}/$1"
-  local dst="${BUILD_DIR}/$2"
-  if should_build_image $1; then
-    echo "Creating $2 from $1..."
-    cp --sparse=always "${src}" "${dst}" || die "Cannot copy $1 to $2"
-  else
-    mv "${src}" "${dst}" || die "Cannot move $1 to $2"
-  fi
-}
-
 check_blacklist() {
   info "Verifying that the base image does not contain a blacklisted package."
   info "Generating list of packages for ${BASE_PACKAGE}."
diff --git a/common.sh b/common.sh
index 7b9ce50379..f036e18f9b 100644
--- a/common.sh
+++ b/common.sh
@@ -404,16 +404,8 @@ DEFAULT_FAST=${FLAGS_FALSE}
 BUILD_DIR=
 
 # Standard filenames
-CHROMEOS_BASE_IMAGE_NAME="coreos_base_image.bin"
-CHROMEOS_DEVELOPER_IMAGE_NAME="coreos_developer_image.bin"
-CHROMEOS_IMAGE_NAME="$CHROMEOS_DEVELOPER_IMAGE_NAME"
-CHROMEOS_RECOVERY_IMAGE_NAME="recovery_image.bin"
-
-COREOS_BASE_IMAGE_NAME=${CHROMEOS_BASE_IMAGE_NAME}
-COREOS_IMAGE_NAME=${CHROMEOS_IMAGE_NAME}
-COREOS_DEVELOPER_IMAGE_NAME=${CHROMEOS_DEVELOPER_IMAGE_NAME}
+COREOS_DEVELOPER_IMAGE_NAME="coreos_developer_image.bin"
 COREOS_PRODUCTION_IMAGE_NAME="coreos_production_image.bin"
-COREOS_RECOVERY_IMAGE_NAME=${CHROMEOS_RECOVERY_IMAGE_NAME}
 
 # -----------------------------------------------------------------------------
 # Functions
diff --git a/image_to_vm.sh b/image_to_vm.sh
index 198b5ab75c..cc6870df42 100755
--- a/image_to_vm.sh
+++ b/image_to_vm.sh
@@ -91,7 +91,7 @@ if [ ${FLAGS_prod_image} -eq ${FLAGS_TRUE} ]; then
   set_vm_paths "${FLAGS_from}" "${FLAGS_to}" "${COREOS_PRODUCTION_IMAGE_NAME}"
 else
   # Use the standard image
-  set_vm_paths "${FLAGS_from}" "${FLAGS_to}" "${CHROMEOS_IMAGE_NAME}"
+  set_vm_paths "${FLAGS_from}" "${FLAGS_to}" "${COREOS_DEVELOPER_IMAGE_NAME}"
 fi
 
