DivestOS/Patches/LineageOS-17.1/android_build/0002-OTA_Keys.patch

From 1dd6a60f1fe8305f74795225a26a8301c690d898 Mon Sep 17 00:00:00 2001
From: Tad <tad@spotco.us>
Date: Mon, 5 Apr 2021 22:55:30 -0400
Subject: [PATCH] Allow setting OTA public keys from environment variable

Change-Id: I23c4acdff039f141afafcd0e736a341992f2f8ec
---
 core/Makefile          | 4 ++++
 core/product_config.mk | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/core/Makefile b/core/Makefile
index a5eef489f..64468d841 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -1891,6 +1891,10 @@ endif
 # substitute other keys for this one.
 OTA_PUBLIC_KEYS := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
 
+ifneq ($(OTA_KEY_OVERRIDE_DIR),)
+    OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem
+endif
+
 # Generate a file containing the keys that will be read by the
 # recovery binary.
 RECOVERY_INSTALL_OTA_KEYS := \
diff --git a/core/product_config.mk b/core/product_config.mk
index 9460357ca..be4bfec75 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -326,6 +326,11 @@ ENFORCE_SYSTEM_CERTIFICATE_WHITELIST := $(PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_RE
 PRODUCT_OTA_PUBLIC_KEYS := $(sort $(PRODUCT_OTA_PUBLIC_KEYS))
 PRODUCT_EXTRA_RECOVERY_KEYS := $(sort $(PRODUCT_EXTRA_RECOVERY_KEYS))
 
+ifneq ($(OTA_KEY_OVERRIDE_DIR),)
+    PRODUCT_OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem
+    PRODUCT_EXTRA_RECOVERY_KEYS := $(OTA_KEY_OVERRIDE_DIR)/extra
+endif
+
 # Resolve and setup per-module dex-preopt configs.
 DEXPREOPT_DISABLED_MODULES :=
 # If a module has multiple setups, the first takes precedence.
-- 
2.30.2
Failed attempt at fixing signing PRODUCT_OTA_PUBLIC_KEYS is meant to be set by a vendor tree, something we don't use. Override it at the source and set it explicitely as well. This ensures that the compiled recovery.img and the one generated by sign_target_files_apks.py includes the real public keys for verification. 11.0 signing is ignored. This will need to be extensively tested as breakage can mean brick on locked devices. Although in failure cases it seems test-keys are accepted. -- After much testing there appears to be a deeper issue with how keys are inserted into the recovery and handled 2021-04-05 22:57:59 -04:00			`From 1dd6a60f1fe8305f74795225a26a8301c690d898 Mon Sep 17 00:00:00 2001`
			`From: Tad <tad@spotco.us>`
			`Date: Mon, 5 Apr 2021 22:55:30 -0400`
			`Subject: [PATCH] Allow setting OTA public keys from environment variable`

			`Change-Id: I23c4acdff039f141afafcd0e736a341992f2f8ec`
			`---`
			`core/Makefile \| 4 ++++`
			`core/product_config.mk \| 5 +++++`
			`2 files changed, 9 insertions(+)`

			`diff --git a/core/Makefile b/core/Makefile`
			`index a5eef489f..64468d841 100644`
			`--- a/core/Makefile`
			`+++ b/core/Makefile`
			`@@ -1891,6 +1891,10 @@ endif`
			`# substitute other keys for this one.`
			`OTA_PUBLIC_KEYS := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem`

			`+ifneq ($(OTA_KEY_OVERRIDE_DIR),)`
			`+ OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem`
			`+endif`
			`+`
			`# Generate a file containing the keys that will be read by the`
			`# recovery binary.`
			`RECOVERY_INSTALL_OTA_KEYS := \`
			`diff --git a/core/product_config.mk b/core/product_config.mk`
			`index 9460357ca..be4bfec75 100644`
			`--- a/core/product_config.mk`
			`+++ b/core/product_config.mk`
			`@@ -326,6 +326,11 @@ ENFORCE_SYSTEM_CERTIFICATE_WHITELIST := $(PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_RE`
			`PRODUCT_OTA_PUBLIC_KEYS := $(sort $(PRODUCT_OTA_PUBLIC_KEYS))`
			`PRODUCT_EXTRA_RECOVERY_KEYS := $(sort $(PRODUCT_EXTRA_RECOVERY_KEYS))`

			`+ifneq ($(OTA_KEY_OVERRIDE_DIR),)`
			`+ PRODUCT_OTA_PUBLIC_KEYS := $(OTA_KEY_OVERRIDE_DIR)/releasekey.x509.pem`
			`+ PRODUCT_EXTRA_RECOVERY_KEYS := $(OTA_KEY_OVERRIDE_DIR)/extra`
			`+endif`
			`+`
			`# Resolve and setup per-module dex-preopt configs.`
			`DEXPREOPT_DISABLED_MODULES :=`
			`# If a module has multiple setups, the first takes precedence.`
			`--`
			`2.30.2`