summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-06-06Revert "Revert "certify_bootimg: support --extra_footer_args""android-t-beta-4_r0.5android-t-beta-3.3_r0.4android-t-beta-3.2_r0.4android-13.0.0_r0.44android-13.0.0_r0.43android-13.0.0_r0.4android-13.0.0_r0.20android-13.0.0_r0.19android-13.0.0_r0.15android-13.0.0_r0.14android-gs-raviole-5.10-t-beta-4android-gs-raviole-5.10-t-beta-3android-gs-raviole-5.10-android13android-gs-bluejay-5.10-android13Bowgo Tsai
This reverts commit dc7cea59b3bdf95435e4846309474b28a7fad161. After more discussions, decides to use the approach of --extra_footer_args, because `avbtool info_image` doesn't output a avb property value if the length is >= 256. So we cannot retain the avb properties based on the output of avbtool. Bug: 232062499 Test: atest --host certify_bootimg_test Change-Id: Id9acb4c8d1238a30451784970443f6112508a6ec
2022-06-01Revert "certify_bootimg: support --extra_footer_args"Bowgo Tsai
This reverts commit f754a7c3b8fcff3f74ad67a7c8138d97c3d9e879. After more thoughts, decided to use another approach: retaining the AVB properties from the original footer. So no need to use --extra_footer_args to add new AVB properties. With this approach, the certify_bootimg script can focus on boot signature generation without involving too much in the AVB footer generation. Bug: 232062499 Test: atest --host certify_bootimg_test Change-Id: Ie11c2a144cf3a1f33b25fc2ad25ffe2c80b73518
2022-05-27Support certifying the boot.img in a boot-img.tar.gzBowgo Tsai
The current glob() pattern will only certify boot-*.img in an archive. Changing this to boot*.img to make it certify a boot.img as well. Bug: 223288963 Test: atest --host certify_bootimg_test Change-Id: I7e97fd8ddaa02b628b58aedee2e8be3c8c863605
2022-05-24certify_bootimg: support --extra_footer_argsBowgo Tsai
This is used to add additional properties in the AVB footer, as VTS will be running in the GKI pre-release tests, where some VTS test cases expect SPL settings in the AVB footer of the boot.img. Note that the official boot.img AVB footer should be added by the device owner to create device-specific verified boot chain. The CL here is just to pass GKI pre-release testing. An usage example: certify_bootimg --boot_img boot.img \ --algorithm SHA256_RSA4096 \ --key external/avb/test/data/testkey_rsa4096.pem \ --extra_footer_args="--prop com.android.build.boot.os_version:13" \ --extra_footer_args="--prop com.android.build.boot.security_patch:2022-05-05" \ --output boot-certified-img The above --extra_footer_args can also be specified in a gki-info.txt: certify_bootimg_extra_footer_args=--prop com.android.build.boot.os_version:13 \ --prop com.android.build.boot.security_patch:2022-05-05 An usage example with --gki_info: certify_bootimg --boot_img boot.img \ --algorithm SHA256_RSA4096 \ --key external/avb/test/data/testkey_rsa4096.pem \ --gki_info gki-info.txt \ --output boot-certified-img Bug: 232062499 Test: atest --host certify_bootimg_test Change-Id: Ib5b7c8f68c56f8318f84fe34b6ad6fa7b01f03fe
2022-04-28certify_bootimg: support --gki_info for a boot.imgandroid-t-beta-3_r0.4Bowgo Tsai
