summaryrefslogtreecommitdiff
path: root/scripts/paycheck.py
Commit message (Collapse)AuthorAgeFilesLines
* update_payload: Allow specifying partition options for major version 2Tudor Brindus2018-06-251-38/+70
| | | | | | | | | | | | | | | | | | | | | | | This commit adds the ability to specify partition options for more than just kernel/rootfs. This supersedes -p/--root-part-size, -P/--kern-part-size, --dst_kern, --dst_root, --src_kern, --src_root, --out_dst_kern, and --out_dst_root. They are replaced by --part_names used in conjunction with --part_sizes, --dst_part_paths, --src_part_paths, and --out_dst_part_paths. Backwards-compatibility with the old flags is kept, so long as they are not used alongside the new flags. BUG=b:794404 TEST=no errors during run_unittests and test_paycheck.sh Change-Id: Icc1118abbf89dd268be3eafe41723657c5178197 Reviewed-on: https://chromium-review.googlesource.com/1103063 Commit-Ready: Tudor Brindus <tbrindus@chromium.org> Tested-by: Tudor Brindus <tbrindus@chromium.org> Reviewed-by: Amin Hassani <ahassani@chromium.org>
* update_payload: Allow check for given metadata sizeAmin Hassani2018-03-231-1/+6
| | | | | | | | | | | | | | | Allow passing metadata size to check_update_payload so we can verify the metadata size in omaha equals to the one in the payload. BUG=chromium:820243 TEST=run paycheck.py with both valid and invalid metadata sizes reports as expected TEST=unittests Change-Id: Ib41ce77af77636fffec6752201c363e7fbbf868d Reviewed-on: https://chromium-review.googlesource.com/955679 Commit-Ready: Amin Hassani <ahassani@chromium.org> Tested-by: Amin Hassani <ahassani@chromium.org> Reviewed-by: Ben Chan <benchan@chromium.org>
* update_payload: Allow paycheck.py to compare apply results.Amin Hassani2018-03-051-4/+43
| | | | | | | | | | | | | | | | | | | | | | | | Currently paycheck.py only applies the payloads. The responsibility of checking if the final root and kernel partitions are what we wanted is out of paycheck.py. Currently when paycheck.py runs and applies a payload files passed by --dst_kern and --dst_root are populated with the newly generated partitions by applier.py. This patch adds two new flags --out_dst_kern and --out_dst_root so instead paychek.py outputs the new partitions into paths passed by these flags and --dst_kern and --dst_root is reserved for passing the actual original partitions that newly generated partitions need to be compared to. This allows paycheck.py to check the newly generated partitions against the given ones and make sure they are equal. BUG=chromium:808495 TEST=test_paycheck.sh old.full delta.bin new.full Change-Id: I57a476de1477e3cba7557d0564b49ec03253c047 Reviewed-on: https://chromium-review.googlesource.com/929652 Commit-Ready: Amin Hassani <ahassani@chromium.org> Tested-by: Amin Hassani <ahassani@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org> Reviewed-by: Ben Chan <benchan@chromium.org> Reviewed-by: Sen Jiang <senj@chromium.org>
* update_payload: migrate the license headers to AOSPAmin Hassani2018-01-301-3/+14
| | | | | | | | | | | | | | update_engine/scripts/* have CROS license but the rest of UE have android license. This cl just migrates all CROS licenses to AOSP. BUG=None TEST=repo upload did not complain about the mismatched licenses. Change-Id: Id947be3e860baf7a523163965336f47d268c6808 Reviewed-on: https://chromium-review.googlesource.com/891688 Commit-Ready: Amin Hassani <ahassani@chromium.org> Tested-by: Amin Hassani <ahassani@chromium.org> Reviewed-by: Amin Hassani <ahassani@chromium.org>
* update_payload: remove block tracerAmin Hassani2018-01-291-23/+1
| | | | | | | | | | | | | | | block tracing was useful for minor version 1 with move operations (before having A/B updates). But, we do not create that operation anymore and we are in the process of moving to major version 2. So this needs to go BUG=chromium:794404 TEST=unit tests Change-Id: I56d24ef81e8f37c481669d47e5878eb3a321131f Reviewed-on: https://chromium-review.googlesource.com/888546 Commit-Ready: Amin Hassani <ahassani@chromium.org> Tested-by: Amin Hassani <ahassani@chromium.org> Reviewed-by: Ben Chan <benchan@chromium.org>
