StrixOS/build
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "OTA Tools: Handle password encrypted keys"

Browse Source
This commit is contained in:
Tao Bao
2017-05-11 19:28:05 +00:00
committed by Gerrit Code Review
parent 57273013cf f63e2cd47b
commit 4e1c113554
1 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
tools/releasetools/ota_from_target_files.py
View File

@@ -181,14 +181,14 @@ OPTIONS.log_diff = None
OPTIONS.payload_signer = None OPTIONS.payload_signer = None
OPTIONS.payload_signer_args = [] OPTIONS.payload_signer_args = []
OPTIONS.extracted_input = None OPTIONS.extracted_input = None
OPTIONS.key_passwords = []
METADATA_NAME = 'META-INF/com/android/metadata' METADATA_NAME = 'META-INF/com/android/metadata'
UNZIP_PATTERN = ['IMAGES/*', 'META/*'] UNZIP_PATTERN = ['IMAGES/*', 'META/*']
def SignOutput(temp_zip_name, output_zip_name): def SignOutput(temp_zip_name, output_zip_name):
key_passwords = common.GetKeyPasswords([OPTIONS.package_key]) pw = OPTIONS.key_passwords[OPTIONS.package_key]
pw = key_passwords[OPTIONS.package_key]
common.SignFile(temp_zip_name, output_zip_name, OPTIONS.package_key, pw, common.SignFile(temp_zip_name, output_zip_name, OPTIONS.package_key, pw,
whole_file=True) whole_file=True)
@@ -1021,21 +1021,17 @@ def WriteABOTAPackageWithBrilloScript(target_file, output_file,
# The place where the output from the subprocess should go. # The place where the output from the subprocess should go.
log_file = sys.stdout if OPTIONS.verbose else subprocess.PIPE log_file = sys.stdout if OPTIONS.verbose else subprocess.PIPE
# Setup signing keys.
if OPTIONS.package_key is None:
OPTIONS.package_key = OPTIONS.info_dict.get(
"default_system_dev_certificate",
"build/target/product/security/testkey")
# A/B updater expects a signing key in RSA format. Gets the key ready for # A/B updater expects a signing key in RSA format. Gets the key ready for
# later use in step 3, unless a payload_signer has been specified. # later use in step 3, unless a payload_signer has been specified.
if OPTIONS.payload_signer is None: if OPTIONS.payload_signer is None:
cmd = ["openssl", "pkcs8", cmd = ["openssl", "pkcs8",
"-in", OPTIONS.package_key + OPTIONS.private_key_suffix, "-in", OPTIONS.package_key + OPTIONS.private_key_suffix,
"-inform", "DER", "-nocrypt"] "-inform", "DER"]
pw = OPTIONS.key_passwords[OPTIONS.package_key]
cmd.extend(["-passin", "pass:" + pw] if pw else ["-nocrypt"])
rsa_key = common.MakeTempFile(prefix="key-", suffix=".key") rsa_key = common.MakeTempFile(prefix="key-", suffix=".key")
cmd.extend(["-out", rsa_key]) cmd.extend(["-out", rsa_key])
p1 = common.Run(cmd, stdout=log_file, stderr=subprocess.STDOUT) p1 = common.Run(cmd, verbose=False, stdout=log_file, stderr=subprocess.STDOUT)
p1.communicate() p1.communicate()
assert p1.returncode == 0, "openssl pkcs8 failed" assert p1.returncode == 0, "openssl pkcs8 failed"
@@ -1383,6 +1379,17 @@ def main(argv):
ab_update = OPTIONS.info_dict.get("ab_update") == "true" ab_update = OPTIONS.info_dict.get("ab_update") == "true"
# Use the default key to sign the package if not specified with package_key.
# package_keys are needed on ab_updates, so always define them if an
# ab_update is getting created.
if not OPTIONS.no_signing or ab_update:
if OPTIONS.package_key is None:
OPTIONS.package_key = OPTIONS.info_dict.get(
"default_system_dev_certificate",
"build/target/product/security/testkey")
# Get signing keys
OPTIONS.key_passwords = common.GetKeyPasswords([OPTIONS.package_key])
if ab_update: if ab_update:
if OPTIONS.incremental_source is not None: if OPTIONS.incremental_source is not None:
OPTIONS.target_info_dict = OPTIONS.info_dict OPTIONS.target_info_dict = OPTIONS.info_dict
@@ -1448,13 +1455,6 @@ def main(argv):
raise common.ExternalError( raise common.ExternalError(
"--- target build has specified no recovery ---") "--- target build has specified no recovery ---")
# Use the default key to sign the package if not specified with package_key.
if not OPTIONS.no_signing:
if OPTIONS.package_key is None:
OPTIONS.package_key = OPTIONS.info_dict.get(
"default_system_dev_certificate",
"build/target/product/security/testkey")
# Set up the output zip. Create a temporary zip file if signing is needed. # Set up the output zip. Create a temporary zip file if signing is needed.
if OPTIONS.no_signing: if OPTIONS.no_signing:
if os.path.exists(args[1]): if os.path.exists(args[1]):