Extracts keyid inline using openssl commands.
The keyid is passed as one of the kernel command line parameters
for the dm-android-verity module to mount root fs(system)
with verity enabled.
(cherry-picked from 3af315aed5https://googleplex-android-review.git.corp.google.com/#/c/1061691/)
BUG: 28384658
Change-Id: I8efbe1b0e415ef1d396f9b51cfa4b3fa01b22484
For AB devices, support flashing two system partitions for factory use.
The normal system image on one partition, but without dex preopt. And a
system_other image that just contains the odex files. The dex files will
not be stripped out of the system image, in case the second system
partition is wiped.
Setting BOARD_USES_SYSTEM_OTHER_ODEX := true in the BoardConfig.mk
enables this behavior.
One can control which directories are placed in system_other by the
SYSTEM_OTHER_ODEX_FILTER configuration variable. Currently we default
to only copying only app and priv-app odexs.
Bug: 29278988
Change-Id: I7f4e87da919e7dc6a89fd8c668193cd4e98631bc
Verity is not enabled in eng builds. Pass the build variant so
that kernel does not try to enable verity in eng builds
BUG:29276559
Change-Id: I7f412196ac59aa63e91c21d825ad15bae9f51691
Standardize symlinking /system/vendor -> /vendor for aosp_* devices,
since some /vendor binaries still use /system/vendor/... paths.
Support using a prebuilt vendor image and including it into all the
normal packaging steps.
Bug: 28987532
Change-Id: I27040e8a8d1df0777e16cd1e3c3a9f1b28695e96
We recently moved Brillo verified boot from system/bvb to external/bvb
so update the path accordingly.
TEST=Build with 'BOARD_BVB_ENABLE := true' succeeds.
BUG=29099910
Change-Id: I66f3b90e23d6b2afc09f81af571ede7b573325e9
TARGET_RECOVERY_BRICK specifies the file that lists all the partitions
to be bricked under recovery. The file, if present, will be copied to
'$(TARGET_RECOVERY_ROOT_OUT)/etc/recovery.brick'.
Bug: 27253717
Change-Id: Id84195b5ee1031a83bf7a077be070a3728416580
(cherry picked from commit 3051f4f11a)
TARGET_RECOVERY_BRICK specifies the file that lists all the partitions
to be bricked under recovery. The file, if present, will be copied to
'$(TARGET_RECOVERY_ROOT_OUT)/etc/recovery.brick'.
Bug: 27253717
Change-Id: Id84195b5ee1031a83bf7a077be070a3728416580
Extracts keyid inline using openssl commands.
The keyid is passed as one of the kernel command line parameters
for the dm-android-verity module to mount root fs(system)
with verity enabled.
BUG: 28384658
Change-Id: I8efbe1b0e415ef1d396f9b51cfa4b3fa01b22484
rsync will complain due to broken cache symlink on devices
without cache partition when creating the recovery disk.
Recovery does not depend on /cache.
Bug: 28747374
Change-Id: Ie2dc6e84194fbc3bbb39fe59ef92a6e8936b71e2
am: eac63ed087
* commit 'eac63ed087e7e84a80ddc6c45d2f21bfae5617b0':
Correct some dependencies around zip packages
Change-Id: I783119bdce2044473c96c680cd035d131604dc94
am: a22d0a88ba
* commit 'a22d0a88ba74bba43a8683e542b5f46eb9afce22':
Include BRILLO_VENDOR_PARTITIONS in target zip generation
Change-Id: I44390a1512b24880183d40d35087409b9693435f
This change will enable the target zip to include partition defined in
BRILLO_VENDOR_PARTITIONS. This is necessary for OTA to support
partitions other than boot and system in ab_partitions.txt.
The target zip will include images in BRILLO_VENDOR_PARTITIONS if
defined, under VENDOR_IMAGES/ with path kept. Also any vendor partitions
defined in AB_OTA_PARTITIONS will be copied to IMAGES/ in the target zip.
