I have an Asus C100PA running ChromeOS 72.0.3626.122 (32 bit). I am experienced Linux user and have carefully followed the installation instructions. I installed the current release (9 March) image onto an SD card (/dev/mmcblk1)
It is failing to boot the kernel, apparently because the kernel image is not signed correctly. Does anyone know of any possible cause?
$this->bbcode_second_pass_code('', 'cgpt show /dev/mmcblk1
start size part contents
0 1 PMBR
1 1 Pri GPT header
2 32 Pri GPT table
8192 32768 1 Label: "Kernel"
Type: ChromeOS kernel
UUID: 89A7A3F1-6521-CC49-A323-D916C828F710
Attr: priority=10 tries=5 successful=1
40960 30277599 2 Label: "Root"
Type: Linux data
UUID: 4D420DA4-9FB6-B54A-A206-140D746D08CF
30318559 32 Sec GPT table
30318591 1 Sec GPT header
')
$this->bbcode_second_pass_code('', 'vbutil_kernel --verify /dev/mmcblk1p1
Key block:
Signature: ignored
Size: 0x4b8
Flags: 7 !DEV DEV !REC
Data key algorithm: 4 RSA2048 SHA256
Data key version: 1
Data key sha1sum: d6170aa480136f1f29cf339a5ab1b960585fa444
Preamble:
Size: 0xfb48
Header version: 2.2
Kernel version: 1
Body load address: 0x100000
Body size: 0x590000
Bootloader address: 0x68f000
Bootloader size: 0x1000
Flags : 0x0
Body verification succeeded.
Config:
console=ttyS2,115200n8 earlyprintk=ttyS2,115200n8 console=tty1 init=/sbin/init root=PARTUUID=%U/PARTNROFF=1 rootwait rw noinitrd')
In /var/log/debug_vboot_noisy.log:
$this->bbcode_second_pass_code('', 'Examining kernels...
# copying /dev/mmcblk1p1 to kern_0...
+ dd if=/dev/mmcblk1p1 of=kern_0
32768+0 records in
32768+0 records out
16777216 bytes (17 MB, 16 MiB) copied, 0.513823 s, 32.7 MB/s
# Kernel /dev/mmcblk1p1:
+ futility vbutil_keyblock --unpack kern_0
Key block file: kern_0
Signature ignored
Flags: 7 !DEV DEV !REC
Data key algorithm: 4 RSA2048 SHA256
Data key version: 1
Data key sha1sum: d6170aa480136f1f29cf339a5ab1b960585fa444
# OK
# Verify /dev/mmcblk1p1 with kern_subkey_A.vbpubk:
+ futility vbutil_kernel --verify kern_0 --signpubkey kern_subkey_A.vbpubk
Error verifying key block.
# FAILED
# Verify /dev/mmcblk1p1 with kern_subkey_B.vbpubk:
Error verifying key block.
# FAILED
# Verify /dev/mmcblk1p1 with recoverykey.vbpubk:
+ futility vbutil_kernel --verify kern_0 --signpubkey recoverykey.vbpubk
Error verifying key block.
# FAILED')
After this point, it goes on to load the default ChromeOS kernel on disk successfully.
After some research, I attempted to resign the kernel, but this had the same result:
$this->bbcode_second_pass_code('', 'vbutil_kernel --verify vmlinux.kpart --verbose | tail -1 > config.txt
vbutil_kernel --repack repacked.kpart \
--config config.txt \
--signprivate recovery_kernel_data_key.vbprivk \
--keyblock /usr/share/vboot/devkeys/recovery_kernel.keyblock
--oldblob vmlinux.kpart
vbutil_kernel --verify repacked.kpart --verbose --signpubkey /usr/share/vboot/devkeys/recovery_key.vbpubk
sudo dd if=repacked.kpart of=/dev/mmcblk1p1')