 # Make sure things are cleaned up on failure
diff --git a/security_test_image b/security_test_image
deleted file mode 100755
index f35b9f8638..0000000000
--- a/security_test_image
+++ /dev/null
@@ -1,112 +0,0 @@
-#!/bin/bash
-
-# Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-CROS_LOG_PREFIX=${0##*/}
-
-SCRIPT_ROOT=$(dirname "$(readlink -f "$0")")
-. "${SCRIPT_ROOT}/build_library/build_common.sh" || exit 1
-
-# Developer-visible flags.
-DEFINE_string board "${DEFAULT_BOARD}" \
-  "The board to build an image for."
-DEFINE_string image "" \
-  "Source release image to use (${CHROMEOS_RECOVERY_IMAGE_NAME} by default)."
-DEFINE_string baselines "" \
-  "Directory to load security baselines from (default from cros-signing)"
-
-FLAGS_HELP="USAGE: security_test_image [flags]
-This script is used to run security tests on a Chrome OS images.
-
-Note: You probably will need an internal checkout by default for these
-      tests to be useful.  You can provide your own baselines, but you
-      can certainly provide your own set of configs.
-
-Note: These tests will fail on dev images.  They are designed to
-      check recovery images only.
-"
-show_help_if_requested "$@"
-
-# Parse command line.
-FLAGS "$@" || exit 1
-eval set -- "${FLAGS_ARGV}"
-
-# Only now can we die on error.  shflags functions leak non-zero error codes,
-# so will die prematurely if 'switch_to_strict_mode' is specified before now.
-switch_to_strict_mode
-
-SIGNER_DIR="${CHROOT_TRUNK_DIR}/cros-signing"
-SIGNING_TOOLS_DIR="${SIGNER_DIR}/signer/signingtools-bin"
-SECURITY_BASELINE_DIR="${SIGNER_DIR}/security_test_baselines"
-VBOOT_DIR="${CHROOT_TRUNK_DIR}/src/platform/vboot_reference/scripts/"\
-"image_signing"
-
-# No security baselines provided.  Use the standard one.
-if [[ -z ${FLAGS_baselines} ]]; then
-  FLAGS_baselines=${SECURITY_BASELINE_DIR}
-  if [[ ! -d ${FLAGS_baselines} ]]; then
-    if [[ ! -d ${SIGNER_DIR} ]]; then
-      warn "Skipping security tests with public manifest"
-      exit 0
-    else
-      die "Could not locate security baselines from" \
-          "${FLAGS_baselines} with private manifest"
-    fi
-  fi
-fi
-info "Loading baselines from ${FLAGS_baselines}"
-
-# No image was provided.  Use the standard latest image.
-if [[ -z ${FLAGS_image} ]]; then
-  DEFAULT_IMAGE_DIR=$("${SCRIPT_ROOT}"/get_latest_image.sh \
-                        --board="${FLAGS_board}")
-  FLAGS_image="${DEFAULT_IMAGE_DIR}/${CHROMEOS_RECOVERY_IMAGE_NAME}"
-fi
-info "Using ${FLAGS_image}"
-
-# The signer uses these binaries, so we should too.
-PATH="${SIGNING_TOOLS_DIR}:${PATH}"
-
-# Run all the security tests.
-failed_count=0
-run_check() {
-  local cmd=(
-    "${VBOOT_DIR}/ensure_$1.sh"
-    "${FLAGS_image}"
-  )
-  if [[ $# -ge 2 ]]; then
-    cmd+=( "${FLAGS_baselines}/ensure_$1.config" )
-  fi
-  info "Running ensure_$1.sh"
-  if ! "${cmd[@]}"; then
-    error "$1: test failed"
-    : $(( ++failed_count ))
-  fi
-}
-
-sec_checks=(
-  no_nonrelease_files
-  sane_lsb-release
-  secure_kernelparams
-)
-for check in "${sec_checks[@]}"; do
-  run_check "${check}" "${check}"
-done
-
-sec_checks=(
-  not_ASAN
-  # This test requires an update key to be inserted
-  # first which the signer itself currently does.
-  #update_verification
-)
-for check in "${sec_checks[@]}"; do
-  run_check "${check}"
-done
-
-if [[ ${failed_count} -gt 0 ]]; then
-  die_notrace "${failed_count} tests failed"
-else
-  info "All tests passed!"
-fi

From 1836d5998df1631ddfd7d26f7d63285a5a7cfcad Mon Sep 17 00:00:00 2001
From: Michael Marineau <michael.marineau@coreos.com>
Date: Thu, 27 Mar 2014 18:21:45 -0700
Subject: [PATCH 2/5] refactor(base_image_util): Split into two functions.

Use what was the base image build function as setup/finalize steps in
the dev and prod build functions. This eliminates duplicate code
that mounted and unmounted the filesystem images.
---
 build_image                       |  8 ++------
 build_library/base_image_util.sh  | 19 +++++++------------
 build_library/build_image_util.sh |  9 +++++++--
 build_library/dev_image_util.sh   | 28 +++++++++-------------------
 build_library/prod_image_util.sh  | 16 +++++++++-------
 5 files changed, 34 insertions(+), 46 deletions(-)

diff --git a/build_image b/build_image
index 8b7c7ec0b7..6d943c8e54 100755
--- a/build_image
+++ b/build_image
@@ -102,8 +102,6 @@ for arg in "$@"; do
   esac
 done
 