* update_payload: use argparseAmin Hassani2018-01-231-138/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | optparse is deprecated (or going to be). Change paycheck.py and blockdiff.py to use argparse instead. Both of these files are being used manually and it would be a good time to fix these before major changes in update_payload. paycheck.sh -h: usage: paycheck.py [-h] [-c] [-D] [-r FILE] [-t {full,delta}] [-z NUM] [-u] [-d] [-k FILE] [-m FILE] [-p NUM] [-P NUM] [-x] [--bspatch-path FILE] [--puffpatch-path FILE] [--dst_kern FILE] [--dst_root FILE] [--src_kern FILE] [--src_root FILE] [-b BLOCK] [-B BLOCK] [-s NUM] PAYLOAD Applies a Chrome OS update PAYLOAD to src_kern and src_root emitting dst_kern and dst_root, respectively. src_kern and src_root are only needed for delta payloads. When no partitions are provided, verifies the payload integrity. positional arguments: PAYLOAD the payload file optional arguments: -h, --help show this help message and exit Checking payload integrity: -c, --check force payload integrity check (e.g. before applying) -D, --describe Print a friendly description of the payload. -r FILE, --report FILE dump payload report (`-' for stdout) -t {full,delta}, --type {full,delta} assert the payload type -z NUM, --block-size NUM assert a non-default (4096) payload block size -u, --allow-unhashed allow unhashed operations -d , --disabled_tests space separated list of tests to disable. allowed options include: dst-pseudo-extents, move-same-src- dst-block, payload-sig -k FILE, --key FILE override standard key used for signature validation -m FILE, --meta-sig FILE verify metadata against its signature -p NUM, --root-part-size NUM override rootfs partition size auto-inference -P NUM, --kern-part-size NUM override kernel partition size auto-inference Applying payload: -x, --extract-bsdiff use temp input/output files with BSDIFF operations (not in-place) --bspatch-path FILE use the specified bspatch binary --puffpatch-path FILE use the specified puffpatch binary --dst_kern FILE destination kernel partition file --dst_root FILE destination root partition file --src_kern FILE source kernel partition file --src_root FILE source root partition file Block tracing: -b BLOCK, --root-block BLOCK trace the origin for a rootfs block -B BLOCK, --kern-block BLOCK trace the origin for a kernel block -s NUM, --skip NUM skip first NUM occurrences of traced block Note: a payload may verify correctly but fail to apply, and vice versa; this is by design and can be thought of as static vs dynamic correctness. A payload that both verifies and applies correctly should be safe for use by the Chrome OS Update Engine. Use --check to verify a payload prior to applying it. BUG=chromium:796338 TEST=unitests TEST=test_paycheck.sh TEST=blockdiff.py Change-Id: I794b5f61e6ba6f92939947c97c432f9fea0b6b3c Reviewed-on: https://chromium-review.googlesource.com/834876 Commit-Ready: Amin Hassani <ahassani@chromium.org> Tested-by: Amin Hassani <ahassani@chromium.org> Reviewed-by: Ben Chan <benchan@chromium.org> Reviewed-by: Sen Jiang <senj@chromium.org>
* update_payload: Fix most of lint styling issues.Amin Hassani2018-01-051-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a lot of pylint issues in the update_engine scripts. Majority of this changes are based on recommendation found in: https://www.chromium.org/chromium-os/python-style-guidelines It is a good idea to do these changes now, because if there are many pylint errors when performing 'repo upload', serious problems can be overshadowed by a lot of noise and eventually cause problems. These fixes include: - Fixing executable shebangs to /usr/bin/python2. - Fixing import-error problems by disabiling them. - Removing pylint disables that are not valid anymore. - Changing all imports to proper absolute import format. - Change the import of PayloadError from update_payload.PayloadError for simplicity. - Add pydoc strings for functions and classes that were missing. The remaining unchanged pylint problmes include: - The header files of these scripts are in CrOS copyright format, but the the cros lint hook is configured to AoSP copyright format. - The test* functions in unittests are not compatible with CamelCase format. BUG=chromium:796338 TEST=unittests pass TEST=start_devserver TEST=cros flash TEST=scripts/paycheck.py Change-Id: I7eed4d1625eb7c510c7949fada120de5a6a26c7b Reviewed-on: https://chromium-review.googlesource.com/834875 Commit-Ready: Amin Hassani <ahassani@chromium.org> Tested-by: Amin Hassani <ahassani@chromium.org> Reviewed-by: Ben Chan <benchan@chromium.org> Reviewed-by: Sen Jiang <senj@chromium.org>
