From 5faa489f93e4eccf8bee8aea7271098dc18caa4b Mon Sep 17 00:00:00 2001
From: Jooyung Han <jooyung@google.com>
Date: Fri, 18 Aug 2023 17:25:47 +0900
Subject: [PATCH] Put authsecret example in VAPEX

authsecret example instance is put in APEX.

Bug: 296522705
Test: authsecret HAL starts from APEX in cuttlefish/goldfish
Change-Id: I226fd57fb1ec5c8da98c07292431df055e6078d7
---
 authsecret/aidl/default/Android.bp            |  50 ++++++++++++++++-
 ...oid.hardware.authsecret-service.example.rc |   2 +-
 .../com.android.hardware.authsecret.avbpubkey | Bin 0 -> 1032 bytes
 .../com.android.hardware.authsecret.pem       |  52 ++++++++++++++++++
 .../com.android.hardware.authsecret.pk8       | Bin 0 -> 2374 bytes
 .../com.android.hardware.authsecret.x509.pem  |  34 ++++++++++++
 authsecret/aidl/default/file_contexts         |   3 +
 authsecret/aidl/default/manifest.json         |   4 ++
 .../compatibility_matrix.9.xml                |   2 +-
 9 files changed, 142 insertions(+), 5 deletions(-)
 create mode 100644 authsecret/aidl/default/com.android.hardware.authsecret.avbpubkey
 create mode 100644 authsecret/aidl/default/com.android.hardware.authsecret.pem
 create mode 100644 authsecret/aidl/default/com.android.hardware.authsecret.pk8
 create mode 100644 authsecret/aidl/default/com.android.hardware.authsecret.x509.pem
 create mode 100644 authsecret/aidl/default/file_contexts
 create mode 100644 authsecret/aidl/default/manifest.json

diff --git a/authsecret/aidl/default/Android.bp b/authsecret/aidl/default/Android.bp
index 7ce83fd9ea..7e6e48b572 100644
--- a/authsecret/aidl/default/Android.bp
+++ b/authsecret/aidl/default/Android.bp
@@ -26,16 +26,60 @@ package {
 cc_binary {
     name: "android.hardware.authsecret-service.example",
     relative_install_path: "hw",
-    init_rc: ["android.hardware.authsecret-service.example.rc"],
-    vintf_fragments: ["android.hardware.authsecret-service.example.xml"],
     vendor: true,
     srcs: [
         "service.cpp",
         "AuthSecret.cpp",
     ],
     shared_libs: [
