Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit beb0b692 authored by Jacky Liu's avatar Jacky Liu
Browse files

Add PRODUCT_EXTRA_OTA_KEYS to add extra ota keys in otacerts.zip 

Equivalent to PRODUCT_EXTRA_RECOVERY_KEYS but for A/B OTA.

Bug: 211848136
Test: set PRODUCT_EXTRA_OTA_KEYS and check otacerts.zip
Change-Id: I81e27d12a22b405f6227b09c01ed684dfcede19e
parent 8beddf2e

core/Makefile

+3 −0
Original line number Diff line number Diff line
@@ -4623,6 +4623,9 @@ else 
endif

	$(hide) echo "tool_extensions=$(tool_extensions)" >> $@

	$(hide) echo "default_system_dev_certificate=$(DEFAULT_SYSTEM_DEV_CERTIFICATE)" >> $@

ifdef PRODUCT_EXTRA_OTA_KEYS

	$(hide) echo "extra_ota_keys=$(PRODUCT_EXTRA_OTA_KEYS)" >> $@

endif

ifdef PRODUCT_EXTRA_RECOVERY_KEYS

	$(hide) echo "extra_recovery_keys=$(PRODUCT_EXTRA_RECOVERY_KEYS)" >> $@

endif

core/product-graph.mk

+1 −0
Original line number Diff line number Diff line
@@ -126,6 +126,7 @@ $(OUT_DIR)/products/$(strip $(1)).txt: $(this_makefile) 
	$(hide) echo 'PRODUCT_CHARACTERISTICS=$(call get-product-var,$(1),PRODUCT_CHARACTERISTICS)' >> $$@

	$(hide) echo 'PRODUCT_COPY_FILES=$(call get-product-var,$(1),PRODUCT_COPY_FILES)' >> $$@

	$(hide) echo 'PRODUCT_OTA_PUBLIC_KEYS=$(call get-product-var,$(1),PRODUCT_OTA_PUBLIC_KEYS)' >> $$@

	$(hide) echo 'PRODUCT_EXTRA_OTA_KEYS=$(call get-product-var,$(1),PRODUCT_EXTRA_OTA_KEYS)' >> $$@

	$(hide) echo 'PRODUCT_EXTRA_RECOVERY_KEYS=$(call get-product-var,$(1),PRODUCT_EXTRA_RECOVERY_KEYS)' >> $$@

	$(hide) echo 'PRODUCT_PACKAGE_OVERLAYS=$(call get-product-var,$(1),PRODUCT_PACKAGE_OVERLAYS)' >> $$@

	$(hide) echo 'DEVICE_PACKAGE_OVERLAYS=$(call get-product-var,$(1),DEVICE_PACKAGE_OVERLAYS)' >> $$@

core/product.mk

+1 −0
Original line number Diff line number Diff line
@@ -183,6 +183,7 @@ _product_list_vars += PRODUCT_COPY_FILES 
# signing tools can substitute them for the test key embedded by

# default.

_product_list_vars += PRODUCT_OTA_PUBLIC_KEYS

_product_list_vars += PRODUCT_EXTRA_OTA_KEYS

_product_list_vars += PRODUCT_EXTRA_RECOVERY_KEYS



# Should we use the default resources or add any product specific overlays

core/product_config.mk

+1 −0
Original line number Diff line number Diff line
@@ -381,6 +381,7 @@ ENFORCE_SYSTEM_CERTIFICATE := $(PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQU 
ENFORCE_SYSTEM_CERTIFICATE_ALLOW_LIST := $(PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_ALLOW_LIST)



PRODUCT_OTA_PUBLIC_KEYS := $(sort $(PRODUCT_OTA_PUBLIC_KEYS))

PRODUCT_EXTRA_OTA_KEYS := $(sort $(PRODUCT_EXTRA_OTA_KEYS))

PRODUCT_EXTRA_RECOVERY_KEYS := $(sort $(PRODUCT_EXTRA_RECOVERY_KEYS))



# Resolve and setup per-module dex-preopt configs.

target/product/security/Android.mk

+12 −4
Original line number Diff line number Diff line
@@ -63,9 +63,17 @@ LOCAL_MODULE_CLASS := ETC 
LOCAL_MODULE_STEM := otacerts.zip

LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/security

include $(BUILD_SYSTEM)/base_rules.mk



extra_ota_keys := $(addsuffix .x509.pem,$(PRODUCT_EXTRA_OTA_KEYS))



$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem

$(LOCAL_BUILT_MODULE): $(SOONG_ZIP) $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem

	$(SOONG_ZIP) -o $@ -j -symlinks=false -f $(PRIVATE_CERT)

$(LOCAL_BUILT_MODULE): PRIVATE_EXTRA_OTA_KEYS := $(extra_ota_keys)

$(LOCAL_BUILT_MODULE): \

	    $(SOONG_ZIP) \

	    $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem \

	    $(extra_ota_keys)

	$(SOONG_ZIP) -o $@ -j -symlinks=false \

	    $(addprefix -f ,$(PRIVATE_CERT) $(PRIVATE_EXTRA_OTA_KEYS))





#######################################
@@ -80,7 +88,7 @@ LOCAL_MODULE_STEM := otacerts.zip 
LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)/system/etc/security

include $(BUILD_SYSTEM)/base_rules.mk



extra_recovery_keys := $(patsubst %,%.x509.pem,$(PRODUCT_EXTRA_RECOVERY_KEYS))

extra_recovery_keys := $(addsuffix .x509.pem,$(PRODUCT_EXTRA_RECOVERY_KEYS))



$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem

$(LOCAL_BUILT_MODULE): PRIVATE_EXTRA_RECOVERY_KEYS := $(extra_recovery_keys)
@@ -89,4 +97,4 @@ $(LOCAL_BUILT_MODULE): \ 
	    $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem \

	    $(extra_recovery_keys)

	$(SOONG_ZIP) -o $@ -j -symlinks=false \

	    $(foreach key_file, $(PRIVATE_CERT) $(PRIVATE_EXTRA_RECOVERY_KEYS), -f $(key_file))
 
	    $(addprefix -f ,$(PRIVATE_CERT) $(PRIVATE_EXTRA_RECOVERY_KEYS))