BUG: 28623063
Change-Id: Ic479048dfb8ac506acf827865e784fcb0432a1d5
Add scripts which creates these packages to their dependencies.
$(SYMBOLS_ZIP) contains symbol info of the updater binary so
it should depend on it.
Bug: 27954979
Change-Id: If78746ec843dd57fe5fdda3ed504a12bb298ea1d
am: eb06b4d3b3
* commit 'eb06b4d3b3862759ca15e9c52802808debc0a295':
Include vendor partitions in target zip generation
Change-Id: I9646c90fbe5c57a1f8c6022b8aad03f4e19f56e7
This change will enable the target zip to include partition defined in
BRILLO_VENDOR_PARTITIONS. This is necessary for OTA to support
partitions other than boot and system in ab_partitions.txt.
BUG: 28623063
Change-Id: I6e0969c31c9ad2e8285c6f560825c160aa8c4d55
Pack the base_fs files ({system,vendor}.map) into target_files.zip,
which would be needed when rebuilding the images at signing.
Reset the base_fs paths to point to the files in META/.
Also add blk_alloc_to_base_fs into otatools.zip.
Bug: 27698960
Change-Id: If4eb274b3f3d839c4365624f46f0dc89bd2fa440
The following tools are essential to create squashfs and f2fs images
during signing (if applicable).
squashfs: mksquashfs and mksquashfsimage.sh
f2fs: make_f2fs and mkf2fsuserimg.sh
Bug: 28179154
Change-Id: Ia48bc6d9a40d2667bc6f2c973bd0c55eed7a06fc
(cherry picked from commit cffaf73f84)
The following tools are essential to create squashfs and f2fs images
during signing (if applicable).
squashfs: mksquashfs and mksquashfsimage.sh
f2fs: make_f2fs and mkf2fsuserimg.sh
Bug: 28179154
Change-Id: Ia48bc6d9a40d2667bc6f2c973bd0c55eed7a06fc
To generate partition tables in the Android build system, simply add
the path to a .bpt file to the BOARD_BPT_INPUT_FILES variable.
BOARD_BPT_INPUT_FILES += "hardware/bsp/vendor/soc/board/board-specific.bpt"
The variable BOARD_BPT_DISK_SIZE can be used to specify or override
the disk size, for example:
BOARD_BPT_DISK_SIZE := "10 GiB"
Additional arguments to 'bpttool make_table' can be specified in the
variable BOARD_BPT_MAKE_TABLE_ARGS.
If BOARD_BPT_INPUT_FILES is set, the build system generates two files
partition-table.img
partition-table.bpt
in ${ANDROID_PRODUCT_OUT} using 'bpttool make_table'. The former is
the binary partition tables generated using bptool's --output_gpt
option and the latter is a JSON file generated using the --output_json
option. These files will also be put in the IMAGES/ directory of
target-files.zip when running 'm dist'.
BUG=27831397
TEST=Manually tested.
Change-Id: Iedd15354afb2dd483dcb9bc001360b2a37fd6dc0
To rebuild odex files of Java libraries and apps,
we store the jars/apks without stripping the classes.dex inside the
platform.zip. We also save the build variables that may affect how we
rebuild an odex in pdk_dexpreopt_config.mk in the platform.zip.
We store the files and configuration only for libraries/apps that get
installed to the system.img (or vendor.img).
In PDK fusion build, we auto-generate prebuilt module definitions for
the javalib.jar and package.dex.apk carried in the platform.zip, using
configuration stored in pdk_dexpreopt_config.mk.
With the prebult modules, we override the implicit rule that directly
copies the odex from the platform.zip.
To rebuild odex of javalib.jar, we added support for prebuilt shared Java
library to prebiult_internal.mk. An installable prebuilt Java library is
treated as shared Java library, i.e. with classes.dex in the jar instead
of a set of .class files.