* update_payload: Add puffin binary path to paycheck.pyAmin Hassani2017-12-011-0/+6
| | | | | | | | | | | | | | We forgot to add the path to the puffin binary to paycheck.py and payload.py and this caused the canary builds fail for minor version 4. This patch fixes it. BUG=chromium:791079 TEST=tryjob Change-Id: I194ab9d9d0b93fc9d456b994f73424d7dedbf181 Reviewed-on: https://chromium-review.googlesource.com/803656 Commit-Ready: Amin Hassani <ahassani@chromium.org> Tested-by: Amin Hassani <ahassani@chromium.org> Reviewed-by: Andrew de los Reyes <adlr@chromium.org>
* paycheck: Small improvements to the block tracer utility.Gilad Arnold2015-07-221-1/+1
| | | | | | | | | | | | | | This prepends the current block number to the output, simplifies some logic, and tightens argument validation in the command-line parser. BUG=None TEST=paycheck -B/-b works. Change-Id: I90d5cdf721612cdd12e49f4e4181849fc699807f Reviewed-on: https://chromium-review.googlesource.com/286547 Tested-by: Gilad Arnold <garnold@chromium.org> Commit-Queue: Gilad Arnold <garnold@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org>
* paycheck: Properly infer usable target partition size.Gilad Arnold2015-07-171-16/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The payload checker used to restrict read/write block indexes to the reported target filesystem size, unless explicitly given a partition size value to use instead. So far this value was easy for clients (like paygen) to come up with, because it was constant at 2GB for all known boards. However this is no longer the case, and there is no an easy way for clients to know the actual target partition size after the payload has been generated (nor is it encoded in the payload). This adds logic for inferring the usable target partition size into PayloadChecker() itself, as follows: 1) If a partition size was given, use that. 2) Else, if this is an old delta (minor version < 2), use the aforementioned default. This is necessary because older deltas may actually read/write data beyond the filesystem size. It is also sufficient because any old delta payload we generate should write to a 2GB target partition. 3) In all other cases, just use the new filesystem size, as encoded in the payload. This is a safe choice for full updates and newer deltas. The command-line tool is updated accordingly. Note that the usable kernel partition size inference remains unaffected. BUG=chromium:508566 TEST=Unit tests (revised) Change-Id: I987f28fdfe1d82d0f6f565ae9852b7b11bce13e8 Reviewed-on: https://chromium-review.googlesource.com/285447 Reviewed-by: Gilad Arnold <garnold@chromium.org> Tested-by: Gilad Arnold <garnold@chromium.org> Commit-Queue: Gilad Arnold <garnold@chromium.org>
* paycheck: Fix linter errors.Gilad Arnold2015-07-171-3/+5
| | | | | | | | | | | BUG=None TEST=None Change-Id: Ife881c35ee090c494307e7f55e3ce0a1a22eb1b1 Reviewed-on: https://chromium-review.googlesource.com/285999 Tested-by: Gilad Arnold <garnold@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org> Commit-Queue: Gilad Arnold <garnold@chromium.org>
* paycheck: allow to pass an explicit path to bspatchGilad Arnold2013-08-261-0/+6
| | | | | | | | | | | | | | | | | The bspatch binary is used when applying update payloads. By default, we were using whatever bspatch that was found via path expansion in os.execvp, however there are cases where we want to be specific about where the bspatch binary is that we need to be using (such as during paygen runs). BUG=chromium:277072 TEST=Non-default bspatch binary used Change-Id: I85ffd28aeb26938cbf5ea428fa97d29af0353a7d Reviewed-on: https://gerrit.chromium.org/gerrit/66736 Tested-by: Gilad Arnold <garnold@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org> Commit-Queue: Gilad Arnold <garnold@chromium.org>