+        "libbinder_ndk",
+        "liblog",
+    ],
+    static_libs: [
         "android.hardware.authsecret-V1-ndk",
         "libbase",
-        "libbinder_ndk",
+    ],
+    stl: "c++_static",
+}
+
+prebuilt_etc {
+    name: "android.hardware.authsecret-service.example.rc",
+    src: "android.hardware.authsecret-service.example.rc",
+    installable: false,
+}
+
+prebuilt_etc {
+    name: "android.hardware.authsecret-service.example.xml",
+    src: "android.hardware.authsecret-service.example.xml",
+    sub_dir: "vintf",
+    installable: false,
+}
+
+apex_key {
+    name: "com.android.hardware.authsecret.key",
+    public_key: "com.android.hardware.authsecret.avbpubkey",
+    private_key: "com.android.hardware.authsecret.pem",
+}
+
+android_app_certificate {
+    name: "com.android.hardware.authsecret.certificate",
+    certificate: "com.android.hardware.authsecret",
+}
+
+apex {
+    name: "com.android.hardware.authsecret",
+    manifest: "manifest.json",
+    file_contexts: "file_contexts",
+    key: "com.android.hardware.authsecret.key",
+    certificate: ":com.android.hardware.authsecret.certificate",
+    updatable: false,
+    vendor: true,
+
+    binaries: [
+        "android.hardware.authsecret-service.example",
+    ],
+    prebuilts: [
+        "android.hardware.authsecret-service.example.rc", // init_rc
+        "android.hardware.authsecret-service.example.xml", // vintf_fragments
     ],
 }
diff --git a/authsecret/aidl/default/android.hardware.authsecret-service.example.rc b/authsecret/aidl/default/android.hardware.authsecret-service.example.rc
index fef6e2401e..9f51837575 100644
--- a/authsecret/aidl/default/android.hardware.authsecret-service.example.rc
+++ b/authsecret/aidl/default/android.hardware.authsecret-service.example.rc
@@ -1,4 +1,4 @@
-service vendor.authsecret_default /vendor/bin/hw/android.hardware.authsecret-service.example
+service vendor.authsecret_default /apex/com.android.hardware.authsecret/bin/hw/android.hardware.authsecret-service.example
     class hal
