Git-Mirrors/DivestOS
1
0
Fork 0
mirror of https://github.com/Divested-Mobile/DivestOS-Build.git synced 2024-10-01 01:35:54 -04:00
Code Issues Packages Projects Releases Wiki Activity
da1df44c8f
DivestOS/Patches/LineageOS-18.1/android_build/0002-OTA_Keys.patch

71 lines
2.8 KiB
Diff
Raw Normal View History

Refresh most branch specific patches Fixed up: LineageOS-16.0/android_packages_apps_Backgrounds/308977.patch LineageOS-16.0/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-17.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-18.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch Must review again: LineageOS-14.1/android_packages_apps_PackageInstaller/64d8b44.patch Signed-off-by: Tad <tad@spotco.us>
2021-10-16 14:05:45 -04:00
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
Small changes - Disable generation of unused OTA to reduce compile time - 17.1+: Disable APEX, breaks signing, and is also useless since no Play Store. - 18.1: Fixup signing
2021-03-29 17:09:12 -04:00
From: Tad <tad@spotco.us>
18.1: fix recovery signing friendly reminder to take a break when dealing with the same issue for extended periods of time
2021-04-06 05:06:15 -04:00
Date: Tue, 6 Apr 2021 05:04:32 -0400
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
Subject: [PATCH] Allow setting OTA public keys from environment variable
Small changes - Disable generation of unused OTA to reduce compile time - 17.1+: Disable APEX, breaks signing, and is also useless since no Play Store. - 18.1: Fixup signing
2021-03-29 17:09:12 -04:00
18.1: fix recovery signing friendly reminder to take a break when dealing with the same issue for extended periods of time
2021-04-06 05:06:15 -04:00
Change-Id: Ib2a00de63b0c7a8790640462d13a84daf2076fa7
Small changes - Disable generation of unused OTA to reduce compile time - 17.1+: Disable APEX, breaks signing, and is also useless since no Play Store. - 18.1: Fixup signing
2021-03-29 17:09:12 -04:00
---
18.1: fix recovery signing friendly reminder to take a break when dealing with the same issue for extended periods of time
2021-04-06 05:06:15 -04:00
core/product_config.mk | 5 +++++
Better ensure extra keys are included Signed-off-by: Tad <tad@spotco.us>
2022-05-12 10:12:31 -04:00
target/product/security/Android.mk | 22 ++++++++++++++++++----
2 files changed, 23 insertions(+), 4 deletions(-)
Small changes - Disable generation of unused OTA to reduce compile time - 17.1+: Disable APEX, breaks signing, and is also useless since no Play Store. - 18.1: Fixup signing
2021-03-29 17:09:12 -04:00
diff --git a/core/product_config.mk b/core/product_config.mk
Refresh most branch specific patches Fixed up: LineageOS-16.0/android_packages_apps_Backgrounds/308977.patch LineageOS-16.0/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-17.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch LineageOS-18.1/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch Must review again: LineageOS-14.1/android_packages_apps_PackageInstaller/64d8b44.patch Signed-off-by: Tad <tad@spotco.us>
2021-10-16 14:05:45 -04:00
index a16af05cf4..4849d50093 100644
Small changes - Disable generation of unused OTA to reduce compile time - 17.1+: Disable APEX, breaks signing, and is also useless since no Play Store. - 18.1: Fixup signing
2021-03-29 17:09:12 -04:00
--- a/core/product_config.mk
+++ b/core/product_config.mk
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
@@ -283,6 +283,11 @@ ENFORCE_SYSTEM_CERTIFICATE_ALLOW_LIST := $(PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_R
PRODUCT_OTA_PUBLIC_KEYS := $(sort $(PRODUCT_OTA_PUBLIC_KEYS))
PRODUCT_EXTRA_RECOVERY_KEYS := $(sort $(PRODUCT_EXTRA_RECOVERY_KEYS))
Small changes - Disable generation of unused OTA to reduce compile time - 17.1+: Disable APEX, breaks signing, and is also useless since no Play Store. - 18.1: Fixup signing
2021-03-29 17:09:12 -04:00
+ifneq ($(OTA_KEY_OVERRIDE_DIR),)
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
+ PRODUCT_OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem
Small changes - Disable generation of unused OTA to reduce compile time - 17.1+: Disable APEX, breaks signing, and is also useless since no Play Store. - 18.1: Fixup signing