-BASE_PACKAGE="coreos-base/coreos"
-
 eclean-$BOARD -d packages
 
 if [[ ${skip_blacklist_check} -ne 1 ]]; then
@@ -139,14 +137,12 @@ mkdir -p "${BUILD_DIR}"
 DISK_LAYOUT="${FLAGS_disk_layout:-base}"
 
 if [[ "${DEV_IMAGE}" -eq 1 ]]; then
-  create_base_image ${COREOS_DEVELOPER_IMAGE_NAME} ${DISK_LAYOUT} ${FLAGS_group}
-  install_dev_packages ${COREOS_DEVELOPER_IMAGE_NAME} ${DISK_LAYOUT}
+  create_dev_image ${COREOS_DEVELOPER_IMAGE_NAME} ${DISK_LAYOUT} ${FLAGS_group}
   upload_image "${BUILD_DIR}/${COREOS_DEVELOPER_IMAGE_NAME}"
 fi
 
 if [[ "${PROD_IMAGE}" -eq 1 ]]; then
-  create_base_image ${COREOS_PRODUCTION_IMAGE_NAME} ${DISK_LAYOUT} ${FLAGS_group}
-  setup_prod_image ${COREOS_PRODUCTION_IMAGE_NAME} ${DISK_LAYOUT}
+  create_prod_image ${COREOS_PRODUCTION_IMAGE_NAME} ${DISK_LAYOUT} ${FLAGS_group}
   upload_image "${BUILD_DIR}/${COREOS_PRODUCTION_IMAGE_NAME}"
   if [[ ${FLAGS_generate_update} -eq ${FLAGS_TRUE} ]]; then
     generate_update "${COREOS_PRODUCTION_IMAGE_NAME}" ${DISK_LAYOUT}
diff --git a/build_library/base_image_util.sh b/build_library/base_image_util.sh
index b90312d738..e4bf81d078 100755
--- a/build_library/base_image_util.sh
+++ b/build_library/base_image_util.sh
@@ -2,13 +2,12 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-create_base_image() {
+start_image() {
   local image_name=$1
   local disk_layout=$2
-  local update_group="$3"
+  local root_fs_dir=$3
 
   local disk_img="${BUILD_DIR}/${image_name}"
-  local root_fs_dir="${BUILD_DIR}/rootfs"
 
   info "Using image type ${disk_layout}"
   "${BUILD_LIBRARY_DIR}/disk_util" --disk_layout="${disk_layout}" \
@@ -26,16 +25,12 @@ create_base_image() {
   # FIXME(marineam): Work around glibc setting EROOT=$ROOT
   # https://bugs.gentoo.org/show_bug.cgi?id=473728#c12
   sudo mkdir -p "${root_fs_dir}/etc/ld.so.conf.d"
+}
 
-  # We "emerge --root=${root_fs_dir} --root-deps=rdeps --usepkgonly" all of the
-  # runtime packages for chrome os. This builds up a chrome os image from
-  # binary packages with runtime dependencies only.  We use INSTALL_MASK to
-  # trim the image size as much as possible.
-  emerge_prod_gcc --root="${root_fs_dir}"
-  emerge_to_image --root="${root_fs_dir}" ${BASE_PACKAGE}
-
-  # Make sure profile.env and ld.so.cache has been generated
-  sudo ROOT="${root_fs_dir}" env-update
+finish_image() {
+  local disk_layout=$1
+  local root_fs_dir=$2
+  local update_group=$3
 
   # Record directories installed to the state partition.
   # Explicitly ignore entries covered by existing configs.
diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh
index 1122799801..a7a7201176 100755
--- a/build_library/build_image_util.sh
+++ b/build_library/build_image_util.sh
@@ -107,6 +107,7 @@ generate_update() {
 # Arguments to this command are passed as addition options/arguments
 # to the basic emerge command.
 emerge_to_image() {
+  local root_fs_dir="$1"; shift
   local mask="${INSTALL_MASK:-$(portageq-$BOARD envvar PROD_INSTALL_MASK)}"
   test -n "$mask" || die "PROD_INSTALL_MASK not defined"
 