     user hsm
     group hsm
diff --git a/authsecret/aidl/default/com.android.hardware.authsecret.avbpubkey b/authsecret/aidl/default/com.android.hardware.authsecret.avbpubkey
new file mode 100644
index 0000000000000000000000000000000000000000..2fb5f0b61ad11acd971c3a5d8af2e374fbf8a070
GIT binary patch
literal 1032
zcmV+j1o!&@01yC0Se6~6lDbvpD_+2=x*X~t(1{xb5G}YUQ?Urd*CZI}RmJ`P&{@rk
z)9<N!L(?}qiY1$>4^C}>wgJY$WkDj$DupK+L@b3-@f5J7vp|re`=)~^GIt!6HEvu@
z(8F$B6&|)6B$Sp0hTqHhVRkIZR7Cn5#0z6fAt=v6anVCYtIYXedU4=!a9c6LZ!6}f
z0q7u}AUhAZ5NPDeS~gW%Xuw?ls?tPK>MkW|hoPv+$TVh7ev42zR20dec}_zJ7vkd`
zl-dBDr}eC|CPIC)HTNHRox!3k3ct#XvhvNM){Xjt7%na?+frOU%IF6oK0eMyiLHAE
z6fbSH@!jN7gc<t%hcR%(CJ6cs<d*7tEZh^<^n$o|Bg>nAUzq`I9WQG7K@&Q<j+5Y*
z`vh2wR2>nGJl~_q;KBpTB5&GVO^)z^ys(1K*3Du$q#N6DHa_=-)E>k-VRKu|cf}+S
zFA4nLHa=J2Q)bV@ehdCHdM0w)3ro3R8tc->(uY^!Cv6ibA%?%%{CO!%PmnF^8kBYg
z5!s2kx3n2Ynb|Ws#)oQzGTHL&sIC11@0>4APUTuoVCKO$Yz~yA4vAvY@75@3U<y&2
zSt|q$yIAR%tqw8(o(o;jNj&xf<KQo)#JD9Xa%SaUa*VR>a4@d@Vn@GMtz1LBUgn}S
zzP-p^HzUg`CXr6P0~q7i&OGEIx|hWFoQ8XcyYxwk$3<-P^ZhECoG1EO%8~a4&{*6V
zL`Y%k$?nORvCsK&mLYz<%LOlzaX8d<d!I$A6&SaDk7b%N?p%y}P{7sKnXb58Ew791
z`}H~0Tg-E8dkHU5)d`^w1n*$DT@4xB*u{z&!yHkob&LJf@%_*>dsc#ChF1k$$@4^O
zq-zl7U>kp7sE-0lf#yD?_o_s<(Z{iq@u1FcX%E<-N%sgE3I$*p2^PnKi_ANvH{5VL
zxTXgX?v7-yEtUX*y+{n6zij)m)q5^^W(L+Ekw|tJ`XkOM85v1IxKA9#2t<b;OdgIs
z@YNNWOMJ1aL@9N>g|$bv+9};yB+l<jWbl(E!oZl{W2l9S6OM^kM;d8X5n*rwywELo
z_DiphxqKMwr|g-cyu=cx%}?oZz|@BAcV~OiAQ>K2-1SZJQE}F$kRt^*MGeaOD?VW^
zf<H1sT-mU0#1^?&uXol;DPc%;O`1{3SAVF^K4c3L-CWNsaEv07$v>I4i30SWhwApz
zoPJY)W)ROi-fnP?%G!QiUk?mW&I+M4Ezt`j>M!6F-T9sqlj>2a=HG#RjJvJx>gHZz
zYFWQ<q{e=J-}Sk9H<$2gU^s8&e$)czycMPu4e(mi+MK8SE4Ab-Qo(;I?>M4X#J2%z
Co&7@q

literal 0
HcmV?d00001

diff --git a/authsecret/aidl/default/com.android.hardware.authsecret.pem b/authsecret/aidl/default/com.android.hardware.authsecret.pem
new file mode 100644
index 0000000000..644868c9a6
--- /dev/null
+++ b/authsecret/aidl/default/com.android.hardware.authsecret.pem
@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCkkrpV5StewKq6