2021-03-29 17:09:12 -04:00
+ PRODUCT_EXTRA_RECOVERY_KEYS := $(OTA_KEY_OVERRIDE_DIR)/extra
+endif
+
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled
2021-04-05 22:57:59 -04:00
# Resolve and setup per-module dex-preopt configs.
DEXPREOPT_DISABLED_MODULES :=
# If a module has multiple setups, the first takes precedence.
18.1: fix recovery signing friendly reminder to take a break when dealing with the same issue for extended periods of time
2021-04-06 05:06:15 -04:00
diff --git a/target/product/security/Android.mk b/target/product/security/Android.mk
Better ensure extra keys are included Signed-off-by: Tad <tad@spotco.us>
2022-05-12 10:12:31 -04:00
index d6a8b5378d..0018105865 100644
18.1: fix recovery signing friendly reminder to take a break when dealing with the same issue for extended periods of time
2021-04-06 05:06:15 -04:00
--- a/target/product/security/Android.mk
+++ b/target/product/security/Android.mk
@@ -55,8 +55,15 @@ LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_STEM := otacerts.zip
LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/security
include $(BUILD_SYSTEM)/base_rules.mk
-$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
-$(LOCAL_BUILT_MODULE): $(SOONG_ZIP) $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
+
+OTA_PUBLIC_KEYS := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
+
+ifneq ($(OTA_KEY_OVERRIDE_DIR),)
+ OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem
+endif
+
+$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(OTA_PUBLIC_KEYS)
+$(LOCAL_BUILT_MODULE): $(SOONG_ZIP) $(OTA_PUBLIC_KEYS)
$(SOONG_ZIP) -o $@ -j -f $(PRIVATE_CERT)
Better ensure extra keys are included Signed-off-by: Tad <tad@spotco.us>
2022-05-12 10:12:31 -04:00
@@ -72,11 +79,18 @@ include $(BUILD_SYSTEM)/base_rules.mk
18.1: fix recovery signing friendly reminder to take a break when dealing with the same issue for extended periods of time
2021-04-06 05:06:15 -04:00
extra_recovery_keys := $(patsubst %,%.x509.pem,$(PRODUCT_EXTRA_RECOVERY_KEYS))
-$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
+OTA_PUBLIC_KEYS := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
+
+ifneq ($(OTA_KEY_OVERRIDE_DIR),)
+ OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem
Better ensure extra keys are included Signed-off-by: Tad <tad@spotco.us>
2022-05-12 10:12:31 -04:00
+ extra_recovery_keys := $(OTA_KEY_OVERRIDE_DIR)/extra.x509.pem
18.1: fix recovery signing friendly reminder to take a break when dealing with the same issue for extended periods of time
2021-04-06 05:06:15 -04:00
+endif
+
+$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(OTA_PUBLIC_KEYS)
$(LOCAL_BUILT_MODULE): PRIVATE_EXTRA_RECOVERY_KEYS := $(extra_recovery_keys)
$(LOCAL_BUILT_MODULE): \
$(SOONG_ZIP) \
- $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem \
+ $(OTA_PUBLIC_KEYS) \
$(extra_recovery_keys)
$(SOONG_ZIP) -o $@ -j \
$(foreach key_file, $(PRIVATE_CERT) $(PRIVATE_EXTRA_RECOVERY_KEYS), -f $(key_file))
Reference in New Issue Copy Permalink