blob: c5349e546a979f8804eab259fc3a84650b9364ce (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
#!/bin/sh
#
# Copyright (C) 2016 Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# resigns your images with your keys and also generates keys for you
# puts everything in out/dist
# most information taken from here:
# https://source.android.com/devices/tech/ota/sign_builds.html
# final check if recovery has the right key:
# java -jar out/host/linux-x86/framework/dumpkey.jar vendor/replicant-security/releasekey.x509.pem
# in recovery: adb shell cat /res/keys
# both outputs should match
# also /system/etc/security/otacerts.zip should only contain your release key
set -e
BASEDIR=$(pwd)
KEY_DIR=$BASEDIR/vendor/replicant-security
TARGET_FILES=$BASEDIR/out/target/product/*/obj/PACKAGING/target_files_intermediates/*-target_files-*.zip
OUT_DIR=$BASEDIR/"out/dist"
RELEASE=replicant-6.0
generate_keys () {
# keys default values
KEY_C=AU
KEY_ST=Some-State
KEY_O="Internet Widgits Pty Ltd"
echo "No keys present. Generating them now."
echo
echo "You are about to be asked to enter information that will be incorporated"
echo "into your certificate requests."
echo "What you are about to enter is what is called a Distinguished Name or a DN."
echo "There are quite a few fields but you can leave some blank."
echo "For some fields there will be a default value."
read -p "Country Name (2 letter code) [AU]:" KEY_CN
read -p "State or Province Name (full name) [Some-State]:" KEY_ST
read -p "Locality Name (eg, city) []:" KEY_L
read -p "Organization Name (eg, company) [Internet Widgits Pty Ltd]:" KEY_O
read -p "Organizational Unit Name (eg, section) []:" KEY_OU
read -p "Common Name (e.g. your name) []:" KEY_CN
read -p "Email Address []:" KEY_EA
SUBJECT="/C=$KEY_C/ST=$KEY_ST/L=$KEY_L/O=$KEY_O/OU=$KEY_OU/CN=$KEY_CN \
/emailAddress=$KEY_EA"
mkdir $KEY_DIR
for x in releasekey platform shared media; do \
./development/tools/make_key $KEY_DIR/$x "$SUBJECT"; \
done
}
if ! [ -d "$KEY_DIR" ]
then
generate_keys
fi
if ! [ -f $TARGET_FILES ]
then
echo "You need to build before you can sign: make -j $(nproc) bacon"
exit 1
fi
mkdir -p $OUT_DIR
cp $TARGET_FILES $OUT_DIR/target_files_temp.zip
# remove recovery.img to make sure that it gets rebuild with the new keys
zip -d $OUT_DIR/target_files_temp.zip "BOOTABLE_IMAGES/recovery.img"
# -o option replaces the test keys with the created ones
python $BASEDIR/build/tools/releasetools/sign_target_files_apks \
-e FDroid.apk=$KEY_DIR/platform \
-o \
-d $KEY_DIR $OUT_DIR/target_files_temp.zip \
$OUT_DIR/signed-target_files.zip
python $BASEDIR/build/tools/releasetools/ota_from_target_files \
-k $KEY_DIR/releasekey \
$OUT_DIR/signed-target_files.zip \
$OUT_DIR/$RELEASE.zip
python $BASEDIR/build/tools/releasetools/img_from_target_files \
$OUT_DIR/signed-target_files.zip \
$OUT_DIR/signed-img.zip
# get the recovery from the signed-img.zip
unzip -o -j $OUT_DIR/signed-img.zip recovery.img -d $OUT_DIR
|