* update_payload library: TODO + bug referencesGilad Arnold2013-06-101-0/+4
| | | | | | | | | | | BUG=chromium:243559 TEST=None Change-Id: I6837b87ff6f0b845ebbca97fdfa4190dc2d1282a Reviewed-on: https://gerrit.chromium.org/gerrit/57179 Commit-Queue: Gilad Arnold <garnold@chromium.org> Tested-by: Gilad Arnold <garnold@chromium.org> Reviewed-by: Chris Sosa <sosa@chromium.org>
* paycheck: close metadata signature fileGilad Arnold2013-05-231-2/+4
| | | | | | | | | | | | | Paycheck used to open it but not closing it. Cleaned up now. BUG=None TEST=Integration tests Change-Id: I101f2acd394bcbe5e5d683b5eecc6170ab1bcf2d Reviewed-on: https://gerrit.chromium.org/gerrit/56336 Tested-by: Gilad Arnold <garnold@chromium.org> Reviewed-by: Chris Sosa <sosa@chromium.org> Commit-Queue: Gilad Arnold <garnold@chromium.org>
* paycheck: move default pubkey handling inside the libraryGilad Arnold2013-05-221-9/+4
| | | | | | | | | | | | | | | | This is a more sensible choice given that the pubkey ships within the library directory and hence should not be specified explicitly by an outside entity (like paycheck). From the practical standpoint, it makes this useful feature available to clients who use the library directly. BUG=chromium:241283 TEST=Unit + integration tests Change-Id: I059302326af1e0e394829466ee97ad2f60de4986 Reviewed-on: https://gerrit.chromium.org/gerrit/56335 Tested-by: Gilad Arnold <garnold@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org> Commit-Queue: Gilad Arnold <garnold@chromium.org>
* Update paycheck to understand the updated update_metadata fields.Don Garrett2013-05-151-0/+5
| | | | | | | | | | | | | | | | | | When checking a payload, always start by printing a description of the payload being checked. Recompiled (with protoc) the updated update_metadata.proto from the update_engine. BUG=chromium:226310 TEST=Manual Run CQ-DEPEND=CL:47347 Change-Id: Ib60c6e6978d30444db7b65ef6d09540c9ffacdb8 Reviewed-on: https://gerrit.chromium.org/gerrit/50899 Commit-Queue: Don Garrett <dgarrett@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org> Tested-by: Don Garrett <dgarrett@chromium.org>
* paycheck: support for in-place BSDIFF operationsGilad Arnold2013-05-131-10/+16
| | | | | | | | | | | | | | | | | | | | | | | | When applying BSDIFF operations in payloads, we used to extract the block sequences from the old partition and serialize it into a temporary file, and vice versa for the new partition. This worked but did not allow us to test bspatch as it is actually being used by the update engine. This CLs allows paycheck to invoke bspatch so that it reads/writes block extents directly from/to the partition file, in the same way it's being used by the update engine. Since performance is the same, this is the new default behavior; users can opt for the aforementioned old behavior using a command-line flag (-x or --extract-bsdiff). BUG=chromium:229705 TEST=bspatch invoked differently depending on the -x flag TEST=Passes unit/integration tests Change-Id: I8821754e1163b357617ece6befa42d1c2e575930 Reviewed-on: https://gerrit.chromium.org/gerrit/50486 Tested-by: Gilad Arnold <garnold@chromium.org> Reviewed-by: Darin Petkov <petkov@chromium.org> Commit-Queue: Gilad Arnold <garnold@chromium.org>
* paycheck: src/dst -> old/new in applier codeGilad Arnold2013-05-131-2/+2
| | | | | | | | | | | | | | | The old/new terminology is consistent with that used in update payload manifest, as well as other parts of the update_payload library (e.g. checker). BUG=None TEST=Unit/integration test passes Change-Id: I91244ae8adf073b958e8cd7e7670341f056c848e Reviewed-on: https://gerrit.chromium.org/gerrit/50130 Tested-by: Gilad Arnold <garnold@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org> Commit-Queue: Gilad Arnold <garnold@chromium.org>
* paycheck: fix integration test scriptGilad Arnold2013-05-131-1/+2
