プラットホーム
Android 7.1 + RK3288
周囲
現在の署名ファイルは次のとおりです。
- ビルド/ターゲット/製品/セキュリティ/
-rw-rw-r-- 1 anson anson 260 6月 19 2018 Android.mk
-rw-rw-r-- 1 anson anson 1675 6月 19 2018 media.pem
-rw-rw-r-- 1 anson anson 1217 6月 19 2018 media.pk8
-rw-rw-r-- 1 anson anson 1440 6月 19 2018 media.x509.pem
-rw-rw-r-- 1 anson anson 1675 6月 19 2018 platform.pem
-rw-rw-r-- 1 anson anson 1216 6月 19 2018 platform.pk8
-rw-rw-r-- 1 anson anson 1440 6月 19 2018 platform.x509.pem
-rw-rw-r-- 1 anson anson 3123 6月 19 2018 README
-rw-rw-r-- 1 anson anson 1679 6月 19 2018 shared.pem
-rw-rw-r-- 1 anson anson 1218 6月 19 2018 shared.pk8
-rw-rw-r-- 1 anson anson 1440 6月 19 2018 shared.x509.pem
-rw-rw-r-- 1 anson anson 1675 6月 19 2018 testkey.pem
-rw-rw-r-- 1 anson anson 1216 6月 19 2018 testkey.pk8
-rw-rw-r-- 1 anson anson 1440 6月 19 2018 testkey.x509.pem
-rw-rw-r-- 1 anson anson 524 6月 19 2018 verity_key
-rw-rw-r-- 1 anson anson 1219 6月 19 2018 verity.pk8
-rw-rw-r-- 1 anson anson 1444 6月 19 2018 verity.x509.pem
- 対応するキーの目的：
testkey # 普通APK，默认情况下使用
platform # 该APK完成一些系统的核心功能,这种方式编译出来的APK所在进程的UID为system
shared # 该APK是media/download系统中的一环
media # 该APK是media/download系统中的一环
- build / core / main.mk
include $(BUILD_SYSTEM)/config.mk
- build / core / config.mk
include $(BUILD_SYSTEM)/envsetup.mk
DEFAULT_SYSTEM_DEV_CERTIFICATE := build/target/product/security/testkey
テストキーは、アプリケーションの署名だけでなく、パッケージ化されたファームウェアOTAアップグレードパッケージにも影響します。
成し遂げる
-
最も簡単な解決策は、ビルド/ターゲット/製品/セキュリティに関連するキーファイルを置き換えることです
-
キー名をカスタマイズし、Makefileと対応する.MKファイルを同時に変更します
- build / core / config.mk：中DEFAULT_SYSTEM_DEV_CERTIFICATE：= build / target / product / security / mykey
- build / core / Makefile：ifeq（$（DEFAULT_SYSTEM_DEV_CERTIFICATE）、build / target / product / security / mykey）
-
apk署名に関しては、Android.mkの宣言を変更することで署名を変更できます。
LOCAL_PATH:= $(call my-dir)
include $(CLEAR_VARS)
LOCAL_MODULE_TAGS := optional
LOCAL_SRC_FILES := $(call all-subdir-java-files)
LOCAL_PACKAGE_NAME := Provision
LOCAL_CERTIFICATE := mykey
## 也可定义绝对路径:
#LOCAL_CERTIFICATE := build/target/product/security/mykey/mykey
LOCAL_PRIVILEGED_MODULE := true
LOCAL_PROGUARD_FLAG_FILES := proguard.flags
include $(BUILD_PACKAGE)
build / target / product / security / mykey関連のファイルが存在することを確認します。存在しない場合は、次のように表示されます。
ninja: error: 'build/target/product/security/mykey.pk8', needed by 'out/target/product/rk3288/obj/APPS/Provision_intermediates/package.apk', missing and no known rule to make it
- build / core / package_internal.mk
# Pick a key to sign the package with. If this package hasn't specified
# an explicit certificate, use the default.
# Secure release builds will have their packages signed after the fact,
# so it's ok for these private keys to be in the clear.
ifeq ($(LOCAL_CERTIFICATE),)
LOCAL_CERTIFICATE := $(DEFAULT_SYSTEM_DEV_CERTIFICATE)
endif
ifeq ($(LOCAL_CERTIFICATE),EXTERNAL)