For apks in the platform.zip, we install the stripped version from
platform files inside platform.zip, instead of the package.dex.apk,
using a new variable LOCAL_REPLACE_PREBUILT_APK_INSTALLED. We can't
strip package.dex.apk because we can't re-sign the stripped apk at this
point.
We generate prebuilt module only if it's not already defined in the
source tree.
Bug: 27543283
Change-Id: I9e146f8b713d6f57c397fd28d88c9ab700757ca1
(cherry-pick from commit 3a61eeb6cb)
The following variables are introduced
BOARD_BVB_ENABLE: can be set to true to build boot.img and system.img
files compatible with Brillo Verfied Boot.
BOARD_BVB_ROLLBACK_INDEX: can be set to an integer to use for the
rollback index.
BOARD_BVB_KEY_PATH, BOARD_BVB_ALGORITHM: If set, the former must be a
path to the private key used to sign the boot image and the latter must
be the algorithm to use. If unset, a test-key stored in the tree will
be used.
BOARD_BVB_MAKE_BOOT_IMAGE_ARGS: Extra options to pass to 'bvbtool
make_boot_image'.
BOARD_BVB_SIGN_BOOT_IMAGE_ARGS: Extra options to pass to 'bvbtool
sign_boot_image'.
BOARD_BVB_ADD_IMAGE_HASHES_ARGS: Extra options to pass to 'bvbtool
add_image_hashes'.
BOARD_CUSTOM_BVBTOOL: Can be set to specify what bvbtool program to
use.
The existing BOARD_KERNEL_CMDLINE variable is also used, as are existing
kernel and initrd-related variables. Therefore, simply adding
BOARD_BVB_ENABLE := true
to an existing Makefile should do the trick.
Bug: 26185038
TEST=Added 'BOARD_BVB_ENABLE := true' to hardware/bsp/intel/soc/edison/soc.mk
and built an image and then ran bvbtool's info_boot_image and
info_image_hashes commands on the resulting boot.img and system.img
files and verified that the information was correct. Also ran 'm dist'
and verified that the boot.img and system.img files in the resulting
target_files.zip file had similar information.
Change-Id: I08045ed8b0cbddc7c3acdd3a6f2c4bb75cb44bbc
Also ensure that sdk.atree can find jack.jar and jill.jar from prebuilt.
Bug: 27372042
(cherry picked from commit 233584bb80)
Change-Id: Ie266104e51c09fa21ccb09c1f27ad7068472965c
To rebuild odex files of Java libraries and apps,
we store the jars/apks without stripping the classes.dex inside the
platform.zip. We also save the build variables that may affect how we
rebuild an odex in pdk_dexpreopt_config.mk in the platform.zip.
We store the files and configuration only for libraries/apps that get
installed to the system.img (or vendor.img).
In PDK fusion build, we auto-generate prebuilt module definitions for
the javalib.jar and package.dex.apk carried in the platform.zip, using
configuration stored in pdk_dexpreopt_config.mk.
With the prebult modules, we override the implicit rule that directly
copies the odex from the platform.zip.
To rebuild odex of javalib.jar, we added support for prebuilt shared Java
library to prebiult_internal.mk. An installable prebuilt Java library is
treated as shared Java library, i.e. with classes.dex in the jar instead
of a set of .class files.
For apks in the platform.zip, we install the stripped version from
platform files inside platform.zip, instead of the package.dex.apk,
using a new variable LOCAL_REPLACE_PREBUILT_APK_INSTALLED. We can't
strip package.dex.apk because we can't re-sign the stripped apk at this
point.
We generate prebuilt module only if it's not already defined in the
source tree.
Bug: 27543283
Change-Id: I9e146f8b713d6f57c397fd28d88c9ab700757ca1
Allows passing the *.base_fs or *.map files for system and vendor in
INTERNAL_SYSTEM_BASE_FS_PATH and INTERNAL_VENDOR_BASE_FS_PATH variables
respectively.