@@ -122,12 +123,16 @@ emerge_to_image() {
     emerge_cmd+=" --jobs=$FLAGS_jobs"
   fi
 
-  sudo -E INSTALL_MASK="$mask" ${emerge_cmd} "$@"
+  sudo -E INSTALL_MASK="$mask" ${emerge_cmd} --root="${root_fs_dir}" "$@"
+
+  # Make sure profile.env and ld.so.cache has been generated
+  sudo -E ROOT="${root_fs_dir}" env-update
 }
 
 # The GCC package includes both its libraries and the compiler.
 # In prod images we only need the shared libraries.
 emerge_prod_gcc() {
+    local root_fs_dir="$1"; shift
     local mask="${INSTALL_MASK:-$(portageq-$BOARD envvar PROD_INSTALL_MASK)}"
     test -n "$mask" || die "PROD_INSTALL_MASK not defined"
 
@@ -143,5 +148,5 @@ emerge_prod_gcc() {
         /usr/share/gcc-data/*/*/c99
         /usr/share/gcc-data/*/*/python"
 
-    INSTALL_MASK="${mask}" emerge_to_image --nodeps sys-devel/gcc "$@"
+    INSTALL_MASK="${mask}" emerge_to_image "${root_fs_dir}" --nodeps sys-devel/gcc "$@"
 }
diff --git a/build_library/dev_image_util.sh b/build_library/dev_image_util.sh
index 6b8f63a5d4..cc376d8d85 100755
--- a/build_library/dev_image_util.sh
+++ b/build_library/dev_image_util.sh
@@ -50,11 +50,10 @@ detect_dev_url() {
     fi
 }
 
-# Modifies an existing image to add development packages.
-# Takes as an arg the name of the image to be created.
-install_dev_packages() {
+create_dev_image() {
   local image_name=$1
   local disk_layout=$2
+  local update_group=$3
   local devserver=$(detect_dev_url)
   local auserver=""
 
@@ -65,18 +64,16 @@ install_dev_packages() {
     info "Unable do detect local dev server address."
   fi
 
-  info "Adding developer packages to ${image_name}"
+  info "Building developer image ${image_name}"
   local root_fs_dir="${BUILD_DIR}/rootfs"
 
-  "${BUILD_LIBRARY_DIR}/disk_util" --disk_layout="${disk_layout}" \
-      mount "${BUILD_DIR}/${image_name}" "${root_fs_dir}"
-  trap "cleanup_mounts '${root_fs_dir}' && delete_prompt" EXIT
+  start_image "${image_name}" "${disk_layout}" "${root_fs_dir}"
 
-  # Install developer packages described in coreos-dev.
-  emerge_to_image --root="${root_fs_dir}" coreos-base/coreos-dev
+  emerge_to_image "${root_fs_dir}" coreos-base/coreos-dev
 
-  # Make sure profile.env and ld.so.cache has been generated
-  sudo ROOT="${root_fs_dir}" env-update
+  "${BUILD_LIBRARY_DIR}/set_lsb_release" \
+    --root="${root_fs_dir}" \
+    --board="${BOARD}"
 
   # Setup portage for emerge and gmerge
   configure_dev_portage "${root_fs_dir}" "${devserver}"
@@ -101,12 +98,5 @@ EOF
   sudo mkdir -p "${fs_wants}"
   sudo ln -s ../remount-usr.service "${fs_wants}"
 
-  # Zero all fs free space, not fatal since it won't work on linux < 3.2
-  sudo fstrim "${root_fs_dir}" || true
-  sudo fstrim "${root_fs_dir}/usr" || true
-
-  info "Developer image built and stored at ${image_name}"
-
-  cleanup_mounts "${root_fs_dir}"
-  trap - EXIT
+  finish_image "${disk_layout}" "${root_fs_dir}" "${update_group}"
 }
diff --git a/build_library/prod_image_util.sh b/build_library/prod_image_util.sh
index 66b1a44662..3e4f492d9c 100755
--- a/build_library/prod_image_util.sh
+++ b/build_library/prod_image_util.sh
@@ -3,16 +3,19 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-setup_prod_image() {
+create_prod_image() {
   local image_name="$1"
   local disk_layout="$2"
+  local update_group="$3"
 
