009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
2026-10-05 10:42:00 +02:00
1 parent fd793b9471
commit deaaf42caa
@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+# Generate project Android + AVB signing keys on rom-dev01 only.
+# Never run this to a path inside a Git working tree that gets committed.
+set -euo pipefail
+
+OUT="${ANDROID_CERTS_DIR:-}"
+if [[ -z "$OUT" ]]; then
+  if [[ -d /srv/rom/secrets && -w /srv/rom/secrets ]]; then
+    OUT=/srv/rom/secrets/android-certs
+  else
+    # Lineage convention; /srv/rom/secrets is often root-owned (750, no group write).
+    OUT="${HOME}/.android-certs"
+  fi
+fi
+LINEAGE_TOP="${LINEAGE_TOP:-/srv/rom/src/lineage}"
+MAKE_KEY="${LINEAGE_TOP}/development/tools/make_key"
+
+# Distinct from AOSP testkey DN (android@android.com).
+SUBJECT="${ANDROID_CERT_SUBJECT:-/C=DE/ST=NA/L=NA/O=AXP-Resurection/OU=sunfish-a16/CN=release}"
+
+KEYS=(releasekey platform shared media networkstack sdk_sandbox bluetooth nfc)
+
+if [[ ! -x "$MAKE_KEY" && ! -f "$MAKE_KEY" ]]; then
+  echo "ERROR: make_key not found at $MAKE_KEY" >&2
+  exit 1
+fi
+
+if [[ "$(id -u)" -eq 0 ]]; then
+  echo "ERROR: refuse to generate keys as root; run as android-build" >&2
+  exit 1
+fi
+
+mkdir -p "$OUT"
+chmod 700 "$OUT"
+
+existing=0
+for k in "${KEYS[@]}"; do
+  if [[ -e "$OUT/$k.pk8" || -e "$OUT/$k.x509.pem" ]]; then
+    echo "EXISTS: $OUT/$k.*"
+    existing=1
+  fi
+done
+if [[ -e "$OUT/avb.pem" ]]; then
+  echo "EXISTS: $OUT/avb.pem"
+  existing=1
+fi
+if [[ "$existing" -eq 1 ]]; then
+  echo "ERROR: refusing to overwrite. Delete specifically if you truly mean to rotate." >&2
+  exit 1
+fi
+
+echo "=== Generating APK/OTA keys in $OUT ==="
+echo "subject=$SUBJECT"
+for k in "${KEYS[@]}"; do
+  # make_key always exits 1 because of its EXIT trap — ignore status; check files.
+  # Blank password (Lineage/build-server norm); protect via directory mode 700.
+  printf '\n' | bash "$MAKE_KEY" "$OUT/$k" "$SUBJECT" || true
+  if [[ ! -f "$OUT/$k.pk8" || ! -f "$OUT/$k.x509.pem" ]]; then
+    echo "ERROR: failed to create $k" >&2
+    exit 1
+  fi
+  chmod 600 "$OUT/$k.pk8"
+  chmod 644 "$OUT/$k.x509.pem"
+  echo "OK $k"
+done
+
+echo "=== Generating AVB RSA-4096 key ==="
+openssl genrsa -out "$OUT/avb.pem" 4096
+chmod 600 "$OUT/avb.pem"
+# Public key metadata for avbtool / optional custom key flash (not used for lock ship)
+if [[ -x "$LINEAGE_TOP/external/avb/avbtool.py" ]]; then
+  python3 "$LINEAGE_TOP/external/avb/avbtool.py" extract_public_key \
+    --key "$OUT/avb.pem" --output "$OUT/avb_pkmd.bin"
+  chmod 644 "$OUT/avb_pkmd.bin"
+elif command -v avbtool >/dev/null 2>&1; then
+  avbtool extract_public_key --key "$OUT/avb.pem" --output "$OUT/avb_pkmd.bin"
+  chmod 644 "$OUT/avb_pkmd.bin"
+else
+  echo "WARN: avbtool not found; skipped avb_pkmd.bin (openssl key still OK)"
+fi
+
+{
+  echo "# generated $(date -Is) on $(hostname)"
+  echo "subject=$SUBJECT"
+  echo "dir=$OUT"
+  echo "keys=${KEYS[*]} avb.pem"
+} >"$OUT/GENERATED.txt"
+chmod 644 "$OUT/GENERATED.txt"
+
+echo
+echo "=== DONE ==="
+echo "Public releasekey subject:"
+openssl x509 -in "$OUT/releasekey.x509.pem" -noout -subject
+echo
+echo "NEXT (mandatory before first signed ship bacon):"
+echo "  1. Encrypted offline backup of $OUT"
+echo "  2. If keys are under \$HOME/.android-certs, have root install -d"
+echo "     /srv/rom/secrets/android-certs and move/copy there (preferred long-term)."
+echo "  3. Record backup location/date in docs/009-hardening-signing-checklist.md"
+echo "  4. US-S2: export PRODUCT_DEFAULT_DEV_CERTIFICATE=$OUT/releasekey"
+echo "  5. Never copy .pk8 / avb.pem into Git"