tree 46325d1bbcfdae1a4a73c91fbdf7bef9abef28d5
parent 95809764cdb695b61880be0acd601f3c327b8207
author Bowgo Tsai <bowgotsai@google.com> 1645889194 +0800
committer Bowgo Tsai <bowgotsai@google.com> 1646743961 +0800

Initial commit of certify_bootimg.py

Adding a new script, certify_bootimg.py, to add boot
certificates for a given boot image. The script adds
two certificates: 'boot' and 'generic_kernel'. The former
is to certify the entire boot.img, while the latter
is to certify the kernel packed in the boot.img.

It assumes all boot certificates are within the last 16K
of the boot image, i.e., the boot signature block, before
adding the AVB footer.

It also adds a non-signed AVB hash footer, for device with
AVB to use the output boot image directly if it is unlocked,
where the verification error is allowed.

An usage example:
    certify_bootimg --boot_img boot.img \
	--algorithm SHA256_RSA4096 \
	--key external/avb/test/data/testkey_rsa4096.pem \
	--extra_args "--prop foo:bar" \
	--extra_args "--prop gki:nice" \
        --output boot-certified.img

Bug: 223288963
Test: atest --host certify_bootimg_test
Change-Id: Id03d9967b89d87f3d3e0ce08b886909c68fac18c