+HOog0IkbBRAtuChTsQjE1yQY6VXF/f/QWc2L0++pe0PTNzuKJZuqD05tgLYBxsFl
+QSLMKoUnGkQshVHxFLCls0CQo/umgygydxyVNW5cTdDDbl0VHrYcJJSWBobfy/hh
+dizJVET6HMQLY0shKM9CcdFDRqvM+WB6ceBxcFsxwm8r5qcB6CCeIDsPuBBo5Mpa
+NlVbaMBc/qrSRFLqLiVph6Goycg0Zk5+i1A4VBTJoHlOQwgX4uMdlNoAnaf1rLIm
+Qn2zNfcfeZ3BoiwKv8qMsvLNotaN+oIYLi4t21JcPsroByI+Ps5Gia17BhQvbbXx
+3eRShBn6/YcxcMQmCPoN5JbqeyzcE9f0grh3I8ubf1+ZAW0dL2r6QRM6uo6T4Jf7
+BFiMVB0RjTzfo8ngwgPLIm/aXU2O8IG8sILO1s1iOaQb23E2PveF1B7EOmFzW8x3
+xSQQLwn83zY+V+BTZs/Dfgv+M3omctsLS7lgGuvSx9KHV+EnbRMoIYa/2fx5KUxP
+kC3rGpR2BRHZibm3tBlHmdkzOsaHaoQy2fLtqK39Au+cL05O5VpOYObBN2wOlKUO
+iWLS79YoaWAKUZtZKwQNu1jpmK0OMgCeC13QSTz2AuPgL6XEuCUpcmblX3KMsu5w
+MK79Yke/V61cQ71e5qI0vr3IXjcjywIDAQABAoICAAYZ0GGNyNFO6CVVHBLSWDrR
+sbtYJ9qOZgpSBWsM/1qDI4AYTCfiV/Ca+rUyR3lEEqS3w4sIqfaf5Rx5US5rZxs/
+fIZ//L0orLG/1uVlxtbx5sQUKVGYtPokAli0VywIwuyBKKb1H/vc5lzKkjd2ccYp
+2dSoPilBB4npiT3quUS0e/CeFxltdlv+XrusZcWK0ua5wCbBho406RF2ESz90Z/A
+6xk3YjF/O3DRj9sfe9YBcuh7BqLH7ytYURbnIj4scYnvsjMypP7VA5eqgFlr5zjZ
++9CpT+OoH3yex6R65GRIBJmb4KdfiYqU41W9qfXPwzrXMMCuRYJKmWOZe7TZY9Mc
+V46jaDgLgKxe+mI4CLi2auKFE4KL8x68KSqa22y2dEjWwBPiT7If6v0ZL4CiAy9n
+SNHFaceMY3l485vaZEtXxusRB/UGDZnAXr9NqBVm4YVAfOaEnJNDSqvYefM5iyOG
+yQZ7dCXS9Ey4JvVlceA6mybj2JSx20QS2wN/tcyZjWsjM0f/sIHAJRS6KhEqCIfX
+4L8d5nXJ1wvnBFvcfboSERkPOTQsuipsvn9uj8Zs9QWNYYRSyleptL+ce8fBqed6
+9ryErCuB9lpVTjUsOiaIibtGdePleQb10club1B/4vsgPl5wvTPRNCTmpOCP3pSf
+Rei2x4z1VGFOBwd3MiTtAoIBAQDiQCsK87Zs8E5cwc0CqeMWstWHvJLTkj2B42OI
+Zrbr6ByRixuLpWgVWtJJLKbLXPN83wl8eksv3+Ba+yi17uafhXX7M1O5RlOzvTHt
+bbFPeysB3KEmNt96dRDRKYY3z0KHJxCRWKKZjZjp8Usf3TuKi9Xbque8o2n1LKKB
+KANRC4xtHmUesl6d4S4iAfIkq5/nA4ocuJ2qd/2t3nc6yhPPRrP9+4sUPYdqBEUz
+ds9isqt5erUybstCoHRgsEwWo/9ew8Dyj1TCIDTSqRt1/0QnEVm77bgBrA8P66HI
+KKFVoo/MLQSw5V+CDZwTJNlPQwrG9tyrSkcMFgLSRzi+7d/3AoIBAQC6Nm5Ztiad
+zm/1jM89uHmvedimKCKKG6+Eom5D96PduP76uRr65s6Usn0QCZ4Jvou0xnbtCP1K
+lzVI1+v6EiIQyWX0y1bd0UJDdyYo4Ck2nqOh0vgw+cBO70faV50J5QA2mS/wFdw0
+PvykQpPYGiIfv1MMHWA+rPDzMtf1uUQ18vzzN7RaZll88pletC7mc7qgBaucQVvB
+/qzOZSwhiaSSvXS1sFKfkqLqpJ3x9748D74MIwDD2i3fRxxfqPcgrG3B7xxIKVgd
