Resign some APEX packages during the release build

APEX packages currently are not resigned by a release key during the release build. Need to resign them to pass the CTS tests: testApexPubKeyIsNotWellKnownKey testPackageSignatures Test done: These two cts cases can pass with patch. Tracked-On: OAM-122509 Signed-off-by: jizhenlo <[email protected]>
projectceladon · Jul 19, 2024 · 705cd40 · 705cd40
1 parent 2996f0e
commit 705cd40
Showing 1 changed file with 17 additions and 0 deletions.
diff --git a/tasks/flashfiles.mk b/tasks/flashfiles.mk
@@ -20,12 +20,29 @@ BUILT_RELEASE_SUPER_IMAGE := $(PRODUCT_OUT)/release_sign/super.img
 endif
 SOONG_HOST_TOOL := \
 	PATH="$(SOONG_HOST_OUT)/bin:$$PATH"
+
+APEX_LIST := com.android.tethering.apex,\
+			 com.android.media.swcodec.apex,\
+			 com.android.ondevicepersonalization.apex,\
+			 com.android.scheduling.apex,\
+			 com.android.media.apex,\
+			 com.android.conscrypt.apex,\
+			 com.android.resolv.apex,\
+			 com.android.tzdata.apex,\
+			 com.android.btservices.apex,\
+			 com.android.sdkext.apex,\
+			 com.android.runtime.apex,\
+			 com.android.i18n.apex
+BUILT_APEXS := $(subst $(space),,$(APEX_LIST))
+
 $(BUILT_RELEASE_TARGET_FILES_PACKAGE):$(BUILT_TARGET_FILES_PACKAGE)
 	@echo "Package release: $@"
 	$(SOONG_HOST_TOOL) \
 	$(HOST_OUT_EXECUTABLES)/sign_target_files_apks -o \
 	-d device/intel/build/testkeys/cts-release-test \
 	--key_mapping  build/target/product/security/networkstack=device/intel/build/testkeys/cts-release-test/networkstack \
+	--extra_apks             $(BUILT_APEXS)=device/intel/build/testkeys/cts-release-test/apex \
+	--extra_apex_payload_key $(BUILT_APEXS)=device/intel/build/testkeys/cts-release-test/apex.pem \
 	$(BUILT_TARGET_FILES_PACKAGE) $@
 
 ifeq ($(SUPER_IMG_IN_FLASHZIP),true)