Script to disable rootFS verification on Chrome OS Flex/CloudReady 96+

disable_verify.sh

#!/bin/bash -eu
# disable_verify.sh: Script to disable rootFS verification on Chrome OS Flex/CloudReady 96+
#
# Usage:
#   curl -Ls 'https://gist.github.com/supechicken/ccf8bfad3be30dbcd144b46bc4d7083e/raw' | sudo bash -eu

[[ "${EUID}" != 0 ]] && echo -e "\e[1;31m"'Please run this script as root.'"\e[0m" && exit 1

# get disk device name which has Chrome OS installed to
cros_disk="$([[ "$(mount | grep '/mnt/stateful_partition')" =~ (sd[a-z]|nvme[0-9]n[0-9]p|mmcblk[0-9]p) ]] && \
             echo "${BASH_REMATCH[1]}")"

# mount the EFI partition of Chrome OS
mount -o rw /dev/${cros_disk}12 /boot

# backup existing EFI partition
(cd /boot; tar cf /mnt/stateful_partition/efi_backup.tar .)

# (Legacy only) tell SYSLINUX to boot from entries without dm-verify
find /boot/syslinux -name '*.cfg' \
  -exec sed -i 's/label chromeos-vhd/label chromeos-vhd-bak/g' {} \+ \
  -exec sed -i 's/label chromeos-hd/label chromeos-vhd/g' {} \+

# (EFI only) tell GRUB to boot from entries without dm-verify
sed -i 's/^defaultA=2$/defaultA=0/g' /boot/efi/boot/grub.cfg
sed -i 's/^defaultB=3$/defaultB=1/g' /boot/efi/boot/grub.cfg

# override invaild header byte by NUL char so that the rootFS partition can be
# mounted as read/write without any errors
printf '\000' | dd of=/dev/${cros_disk}3 seek=1127 conv=notrunc count=1 bs=1
printf '\000' | dd of=/dev/${cros_disk}5 seek=1127 conv=notrunc count=1 bs=1

# umount EFI partition
umount -l /boot

# reboot
echo -e "\e[1;32m"'Success!'"\e[0m"
read -N 1 -p $'\e[1;33m'"Reboot now? [Y/n]: "$'\e[0m' REBOOT <&1

[[ "${REBOOT}" =~ (Y|y) ]] && reboot