# The special value "EXTERNAL" means that we will sign it with the
# default devkey, apply predexopt, but then expect the final .apk
# (after dexopting) to be signed by an outside tool.
LOCAL_CERTIFICATE := $(DEFAULT_SYSTEM_DEV_CERTIFICATE)
PACKAGES.$(LOCAL_PACKAGE_NAME).EXTERNAL_KEY := 1
endif
# If this is not an absolute certificate, assign it to a generic one.
ifeq ($(dir $(strip $(LOCAL_CERTIFICATE))),./)
LOCAL_CERTIFICATE := $(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))$(LOCAL_CERTIFICATE)
endif
private_key := $(LOCAL_CERTIFICATE).pk8
certificate := $(LOCAL_CERTIFICATE).x509.pem
- ビルドの途中からninja-> out / build-rk3288-mmm-packages_apps_Provision_Android.mk.ninja
description = target Package: Provision (out/target/product/rk3288/obj/APPS/Provision_intermediates/package.apk)
command = /bin/bash -c
"(touch out/target/product/rk3288/obj/APPS/Provision_intermediates/zipdummy )
&& ((cd out/target/product/rk3288/obj/APPS/Provision_intermediates/
&& jar cf package.apk zipdummy) )
&& (zip -qd out/target/product/rk3288/obj/APPS/Provision_intermediates/package.apk zipdummy )
&& (rm out/target/product/rk3288/obj/APPS/Provision_intermediates/zipdummy )
&& (out/host/linux-x86/bin/aapt
package
-u
-z
--pseudo-localize
-c zh_CN,en_US,cs_CZ,da_DK,de_AT,de_CH,de_DE,de_LI,el_GR,en_AU,en_CA,en_GB,en_NZ,en_SG,eo_EU,es_ES,fr_CA,fr_CH,fr_BE,fr_FR,it_CH,it_IT,ja_JP,ko_KR,nb_NO,nl_BE,nl_NL,pl_PL,pt_PT,ru_RU,sv_SE,tr_TR,zh_CN,zh_HK,zh_TW,am_ET,hi_IN,en_US,en_AU,en_IN,fr_FR,it_IT,es_ES,et_EE,de_DE,nl_NL,cs_CZ,pl_PL,ja_JP,zh_TW,zh_CN,zh_HK,ru_RU,ko_KR,nb_NO,es_US,da_DK,el_GR,tr_TR,pt_PT,pt_BR,sv_SE,bg_BG,ca_ES,en_GB,fi_FI,hi_IN,hr_HR,hu_HU,in_ID,iw_IL,lt_LT,lv_LV,ro_RO,sk_SK,sl_SI,sr_RS,uk_UA,vi_VN,tl_PH,ar_EG,fa_IR,th_TH,sw_TZ,ms_MY,af_ZA,zu_ZA,am_ET,en_XA,ar_XB,fr_CA,km_KH,lo_LA,ne_NP,si_LK,mn_MN,hy_AM,az_AZ,ka_GE,my_MM,mr_IN,ml_IN,is_IS,mk_MK,ky_KG,eu_ES,gl_ES,bn_BD,ta_IN,kn_IN,te_IN,uz_UZ,ur_PK,kk_KZ,sq_AL,gu_IN,pa_IN,be_BY,bs_BA
-M packages/apps/Provision/AndroidManifest.xml
-I out/target/common/obj/APPS/framework-res_intermediates/package-export.apk
--min-sdk-version 25
--target-sdk-version 25
--product tablet
--version-code 25
--version-name 7.1.2
--skip-symbols-without-default-localization
-F out/target/product/rk3288/obj/APPS/Provision_intermediates/package.apk )
&& (find out/target/common/obj/APPS/Provision_intermediates/
-maxdepth 1
-name \"classes*.dex\" | sort | xargs zip -qjX out/target/product/rk3288/obj/APPS/Provision_intermediates/package.apk )
&& (if [ -d out/target/common/obj/APPS/Provision_intermediates/jack-rsc ] ;
then find out/target/common/obj/APPS/Provision_intermediates/jack-rsc -type f |
sort | sed -e \"s?^out/target/common/obj/APPS/Provision_intermediates/jack-rsc/?
