Gitiles
Code Review Sign In
review.blissroms.org / platform_build_make / 27c39b0af23c16c0d3d9ba4b14a2b2b19527c680
commit27c39b0af23c16c0d3d9ba4b14a2b2b19527c680[log] [tgz]
authorBowgo Tsai <bowgotsai@google.com>Fri Mar 12 21:40:32 2021 +0800
committerBowgo Tsai <bowgotsai@google.com>Fri Mar 19 17:11:04 2021 +0800
tree18c81589c98ef5681fffc81ed0126a42df58b0bf
parent82a4cfb397190fa7f1182692891e4532b9fda22f [diff]
Support GKI boot.img v4 signing

Commit I9967d06bde0e18a12b84b5b0b568db09765fe305 supports adding a
generic boot_signature into boot.img v4. This change allows replacing
the boot_signture signing key with a release key during the release
process.

The default GKI signing key can be specified in a BoardConfig.mk via:

  BOARD_GKI_SIGNING_KEY_PATH := external/avb/test/data/testkey_rsa2048.pem
  BOARD_GKI_SIGNING_ALGORITHM := SHA256_RSA2048
  BOARD_GKI_SIGNING_SIGNATURE_ARGS := --prop foo:bar

The release signing key/algorithm can be specified by the following options
when invoking sign_target_files_apks:

  --gki_signing_key=external/avb/test/data/testkey_rsa4096.pem
  --gki_signing_algorithm=SHA256_RSA4096

Additional arguments for generating the GKI signature can be
specified as below:

  --gki_signing_extra_args="--prop gki:prop1 --prop gki:prop2"

Bug: 177862434
Test: make dist
Test: sign_target_files_apks \
        --gki_signing_key=external/avb/test/data/testkey_rsa4096.pem \
        --gki_signing_algorithm=SHA256_RSA4096 \
        --gki_signing_extra_args="--prop gki:prop1 --prop gki:prop2" \
        ./out/dist/*-target_files-eng.*.zip signed.zip
Test: Checks GKI boot_signature is expected after signing:
      `unzip signed.zip IMAGES/boot.img`
      `unpack_bootimg --boot_img IMAGES/boot.img --out unpack`
      `avbtool info_image --image unpack/boot_signature`
Test: unit test: releasetools_test and releasetools_py3_test

Change-Id: I61dadbc242360e4cab3dc70295931b4a5b9422a9
5 files changed
tree: 18c81589c98ef5681fffc81ed0126a42df58b0bf
  1. common/
  2. core/
  3. packaging/
  4. target/
  5. tests/
  6. tools/
  7. .gitignore
  8. Android.bp
  9. buildspec.mk.default
  10. Changes.md
  11. CleanSpec.mk
  12. Deprecation.md
  13. envsetup.sh
  14. help.sh
  15. METADATA
  16. navbar.md
  17. OWNERS
  18. PREUPLOAD.cfg
  19. rbesetup.sh
  20. README.md
  21. tapasHelp.sh
  22. Usage.txt
README.md

Android Make Build System

This is the Makefile-based portion of the Android Build System.

For documentation on how to run a build, see Usage.txt

For a list of behavioral changes useful for Android.mk writers see Changes.md

For an outdated reference on Android.mk files, see build-system.html. Our Android.mk files look similar, but are entirely different from the Android.mk files used by the NDK build system. When searching for documentation elsewhere, ensure that it is for the platform build system -- most are not.

This Makefile-based system is in the process of being replaced with Soong, a new build system written in Go. During the transition, all of these makefiles are read by Kati, and generate a ninja file instead of being executed directly. That's combined with a ninja file read by Soong so that the build graph of the two systems can be combined and run as one.