For generating a signed kernel to use Arch on a Chromebook

generate-signed-kernel.sh

#!/bin/sh
set -e

DEV="/dev/mmcblk0"
DEV_MNT="/tmp/emmc"
P1="${DEV}p1"
P3="${DEV}p3"

PP="$(pwd)/"
KEYS_OUT="${PP}devkeys"
KEYS_IN="${DEV_MNT}/usr/share/vboot/devkeys/"

# Mount emmc
mkdir -p "${DEV_MNT}"
mount -t ext4 -o ro "${P3}" "${DEV_MNT}"

# Copy keys from emmc to current directory
if [[ !-d ${KEYS_IN} ]]; then
    echo "Couldn't find devkeys. Does your Chromebook have Chrome OS on it?"
    umount "${P3}"
    exit 0;
else
    mkdir -p "${KEYS_OUT}"
    cp -r "${KEYS_IN}" "${KEYS_OUT}"
    echo "Copied devkeys"
    ls "${KEYS_OUT}"
fi

# Generate signed kernel
echo "root=${P3} rootwait rw quiet lsm.module_locking=0" > config.txt

vbutil_kernel \
--pack arch-eMMC.kpart \
--keyblock "${KEYS_OUT}kernel.keyblock" \
--signprivate "${KEYS_OUT}kernel_data_key.vbprivk" \
--config config.txt \
--vmlinuz /boot/vmlinux.uimg \
--arch arm \
--version 1

echo "Generated arch-eMMC.kpart you can dd this to ${P1} after you restore the full Arch eMMC image."

umount "${P3}"