sunfish-adminandCursor
3f941e8451
Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path, and adds deblob appliers plus tests; docs capture Swissquote fix and parity. Co-authored-by: Cursor <cursoragent@cursor.com>
23 lines
1.2 KiB
Makefile
23 lines
1.2 KiB
Makefile
# US-S2 — project release keys (Gate G).
|
|
# Soong requires paths inside ANDROID_BUILD_TOP (absolute $HOME/.android-certs panics).
|
|
# Host: copy keys into vendor/sunfish-a16/certs/ (gitignored). See docs/009-hardening-signing-checklist.md
|
|
# apply_009_axp_identity.py copies them to vendor/lineage-priv/keys, the only
|
|
# path for which build/make/core/config.mk sets BUILD_KEYS := release-keys.
|
|
|
|
_AXP_CERT_DIR := vendor/sunfish-a16/certs
|
|
ifneq ($(wildcard vendor/lineage-priv/keys/releasekey.pk8),)
|
|
_AXP_CERT_DIR := vendor/lineage-priv/keys
|
|
endif
|
|
|
|
ifneq ($(wildcard $(_AXP_CERT_DIR)/releasekey.pk8),)
|
|
PRODUCT_DEFAULT_DEV_CERTIFICATE := $(_AXP_CERT_DIR)/releasekey
|
|
PRODUCT_OTA_PUBLIC_KEYS := $(_AXP_CERT_DIR)/releasekey.x509.pem
|
|
# Without this, non-Google BT apex keeps AOSP security/bluetooth.x509.pem in
|
|
# plat_mac_permissions while apps sign with $(_AXP_CERT_DIR)/bluetooth →
|
|
# seinfo=default → zygote setcontext fails → Bluetooth crash loop (LAB 2026-10-02).
|
|
PRODUCT_MAINLINE_BLUETOOTH_SEPOLICY_DEV_CERTIFICATES := $(_AXP_CERT_DIR)
|
|
endif
|
|
|
|
# Host setup: also symlink certs/testkey.{pk8,x509.pem} -> releasekey.*
|
|
# (system/sepolicy keys.conf @RELEASE still references testkey.x509.pem in this dir).
|