-  info "Configuring production image ${image_name}"
+  info "Building production image ${image_name}"
   local root_fs_dir="${BUILD_DIR}/rootfs"
 
-  "${BUILD_LIBRARY_DIR}/disk_util" --disk_layout="${disk_layout}" \
-      mount "${BUILD_DIR}/${image_name}" "${root_fs_dir}"
-  trap "cleanup_mounts '${root_fs_dir}' && delete_prompt" EXIT
+  start_image "${image_name}" "${disk_layout}" "${root_fs_dir}"
+
+  # Install minimal GCC (libs only) and then everything else
+  emerge_prod_gcc "${root_fs_dir}"
+  emerge_to_image "${root_fs_dir}" coreos-base/coreos
 
   # clean-ups of things we do not need
   sudo rm ${root_fs_dir}/etc/csh.env
@@ -38,8 +41,7 @@ EOF
   sudo rm ${root_fs_dir}/etc/xinetd.d/rsyncd
   sudo rmdir ${root_fs_dir}/etc/xinetd.d
 
-  cleanup_mounts "${root_fs_dir}"
-  trap - EXIT
+  finish_image "${disk_layout}" "${root_fs_dir}" "${update_group}"
 
   # Make the filesystem un-mountable as read-write.
   if [ ${FLAGS_enable_rootfs_verification} -eq ${FLAGS_TRUE} ]; then

From 1c5393b78e875c7548c0fd7f0c7c521a77414108 Mon Sep 17 00:00:00 2001
From: Michael Marineau <michael.marineau@coreos.com>
Date: Thu, 27 Mar 2014 19:33:01 -0700
Subject: [PATCH 3/5] refactor(build_image_util): Merge with base_image_util

There isn't a base image now, and less file clutter is nice.
---
 build_image                       |  1 -
 build_library/base_image_util.sh  | 66 -------------------------------
 build_library/build_image_util.sh | 63 +++++++++++++++++++++++++++++
 3 files changed, 63 insertions(+), 67 deletions(-)
 delete mode 100755 build_library/base_image_util.sh