Internal Design Doc: go/incremental-ext4
BUG: 26839493
Signed-off-by: Mohamad Ayyash <mkayyash@google.com>
Change-Id: Ie57ef6dbfa6084268b6535fe0a673a3b4aaa6e2f
Signed-off-by: Mohamad Ayyash <mkayyash@google.com>
am: a65b01fc09
* commit 'a65b01fc09b47c83e59dc4757c76eafba1e15cbc':
Remove LOCAL_ACP_UNAVAILABLE
Remove unused dependencies on $(ACP)
Replace some uses of acp with cp
When more than one makefile tries to copy a header to the same
destination, the warning is not clear, and hard to track down and assign
blame:
build/core/copy_headers.mk:15: warning: ignoring old commands for target `out/target/product/bullhead/obj/include/qcom/display/copybit.h'
With this change, the same behavior is kept, but the warning message is
more descriptive, and contains the offending Android.mk files:
build/core/Makefile:54: Duplicate header copy: out/target/product/bullhead/obj/include/qcom/display/copybit.h
build/core/Makefile:54: Defined in: hardware/qcom/display/msm8994/libcopybit/Android.mk hardware/qcom/display/msm8994/libcopybit/Android.mk
In this case, a $(CLEAR_VARS) is missing, so the same Android.mk file is
copying the same headers twice.
Bug: 27302058
Change-Id: Icf8f580ae71a78741db21c1d8f3213424459e637
(cherry picked from commit 6f60f020d7)
When more than one makefile tries to copy a header to the same
destination, the warning is not clear, and hard to track down and assign
blame:
build/core/copy_headers.mk:15: warning: ignoring old commands for target `out/target/product/bullhead/obj/include/qcom/display/copybit.h'
With this change, the same behavior is kept, but the warning message is
more descriptive, and contains the offending Android.mk files:
build/core/Makefile:54: Duplicate header copy: out/target/product/bullhead/obj/include/qcom/display/copybit.h
build/core/Makefile:54: Defined in: hardware/qcom/display/msm8994/libcopybit/Android.mk hardware/qcom/display/msm8994/libcopybit/Android.mk
In this case, a $(CLEAR_VARS) is missing, so the same Android.mk file is
copying the same headers twice.
Bug: 27302058
Change-Id: Icf8f580ae71a78741db21c1d8f3213424459e637
With the change in [1], delta_generator now needs
libprotobuf-cpp-lite.so instead of libprotobuf-cpp-lite-rtti.so to
generate A/B payloads.
[1] commit ab5bd668f6be600a8cceb8772e426c0aa902a5e1
Bug: 27145830
Change-Id: Ib9a93bf0fbe7fa44fc5fb94668d17fa1a2e07b05
(cherry picked from commit fdd2693b65)
With the change in [1], delta_generator now needs
libprotobuf-cpp-lite.so instead of libprotobuf-cpp-lite-rtti.so to
generate A/B payloads.
[1] commit ab5bd668f6be600a8cceb8772e426c0aa902a5e1
Bug: 27145830
Change-Id: Ib9a93bf0fbe7fa44fc5fb94668d17fa1a2e07b05
Previously, the squashfs dependencies were included only if
the system image was squashfs. Allow the vendor image trigger
the dependency.
Change-Id: I5b1c513e9c13d83efc3ca6a904f08a91d9cca85f
To help early verification of a target_files.zip being uploaded to our
servers, we place the META/ directory first in the .zip file, so checks
against the product_id.txt and product_version.txt don't need to wait
for the whole file to upload.
Note that META/*filesystem_config.txt files are generated and added to
the .zip file at a later point, so they are not included at the
beginning.
Bug: 26806325
TEST=`make dist` and `unzip -l out/dist/edison-target_files-eng.$USER.zip` shows most META/ files first.
