desktop: Replace unsigned FW with presigned FW during signing
The Android signer doesn't poses the ability to sign desktop AP/EC
firmware. To workaround this we commit pre-signed firmware into the
`<product>-prebuilts/firmware/{dev,premp}-signed` directories.
The `desktop-firmware-zip-signed` target will be generating a `zip` file
with the signed firmware. This firmware should only ever be used with a
signed OS image. We never want to mix unsigned firmware with a signed OS
since it won't boot, or vice versa.
When a desktop build is built, it generates a
`android-desktop_image.bin`. This file is "unsigned" since the builders
don't have access to real keys. For this reason we cant just swap out
the firmware during the build.
This change solves the issue by adding the signed firmware into the
`target_files.zip`. The `sign_target_files_apks.py` (which is only
called by the signer after the builder has completed) then swaps out the
unsigned firmware with the signed firmware. This solves the OTA case
where we bundle the signed firmware with the signed OS.
Bug: 435006163
Flag: EXEMPT desktop only change
Test: m target-files-package
Test: ./out/host/linux-x86/bin/sign_target_files_apks out/target/product/brya/obj/PACKAGING/target_files_intermediates/brya-target_files.zip ~/tmp/signed-target_files.zip
Change-Id: Ic1bf77da520b328f827e580c860ee998ca4a5c18
diff --git a/core/Makefile b/core/Makefile
index 46cca92..09d4098 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -6575,6 +6575,14 @@
droidcore-unbundled: $(INSTALLED_BOOTLOADER_MODULE)
endif
+# Add a dependency for the signed desktop firmware. We need it included in the
+# target_files.zip so that the unsigned firmware can be swapped with the signed
+# firmware when the target files are signed.
+DESKTOP_SIGNED_FW_ZIP := $(call module-built-files,desktop-firmware-zip-signed)
+ifneq ($(DESKTOP_SIGNED_FW_ZIP),)
+ $(BUILT_TARGET_FILES_DIR): $(DESKTOP_SIGNED_FW_ZIP)
+endif
+
# Depending on the various images guarantees that the underlying
# directories are up-to-date.
$(BUILT_TARGET_FILES_DIR): \
@@ -6969,6 +6977,10 @@
$(hide) mkdir -p $(zip_root)/PVMFW
$(hide) cp $(INSTALLED_PVMFW_BINARY_TARGET) $(zip_root)/PVMFW/
endif
+ifneq ($(DESKTOP_SIGNED_FW_ZIP),)
+ $(hide) mkdir -p $(zip_root)/SIGNED_PREBUILTS
+ $(hide) cp $(DESKTOP_SIGNED_FW_ZIP) $(zip_root)/SIGNED_PREBUILTS/ap-ec-fw-signed.zip
+endif
ifdef BOARD_PREBUILT_BOOTLOADER
$(hide) mkdir -p $(zip_root)/IMAGES
$(hide) cp $(INSTALLED_BOOTLOADER_MODULE) $(zip_root)/IMAGES/