platform_build/core/app_certificate_validate.mk


ifeq (true,$(non_system_module))
  ifneq (,$(filter $(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))%,$(LOCAL_CERTIFICATE)))
    CERTIFICATE_VIOLATION_MODULES += $(LOCAL_MODULE)
    ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT))
      $(if $(filter $(LOCAL_MODULE),$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST)),,\
        $(call pretty-error,The module in product partition cannot be signed with certificate in system.))
    endif
  endif
endif
Dump and enforce certificate for apks Dump the list of APKs that aren't located at system partition and signed with system certificate. And when enforcement option is enabled, it makes build error if there is the apk that satisfies the condition above. Bug: 74699609 Test: m -j Test: m out/target/product/$(get_build_var TARGET_DEVICE)/certificate_violation_modules.txt Change-Id: I23c41f2665dd97abac3e77d1c82d81ff91b894eb 2018-12-17 06:45:15 +01:00
Define non-system module as variable Define non_system_module in base_rules.mk when the module is product, vendor, product_services or proprietary module. Bug: 74699609 Test: m -j Change-Id: Iebdd3ec8c643be3d9877b7a96cbdd83465fa3878 2019-01-18 07:09:09 +01:00			`ifeq (true,$(non_system_module))`
Dump and enforce certificate for apks Dump the list of APKs that aren't located at system partition and signed with system certificate. And when enforcement option is enabled, it makes build error if there is the apk that satisfies the condition above. Bug: 74699609 Test: m -j Test: m out/target/product/$(get_build_var TARGET_DEVICE)/certificate_violation_modules.txt Change-Id: I23c41f2665dd97abac3e77d1c82d81ff91b894eb 2018-12-17 06:45:15 +01:00			`ifneq (,$(filter $(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))%,$(LOCAL_CERTIFICATE)))`
			`CERTIFICATE_VIOLATION_MODULES += $(LOCAL_MODULE)`
			`ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT))`
			`$(if $(filter $(LOCAL_MODULE),$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST)),,\`
			`$(call pretty-error,The module in product partition cannot be signed with certificate in system.))`
			`endif`
			`endif`
			`endif`