diff --git a/build_image b/build_image
index 6d943c8e54..014e65b2b1 100755
--- a/build_image
+++ b/build_image
@@ -87,7 +87,6 @@ check_gsutil_opts
 . "${BUILD_LIBRARY_DIR}/toolchain_util.sh" || exit 1
 . "${BUILD_LIBRARY_DIR}/board_options.sh" || exit 1
 . "${BUILD_LIBRARY_DIR}/build_image_util.sh" || exit 1
-. "${BUILD_LIBRARY_DIR}/base_image_util.sh" || exit 1
 . "${BUILD_LIBRARY_DIR}/prod_image_util.sh" || exit 1
 . "${BUILD_LIBRARY_DIR}/dev_image_util.sh" || exit 1
 . "${BUILD_LIBRARY_DIR}/test_image_content.sh" || exit 1
diff --git a/build_library/base_image_util.sh b/build_library/base_image_util.sh
deleted file mode 100755
index e4bf81d078..0000000000
--- a/build_library/base_image_util.sh
+++ /dev/null
@@ -1,66 +0,0 @@
-# Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-start_image() {
-  local image_name=$1
-  local disk_layout=$2
-  local root_fs_dir=$3
-
-  local disk_img="${BUILD_DIR}/${image_name}"
-
-  info "Using image type ${disk_layout}"
-  "${BUILD_LIBRARY_DIR}/disk_util" --disk_layout="${disk_layout}" \
-      format "${disk_img}"
-
-  "${BUILD_LIBRARY_DIR}/disk_util" --disk_layout="${disk_layout}" \
-      mount "${disk_img}" "${root_fs_dir}"
-  trap "cleanup_mounts '${root_fs_dir}' && delete_prompt" EXIT
-
-  # First thing first, install baselayout with USE=build to create a
-  # working directory tree. Don't use binpkgs due to the use flag change.
-  sudo -E USE=build "emerge-${BOARD}" --root="${root_fs_dir}" \
-      --usepkg=n --buildpkg=n --oneshot --quiet --nodeps sys-apps/baselayout
-
-  # FIXME(marineam): Work around glibc setting EROOT=$ROOT
-  # https://bugs.gentoo.org/show_bug.cgi?id=473728#c12
-  sudo mkdir -p "${root_fs_dir}/etc/ld.so.conf.d"
-}
-
-finish_image() {
-  local disk_layout=$1
-  local root_fs_dir=$2
-  local update_group=$3
-
-  # Record directories installed to the state partition.
-  # Explicitly ignore entries covered by existing configs.
-  local tmp_ignore=$(awk '/^[dDfFL]/ {print "--ignore=" $2}' \
-      "${root_fs_dir}"/usr/lib/tmpfiles.d/*.conf)
-  sudo "${BUILD_LIBRARY_DIR}/gen_tmpfiles.py" --root="${root_fs_dir}" \
-      --output="${root_fs_dir}/usr/lib/tmpfiles.d/base_image_var.conf" \
-      ${tmp_ignore} "${root_fs_dir}/var"
-  sudo "${BUILD_LIBRARY_DIR}/gen_tmpfiles.py" --root="${root_fs_dir}" \
-      --output="${root_fs_dir}/usr/lib/tmpfiles.d/base_image_etc.conf" \
-      ${tmp_ignore} "${root_fs_dir}/etc"
-
-  # Set /etc/lsb-release on the image.
-  "${BUILD_LIBRARY_DIR}/set_lsb_release" \
-    --root="${root_fs_dir}" \
-    --group="${update_group}" \
-    --board="${BOARD}"
-
-  ${BUILD_LIBRARY_DIR}/configure_bootloaders.sh \
-    --arch=${ARCH} \
-    --disk_layout="${disk_layout}" \
-    --boot_dir="${root_fs_dir}"/usr/boot \
-    --esp_dir="${root_fs_dir}"/boot/efi \
-    --boot_args="${FLAGS_boot_args}"
-
-  # Zero all fs free space to make it more compressible so auto-update
-  # payloads become smaller, not fatal since it won't work on linux < 3.2
-  sudo fstrim "${root_fs_dir}" || true
-  sudo fstrim "${root_fs_dir}/usr" || true
-
-  cleanup_mounts "${root_fs_dir}"
-  trap - EXIT
-}
diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh
index a7a7201176..a6aa70ad38 100755
--- a/build_library/build_image_util.sh
+++ b/build_library/build_image_util.sh
@@ -150,3 +150,66 @@ emerge_prod_gcc() {
 
