sunfish-admin
deaaf42caa
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
18 lines
952 B
Makefile
18 lines
952 B
Makefile
# US-S2 — project release keys (Gate G).
|
|
# Soong requires paths inside ANDROID_BUILD_TOP (absolute $HOME/.android-certs panics).
|
|
# Host: copy keys into vendor/sunfish-a16/certs/ (gitignored). See docs/009-hardening-signing-checklist.md
|
|
|
|
_AXP_CERT_DIR := vendor/sunfish-a16/certs
|
|
|
|
ifneq ($(wildcard $(_AXP_CERT_DIR)/releasekey.pk8),)
|
|
PRODUCT_DEFAULT_DEV_CERTIFICATE := $(_AXP_CERT_DIR)/releasekey
|
|
PRODUCT_OTA_PUBLIC_KEYS := $(_AXP_CERT_DIR)/releasekey.x509.pem
|
|
# Without this, non-Google BT apex keeps AOSP security/bluetooth.x509.pem in
|
|
# plat_mac_permissions while apps sign with $(_AXP_CERT_DIR)/bluetooth →
|
|
# seinfo=default → zygote setcontext fails → Bluetooth crash loop (LAB 2026-10-02).
|
|
PRODUCT_MAINLINE_BLUETOOTH_SEPOLICY_DEV_CERTIFICATES := $(_AXP_CERT_DIR)
|
|
endif
|
|
|
|
# Host setup: also symlink certs/testkey.{pk8,x509.pem} -> releasekey.*
|
|
# (system/sepolicy keys.conf @RELEASE still references testkey.x509.pem in this dir).
|