Two main sources of my inspiration were this post by Daniel P. Berrangé and this very detailed HOWTO on Debian User Forums. There's also a great, albeit a bit stripped down rootfs from Vassilis Laganakos for those who don't want to bother using debootstrap. Here's my script to run in root shell on ChromeOS to put the signed kernel onto the SD card:
echo "console=tty1 debug verbose root=/dev/mmcblk1p3 rootwait rw lsm.module_locking=0" > /tmp/config dd if=/dev/mmcblk0p2 of=/tmp/oldblob vbutil_kernel --repack /tmp/newkern --keyblock /usr/share/vboot/devkeys/kernel.keyblock --version 1 \ --signprivate /usr/share/vboot/devkeys/kernel_data_key.vbprivk --config=/tmp/config --oldblob /tmp/oldblob dd if=/tmp/newkern of=/dev/mmcblk1p1 dd if=/tmp/newkern of=/dev/mmcblk1p2 cgpt add -i 1 -S 1 -T 5 -P 10 -l KERN-A /dev/mmcblk1 cgpt add -i 2 -S 1 -T 5 -P 5 -l KERN-B /dev/mmcblk1Note the use of --oldblob option -- newer ChromeOS does now mount /boot anymore, but HOWTOs out there still suggest to point to the kernel using --vmlinuz . Also, lsm.module_locking=0 is important. Without it, you won't be able to load kernel modules in Debian.