| commit | f8bc938a1231a8037075deb2cd7e75ec7ae8b7f1 | [log] [tgz] |
|---|---|---|
| author | Raul E Rangel <rrangel@google.com> | Tue Sep 02 16:48:53 2025 -0600 |
| committer | Raul Rangel <rrangel@google.com> | Fri Sep 05 13:42:11 2025 -0700 |
| tree | ff29bd5ddffc0161e0796de0aa10c2a1c846442a | |
| parent | 7b859472ba1cd50cb4c7abcc77381a2dae750433 [diff] |
desktop: Replace unsigned FW with presigned FW during signing
The Android signer doesn't poses the ability to sign desktop AP/EC
firmware. To workaround this we commit pre-signed firmware into the
`<product>-prebuilts/firmware/{dev,premp}-signed` directories.
The `desktop-firmware-zip-signed` target will be generating a `zip` file
with the signed firmware. This firmware should only ever be used with a
signed OS image. We never want to mix unsigned firmware with a signed OS
since it won't boot, or vice versa.
When a desktop build is built, it generates a
`android-desktop_image.bin`. This file is "unsigned" since the builders
don't have access to real keys. For this reason we cant just swap out
the firmware during the build.
This change solves the issue by adding the signed firmware into the
`target_files.zip`. The `sign_target_files_apks.py` (which is only
called by the signer after the builder has completed) then swaps out the
unsigned firmware with the signed firmware. This solves the OTA case
where we bundle the signed firmware with the signed OS.
Bug: 435006163
Flag: EXEMPT desktop only change
Test: m target-files-package
Test: ./out/host/linux-x86/bin/sign_target_files_apks out/target/product/brya/obj/PACKAGING/target_files_intermediates/brya-target_files.zip ~/tmp/signed-target_files.zip
Change-Id: Ic1bf77da520b328f827e580c860ee998ca4a5c18
This is the Makefile-based portion of the Android Build System.
For documentation on how to run a build, see Usage.txt
For a list of behavioral changes useful for Android.mk writers see Changes.md
For an outdated reference on Android.mk files, see build-system.html. Our Android.mk files look similar, but are entirely different from the Android.mk files used by the NDK build system. When searching for documentation elsewhere, ensure that it is for the platform build system -- most are not.
This Makefile-based system is in the process of being replaced with Soong, a new build system written in Go. During the transition, all of these makefiles are read by Kati, and generate a ninja file instead of being executed directly. That's combined with a ninja file read by Soong so that the build graph of the two systems can be combined and run as one.