| | | | | | | | | | | | | | | | Now that paycheck comes equipped with the Chrome OS standard public key and infers metadata signature filenames automatically, we don't need these extra arguments handed to the test script. Also, fixes a small bug in option inference during paycheck invocation. BUG=None TEST=integration test script works as intended Change-Id: If2c0d512c2e9476c3788e9c7179e954ba2502657 Reviewed-on: https://gerrit.chromium.org/gerrit/50985 Tested-by: Gilad Arnold <garnold@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org> Commit-Queue: Gilad Arnold <garnold@chromium.org>
* paycheck: make gpyling happyGilad Arnold2013-05-081-4/+3
| | | | | | | | | | | | | Small conformance issues, now fixed. BUG=None TEST=Still running Change-Id: I96a085d4fdc22edff65629b8b01d6d595f1f7b2d Reviewed-on: https://gerrit.chromium.org/gerrit/50393 Commit-Queue: Gilad Arnold <garnold@chromium.org> Reviewed-by: Gilad Arnold <garnold@chromium.org> Tested-by: Gilad Arnold <garnold@chromium.org>
* paycheck: fixed an undefined variable bugGilad Arnold2013-05-081-2/+3
| | | | | | | | | | | | BUG=None TEST=It is running now Change-Id: I7ed7c17811700f34e7556bac89182db6b8e29992 Reviewed-on: https://gerrit.chromium.org/gerrit/50392 Reviewed-by: Chris Sosa <sosa@chromium.org> Commit-Queue: Gilad Arnold <garnold@chromium.org> Reviewed-by: Gilad Arnold <garnold@chromium.org> Tested-by: Gilad Arnold <garnold@chromium.org>
* paycheck: refined default metadata signature logicGilad Arnold2013-05-071-7/+7
| | | | | | | | | | | | | | | | We now only discover and use a default metadata signature when check is actually triggered and a public key provided; otherwise, we could be forcing the check to fail. This also avoids unnecessary output and directs informational output to stderr. BUG=chromium:238507 TEST=Unit/integration tests pass Change-Id: I39df4060afd12a5d54869a6803141bc3e0d2f89b Reviewed-on: https://gerrit.chromium.org/gerrit/50138 Reviewed-by: Gilad Arnold <garnold@chromium.org> Tested-by: Gilad Arnold <garnold@chromium.org> Commit-Queue: David James <davidjames@chromium.org>
* paycheck: enforce physical partition size correctlyGilad Arnold2013-05-071-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During payload checking, payload has wrongly interpreted the size reported in the update payload to be the physical partition size, whereas this is in fact the size of the filesystem portion only (a misnomer). This sometimes caused it to emit errors on out-of-bounds operations, which are otherwise harmless in real-world scenarios. This CL makes a clear distinction between the two, with the following semantics: - The payload's embedded filesystem size must by <= the physical partition sizes. - Reading/writing from/to the new partition must be within the physical partition size boundaries, and not the filesystem ones. - Reading from the old partition is only allowed from filesystem boundaries; this is unchanged from current behavior and appears to be consistent with how we perform delta updates. - Old/new SHA256 verification during payload application is now limited to the allotted filesystem portion only (and not the full partition size). This is consistent with the update engine's semantics. - Other than that, this change currently has no further effect on payload application, which remains more permissive wrt to partition sizes. This also means that the sizes of partitions resulting from a payload application will not necessarily abide by the predetermined physical partition sizes. This is in line with the prevailing division of responsibilities between payload checking (strict) and application (relaxed). BUG=chromium:221847 TEST=Payload checking respects partition size override TEST=Unit tests pass TEST=Integration tests pass Change-Id: I0dbc88d538c0cc53b7551f4dfa8f543bcf480cd5 Reviewed-on: https://gerrit.chromium.org/gerrit/50103 Reviewed-by: Gilad Arnold <garnold@chromium.org> Tested-by: Gilad Arnold <garnold@chromium.org> Commit-Queue: David James <davidjames@chromium.org>
* paycheck: --disalbed_tests implies --checkGilad Arnold2013-05-071-2/+2
