inclusive: change usage of blacklist/whitelist

Google is working to change its source code to use more inclusive
language. To that end, replace the term "blacklist" & "whitelist"
with inclusive alternatives.

chrome-internal:3214766, chrome-internal:3214767, chrome-internal:3214831
will be checked in separately. They refer to a pinned vboot_reference.
So, this patch won't affect the signer until the pin is moved.

TEST=grep -ir "white*list"
TEST=grep -ir "black*list"
TEST=make runtests

Signed-off-by: Daisuke Nojiri <>
Change-Id: Iff98b55713b3c7381ba092ff14b50141b8422cf2
Reviewed-by: Julius Werner <>
diff --git a/scripts/image_signing/ b/scripts/image_signing/
index 4426d84..3b2dd7e 100755
--- a/scripts/image_signing/
+++ b/scripts/image_signing/
@@ -42,9 +42,9 @@
     mount_loop_image_partition_ro "${loopdev}" 3 "${rootfs}"
     # Pick the right set of test-expectation data to use.
     local boardvar=$(get_boardvar_from_lsb_release "${rootfs}")
-    eval "release_file_blacklist=(\"\${RELEASE_FILE_BLACKLIST_${boardvar}[@]}\")"
+    eval "release_file_denylist=(\"\${RELEASE_FILE_DENYLIST_${boardvar}[@]}\")"
-    for file in ${release_file_blacklist}; do
+    for file in ${release_file_denylist}; do
         if [ -e "${rootfs}/${file}" ]; then
             error "${file} exists in this image!"
             ls -al "${rootfs}/${file}"
diff --git a/scripts/image_signing/ b/scripts/image_signing/
index 7476a8e..388a756 100755
--- a/scripts/image_signing/
+++ b/scripts/image_signing/
@@ -34,7 +34,7 @@
 # Usage: check_keyval_in_list lsbfile lsbkey [list of values]
 # Extracts the lsb-release value for the specified key, and confirms it
-# matches one of the whitelisted values specified in value_array.
+# matches one of the allowlisted values specified in value_array.
 # Implementation note:
 # You can't really pass bash arrays to functions. Best you can do is either
 # serialize to string/pass/deserialize (e.g. using whitspace/IFS hacks), or,
diff --git a/scripts/image_signing/sample-test-configs/ensure_no_nonrelease_files.config b/scripts/image_signing/sample-test-configs/ensure_no_nonrelease_files.config
index 1ca02f1..f98f330 100644
--- a/scripts/image_signing/sample-test-configs/ensure_no_nonrelease_files.config
+++ b/scripts/image_signing/sample-test-configs/ensure_no_nonrelease_files.config
@@ -6,7 +6,7 @@
 # Files/directories that should never be present in a clean,
 # standard release build. 
 # Flag-file indicating "developer mode", crosh offers "shell" if present: