# US-S2 — project release keys (Gate G).
# Soong requires paths inside ANDROID_BUILD_TOP (absolute $HOME/.android-certs panics).
# Host: copy keys into vendor/sunfish-a16/certs/ (gitignored). See docs/009-hardening-signing-checklist.md
# apply_009_axp_identity.py copies them to vendor/lineage-priv/keys, the only
# path for which build/make/core/config.mk sets BUILD_KEYS := release-keys.

_AXP_CERT_DIR := vendor/sunfish-a16/certs
ifneq ($(wildcard vendor/lineage-priv/keys/releasekey.pk8),)
  _AXP_CERT_DIR := vendor/lineage-priv/keys
endif

ifneq ($(wildcard $(_AXP_CERT_DIR)/releasekey.pk8),)
  PRODUCT_DEFAULT_DEV_CERTIFICATE := $(_AXP_CERT_DIR)/releasekey
  PRODUCT_OTA_PUBLIC_KEYS := $(_AXP_CERT_DIR)/releasekey.x509.pem
  # Without this, non-Google BT apex keeps AOSP security/bluetooth.x509.pem in
  # plat_mac_permissions while apps sign with $(_AXP_CERT_DIR)/bluetooth →
  # seinfo=default → zygote setcontext fails → Bluetooth crash loop (LAB 2026-10-02).
  PRODUCT_MAINLINE_BLUETOOTH_SEPOLICY_DEV_CERTIFICATES := $(_AXP_CERT_DIR)
endif

# Host setup: also symlink certs/testkey.{pk8,x509.pem} -> releasekey.*
# (system/sepolicy keys.conf @RELEASE still references testkey.x509.pem in this dir).