Git-Mirrors/DivestOS
1
0
Fork 0
mirror of https://github.com/Divested-Mobile/DivestOS-Build.git synced 2024-10-01 01:35:54 -04:00
Code Issues Packages Projects Releases Wiki Activity
5d57bf13c4
DivestOS/Patches/LineageOS-15.1/android_build/0001-OTA_Keys.patch

44 lines
1.5 KiB
Diff
Raw Normal View History

Refresh most branch specific patches Fixed up: LineageOS-16.0/android_packages_apps_Backgrounds/308977.patch LineageOS-16.0/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-17.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-18.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch Must review again: LineageOS-14.1/android_packages_apps_PackageInstaller/64d8b44.patch Signed-off-by: Tad <tad@spotco.us>
2021-10-16 14:05:45 -04:00
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
From: Tad <tad@spotco.us>
Date: Mon, 5 Apr 2021 23:03:18 -0400
Subject: [PATCH] Allow setting OTA public keys from environment variable
Verify authorship and Change-Id of all contained patches - No patches were found with incorrect authorship/From: lines - The older AndroidHardening patch repos are no longer available to verify CID. - New GrapheneOS patches do not include a CID. - *Signature_Spoofing.patch CID could not be found. - Fixed CID of *Harden_Sig_Spoofing.patch to match 14.1 - Fixed CID of *LGE_Fixes.patch to match 14.1 - Fixed CID of *Harden.patch to match 14.1 - Added edit note to *Harden.patch - Fixed CID of *PREREQ_Handle_All_Modes.patch to match 14.1 - Fixed CID of *More_Preferred_Network_Modes.patch to match 14.1 - Fixed CID of *AES256.patch to match 14.1 - Fixed CID of *0001-OTA_Keys.patch to match 18.1 - Fixed CID of *Camera_Fix.patch to match 15.1 - Fixed CID of *Connectivity.patch to match 14.1 - Fixed CID of *Fix_Calling.patch to match 14.1 - Fixed CID of *Remove_Analytics.patch to match 14.1 - Fixed CID of Unused-*.patch/audio_extn to match original Signed-off-by: Tad <tad@spotco.us>
2022-03-05 12:24:18 -05:00
Change-Id: Ib2a00de63b0c7a8790640462d13a84daf2076fa7
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
---
Better ensure extra keys are included Signed-off-by: Tad <tad@spotco.us>
2022-05-12 10:12:31 -04:00
core/Makefile | 5 +++++
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
core/product_config.mk | 5 +++++
Better ensure extra keys are included Signed-off-by: Tad <tad@spotco.us>
2022-05-12 10:12:31 -04:00
2 files changed, 10 insertions(+)
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
diff --git a/core/Makefile b/core/Makefile
Better ensure extra keys are included Signed-off-by: Tad <tad@spotco.us>
2022-05-12 10:12:31 -04:00
index f2a524d58c..bdd18d7dec 100644
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
--- a/core/Makefile
+++ b/core/Makefile
Better ensure extra keys are included Signed-off-by: Tad <tad@spotco.us>
2022-05-12 10:12:31 -04:00
@@ -1217,6 +1217,11 @@ endif
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
# substitute other keys for this one.
OTA_PUBLIC_KEYS := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
+ifneq ($(OTA_KEY_OVERRIDE_DIR),)
+ OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem
Better ensure extra keys are included Signed-off-by: Tad <tad@spotco.us>
2022-05-12 10:12:31 -04:00
+ PRODUCT_EXTRA_RECOVERY_KEYS := $(OTA_KEY_OVERRIDE_DIR)/extra
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
+endif
+
# Generate a file containing the keys that will be read by the
# recovery binary.
RECOVERY_INSTALL_OTA_KEYS := \
diff --git a/core/product_config.mk b/core/product_config.mk
Refresh most branch specific patches Fixed up: LineageOS-16.0/android_packages_apps_Backgrounds/308977.patch LineageOS-16.0/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-17.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-18.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch Must review again: LineageOS-14.1/android_packages_apps_PackageInstaller/64d8b44.patch Signed-off-by: Tad <tad@spotco.us>
2021-10-16 14:05:45 -04:00
index bcab7a384c..401d270542 100644
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -404,6 +404,11 @@ PRODUCT_OTA_PUBLIC_KEYS := $(sort \
PRODUCT_EXTRA_RECOVERY_KEYS := $(sort \
$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_EXTRA_RECOVERY_KEYS))
+ifneq ($(OTA_KEY_OVERRIDE_DIR),)
+ PRODUCT_OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem
+ PRODUCT_EXTRA_RECOVERY_KEYS := $(OTA_KEY_OVERRIDE_DIR)/extra
+endif
+
PRODUCT_DEX_PREOPT_DEFAULT_FLAGS := \
$(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_DEFAULT_FLAGS))
PRODUCT_DEX_PREOPT_BOOT_FLAGS := \
Reference in New Issue Copy Permalink