Git-Mirrors/DivestOS
1
0
Fork 0
mirror of https://github.com/Divested-Mobile/DivestOS-Build.git synced 2024-10-01 01:35:54 -04:00
Code Issues Packages Projects Releases Wiki Activity
c9765fc883
DivestOS/Patches/LineageOS-17.1/android_build/0002-OTA_Keys.patch

43 lines
1.5 KiB
Diff
Raw Normal View History

Refresh most branch specific patches Fixed up: LineageOS-16.0/android_packages_apps_Backgrounds/308977.patch LineageOS-16.0/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-17.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-18.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch Must review again: LineageOS-14.1/android_packages_apps_PackageInstaller/64d8b44.patch Signed-off-by: Tad <tad@spotco.us>
2021-10-16 14:05:45 -04:00
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
From: Tad <tad@spotco.us>
Date: Mon, 5 Apr 2021 22:55:30 -0400
Subject: [PATCH] Allow setting OTA public keys from environment variable
Verify authorship and Change-Id of all contained patches - No patches were found with incorrect authorship/From: lines - The older AndroidHardening patch repos are no longer available to verify CID. - New GrapheneOS patches do not include a CID. - *Signature_Spoofing.patch CID could not be found. - Fixed CID of *Harden_Sig_Spoofing.patch to match 14.1 - Fixed CID of *LGE_Fixes.patch to match 14.1 - Fixed CID of *Harden.patch to match 14.1 - Added edit note to *Harden.patch - Fixed CID of *PREREQ_Handle_All_Modes.patch to match 14.1 - Fixed CID of *More_Preferred_Network_Modes.patch to match 14.1 - Fixed CID of *AES256.patch to match 14.1 - Fixed CID of *0001-OTA_Keys.patch to match 18.1 - Fixed CID of *Camera_Fix.patch to match 15.1 - Fixed CID of *Connectivity.patch to match 14.1 - Fixed CID of *Fix_Calling.patch to match 14.1 - Fixed CID of *Remove_Analytics.patch to match 14.1 - Fixed CID of Unused-*.patch/audio_extn to match original Signed-off-by: Tad <tad@spotco.us>
2022-03-05 12:24:18 -05:00
Change-Id: Ib2a00de63b0c7a8790640462d13a84daf2076fa7
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
---
core/Makefile | 4 ++++
core/product_config.mk | 5 +++++
2 files changed, 9 insertions(+)
diff --git a/core/Makefile b/core/Makefile
Refresh most branch specific patches Fixed up: LineageOS-16.0/android_packages_apps_Backgrounds/308977.patch LineageOS-16.0/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-17.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-18.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch Must review again: LineageOS-14.1/android_packages_apps_PackageInstaller/64d8b44.patch Signed-off-by: Tad <tad@spotco.us>
2021-10-16 14:05:45 -04:00
index f6c2463439..7f4823a1ac 100644
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
--- a/core/Makefile
+++ b/core/Makefile
Refresh most branch specific patches Fixed up: LineageOS-16.0/android_packages_apps_Backgrounds/308977.patch LineageOS-16.0/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-17.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-18.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch Must review again: LineageOS-14.1/android_packages_apps_PackageInstaller/64d8b44.patch Signed-off-by: Tad <tad@spotco.us>
2021-10-16 14:05:45 -04:00
@@ -1895,6 +1895,10 @@ endif
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
# substitute other keys for this one.
OTA_PUBLIC_KEYS := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
+ifneq ($(OTA_KEY_OVERRIDE_DIR),)
+ OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem
+endif
+
# Generate a file containing the keys that will be read by the
# recovery binary.
RECOVERY_INSTALL_OTA_KEYS := \
diff --git a/core/product_config.mk b/core/product_config.mk
Refresh most branch specific patches Fixed up: LineageOS-16.0/android_packages_apps_Backgrounds/308977.patch LineageOS-16.0/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-17.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-18.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch Must review again: LineageOS-14.1/android_packages_apps_PackageInstaller/64d8b44.patch Signed-off-by: Tad <tad@spotco.us>
2021-10-16 14:05:45 -04:00
index 9460357ca1..be4bfec75e 100644
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -326,6 +326,11 @@ ENFORCE_SYSTEM_CERTIFICATE_WHITELIST := $(PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_RE
PRODUCT_OTA_PUBLIC_KEYS := $(sort $(PRODUCT_OTA_PUBLIC_KEYS))
PRODUCT_EXTRA_RECOVERY_KEYS := $(sort $(PRODUCT_EXTRA_RECOVERY_KEYS))
+ifneq ($(OTA_KEY_OVERRIDE_DIR),)
+ PRODUCT_OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem
+ PRODUCT_EXTRA_RECOVERY_KEYS := $(OTA_KEY_OVERRIDE_DIR)/extra
+endif
+
# Resolve and setup per-module dex-preopt configs.
DEXPREOPT_DISABLED_MODULES :=
# If a module has multiple setups, the first takes precedence.
Reference in New Issue Copy Permalink