88a759d651
Some apex payload images contain apk files. And these apks need to be signed during the signing processed when sign_target_files_apks is called. To support the signing, we can extract the payload and repack the apex file with the (de)apexer tool. Add the signing support in the apex_util. Bug: 146508800 Test: unit tests pass, run sign_apex, sign_target_files_apks Change-Id: If6d58975248709a144b07dbabf47c27916e5695e
134 lines
3.7 KiB
Python
Executable file
134 lines
3.7 KiB
Python
Executable file
#!/usr/bin/env python
|
|
#
|
|
# Copyright (C) 2019 The Android Open Source Project
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
"""
|
|
Signs a standalone APEX file.
|
|
|
|
Usage: sign_apex [flags] input_apex_file output_apex_file
|
|
|
|
--avbtool <avbtool>
|
|
Optional flag that specifies the AVB tool to use. Defaults to `avbtool`.
|
|
|
|
--container_key <key>
|
|
Mandatory flag that specifies the container signing key.
|
|
|
|
--payload_key <key>
|
|
Mandatory flag that specifies the payload signing key.
|
|
|
|
--payload_extra_args <args>
|
|
Optional flag that specifies any extra args to be passed to payload signer
|
|
(e.g. --payload_extra_args="--signing_helper_with_files /path/to/helper").
|
|
|
|
-e (--extra_apks) <name,name,...=key>
|
|
Add extra APK name/key pairs. This is useful to sign the apk files in the
|
|
apex payload image.
|
|
"""
|
|
|
|
import logging
|
|
import shutil
|
|
import sys
|
|
|
|
import apex_utils
|
|
import common
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
def SignApexFile(avbtool, apex_file, payload_key, container_key, no_hashtree,
|
|
apk_keys=None, signing_args=None):
|
|
"""Signs the given apex file."""
|
|
with open(apex_file, 'rb') as input_fp:
|
|
apex_data = input_fp.read()
|
|
|
|
return apex_utils.SignApex(
|
|
avbtool,
|
|
apex_data,
|
|
payload_key=payload_key,
|
|
container_key=container_key,
|
|
container_pw=None,
|
|
codename_to_api_level_map=None,
|
|
no_hashtree=no_hashtree,
|
|
apk_keys=apk_keys,
|
|
signing_args=signing_args)
|
|
|
|
|
|
def main(argv):
|
|
|
|
options = {}
|
|
|
|
def option_handler(o, a):
|
|
if o == '--avbtool':
|
|
options['avbtool'] = a
|
|
elif o == '--container_key':
|
|
# Strip the suffix if any, as common.SignFile expects no suffix.
|
|
DEFAULT_CONTAINER_KEY_SUFFIX = '.x509.pem'
|
|
if a.endswith(DEFAULT_CONTAINER_KEY_SUFFIX):
|
|
a = a[:-len(DEFAULT_CONTAINER_KEY_SUFFIX)]
|
|
options['container_key'] = a
|
|
elif o == '--payload_key':
|
|
options['payload_key'] = a
|
|
elif o == '--payload_extra_args':
|
|
options['payload_extra_args'] = a
|
|
elif o in ("-e", "--extra_apks"):
|
|
names, key = a.split("=")
|
|
names = names.split(",")
|
|
for n in names:
|
|
if 'extra_apks' not in options:
|
|
options['extra_apks'] = {}
|
|
options['extra_apks'].update({n: key})
|
|
else:
|
|
return False
|
|
return True
|
|
|
|
args = common.ParseOptions(
|
|
argv, __doc__,
|
|
extra_opts='e:',
|
|
extra_long_opts=[
|
|
'avbtool=',
|
|
'container_key=',
|
|
'payload_extra_args=',
|
|
'payload_key=',
|
|
'extra_apks=',
|
|
],
|
|
extra_option_handler=option_handler)
|
|
|
|
if (len(args) != 2 or 'container_key' not in options or
|
|
'payload_key' not in options):
|
|
common.Usage(__doc__)
|
|
sys.exit(1)
|
|
|
|
common.InitLogging()
|
|
|
|
signed_apex = SignApexFile(
|
|
options.get('avbtool', 'avbtool'),
|
|
args[0],
|
|
options['payload_key'],
|
|
options['container_key'],
|
|
no_hashtree=False,
|
|
apk_keys=options.get('extra_apks', {}),
|
|
signing_args=options.get('payload_extra_args'))
|
|
shutil.copyfile(signed_apex, args[1])
|
|
logger.info("done.")
|
|
|
|
|
|
if __name__ == '__main__':
|
|
try:
|
|
main(sys.argv[1:])
|
|
except common.ExternalError:
|
|
logger.exception("\n ERROR:\n")
|
|
sys.exit(1)
|
|
finally:
|
|
common.Cleanup()
|