-C \\\"out/target/common/obj/APPS/Provision_intermediates/jack-rsc\\\" \\\"?\" -e \"s/\$$/\\\"/\" > out/target/product/rk3288/obj/APPS/Provision_intermediates/jack_res_jar_flags;
if [ -s out/target/product/rk3288/obj/APPS/Provision_intermediates/jack_res_jar_flags ] ;
then jar uf out/target/product/rk3288/obj/APPS/Provision_intermediates/package.apk
@out/target/product/rk3288/obj/APPS/Provision_intermediates/jack_res_jar_flags; fi; fi )
&& (mv out/target/product/rk3288/obj/APPS/Provision_intermediates/package.apk out/target/product/rk3288/obj/APPS/Provision_intermediates/package.apk.unsigned )
&& (java -Djava.library.path=out/host/linux-x86/lib64 -jar out/host/linux-x86/framework/signapk.jar --min-sdk-version \
$$((out/host/linux-x86/bin/aapt dump badging out/target/product/rk3288/obj/APPS/Provision_intermediates/package.apk.unsigned 2>&1
| grep '^sdkVersion' || echo \"sdkVersion:'0'\") | cut -d\"'\" -f2 | sed -e s/^.*[^0-9].*\$$/25/)
build/target/product/security/mykey.x509.pem
build/target/product/security/mykey.pk8
out/target/product/rk3288/obj/APPS/Provision_intermediates/package.apk.unsigned
out/target/product/rk3288/obj/APPS/Provision_intermediates/package.apk.signed )
&& (mv out/target/product/rk3288/obj/APPS/Provision_intermediates/package.apk.signed out/target/product/rk3288/obj/APPS/Provision_intermediates/package.apk )"
コンパイルシステムがbuild / target / product / security / mykey.x509.pem、build / target / product / security /mykey.pk8を検索することがわかります。
展開
Androidシステムリリースシグネチャ
AndroidOTAリリースキーは、
Androidシステムビルドフェーズシグネチャメカニズムに代わるものです。
手動でキーを生成するキーを作成する
- 方法1：
development/tools/make_key testkey '/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/[email protected]'
- 方法2：
# generate RSA key
openssl genrsa -3 -out temp.pem 2048
Generating RSA private key, 2048 bit long modulus
....+++
.....................+++
e is 3 (0x3)
# create a certificate with the public part of the key
openssl req -new -x509 -key temp.pem -out releasekey.x509.pem -days 10000 -subj '/C=US/ST=California/L=San Narciso/O=Yoyodyne, Inc./OU=Yoyodyne Mobility/CN=Yoyodyne/[email protected]'
# create a PKCS#8-formatted version of the private key
openssl pkcs8 -in temp.pem -topk8 -outform DER -out releasekey.pk8 -nocrypt
# securely delete the temp.pem file
shred --remove temp.pem
- コンパイル時に環境変数を出力します。
- build / core / dumpvar.mk
print_build_config_vars := \
PLATFORM_VERSION_CODENAME \
PLATFORM_VERSION \
TARGET_PRODUCT \
TARGET_BUILD_VARIANT \
TARGET_BUILD_TYPE \
TARGET_BUILD_APPS \
TARGET_ARCH \
TARGET_ARCH_VARIANT \
TARGET_CPU_VARIANT \
TARGET_2ND_ARCH \
TARGET_2ND_ARCH_VARIANT \
TARGET_2ND_CPU_VARIANT \
HOST_ARCH \
HOST_2ND_ARCH \
HOST_OS \
HOST_OS_EXTRA \
HOST_CROSS_OS \
HOST_CROSS_ARCH \
HOST_CROSS_2ND_ARCH \
HOST_BUILD_TYPE \
BUILD_ID \
OUT_DIR
ifneq ($(filter report_config,$(DUMP_MANY_VARS)),)
# Construct the shell commands that print the config banner.
report_config_sh := echo '============================================';
report_config_sh += $(foreach v,$(print_build_config_vars),echo '$v=$($(v))';)
report_config_sh += echo '============================================';
endif
============================================
PLATFORM_VERSION_CODENAME=REL
PLATFORM_VERSION=7.1.2
TARGET_PRODUCT=rk3288
TARGET_BUILD_VARIANT=userdebug
TARGET_BUILD_TYPE=release
TARGET_BUILD_APPS=
TARGET_ARCH=arm
TARGET_ARCH_VARIANT=armv7-a-neon
TARGET_CPU_VARIANT=cortex-a15
TARGET_2ND_ARCH=
TARGET_2ND_ARCH_VARIANT=
TARGET_2ND_CPU_VARIANT=
HOST_ARCH=x86_64
HOST_2ND_ARCH=x86
HOST_OS=linux
HOST_OS_EXTRA=Linux-4.15.0-64-generic-x86_64-with-Ubuntu-16.04-xenial
HOST_CROSS_OS=windows
HOST_CROSS_ARCH=x86
HOST_CROSS_2ND_ARCH=x86_64
HOST_BUILD_TYPE=release
BUILD_ID=NHG47K
OUT_DIR=out
BUILD_SYSTEM=build/core
============================================
- build / core / Makefile
# The "test-keys" tag marks builds signed with the old test keys,
# which are available in the SDK. "dev-keys" marks builds signed with
# non-default dev keys (usually private keys from a vendor directory).
# Both of these tags will be removed and replaced with "release-keys"
# when the target-files is signed in a post-build step.
ifeq ($(DEFAULT_SYSTEM_DEV_CERTIFICATE),build/target/product/security/testkey)
BUILD_KEYS := test-keys
else
BUILD_KEYS := dev-keys
endif
ifeq ($(TARGET_BUILD_VARIANT),user)
BUILD_KEYS := release-keys
endif
コンパイルに使用するキーを決定すると、[設定]> [デバイスについて]>次のようなバージョン番号の末尾が表示されます。XXX-userdebug7.1.2NHG47Keng.XXX.20191125.144140test -keys