+CYoFjeC9inZbnwvPmtaKzROJknsuJA21s/ckkSiWJJbjbyymVc1hWNhoMbtSPopa
+OOJ7u695Ls3NAoIBADtRE3fVmXhKMGFFNhiCrdTfoffqSpxJdPK+yPOT6lVDD2ph
+DCG6heVDYGpq2HfssLGGUBhgf6HXkhyISI4aSkB8Xwgy1rp2Y6915McYwSnTYt0k
+GOPJ8yFJ29TajCPJpOmGJmPU1xxm8TY0WrvJ5rhWHQVwcz0Tos3ym9A8y1HOM0zQ
+cTZxETlXNh8YX4GZtVx9oxIQnNV6i/mvn5a8MCFhqgLmlfoCf6Qd5n6toYWAzlAV
+CbhlL8kSBDDtR6WP7X3M2KM/TLtwcijgySBQgm+zrtEEa/+UOoa0AkBV1qZ67jRb
+gSVXnYidRNQIDykmrIapZgVKfgH/K1Ix9gCooNUCggEAeSMzwnS2xm4nc2w43YQG
+1VrEz8LIRWQhWH16kgilt3XDmkOVA6fmt+EtbqNzBg/JPr7lWupALKgVZ9/fiX0G
+YDlEdG1bg03Ad7cpQeohpYCqHnnqL6IpsrAC5E2ewXMSInKhNuRhrjNTk2AkYa8O
+h+ylD/qERAGpdeybhSUS9K2wVGDmmPCAQsJnd65r3EtpGvTVYP87vAX7UQGMJf0u
+7K8HH7Mm7Nwt08tnXKO4Q8ZR8f9LXh2vPdM66Bg5PC4v8LumgGM1CR7NhTN5ApTy
+zkO3IUUvUHh8v0BlleyqZow+uLEd4B7Jcgc+2q5yv2NW1OGVZLl+s5bR74B3dLQ3
++QKCAQBtxqTUKaRE/g+paQByORt0mFuXhO5UyfEBpg6l7+aUS4wTGMeKKDCFjTME
+lDjEK7eiAAOgN3AJYQ+r6831pm3hg6DG5lpxTKUuz2eMqMHk3LVlDFkH6BZF3Jxg
+XxWP1Abi88hK3nnbuGrt6rlUxvJRdWaJcF5nXybJzPMpvzPcDjAg5fCT11vZQsRl
+piAO6NjAECwUOaBHSHPvIXO9fWu4zY03rhg9px+dkutydSJ/6B3jq33q1CzHDQMd
+bklkBBrLu9inpuvETbhVK6IWP2zMHzdViR58M+xd5rg2E3GBQePyd6mjOB+7p7Gd
+hUHo4XX1/r2CDceZTmOjaZP/MQOJ
+-----END PRIVATE KEY-----
diff --git a/authsecret/aidl/default/com.android.hardware.authsecret.pk8 b/authsecret/aidl/default/com.android.hardware.authsecret.pk8
new file mode 100644
index 0000000000000000000000000000000000000000..1453366b27a558f0c9b3535716b522c681dd9965
GIT binary patch
literal 2374
zcmV-M3Ay$#f(b$b0RS)!1_>&LNQU<f0RaI800e>wEHHuzC;|Zh0)heo0N3fI_t>e~
zHECheSH`7hi!$K+Fef=oxvh~tm?~qrt#inEdl*q?vFf@Q?r?tEZCU9Y3)j_1{9x6D
zzC~AVMZ<Hh-R26ydeAqqXnMqygxu6%g4X=<x7Q%)OJ;S5J~?!cmGzkuWcxU`##*>k
z=b<GaTXlH=?&T1{ICggY-SjGAm%n_WrP+D9f8=N`s_LCjJ}7i)h11yj$Fn1K?*L`8
zXkn#eVEo`S78Q!XR}xIK0yqLbraG1?rRI$dTEH1{`clBOaRJ8>6b!)nXNhmv;h(g>
zTXx5r)n?<_xFg$U<bMUD<%_%SDRbm~yJ);nqU0=@C&7_e3#+RhK+N5u_&zY<TlOrL
zfyJa64&Eu$vyJ@1DG%M)W3dvf2BGm7Q0!PUUz*Ta+wS!(fj{pfi%ALv@c_YXv4OHk
zFQ5h!aqjwyevkZu*BOkG`aK&_CuMttUvb|Og==s6sN&~PKhftuuEREjs)@b=X{IRG
zR<?e8oEhxwL8||9l|9D$2`If?{(=aYmG}vfXcV#7D@(Um!C#JxGj`SbEIVXS7yt#t
