mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-09-23 22:51:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(build_image): install the au-key

Browse Source 
Install the developer au key on production images. This will need to
change when we have the production key.
This commit is contained in:
Brandon Philips 2013-07-20 16:24:13 -07:00
parent a80d755473
commit f73cbac8db
2 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
bin/cros_make_image_bootable
View File

@ -107,6 +107,9 @@ DEFINE_string verity_salt "" \
DEFINE_string keys_dir "/usr/share/vboot/devkeys" \ DEFINE_string keys_dir "/usr/share/vboot/devkeys" \
"Directory containing the signing keys." "Directory containing the signing keys."
DEFINE_string au_key "" \
"Filename of the au_key to install"
DEFINE_string rootfs_mountpoint "/tmp/rootfs" \ DEFINE_string rootfs_mountpoint "/tmp/rootfs" \
"Path where the rootfs can be safely mounted" "Path where the rootfs can be safely mounted"
DEFINE_string statefulfs_mountpoint "/tmp/statefulfs" \ DEFINE_string statefulfs_mountpoint "/tmp/statefulfs" \
@ -182,6 +185,16 @@ make_image_bootable() {
legacy_offset_size_export ${image} legacy_offset_size_export ${image}
# Install an auto update key on the root before sealing it off
if [ ! -z "${FLAGS_au_key}" ]; then
local key_location=${FLAGS_rootfs_mountpoint}"/usr/share/update_engine/"
sudo cp "${FLAGS_au_key}" "$key_location/update-payload-key.pub.pem"
sudo chown root:root "$key_location/update-payload-key.pub.pem"
sudo chmod 644 "$key_location/update-payload-key.pub.pem"
echo "AU verification key was installed. Do not forget to resign the image!"
fi
# The rootfs should never be mounted rw again after this point without # The rootfs should never be mounted rw again after this point without
# re-calling make_image_bootable. # re-calling make_image_bootable.
sudo mount -o remount,ro "${FLAGS_rootfs_mountpoint}" sudo mount -o remount,ro "${FLAGS_rootfs_mountpoint}"

8
build_image
View File

@ -168,8 +168,12 @@ fi
if should_build_image ${COREOS_PRODUCTION_IMAGE_NAME}; then if should_build_image ${COREOS_PRODUCTION_IMAGE_NAME}; then
copy_image ${CHROMEOS_BASE_IMAGE_NAME} ${COREOS_PRODUCTION_IMAGE_NAME} copy_image ${CHROMEOS_BASE_IMAGE_NAME} ${COREOS_PRODUCTION_IMAGE_NAME}
${SCRIPTS_DIR}/bin/cros_make_image_bootable "${BUILD_DIR}" \
${COREOS_PRODUCTION_IMAGE_NAME} ${SCRIPTS_DIR}/bin/cros_make_image_bootable \
"${BUILD_DIR}" \
${COREOS_PRODUCTION_IMAGE_NAME} \
--au_key=${SRC_ROOT}/third_party/coreos-overlay/coreos-base/coreos-au-key/files/update-payload-key.pub.pem
upload_image "${BUILD_DIR}/${COREOS_PRODUCTION_IMAGE_NAME}" upload_image "${BUILD_DIR}/${COREOS_PRODUCTION_IMAGE_NAME}"
fi fi