     INSTALL_MASK="${mask}" emerge_to_image "${root_fs_dir}" --nodeps sys-devel/gcc "$@"
 }
+
+start_image() {
+  local image_name="$1"
+  local disk_layout="$2"
+  local root_fs_dir="$3"
+
+  local disk_img="${BUILD_DIR}/${image_name}"
+
+  info "Using image type ${disk_layout}"
+  "${BUILD_LIBRARY_DIR}/disk_util" --disk_layout="${disk_layout}" \
+      format "${disk_img}"
+
+  "${BUILD_LIBRARY_DIR}/disk_util" --disk_layout="${disk_layout}" \
+      mount "${disk_img}" "${root_fs_dir}"
+  trap "cleanup_mounts '${root_fs_dir}' && delete_prompt" EXIT
+
+  # First thing first, install baselayout with USE=build to create a
+  # working directory tree. Don't use binpkgs due to the use flag change.
+  sudo -E USE=build "emerge-${BOARD}" --root="${root_fs_dir}" \
+      --usepkg=n --buildpkg=n --oneshot --quiet --nodeps sys-apps/baselayout
+
+  # FIXME(marineam): Work around glibc setting EROOT=$ROOT
+  # https://bugs.gentoo.org/show_bug.cgi?id=473728#c12
+  sudo mkdir -p "${root_fs_dir}/etc/ld.so.conf.d"
+}
+
+finish_image() {
+  local disk_layout="$1"
+  local root_fs_dir="$2"
+  local update_group="$3"
+
+  # Record directories installed to the state partition.
+  # Explicitly ignore entries covered by existing configs.
+  local tmp_ignore=$(awk '/^[dDfFL]/ {print "--ignore=" $2}' \
+      "${root_fs_dir}"/usr/lib/tmpfiles.d/*.conf)
+  sudo "${BUILD_LIBRARY_DIR}/gen_tmpfiles.py" --root="${root_fs_dir}" \
+      --output="${root_fs_dir}/usr/lib/tmpfiles.d/base_image_var.conf" \
+      ${tmp_ignore} "${root_fs_dir}/var"
+  sudo "${BUILD_LIBRARY_DIR}/gen_tmpfiles.py" --root="${root_fs_dir}" \
+      --output="${root_fs_dir}/usr/lib/tmpfiles.d/base_image_etc.conf" \
+      ${tmp_ignore} "${root_fs_dir}/etc"
+
+  # Set /etc/lsb-release on the image.
+  "${BUILD_LIBRARY_DIR}/set_lsb_release" \
+    --root="${root_fs_dir}" \
+    --group="${update_group}" \
+    --board="${BOARD}"
+
+  ${BUILD_LIBRARY_DIR}/configure_bootloaders.sh \
+    --arch=${ARCH} \
+    --disk_layout="${disk_layout}" \
+    --boot_dir="${root_fs_dir}"/usr/boot \
+    --esp_dir="${root_fs_dir}"/boot/efi \
+    --boot_args="${FLAGS_boot_args}"
+
+  # Zero all fs free space to make it more compressible so auto-update
+  # payloads become smaller, not fatal since it won't work on linux < 3.2
+  sudo fstrim "${root_fs_dir}" || true
+  sudo fstrim "${root_fs_dir}/usr" || true
+
+  cleanup_mounts "${root_fs_dir}"
+  trap - EXIT
+}

From 56b550dc210a09f32f20e699399213347594000f Mon Sep 17 00:00:00 2001
From: Michael Marineau <michael.marineau@coreos.com>
Date: Thu, 27 Mar 2014 19:41:01 -0700
Subject: [PATCH 4/5] cleanup(build_image_util): Delete unused code

---
 build_image                       |  4 ----
 build_library/build_image_util.sh | 25 -------------------------
 build_library/chromeos_blacklist  |  6 ------
 3 files changed, 35 deletions(-)
 delete mode 100644 build_library/chromeos_blacklist

diff --git a/build_image b/build_image
index 014e65b2b1..39ed8446b5 100755
--- a/build_image
+++ b/build_image
@@ -103,10 +103,6 @@ done
 
 eclean-$BOARD -d packages
 
-if [[ ${skip_blacklist_check} -ne 1 ]]; then
-  check_blacklist
-fi
-
 # Check that the build root is sane.
 if [[ ${skip_test_build_root} -ne 1 ]]; then
   info "Checking build root"
diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh
index a6aa70ad38..286434da11 100755
--- a/build_library/build_image_util.sh
+++ b/build_library/build_image_util.sh
@@ -28,31 +28,6 @@ set_build_symlinks() {
     done
 }
 
-check_blacklist() {
-  info "Verifying that the base image does not contain a blacklisted package."
-  info "Generating list of packages for ${BASE_PACKAGE}."
-  local package_blacklist_file="${BUILD_LIBRARY_DIR}/chromeos_blacklist"
-  if [ ! -e "${package_blacklist_file}" ]; then
-    warn "Missing blacklist file."
-    return
-  fi
-  local blacklisted_packages=$(${SCRIPTS_DIR}/get_package_list \
-      --board="${BOARD}" "${BASE_PACKAGE}" \
-      | grep -x -f "${package_blacklist_file}")
-  if [ -n "${blacklisted_packages}" ]; then
-    die "Blacklisted packages found: ${blacklisted_packages}."
-  fi
-  info "No blacklisted packages found."
-}
-
-make_salt() {
-  # It is not important that the salt be cryptographically strong; it just needs
-  # to be different for each release. The purpose of the salt is just to ensure
-  # that if someone collides a block in one release, they can't reuse it in
-  # future releases.
-  xxd -l 32 -p -c 32 /dev/urandom
-}
-
 cleanup_mounts() {
   echo "Cleaning up mounts"
   "${BUILD_LIBRARY_DIR}/disk_util" umount "$1" || true
diff --git a/build_library/chromeos_blacklist b/build_library/chromeos_blacklist
deleted file mode 100644
index 9aa6a5769a..0000000000
--- a/build_library/chromeos_blacklist
+++ /dev/null
@@ -1,6 +0,0 @@
-app-text/iso-codes
-dev-java/icedtea
-dev-java/icedtea6-bin
-dev-lang/perl
-media-sound/pulseaudio
-x11-libs/libxklavier