z-adtblRrLMGeS9f)jOz|bPv>m=DYuV^4NtG#_mLZrXx$ZROtf+NIjPsqpwSVR&1<V
zY~)6;3d!8wcFTt4VY-JcnQ%X)30*lSJH+acdgSJa5b$|$!2$yT009Dm0su3Qk@;GU
z(HE|_R2FX&KjUA1m+IZ?5|#qXeKE9Y#YGh{%0%g%LlB!+-mOkU6ya${z)@MX4()0v
zgFiOv_M`<>Vr-5}f`0a^UK{VZb0|4pBtQzBG*C~u1<hhb?gzpP!eCO`zvXQb@!S>t
z5EYV#eXl8^0A-9}P-`vgBVN<Et$W0nJU9_^zT{lQzGOv<)QKqj2ig=VtW~u`VjcCb
z(}$ML`l<#gdO53NOQm0O-ipYYOrXHK?5bLz(~ubO+TzKPNM-gxHY8pdRg)DUmmlU<
zF&<<Bt_7>W{M5S#VUBKr2hTw3+ozq2^0cP`)s@)1hs2dOqS}I=<|M7`8poP?uR`>q
z5cgbbQ;kiqy_+Wc7`~v|z2&e2AUDhkLX=n_)~=1nYJ5`F2d^2PX!m0Ul;7H_a_}4d
zMZ|3cK1I9;6m$p&tpHGd#h71jyCL?3DZ}^mZZ>Gw(7e|Yx_>4aOX3?pEK1{=0}vwM
zG)7&#zZwg?rPh=f-|)ZBjP)@!A(M{pO~c<7%709mzz03=tn>~Dopl?PmoBc`=#q2a
z$^IVEEVyz`%eWelJf%~4ICzx%Pcf2Qi|cu&*N$&gDihBPPWWr#A2nG^c<A*DrW)^@
zmOw%{bvGH?P!y@?bJRMY+9U(+sbgoGBBR1_GKt!Nbzy!AXZZqx0RaH{RVG4-6NO!r
z(64SvH8{g~b~K#9)lx?R%qmZw>4{+W7ourY?cs|F`5L3?8V>%!=}RRsQICmNN4Lka
z8!#ynt#?VBdd8uKXVktWfxJgCk0+c?8aqHhpZu)pxTX&2DmYXJ=AcbFL{Zm4E3iCQ
zA0@Bd#PT-XVc|Jt)^_FdHo?avCBzNs$^@UqkocWw7X_7-;|x6mn{}@*nB>-Vs(V=W
zi0ibl->5c5niIS;+V!({twtEE0WNKSo$I+~M9~57l+popZ)X5m0sx+~_wCSNH@Z^z
ze%@`ixtmxc)*I*Rs+pFjQY!o+MPPoU=JnqH4=yR!Epd@X5=x~4f&l>l-LJQT%7>*Y
zaKJce`#}_cx_?OthroRpmaXAM4eLa!?vd$e`EK{!?og}8LNiY<+rR;%jxboxv_?bX
zwuoYCRnds)+g~%RmR(*6Yz^`7tF>1(vJt6ncHxm+!$rivwspPYU$(2~b2t%jWvV8j
zq?EjzC@F+xP51jmvGMZA$;SjJc`8_=YqrFvkI~NLT7~2-UK>3Ld%B>2M>;6MKT{c@
z4itm&HncX)^I-ikv}hU}`lY6}|MM5lXikOH$U?tlyXWbS?idAx#T#{33^Hb7zc4?<
zh$?y$%lYa|ddZ76s`<DNE$;sz?XBbH-gO+62vI>!hL;yrZm%Bg0)hbmAoNBkNg>f-
zy9km8OS_p94BFzoO-VYWv+^D-gWYZr=(XDWeFQ7%N}4DUJ^%T)W<AAr*8AqN%3Nwk
z^qg-~9%|b6S-nVql-ej>F>2yXu9-6}4~?7yGzW1=5o8=*peDL!Fx(`U(0Q{jb|<D4
zbCzUI$V&Z?j@BOpjTbqC&kv8W7;pV&v0TU-t?MaJ^sfd-?G>X+buF0kT%sbZ&BTbM
z3xKg!qJj-0k5y6vZ~!8;W4-+&$*3k!#;ZcQuy3pgOL!^)lUei)F}8RLfzss_!-3iu
znM-?anAQ_mB=l*Y&!8^Ipt#k6nXUc6|6ZSDr{#mbclbl7WzdNk0)hbn0HgGej-}^_
znn>k=Q?SLuIc#4uPhTBZ=hc}gAb?ojV<LdN)-9BZv69XU9mTR)0G3bvW>1ACNlHH@
zdI@p)2bc`*YquFh2!izP)twsqGWu(k;#!`8X7_o3p3t>Q{S<X1NXBhF+F|y$zaJ5%
zoT@T!1UDD$nO6Sp(J`Vm<CcgZWhST50-R}rEJI83?j)TZ(+A|SQP4Js`WCas?3KR?