Change-Id: I1955645412688f5c7823063ed56606b251daccfd
For non-Brillo devices using AB update, add the payload signing public
key to the system image
(system/etc/update_engine/update-payload-key.pub.pem).
We first need to sign the payload with some private key, and pack it
into an Android OTA package. Then the whole zip package will be signed
again with the device key. This is to comply with the two existing OTA
flows (Android and CrOS).
We use the same device key to do the two signings, but update_engine
expects the key in RSA public key format. This CL extracts the public
key from x509 certificate and adds it to the system image.
Bug: 25715402
Change-Id: I6f6c1148534250ddb6d9e554175c7a35bceda99e
brillo_update_payload and shflags are the scripts to generate A/B OTA
package (payload). Include them into otatools.zip.
brillo_update_payload was already included in previous CL. Move it to
the folder for executables.
Bug: 25715402
Change-Id: Idf9c05767c24c55d058cc30e696f06d4eb5fd53b
The CL in [1] changed to create a symlink to /storage/self/primary for
/sdcard. It breaks the mount of /sdcard under recovery.
[1] commit 595003a3d06a13862052ef2f4f578371dae5ad65
Bug: 26509280
Change-Id: I98d02d54d707c2c8826c5ee119cf1a3ffa0c4bc9
delta_generator computes the OTA package (aka payload) for A/B update.
Also add its dependent libraries into otatools.zip.
Bug: 25715402
Change-Id: Iddf4b9ac188cc4c8bf3f89ce3641d68451632ba1
With BOARD_USES_RECOVERY_AS_BOOT = true, we skip building the
non-ramdisk boot.img but building the recovery image as boot.img. It
contains recovery's ramdisk (e.g. with /sbin/recovery). It depends on
the bootloader parameter (skip_initramfs) to determine the actual mode
to boot into.
Change-Id: Id6e2d0a2b94383944ca8f35bba688c6401745622
(cherry picked from commit d80bef2b9e)
With BOARD_USES_RECOVERY_AS_BOOT = true, we skip building the
non-ramdisk boot.img but building the recovery image as boot.img. It
contains recovery's ramdisk (e.g. with /sbin/recovery). It depends on
the bootloader parameter (skip_initramfs) to determine the actual mode
to boot into.
Change-Id: Id6e2d0a2b94383944ca8f35bba688c6401745622
This makes the signapk tool use Conscrypt (where possible) instead of
the platform-default JCA providers and the Bouncy Castle JCA provider.
This speeds up (by 10-30%) APK and OTA update signing because
Conscrypt's crypto primitives are backed by BoringSSL.
Previously, the signapk tool consisted only of the signapk.jar.
Because Conscrypt is backed by native code, signapk now consists of
signapk.jar and crypto_openjdk_jni shared library. This requires that
users of the tool be updated to provide a suitable -Djava.library.path
argument to the Java runtime. This change updates all known users of
the tool inside the Android source tree to do so.
Bug: 26097626
Change-Id: I8411b37d7f771ed99269751a3007dff103083552
libext2_uuid_host was renamed to libext2_uuid-host to match the
"-host" suffix used in most libraries.
Bug: 24619596
TEST=make dist
(cherry picked from commit 41ac44ed2b)
Change-Id: I07e3a5e896230ed3ce1c102c607cbd1aa02c67e0
libext2_uuid_host was renamed to libext2_uuid-host to match the
"-host" suffix used in most libraries.
Bug: 24619596
TEST=make dist
Change-Id: Ic5faccb4d5fdbbf3d3bba6f4a35cf99d4961bb54
the value of USER is dependent from the compilation environment,so
when compiling one same device project, the BUILD_FINGERPRINT may
exceed 91 characters because ${USER} is long, but with short ${USER}
the compilation can pass.
Signed-off-by: wei qiao <qiaowei224@gmail.com>
Change-Id: Ia0f7dfa9cf7d605f1f2603f70dd0e6877482eb8a
Set ro.build.ab_update if AB_OTA_UPDATER is true. Device will depend on
this property to call the proper update API.