The gki_info file can be used to append additional 'extra_args' during the certification process. An usage example: certify_bootimg --boot_img_archive boot-img.tar.gz \ --algorithm SHA256_RSA4096 \ --key external/avb/test/data/testkey_rsa4096.pem \ --extra_args "--prop foo:bar" \ --gki_info /path/to/gki-info.txt \ --output boot-certified-img.tar.gz An example of the file content of the gki-info.txt: certify_bootimg_extra_args=--prop KERNEL_RELEASE:5.10.107-android13-1-00361-gf1e8564c5530-ab8332003 Bug: 230426945 Test: atest --host certify_bootimg_test Change-Id: I484f77b4fd6eacb3cdfc2270543a2cd6d33d58c1
2022-04-26certify_bootimg: support more archive formatsBowgo Tsai
The common archive format in a kernel tree is usually *.tar.gz rather than *.zip. Supports different archive formats for --boot_img_archive (renamed from --boot_img_zip). An usage example: certify_bootimg --boot_img_archive boot-img.tar.gz \ --algorithm SHA256_RSA4096 \ --key external/avb/test/data/testkey_rsa4096.pem \ --extra_args "--prop foo:bar" \ --extra_args "--prop gki:nice" \ --output boot-certified-img.tar.gz The formats of the input archive and the output archive can be different: certify_bootimg --boot_img_archive boot-img.zip \ --algorithm SHA256_RSA4096 \ --key external/avb/test/data/testkey_rsa4096.pem \ --extra_args "--prop foo:bar" \ --extra_args "--prop gki:nice" \ --output boot-certified-img.tar The supported archive formats in the python binary built by the current Android build system are: shutil.get_unpack_formats(): [('gztar', ['.tar.gz', '.tgz'], "gzip'ed tar-file"), ('tar', ['.tar'], 'uncompressed tar file'), ('zip', ['.zip'], 'ZIP file')] Bug: 223288963 Test: atest --host certify_bootimg_test Change-Id: I74542c435a7b16f66708530e1c00d6fa8331e4cd
2022-04-01certify_bootimg: makes gki-info.txt optionalandroid-t-beta-2_r0.4android-gs-raviole-5.10-t-beta-2Bowgo Tsai
gki-info.txt from a boot-img.zip is used to provide additional settings and should be optional. Bug: 223288963 Test: atest --host certify_bootimg_test Change-Id: I6ed8efe8521560786da246b614dc42ad03761d34
2022-04-01certify_bootimg: avoid using subprocess calls to unpack_bootimgBowgo Tsai
Uses function calls instead. This makes a certify_bootimg binary can work without a unpack_bootimg binary. This can reduce pre-built binaries in a kernel tree. Bug: 180712476 Bug: 226121398 Test: atest --host mkbootimg_test Test: atest --host certify_bootimg_test Change-Id: I48c9f6767cb7b2c3e3bead008e630eeef310fca3
2022-03-25unpack_bootimg: fix pylint errorsBowgo Tsai
Bug: None Test: `python3 -m pylint unpack_bootimg.py` or `repo upload .` Test: atest --host mkbootimg_test Change-Id: I8403f1dfa61c63b2cf928ec50b3a087227e858bc
2022-03-22Merge "Allow dtb image to be empty in vendor_boot image"Lucas Wei
2022-03-22gki: Use shlex.split() to split command line argument stringsYi-yo Chiang
Bug: 211741246 Change-Id: I9bd08f77d93c7b2793623dd49511f10e37d0532a Test: Presubmit unit tests
2022-03-21certify_bootimg: support spaces in extra_argsBowgo Tsai
Using shlex.split() to split extra_args in shell-like syntax instead of str.split(). An usage example: certify_bootimg --boot_img boot.img \ --algorithm SHA256_RSA4096 \ --key external/avb/test/data/testkey_rsa4096.pem \ --extra_args "--prop gki:nice" \ --extra_args '--prop space:"nice to meet you"' \ --output boot-certified.img Bug: 223288963 Test: atest --host certify_bootimg_test Change-Id: I0dd195fa7580016c2e5b4ac8ab0cb4d1ebc74fac
2022-03-21certify_bootimg: support gki-info.txtBowgo Tsai
