From 160762a27631c0f0429100225863cd66d72fb627 Mon Sep 17 00:00:00 2001 From: Kelvin Zhang Date: Tue, 17 Oct 2023 12:27:56 -0700 Subject: [PATCH] Use deterministic salt for AVB footer of prebuilt boot img When target specified a prebuilt boot.img, current build system will add avb hash footer to it with a random salt. Use a deterministic salt instead for more reproducible builds. To stay consistent with non-prebuilt boot.img code path, we extract the kernel image from prebuilt boot.img and uses sha256sum of kernel image as the salt. Test: th Bug: 293313353 Change-Id: I988999ddc4f18e0b8677b05a3165c847b6a11b52 --- core/Makefile | 6 +++++- core/config.mk | 1 + tools/releasetools/common.py | 10 +++++++++- 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/core/Makefile b/core/Makefile index 37dd0f6b4e..a190a3de50 100644 --- a/core/Makefile +++ b/core/Makefile @@ -1444,15 +1444,19 @@ INTERNAL_PREBUILT_BOOTIMAGE := $(BOARD_PREBUILT_BOOTIMAGE) INSTALLED_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/boot.img ifeq ($(BOARD_AVB_ENABLE),true) -$(INSTALLED_BOOTIMAGE_TARGET): $(INTERNAL_PREBUILT_BOOTIMAGE) $(AVBTOOL) $(BOARD_AVB_BOOT_KEY_PATH) +$(INSTALLED_BOOTIMAGE_TARGET): PRIVATE_WORKING_DIR := $(call intermediates-dir-for,PACKAGING,prebuilt_bootimg) +$(INSTALLED_BOOTIMAGE_TARGET): $(INTERNAL_PREBUILT_BOOTIMAGE) $(AVBTOOL) $(BOARD_AVB_BOOT_KEY_PATH) $(UNPACK_BOOTIMG) cp $(INTERNAL_PREBUILT_BOOTIMAGE) $@ + $(UNPACK_BOOTIMG) --boot_img $(INTERNAL_PREBUILT_BOOTIMAGE) --out $(PRIVATE_WORKING_DIR) chmod +w $@ $(AVBTOOL) add_hash_footer \ --image $@ \ + --salt `sha256sum $(PRIVATE_WORKING_DIR)/kernel | cut -d " " -f 1` \ $(call get-partition-size-argument,$(BOARD_BOOTIMAGE_PARTITION_SIZE)) \ --partition_name boot $(INTERNAL_AVB_BOOT_SIGNING_ARGS) \ $(BOARD_AVB_BOOT_ADD_HASH_FOOTER_ARGS) + $(call declare-container-license-metadata,$(INSTALLED_BOOTIMAGE_TARGET),SPDX-license-identifier-GPL-2.0-only SPDX-license-identifier-Apache-2.0,restricted notice,$(BUILD_SYSTEM)/LINUX_KERNEL_COPYING build/soong/licenses/LICENSE,"Boot Image",bool) $(call declare-container-license-deps,$(INSTALLED_BOOTIMAGE_TARGET),$(INTERNAL_PREBUILT_BOOTIMAGE),$(PRODUCT_OUT)/:/) diff --git a/core/config.mk b/core/config.mk index 196f07c0a3..c747fd5fb3 100644 --- a/core/config.mk +++ b/core/config.mk @@ -722,6 +722,7 @@ else BUILD_SUPER_IMAGE := $(BOARD_CUSTOM_BUILD_SUPER_IMAGE) endif IMG_FROM_TARGET_FILES := $(HOST_OUT_EXECUTABLES)/img_from_target_files$(HOST_EXECUTABLE_SUFFIX) +UNPACK_BOOTIMG := $(HOST_OUT_EXECUTABLES)/unpack_bootimg MAKE_RECOVERY_PATCH := $(HOST_OUT_EXECUTABLES)/make_recovery_patch$(HOST_EXECUTABLE_SUFFIX) OTA_FROM_TARGET_FILES := $(HOST_OUT_EXECUTABLES)/ota_from_target_files$(HOST_EXECUTABLE_SUFFIX) OTA_FROM_RAW_IMG := $(HOST_OUT_EXECUTABLES)/ota_from_raw_img$(HOST_EXECUTABLE_SUFFIX) diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py index 33eba7c432..843d8ca8d0 100644 --- a/tools/releasetools/common.py +++ b/tools/releasetools/common.py @@ -1947,7 +1947,15 @@ def _SignBootableImage(image_path, prebuilt_name, partition_name, cmd = [avbtool, "add_hash_footer", "--image", image_path, "--partition_size", str(part_size), "--partition_name", partition_name] - AppendAVBSigningArgs(cmd, partition_name) + # Use sha256 of the kernel as salt for reproducible builds + with tempfile.TemporaryDirectory() as tmpdir: + RunAndCheckOutput(["unpack_bootimg", "--boot_img", image_path, "--out", tmpdir]) + for filename in ["kernel", "ramdisk", "vendor_ramdisk00"]: + path = os.path.join(tmpdir, filename) + if os.path.exists(path) and os.path.getsize(path): + with open(path, "rb") as fp: + salt = sha256(fp.read()).hexdigest() + AppendAVBSigningArgs(cmd, partition_name, salt) args = info_dict.get("avb_" + partition_name + "_add_hash_footer_args") if args and args.strip(): split_args = ResolveAVBSigningPathArgs(shlex.split(args))