commit 40837258677fca4b9bfb37b7bfb288baf40831e0
author Hung-Te Lin <hungte@chromium.org> Wed Jan 28 13:23:15 2015 +0800
committer ChromeOS Commit Bot <chromeos-commit-bot@chromium.org> Wed Jan 28 11:14:03 2015 +0000
tree 6e88013c4052c5e88f89e8da605aa55bf0b92dbe
parent 5fb14634b9f7618592b9e88d9aa74b2111f15ee1

sign_official_buid: Fix "incorrect rootfs hash" when image has no firmware updater .

For each mount_image_partition, we have to unmount explicitly before doing other
changes (especially when using dd) to image. Otherwise system may flush data
when releaseing loop device and cause output image to be corrupted.

BUG=chromium:449450
TEST=sign_official_build.sh factory factory_install_shim.bin \
     ../../../tests/devkeys signed.bin ../../../tests/devkeys/key.versions
     sign_official_build.sh verify signed.bin
BRANCH=signer

Change-Id: I20756d9769c3737e25cfea348a9a4d64cc43b202
Signed-off-by: Hung-Te Lin <hungte@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/243496
Reviewed-by: Mike Frysinger <vapier@chromium.org>

scripts/image_signing/sign_official_build.sh

diff --git a/scripts/image_signing/sign_official_build.sh b/scripts/image_signing/sign_official_build.sh
index f612687..8d782ad 100755
--- a/scripts/image_signing/sign_official_build.sh
+++ b/scripts/image_signing/sign_official_build.sh
@@ -476,9 +476,12 @@
   local shellball_dir=$(make_temp_dir)
 
   # extract_firmware_bundle can fail if the image has no firmware update.
-  extract_firmware_bundle "${firmware_bundle}" "${shellball_dir}" ||
-    { echo "Didn't find a firmware update. Not signing firmware."
-    return; }
+  if ! extract_firmware_bundle "${firmware_bundle}" "${shellball_dir}"; then
+    # Unmount now to prevent changes.
+    sudo umount "${rootfs_dir}"
+    echo "Didn't find a firmware update. Not signing firmware."
+    return
+  fi
   echo "Found a valid firmware update shellball."
 
   local image_file sign_args=() loem_sfx loem_output_dir