Support reading gki-info.txt from a boot-img.zip, to append additional settings. e.g., adding BRANCH or BUILD_NUMBER info into the AVB props of the boot signatures. Bug: 223288963 Test: atest --host certify_bootimg_test Change-Id: Ic88602a0d08154e47c0f9f63d946e04ea114d0d4
2022-03-18certify_bootimg: support boot images archiveBowgo Tsai
This allows us to certify multiple boot images in a zip archive. An usage example: certify_bootimg --boot_img_zip boot-img.zip \ --algorithm SHA256_RSA4096 \ --key external/avb/test/data/testkey_rsa4096.pem \ --extra_args "--prop foo:bar" \ --extra_args "--prop gki:nice" \ --output boot-certified-img.zip Bug: 223288963 Test: atest --host certify_bootimg_test Change-Id: I5ea8b81cfc79b7e00fd530d2ac3c8418b9a6568b
2022-03-10Allow dtb image to be empty in vendor_boot imageLucas Wei
Currently, building vendor_boot image will check size of dtb image and abort if not specified. We want to allow this condition and make user to build dtb whether in vendor_boot or vendor_kernel_boot. Bug: 222429295 Bug: 214409109 Test: atest --host mkbootimg_test Signed-off-by: Lucas Wei <lucaswei@google.com> Change-Id: I7a96ddc700d2ca43bd1063fd634ef8af76e94005
2022-03-08Initial commit of certify_bootimg.pyandroid-t-beta-1_r0.4android-gs-raviole-5.10-t-beta-1Bowgo Tsai
Adding a new script, certify_bootimg.py, to add boot certificates for a given boot image. The script adds two certificates: 'boot' and 'generic_kernel'. The former is to certify the entire boot.img, while the latter is to certify the kernel packed in the boot.img. It assumes all boot certificates are within the last 16K of the boot image, i.e., the boot signature block, before adding the AVB footer. It also adds a non-signed AVB hash footer, for device with AVB to use the output boot image directly if it is unlocked, where the verification error is allowed. An usage example: certify_bootimg --boot_img boot.img \ --algorithm SHA256_RSA4096 \ --key external/avb/test/data/testkey_rsa4096.pem \ --extra_args "--prop foo:bar" \ --extra_args "--prop gki:nice" \ --output boot-certified.img Bug: 223288963 Test: atest --host certify_bootimg_test Change-Id: Id03d9967b89d87f3d3e0ce08b886909c68fac18c
2022-03-01Remove 'generic_ramdisk' and add 'boot' certification am: 3e4ce8371dYi-Yo Chiang
Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1999090 Change-Id: I3ed5c238d0a86ea0e4c63d1275c29ee454a4cf62
2022-03-01Merge "Update retrofit_gki.sh for new init_boot plan" am: ac75382f8bTreehugger Robot
Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1976890 Change-Id: I90f0a8f2b500fea2991ad6694b74bb196faaeefc
2022-02-25Remove 'generic_ramdisk' and add 'boot' certificationYi-Yo Chiang
* Remove 'generic_ramdisk' certification since we are no longer certifying it in VTS. * Add 'boot' certification which certifies the entire boot.img. * 'generic_kernel' certification certifies the kernel.img. * Remove --boot_signature option. * Change Android T GKI to have fixed 16K boot_signature size, and must be appended at the end of the boot image, before appending the AVB footer. Bug: 211741246 Test: atest --host mkbootimg_test Test: atest --host retrofit_gki_test Test: ./boot_signature_info.sh boot-5.10.img Change-Id: Ibb9f9bb9fba6a82e4c913b8c23ce519816e96eeb
2022-02-17Merge "Update retrofit_gki.sh for new init_boot plan"Treehugger Robot
2022-02-11Empty merge of sc-v2-dev-plus-aosp-without-vendor@8084891Xin Li
Bug: 214455710 Merged-In: Iebcf0e826ae0f61a00e2ec522ceeb0e8a6ceb8e8 Change-Id: I5a6fbace443c2140a1fe614a5be1119f4f2ab5fc