Change-Id: I5916ef5b30ea3351d323382f7ce83a17df2b0a70
For system images that contain the root directory, "adb shell" in
recovery stops working if the image is mounted at "/system", because
sh now locates at /system/system/bin/sh. We fix the issue by mounting
the image on /system_root and create a symlink to /system_root/system
for /system.
Bug: 22855115
Change-Id: Ia6b257b75aeb67687c3909063d1725a23a5ccd60
If system image contains the root directory
(BOARD_BUILD_SYSTEM_ROOT_IMAGE == "true"), we package the root directory
into ROOT/ instead of BOOT/RAMDISK/ in the target_files zip.
Change-Id: I817776ca97194991308b2131d0e34ab136283464
If BOARD_USES_FULL_RECOVERY_IMAGE == true, a full copy of recovery
image will be carried as /system/etc/recovery.img instead of a patch
at /system/recovery_from_boot.p.
Bug: 22641135
Change-Id: Ie271d3e2d55d7b003f667ac5b44203d69b23c63b
(cherry picked from commit 8beab69bd5)
Now that symlinks are created at build time, the rsync while
making recovery runs into issues around the etc symlink
Change-Id: Ie781507b22e4661629840075b274eaab2f712de6
Don't generate recovery.img when calling 'make dist' if
TARGET_NO_RECOVERY is set. The build system passes the flag to the
packaging script which then generates recovery.img conditionally.
Bug: 25329471
Change-Id: Ia7f08943834ee39e781d7e9b5beb1b31d95a73d9
(cherry picked from commit db45efa647)
The config file will be passed to delta_generator to add the postinstall
field in the update payload.
Bug: 24537566
Change-Id: I06b8d9d0b2c37f9a3e7a844ac4d9e2eead8cd4d2
TEST: make dist
check_prereq is a tool for recovery API v2, which has been obselete
since we moved to v3 in [1].
[1] commit e08991e02a7d678f2574e85289a34b2a9a537c82
Bug: 24621915
Change-Id: Ie96348fb56c5a3e029cac2417b59d8eb62dc085b
The build requires LINUX_KERNEL_COPYING when building
the notices. Change from depending on a file in
prebuilds/qemu-kernel to one in /build/core.
This is required as Brillo does not have the qemu-kernel
in its checkout.
BUG=25578534
Change-Id: Ieff6970035d27884c0769106e507284c1096c33f
For AB builds, add the build type to META/build_type.txt so the
server can easily determine user, userdebug, and eng builds
from each other.
Bug: 25420005
Change-Id: I6e4de2ba36a6fd1208c65a434d4725bb93d2cee6
ziptime fails on zip file larger than 2GB.
These zip files won't installed on device and we don't care that much
about their reprodudcibility across builds.
Change-Id: I47062928d075a59eda92dd5333e59502f490d1cb
Pass -X to zip so that Unix UID/GID and extra timestamps aren't
saved into the zip files.
Add a new tool, ziptime, that uses a very stripped down copy of
zipalign. It no longer depends on libandroidfw, and now rewrites the
timestamps in place instead of making a copy of the zipfile. This should
improve speed and reduce disk requirements, especially with the large
packaging zip files.
Bug: 24201956
Change-Id: I50f68669f659da1b4393e964ad40b6aafb00c1e7
Specifically, do not error out if no installable apps are found.
- When creating an archive of all the apps, and if no apps exist
for the target, generate an empty archive file.
- If building for a target with no installable jar(s) or apk(s),
generate an empty package stats file.
The former is just an output artifact. The latter is used
by the upload_pkg_stats.py script which correctly handles
an empty input file.
BUG: 23421592
Change-Id: I48db9f9e1f61914d8fd938130e09b41849685450
Badhri Jagan Sridharan