| | | | | | | | | | | | | | This is in line with other check-related options whose use implies --check. BUG=None TEST=Integrity check is implied as expected Change-Id: I5c2d964d9b6462c76747358129900acbba411d04 Reviewed-on: https://gerrit.chromium.org/gerrit/50102 Tested-by: Gilad Arnold <garnold@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org> Commit-Queue: David James <davidjames@chromium.org>
* Add public update key as default.Don Garrett2013-05-061-1/+6
| | | | | | | | | | | | | This adds the key, and makes it default. BUG=chromium:237064 TEST=Ran tool manually. Change-Id: I0c47515980dd0349e6d427524b933ff812b61318 Reviewed-on: https://gerrit.chromium.org/gerrit/49704 Tested-by: Don Garrett <dgarrett@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org> Commit-Queue: Don Garrett <dgarrett@chromium.org>
* Add default name for the metadata signature file.Don Garrett2013-05-021-0/+9
| | | | | | | | | | | | | | If the metadata signature file isn't specified, and a file exists with the name <payload_file>.metadata-signature, use it for the metadata signature. BUG=None TEST=Manual Change-Id: I193dcbeece659e6fa9da8a7a22b871aa53622ceb Reviewed-on: https://gerrit.chromium.org/gerrit/49832 Commit-Queue: Don Garrett <dgarrett@chromium.org> Tested-by: Don Garrett <dgarrett@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org>
* paycheck: allow to disable specific checksGilad Arnold2013-05-021-1/+14
| | | | | | | | | | | | | | | This became necessary as the delta generator appears to generate payloads that fail certain checks (e.g. during update_engine unit testing). BUG=None TEST=Disabled checks not being triggered Change-Id: I4491e0cb32ef44f85e11ffb0402b40d1371525ae Reviewed-on: https://gerrit.chromium.org/gerrit/49676 Tested-by: Gilad Arnold <garnold@chromium.org> Reviewed-by: Chris Sosa <sosa@chromium.org> Commit-Queue: Gilad Arnold <garnold@chromium.org>
* paycheck: perform payload integrity check by defaultGilad Arnold2013-04-231-45/+63
| | | | | | | | | | | | | | | | | | | | | | | Currently, paycheck requires that --check, or one of its sub-options (e.g. --type), is specified explicitly on the command-line in order to trigger full payload checking. This means that invoking paycheck without *any* optional arguments will amount to loading the payload manifest and quitting. This is not a useful behavior. Instead, we want payload integrity check to be the default behavior when nothing else is requested. This also edits the help text to clarify the distinction between verifying/applying a payload, and what guarantees are provided wrt the actual CrOS update engine. BUG=None TEST=Payload checking triggered when no other argument is given; passes unit/integrity testing. Change-Id: I8199813d4654f5598fcf152a3cdc62efbfc533da Reviewed-on: https://gerrit.chromium.org/gerrit/48373 Tested-by: Gilad Arnold <garnold@chromium.org> Reviewed-by: Darin Petkov <petkov@chromium.org> Commit-Queue: Gilad Arnold <garnold@chromium.org>
* Update payload library + command-line toolGilad Arnold2013-03-081-0/+160
An initial implementation of a Python module for parsing, checking and applying a Chrome OS update payload. Comes with a command-line tool (paycheck.py) for applying such operations on payload files, and a test script (test_paycheck.sh) for ensuring that the library and tool are working correctly. Since update_payload is introduced as a package, we're moving some previously merged utilities into the package's directory. (Unit testing for this code will be uploaded on a separate CL; see chromium-os:39663) BUG=chromium-os:34911,chromium-os:33607,chromium-os:7597 TEST=test_paycheck.sh successful on MP-signed payloads CQ-DEPEND=I5746a1d80e822a575f0d96f94d0b4e765fc64507 Change-Id: I77123a1fffbb2059c239b7145c6922968fdffb6a Reviewed-on: https://gerrit.chromium.org/gerrit/43041 Reviewed-by: Gilad Arnold <garnold@chromium.org> Tested-by: Gilad Arnold <garnold@chromium.org> Reviewed-by: Chris Sosa <sosa@chromium.org> Reviewed-by: Jay Srinivasan <jaysri@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org> Commit-Queue: Gilad Arnold <garnold@chromium.org>