2022-02-11Update retrofit_gki.sh for new init_boot planYi-Yo Chiang
Only GKI kernel, boot.img, need to be officially certified. Also remove V3 & V4 retrofit plan as the latest consensus is to support V2 only. Bug: 210367929 Test: retrofit_gki_test Change-Id: Ia1d81b3382fe62a39a028a933a1f4275977d8bbd
2022-01-27[LSC] Add LOCAL_LICENSE_KINDS to system/tools/mkbootimg am: 302cb50dc2Bob Badour
Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1963686 Change-Id: I06a41e7a4764816e7bd881e6a04d233f1af11da7
2022-01-27[LSC] Add LOCAL_LICENSE_KINDS to system/tools/mkbootimgandroid-t-preview-2_r0.4android-t-preview-2android-t-preview-1_r0.4android-t-preview-1android-t-beta-3android-s-v2-beta-3android-s-qpr3-beta-1android-t-preview-1android-s-v2-beta-3android-s-qpr3-beta-1android-gs-raviole-5.10-t-preview-2android-gs-raviole-5.10-t-preview-1Bob Badour
Added SPDX-license-identifier-Apache-2.0 to: gki/Android.bp Bug: 68860345 Bug: 151177513 Bug: 151953481 Test: m all Change-Id: I957d3faf553c8199d3468e0d1d07003c6d35c516
2022-01-26Add 'boot_signature_info' utility am: 41681b2656Yi-Yo Chiang
Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1960407 Change-Id: I68fbe5c21a88b1b3edb37d5218dd6248dc84b93b
2022-01-26Add 'boot_signature_info' utilityYi-Yo Chiang
Dumps the boot_signature info of a boot.img or init_boot.img. For debugging and development. Bug: 210367929 Test: manual Change-Id: Icb0a99708aacaf2784be65503b72c614481627a1
2022-01-24Add `gki_retrofitting_tools.zip` to GSI/GKI DIST_DIR am: 680c62a5d2Yi-Yo Chiang
Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1956320 Change-Id: I52b692e0f343bcd09c137e43525e6f48dc176cf5
2022-01-24Add 'retrofit_gki' tool that retrofits GKIs am: a37920c9beYi-Yo Chiang
Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1952245 Change-Id: I7a74da524a3c248a1ce781f76a466f6acb292b1a
2022-01-24Add `gki_retrofitting_tools.zip` to GSI/GKI DIST_DIRYi-Yo Chiang
For easy pickup from ci.android.com The zip archive would contain the `retrofit_gki` tool and its dependencies plus a README file. Bug: 210367929 Test: m dist && unzip out/dist/gki_retrofitting_tools.zip Change-Id: I2ffb457e8c09091e7aaf248b1e18f4c4d96e4492
2022-01-21Add 'retrofit_gki' tool that retrofits GKIsYi-Yo Chiang
Bug: 210367929 Test: cd system/tools/mkbootimg/gki && atest --host-unit-test-only Test: atest vts_gki_compliance_test Change-Id: I972f98ec1c1c94a5df843a94d931eaf7c583a1f8
2022-01-19unpack_bootimg: Export 'vendor_ramdisk' for vendor_boot v4 am: 33bf962400Yi-Yo Chiang
Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1952244 Change-Id: I71c6d560c1ed3a915cc3b9eb0f266148ec7c48f4
2022-01-18unpack_bootimg: Export 'vendor_ramdisk' for vendor_boot v4Yi-Yo Chiang
Which is the concatenation of all vendor ramdisks. Bug: 210367929 Test: manual Change-Id: Ieeaf8093fbca397b8f3c505006e02a1c8b89a071
2022-01-12Merge "Remove hridya@ from OWNERS file" am: 0b0493c73f am: f712139aaf am: ↵Treehugger Robot
d423092fec Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1940794 Change-Id: I68a47b2faf959e69cdfbaf340fb890a51e68bff2
2022-01-12Merge "Remove hridya@ from OWNERS file" am: 0b0493c73f am: f712139aafTreehugger Robot
Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1940794 Change-Id: I6e7668dd2b562b344b4a9d247ec7dc7acc4e2751
2022-01-12Merge "Remove hridya@ from OWNERS file" am: 0b0493c73fTreehugger Robot
Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1940794 Change-Id: I5e57574f9a6ee61ec8442d52bfd040afd7b1136c
2022-01-12Merge "Remove hridya@ from OWNERS file"Treehugger Robot
2022-01-11Merge "mkbootimg: Add '--boot_signature' and mark '--gki-*' as deprecated" ↵Yi-yo Chiang
am: 8bfa493d8e am: 3abe52d850 am: 14c7d4b133 Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1933195 Change-Id: Ie49166af9a3c4ada00faae8dfee98ad558058b44
2022-01-11Merge "mkbootimg: Add '--boot_signature' and mark '--gki-*' as deprecated" ↵Yi-yo Chiang
am: 8bfa493d8e am: 3abe52d850 Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1933195 Change-Id: I6ec9f5a3fd3133a442b231e6ed34208168f99a9a
2022-01-11Merge "mkbootimg: Add '--boot_signature' and mark '--gki-*' as deprecated" ↵Yi-yo Chiang
am: 8bfa493d8e Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1933195 Change-Id: I9102a4b3bb1b7b1dc69d4d15c0ad16bc47191117
2022-01-11Merge "mkbootimg: Add '--boot_signature' and mark '--gki-*' as deprecated"Yi-yo Chiang
2022-01-10generate_gki_certificate: Support supplying --additional_avb_args multiple ↵Yi-Yo Chiang
times am: 388052e43c am: 91252412ac am: 83f2cc9612 Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1941493 Change-Id: I53ac90fe350302833621de7310cbb9d343e9a4d3
2022-01-10generate_gki_certificate: Support supplying --additional_avb_args multiple ↵Yi-Yo Chiang
times am: 388052e43c am: 91252412ac Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1941493 Change-Id: I048a57d51c48cfe2bea504196c7cb22710b8c45c
2022-01-10generate_gki_certificate: Support supplying --additional_avb_args multiple ↵Yi-Yo Chiang
times am: 388052e43c Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1941493 Change-Id: Ie00c3389718ae31af33a3c2feb0d043fed5ae872
2022-01-08generate_gki_certificate: Support supplying --additional_avb_args multiple timesYi-Yo Chiang
They are concatenated and forwarded to avbtool. Bug: 211741246 Bug: 210367929 Test: atest --host mkbootimg_test Change-Id: Iebcf0e826ae0f61a00e2ec522ceeb0e8a6ceb8e8
2022-01-07Remove hridya@ from OWNERS fileHridya Valsaraju
Test: N/A Bug: N/A Change-Id: I4e47c58c3527049ad73fc0e15c4f98d57d05f95e
2022-01-03Add 'generate_gki_certificate' standalone tool to certify GKI am: 6ec5817b45 ↵Yi-Yo Chiang
am: c7d21760d2 am: 414d58ed95 Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1933194 Change-Id: I39e1722aca21d570db8752434f72769e9a95f706
2022-01-03Add 'generate_gki_certificate' standalone tool to certify GKI am: 6ec5817b45 ↵Yi-Yo Chiang
am: c7d21760d2 Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1933194 Change-Id: I9f02d070454ca931f2f07b7ffd37d1d192be56ca
2022-01-03Add 'generate_gki_certificate' standalone tool to certify GKI am: 6ec5817b45Yi-Yo Chiang
Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1933194 Change-Id: I20eac8d67c1d969b408505b43ec4cae88ad7442c
2021-12-30mkbootimg: Factor out GKI certification logic am: 743804f7ef am: 4112125878 ↵Yi-Yo Chiang
am: 073ed07638 Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1933193 Change-Id: Ib4382d1352354453b59aaf78711e462337965e10
2021-12-30mkbootimg: Factor out GKI certification logic am: 743804f7ef am: 4112125878Yi-Yo Chiang
Original change: https://android-review.googlesource.com/c/platform/system/tools/mkbootimg/+/1933193 Change-Id: Idfdd547183d60104f3410f8a2ed13dad9ad8b6b8
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-10 02:58:17 +0000