z7kOxA<pG9kdJ1Gy9&N=4dm>F;ZNCDwI;|d75Vu3tb<`V!J9v;kl%R^-PtxyumC(Hi
zjC=r|WdYd+7A8UEIy+sFX?U4v3|Z3O*&*@|f04B|&9d<j3fW(uNdkfa08^M@i#<QZ
zEKlTsu9G{k6W-_-p)`>8`pt^41Lxq2Z2Ugm@m?MsbNet+9K*w$8_o<?(P<v`?P)*j
zxU7~ya_*_g4{u+t$`8=C><A8KPNK(4qn6|XyZ|%j+}qPv++4_Jq-`sHnr>-5mOOjR
z<5~W>@`HY3JK!U-C;0!Iv{V8#f12u9nE|3cnS@>r6}5n^+2z`J{{1zaLE;p*P+$h1
zN|p0NDTg<7Z@~|We5af3W=-!89XkE#RGz!r@-mCPjK#oR@9Fywq>g^hem2NKb@XAN
sHu{aFdW$T|d)>IW5ba-qVLY*NLIIS(+Hy6#h&n^~Xn>=A$vDutGjcDKnE(I)

literal 0
HcmV?d00001

diff --git a/authsecret/aidl/default/com.android.hardware.authsecret.x509.pem b/authsecret/aidl/default/com.android.hardware.authsecret.x509.pem
new file mode 100644
index 0000000000..71fe854ef3
--- /dev/null
+++ b/authsecret/aidl/default/com.android.hardware.authsecret.x509.pem
@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF4zCCA8sCFH8r8uUt7ZiBGNZm/OxNbzMI34N3MA0GCSqGSIb3DQEBCwUAMIGs
+MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91
+bnRhaW4gVmlldzEQMA4GA1UECgwHQW5kcm9pZDEQMA4GA1UECwwHQW5kcm9pZDEi
+MCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTEoMCYGA1UEAwwfY29t
+LmFuZHJvaWQuaGFyZHdhcmUuYXV0aHNlY3JldDAgFw0yMzA4MTgwNzA3MDFaGA80
+NzYxMDcxNDA3MDcwMVowgawxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9y
+bmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBWaWV3MRAwDgYDVQQKDAdBbmRyb2lkMRAw
+DgYDVQQLDAdBbmRyb2lkMSIwIAYJKoZIhvcNAQkBFhNhbmRyb2lkQGFuZHJvaWQu
+Y29tMSgwJgYDVQQDDB9jb20uYW5kcm9pZC5oYXJkd2FyZS5hdXRoc2VjcmV0MIIC
+IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA1+ml99ip2TVpYdJXxqVnizLg
+/DAnOUy5rZE+mCpjua1zyHl7GFFnseq6GO5wftptWekcC9fVSPxg1YS+RVduRcNz
+rt3mCsJ60DexaHrElITc1GCC1vzyt9cg6UtmdYg+OXSPlfWZE2T7OLfGWrhU56El
+IFt1eQDu5RDBOHZ2/N30KmKXv3yhpdl5un/kaC6q6p1PPih0aYXT2PrHsyN17wBl
+smhhpWNg/OAzFhWKwFcSTLMCOAI+pjqWKqXmjQ1awBly+lLAtHEBxxEUDMD6Z4lv
+2OGftL9bdseb1Wbj2bgj22bkfwWj5Yu77ilz5H27aLxQouQsmSfBkVgLq6seQMzd
+ovg+MOFb9iyWgcWkGg7eKdSzjfzCKQ/d2GOxEqwGofEYUOxYM1+a0Fnb7vUtgT/v
+I4tJCgXxAMFtsYGySC+gBhNx7vqLfo/8gtcZjJL6PRtRJ2V7hF9x3xKFa2/6qOLn
+UD/R5z+uwzaEqom+AmmmKNdWtn58nBns7EGq/3KVPcb7CSi9Xf6CCJiV+AmRaBSx
+2CtLt1fBX46LM3bV+iw7ZFAYAAXE3j6FgpM/PlozQjl61TuomHQP1ILmu/988tiF
+FMbuRH6mI0u4VOkDBUg9lxmjr0uAVmysWmzkRrAKydzedsuG5WG6hy2ZcD+lCV05