From 17bde8aa128325cc80b20d2ec02a08413d65ae75 Mon Sep 17 00:00:00 2001
From: Michael Marineau <michael.marineau@coreos.com>
Date: Thu, 27 Mar 2014 19:56:53 -0700
Subject: [PATCH 5/5] refactor(build_image_util): Move prod specific code to
 prod_image_util

---
 build_library/build_image_util.sh | 22 ----------------------
 build_library/prod_image_util.sh  | 22 ++++++++++++++++++++++
 2 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh
index 286434da11..c1d3ccb120 100755
--- a/build_library/build_image_util.sh
+++ b/build_library/build_image_util.sh
@@ -104,28 +104,6 @@ emerge_to_image() {
   sudo -E ROOT="${root_fs_dir}" env-update
 }
 
-# The GCC package includes both its libraries and the compiler.
-# In prod images we only need the shared libraries.
-emerge_prod_gcc() {
-    local root_fs_dir="$1"; shift
-    local mask="${INSTALL_MASK:-$(portageq-$BOARD envvar PROD_INSTALL_MASK)}"
-    test -n "$mask" || die "PROD_INSTALL_MASK not defined"
-
-    mask="${mask}
-        /usr/bin
-        /usr/*/gcc-bin
-        /usr/lib/gcc/*/*/*.o
-        /usr/lib/gcc/*/*/include
-        /usr/lib/gcc/*/*/include-fixed
-        /usr/lib/gcc/*/*/plugin
-        /usr/libexec
-        /usr/share/gcc-data/*/*/c89
-        /usr/share/gcc-data/*/*/c99
-        /usr/share/gcc-data/*/*/python"
-
-    INSTALL_MASK="${mask}" emerge_to_image "${root_fs_dir}" --nodeps sys-devel/gcc "$@"
-}
-
 start_image() {
   local image_name="$1"
   local disk_layout="$2"
diff --git a/build_library/prod_image_util.sh b/build_library/prod_image_util.sh
index 3e4f492d9c..05e116cfaa 100755
--- a/build_library/prod_image_util.sh
+++ b/build_library/prod_image_util.sh
@@ -3,6 +3,28 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+# The GCC package includes both its libraries and the compiler.
+# In prod images we only need the shared libraries.
+emerge_prod_gcc() {
+    local root_fs_dir="$1"; shift
+    local mask="${INSTALL_MASK:-$(portageq-$BOARD envvar PROD_INSTALL_MASK)}"
+    test -n "$mask" || die "PROD_INSTALL_MASK not defined"
+
+    mask="${mask}
+        /usr/bin
+        /usr/*/gcc-bin
+        /usr/lib/gcc/*/*/*.o
+        /usr/lib/gcc/*/*/include
+        /usr/lib/gcc/*/*/include-fixed
+        /usr/lib/gcc/*/*/plugin
+        /usr/libexec
+        /usr/share/gcc-data/*/*/c89
+        /usr/share/gcc-data/*/*/c99
+        /usr/share/gcc-data/*/*/python"
+
+    INSTALL_MASK="${mask}" emerge_to_image "${root_fs_dir}" --nodeps sys-devel/gcc "$@"
+}
+
 create_prod_image() {
   local image_name="$1"
   local disk_layout="$2"