Support GKI boot.img v4 signing
Commit I9967d06bde0e18a12b84b5b0b568db09765fe305 supports adding a generic boot_signature into boot.img v4. This change allows replacing the boot_signture signing key with a release key during the release process. The default GKI signing key can be specified in a BoardConfig.mk via: BOARD_GKI_SIGNING_KEY_PATH := external/avb/test/data/testkey_rsa2048.pem BOARD_GKI_SIGNING_ALGORITHM := SHA256_RSA2048 BOARD_GKI_SIGNING_SIGNATURE_ARGS := --prop foo:bar The release signing key/algorithm can be specified by the following options when invoking sign_target_files_apks: --gki_signing_key=external/avb/test/data/testkey_rsa4096.pem --gki_signing_algorithm=SHA256_RSA4096 Additional arguments for generating the GKI signature can be specified as below: --gki_signing_extra_args="--prop gki:prop1 --prop gki:prop2" Bug: 177862434 Test: make dist Test: sign_target_files_apks \ --gki_signing_key=external/avb/test/data/testkey_rsa4096.pem \ --gki_signing_algorithm=SHA256_RSA4096 \ --gki_signing_extra_args="--prop gki:prop1 --prop gki:prop2" \ ./out/dist/*-target_files-eng.*.zip signed.zip Test: Checks GKI boot_signature is expected after signing: `unzip signed.zip IMAGES/boot.img` `unpack_bootimg --boot_img IMAGES/boot.img --out unpack` `avbtool info_image --image unpack/boot_signature` Test: unit test: releasetools_test and releasetools_py3_test Change-Id: I61dadbc242360e4cab3dc70295931b4a5b9422a9
Loading
Please register or sign in to comment