WIP: enable bl relock

* if you set up your dt like this:
  SirRGB/android_device_sony_sm8250-common@b5cd0fa
  you can use ROM_BUILD_FLAGS=BOARD_AVB_KEY_PATH="${KEYS_DIR}"
  to set up signing like intended

Author: SirRGB

Dockerfile

@@ -35,6 +35,7 @@ ENV BUILD_TYPE=''
 ENV ROM_MANIFEST=''
 ENV ROM_BRANCH=''
 ENV ROM_BUILD_FLAGS=''
+ENV BL_RELOCK=''
 
 # Fallbacks (required for non-standard naming and conflicts)
 ENV LUNCH_PREFIX_FALLBACK=''

README.md

@@ -151,3 +151,4 @@ You can further speed up build times by using tmpfs as described [here](https://
 - [LineageOS4MicroG](https://github.com/lineageos4microg/docker-lineage-cicd)
 - [amyROM](https://github.com/amyROM/vendor_amy/blob/207d5e32c3fba38b9fe1ab9cd12c71ca6b81d653/scripts/generate_json_build_info.sh)
 - [LineageOS Infra](https://github.com/lineageos-infra/build-config/tree/main/android)
+- [Halogen OS](https://github.com/halogenOS/android_external_xos/blob/fb9a58362b930807766100d1288ff809df6b7c51/xostools/xostools.sh)

scripts/packaging.sh

@@ -52,6 +52,11 @@ _packaging() {
   then
     _cleanup_fail
   fi
+
+  # Extract AVB key
+  if [[ -n "${BL_RELOCK}" ]]; then
+    avbtool extract_public_key --key "${KEYS_DIR}"/avbkey_4096.pem --output "${OUT}"/"${PACKAGE_NAME//.zip/-pkmd.bin}"
+  fi
   set -eu
 }
 

scripts/setup.sh

@@ -100,6 +100,15 @@ _keysgen() {
       openssl pkcs8 -in "${KEYS_DIR}"/"${apex}".pk8 -inform DER -nocrypt -out "${KEYS_DIR}"/"${apex}".pem
     fi
   done
+
+  if [[ -n "${BL_RELOCK}" ]]; then
+    if [[ ! -f "${KEYS_DIR}"/avbkey_4096.x509.pem ]] || [[ ! -f "${KEYS_DIR}"/avbkey_4096.pem ]] ; then
+      subject="${KEYS_SUBJECT//CN=Android/CN=\$\{apex\}}"
+      make_key "${KEYS_DIR}"/"${apex}" "${subject}"
+      openssl pkcs8 -in "${KEYS_DIR}"/avbkey_4096.pk8 -inform DER -nocrypt -out "${KEYS_DIR}"/avbkey_4096.pem
+    fi
+  fi
+
   unset KEYS_SUBJECT
 }
 

scripts/sign.sh

@@ -55,11 +55,15 @@ _sign_old() {
 
 # New signing process (APEX), A12/up
 _sign_new() {
-  local apex_args
+  local sign_args
   for apex_key in "${APEX_KEYS[@]}"; do
-    apex_args+=('--extra_apks' "${apex_key}.apex=${KEYS_DIR}/${apex_key}" '--extra_apex_payload_key' "${apex_key}.apex=${KEYS_DIR}/${apex_key}.pem")
+    sign_args+=('--extra_apks' "${apex_key}.apex=${KEYS_DIR}/${apex_key}" '--extra_apex_payload_key' "${apex_key}.apex=${KEYS_DIR}/${apex_key}.pem")
   done
 
+  if [[ -n "${BL_RELOCK}" ]]; then
+    sign_args+=('--avb_vbmeta_key' "${KEYS_DIR}"/avbkey_4096.pem '--avb_vbmeta_algorithm' 'SHA256_RSA4096')
+  fi
+
   set +eu
   if ! sign_target_files_apks -o -d "${KEYS_DIR}" \
       --extra_apks AdServicesApk.apk="${KEYS_DIR}"/releasekey \
@@ -73,7 +77,7 @@ _sign_new() {
       --extra_apks ServiceUwbResources.apk="${KEYS_DIR}"/releasekey \
       --extra_apks ServiceWifiResources.apk="${KEYS_DIR}"/releasekey \
       --extra_apks WifiDialog.apk="${KEYS_DIR}"/releasekey \
-      "${apex_args[@]}" \
+      "${sign_args[@]}" \
       "${OUT}"/obj/PACKAGING/target_files_intermediates/*-target_files*.zip \
       "${OUT}"/signed-target_files.zip 2>&1 | tee --append "${LOGS_DIR}"/"${BUILD_DATE}"/sign.txt
   then

scripts/upload.sh

@@ -57,11 +57,27 @@ _upload_gh() {
     --header "Content-Type: $(file -b --mime-type "${OUT}"/"${PACKAGE_NAME//.zip/-recovery.img}")" \
     --upload-file "${OUT}"/"${PACKAGE_NAME//.zip/-recovery.img}" \
     "${upload_url}"?name="${PACKAGE_NAME//.zip/-recovery.img}"
+
+
+  # Upload Recovery
+  if [[ -n "${BL_RELOCK}" ]]; then
+    curl_cmd \
+      --header 'Accept: application/vnd.github.v3+json' \
+      --header "Content-Length: $(stat -c%s "${OUT}"/"${PACKAGE_NAME//.zip/-pkmd.bin}")" \
+      --header "Authorization: token ${GITHUB_TOKEN}" \
+      --header "Content-Type: $(file -b --mime-type "${OUT}"/"${PACKAGE_NAME//.zip/-pkmd.bin}")" \
+      --upload-file "${OUT}"/"${PACKAGE_NAME//.zip/-pkmd.bin}" \
+      "${upload_url}"?name="${PACKAGE_NAME//.zip/-pkmd.bin}"
+  fi
 }
 
 _upload_ssh() {
   scp "${OUT}"/"${PACKAGE_NAME}" "${1}"@"${2}"
   scp "${OUT}"/"${PACKAGE_NAME//.zip/-recovery.img}" "${1}"@"${2}"
+  if [[ -n "${BL_RELOCK}" ]]; then
+    scp "${OUT}"/"${PACKAGE_NAME//.zip/-pkmd.bin}" "${1}"@"${2}"
+  fi
+
   DL_OTA_URL="${3}"
 }