+JzvE6pB65OaIEPB5cMECAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAozFo1vOIy/Js
+/EU5oRtSGSIoWCNIn7EYQ68jVHQk2ZhklVH2jW+6WVGmreOjPz5iWeDb0fC4KVtH
+MPXJ1Vd+GfvDysrnW5mDBzlI1O2xv/BWYeHt+RFWghhH/NFHaTQqDJpdOZXMZM4F
+dwFefxLchcXftE9jihHJXJ4k0cxC03Kpd0caZE7b67W1YQdJhU9mZx6CP1A3MdWU
+f48QIsmHgejkihtGNDRheBRzNdpHPhdOjYIWhOeAHh/xnm7PVZBMXmZeNW7MrAS0
++lN99r7Xj3eqtSdrMrrob845PWYsATA/a8ouUuTT7812fl8tZx69xb8wV5hNztDj
+srOxxJbjt1uwcSp67f2K91D97CQuMMPnOt1oFEXT+5QtLEiybXKfkshwO7VVDoIg
+owMLoKIiA2Xr+rZn7CEBeTrqQuRJfJEI+k/49zg2zWQIKGQAz8iaO0l95Hk5kPTE
+A5i9qxhn0UqC6a4Dkj8ybQOACzVA06IsbbYdprfzURQHjcUiSrEzjrwWxkkX/9El
+Z0CJAtkXx4pMxo5s6zt26ZPC3cxWB7aageWSC4xDbKuQP5VCNVg1nWymg6nF4Xk9
+d7n7yvSNH6fAZrpmZo7o7CBxCb4QN8j7TpyuaPd7nzyCyR6aGbh7fz8xksukvj6w
+ZSbAAy5uw4hyUwTTpyPyw+qQxI7O/PU=
+-----END CERTIFICATE-----
diff --git a/authsecret/aidl/default/file_contexts b/authsecret/aidl/default/file_contexts
new file mode 100644
index 0000000000..8e79f26c6d
--- /dev/null
+++ b/authsecret/aidl/default/file_contexts
@@ -0,0 +1,3 @@
+(/.*)?                                                      u:object_r:vendor_file:s0
+/etc(/.*)?                                                  u:object_r:vendor_configs_file:s0
+/bin/hw/android\.hardware\.authsecret-service\.example      u:object_r:hal_authsecret_default_exec:s0
\ No newline at end of file
diff --git a/authsecret/aidl/default/manifest.json b/authsecret/aidl/default/manifest.json
new file mode 100644
index 0000000000..ad5a45b444
--- /dev/null
+++ b/authsecret/aidl/default/manifest.json
@@ -0,0 +1,4 @@
+{
+    "name": "com.android.hardware.authsecret",
+    "version": 1
+}
diff --git a/compatibility_matrices/compatibility_matrix.9.xml b/compatibility_matrices/compatibility_matrix.9.xml
index 4ba49f4d47..bb401ddbd7 100644
--- a/compatibility_matrices/compatibility_matrix.9.xml
+++ b/compatibility_matrices/compatibility_matrix.9.xml
@@ -52,7 +52,7 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal format="aidl" optional="true">
+    <hal format="aidl" optional="true" updatable-via-apex="true">
          <name>android.hardware.authsecret</name>
          <version>1</version>
          <interface>