sunfish-admin
deaaf42caa
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
102 lines
3.3 KiB
Bash
Executable File
102 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Generate project Android + AVB signing keys on rom-dev01 only.
|
|
# Never run this to a path inside a Git working tree that gets committed.
|
|
set -euo pipefail
|
|
|
|
OUT="${ANDROID_CERTS_DIR:-}"
|
|
if [[ -z "$OUT" ]]; then
|
|
if [[ -d /srv/rom/secrets && -w /srv/rom/secrets ]]; then
|
|
OUT=/srv/rom/secrets/android-certs
|
|
else
|
|
# Lineage convention; /srv/rom/secrets is often root-owned (750, no group write).
|
|
OUT="${HOME}/.android-certs"
|
|
fi
|
|
fi
|
|
LINEAGE_TOP="${LINEAGE_TOP:-/srv/rom/src/lineage}"
|
|
MAKE_KEY="${LINEAGE_TOP}/development/tools/make_key"
|
|
|
|
# Distinct from AOSP testkey DN (android@android.com).
|
|
SUBJECT="${ANDROID_CERT_SUBJECT:-/C=DE/ST=NA/L=NA/O=AXP-Resurection/OU=sunfish-a16/CN=release}"
|
|
|
|
KEYS=(releasekey platform shared media networkstack sdk_sandbox bluetooth nfc)
|
|
|
|
if [[ ! -x "$MAKE_KEY" && ! -f "$MAKE_KEY" ]]; then
|
|
echo "ERROR: make_key not found at $MAKE_KEY" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$(id -u)" -eq 0 ]]; then
|
|
echo "ERROR: refuse to generate keys as root; run as android-build" >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "$OUT"
|
|
chmod 700 "$OUT"
|
|
|
|
existing=0
|
|
for k in "${KEYS[@]}"; do
|
|
if [[ -e "$OUT/$k.pk8" || -e "$OUT/$k.x509.pem" ]]; then
|
|
echo "EXISTS: $OUT/$k.*"
|
|
existing=1
|
|
fi
|
|
done
|
|
if [[ -e "$OUT/avb.pem" ]]; then
|
|
echo "EXISTS: $OUT/avb.pem"
|
|
existing=1
|
|
fi
|
|
if [[ "$existing" -eq 1 ]]; then
|
|
echo "ERROR: refusing to overwrite. Delete specifically if you truly mean to rotate." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "=== Generating APK/OTA keys in $OUT ==="
|
|
echo "subject=$SUBJECT"
|
|
for k in "${KEYS[@]}"; do
|
|
# make_key always exits 1 because of its EXIT trap — ignore status; check files.
|
|
# Blank password (Lineage/build-server norm); protect via directory mode 700.
|
|
printf '\n' | bash "$MAKE_KEY" "$OUT/$k" "$SUBJECT" || true
|
|
if [[ ! -f "$OUT/$k.pk8" || ! -f "$OUT/$k.x509.pem" ]]; then
|
|
echo "ERROR: failed to create $k" >&2
|
|
exit 1
|
|
fi
|
|
chmod 600 "$OUT/$k.pk8"
|
|
chmod 644 "$OUT/$k.x509.pem"
|
|
echo "OK $k"
|
|
done
|
|
|
|
echo "=== Generating AVB RSA-4096 key ==="
|
|
openssl genrsa -out "$OUT/avb.pem" 4096
|
|
chmod 600 "$OUT/avb.pem"
|
|
# Public key metadata for avbtool / optional custom key flash (not used for lock ship)
|
|
if [[ -x "$LINEAGE_TOP/external/avb/avbtool.py" ]]; then
|
|
python3 "$LINEAGE_TOP/external/avb/avbtool.py" extract_public_key \
|
|
--key "$OUT/avb.pem" --output "$OUT/avb_pkmd.bin"
|
|
chmod 644 "$OUT/avb_pkmd.bin"
|
|
elif command -v avbtool >/dev/null 2>&1; then
|
|
avbtool extract_public_key --key "$OUT/avb.pem" --output "$OUT/avb_pkmd.bin"
|
|
chmod 644 "$OUT/avb_pkmd.bin"
|
|
else
|
|
echo "WARN: avbtool not found; skipped avb_pkmd.bin (openssl key still OK)"
|
|
fi
|
|
|
|
{
|
|
echo "# generated $(date -Is) on $(hostname)"
|
|
echo "subject=$SUBJECT"
|
|
echo "dir=$OUT"
|
|
echo "keys=${KEYS[*]} avb.pem"
|
|
} >"$OUT/GENERATED.txt"
|
|
chmod 644 "$OUT/GENERATED.txt"
|
|
|
|
echo
|
|
echo "=== DONE ==="
|
|
echo "Public releasekey subject:"
|
|
openssl x509 -in "$OUT/releasekey.x509.pem" -noout -subject
|
|
echo
|
|
echo "NEXT (mandatory before first signed ship bacon):"
|
|
echo " 1. Encrypted offline backup of $OUT"
|
|
echo " 2. If keys are under \$HOME/.android-certs, have root install -d"
|
|
echo " /srv/rom/secrets/android-certs and move/copy there (preferred long-term)."
|
|
echo " 3. Record backup location/date in docs/009-hardening-signing-checklist.md"
|
|
echo " 4. US-S2: export PRODUCT_DEFAULT_DEV_CERTIFICATE=$OUT/releasekey"
|
|
echo " 5. Never copy .pk8 / avb.pem into Git"
|