tag feac9fbe53fbd0cf89c9136e39156bf90baf3638
tagger The Android Open Source Project <initial-contribution@android.com> Tue Apr 26 10:50:35 2022 -0700
object 34ac1ae663fc8f553b2a96ee08b66c97ab2290c8

Android t beta 1 release 0.4

commit 34ac1ae663fc8f553b2a96ee08b66c97ab2290c8
author Bowgo Tsai <bowgotsai@google.com> Sat Feb 26 23:26:34 2022 +0800
committer Bowgo Tsai <bowgotsai@google.com> Tue Mar 08 20:52:41 2022 +0800
tree 46325d1bbcfdae1a4a73c91fbdf7bef9abef28d5
parent 95809764cdb695b61880be0acd601f3c327b8207

Initial commit of certify_bootimg.py

Adding a new script, certify_bootimg.py, to add boot
certificates for a given boot image. The script adds
two certificates: 'boot' and 'generic_kernel'. The former
is to certify the entire boot.img, while the latter
is to certify the kernel packed in the boot.img.

It assumes all boot certificates are within the last 16K
of the boot image, i.e., the boot signature block, before
adding the AVB footer.

It also adds a non-signed AVB hash footer, for device with
AVB to use the output boot image directly if it is unlocked,
where the verification error is allowed.

An usage example:
    certify_bootimg --boot_img boot.img \
	--algorithm SHA256_RSA4096 \
	--key external/avb/test/data/testkey_rsa4096.pem \
	--extra_args "--prop foo:bar" \
	--extra_args "--prop gki:nice" \
        --output boot-certified.img

Bug: 223288963
Test: atest --host certify_bootimg_test
Change-Id: Id03d9967b89d87f3d3e0ce08b886909c68fac18c