forked from dan-v/rattlesnakeos-stack
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathbuild_template.go
1293 lines (1097 loc) · 49.3 KB
/
build_template.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
package templates
const BuildTemplate = `
#!/bin/bash
if [ $# -lt 1 ]; then
echo "Need to specify device name as argument"
exit 1
fi
# check if supported device
DEVICE=$1
case "$DEVICE" in
marlin|sailfish)
DEVICE_FAMILY=marlin
AVB_MODE=verity_only
;;
taimen)
DEVICE_FAMILY=taimen
AVB_MODE=vbmeta_simple
;;
walleye)
DEVICE_FAMILY=muskie
AVB_MODE=vbmeta_simple
;;
crosshatch|blueline)
DEVICE_FAMILY=crosshatch
AVB_MODE=vbmeta_chained
EXTRA_OTA=(--retrofit_dynamic_partitions)
;;
sargo|bonito)
DEVICE_FAMILY=bonito
AVB_MODE=vbmeta_chained
EXTRA_OTA=(--retrofit_dynamic_partitions)
;;
*)
echo "warning: unknown device $DEVICE, using Pixel 3 defaults"
DEVICE_FAMILY=$1
AVB_MODE=vbmeta_chained
;;
esac
# this is a build time option to override stack setting IGNORE_VERSION_CHECKS
FORCE_BUILD=false
if [ "$2" = true ]; then
echo "Setting FORCE_BUILD=true"
FORCE_BUILD=true
fi
# allow build and branch to be specified
AOSP_BUILD=$3
AOSP_BRANCH=$4
# set region
REGION=<% .Region %>
export AWS_DEFAULT_REGION=${REGION}
# stack name
STACK_NAME=<% .Name %>
# version of stack running
STACK_VERSION=<% .Version %>
# prevent default action of shutting down on exit
PREVENT_SHUTDOWN=<% .PreventShutdown %>
# whether version checks should be ignored
IGNORE_VERSION_CHECKS=<% .IgnoreVersionChecks %>
# version of chromium to pin to if requested
CHROMIUM_PINNED_VERSION=<% .ChromiumVersion %>
# whether keys are client side encrypted or not
ENCRYPTED_KEYS="<% .EncryptedKeys %>"
ENCRYPTION_KEY=
ENCRYPTION_PIPE="/tmp/key"
# pin to specific version of android
ANDROID_VERSION="10.0"
# build type (user or userdebug)
BUILD_TYPE="user"
# build channel (stable or beta)
BUILD_CHANNEL="stable"
# user customizable things
HOSTS_FILE=<% .HostsFile %>
# attestion server
ENABLE_ATTESTATION=<% .EnableAttestation %>
ATTESTATION_MAX_SPOT_PRICE=<% .AttestationMaxSpotPrice %>
# aws settings
AWS_ATTESTATION_BUCKET="${STACK_NAME}-attestation"
AWS_KEYS_BUCKET="${STACK_NAME}-keys"
AWS_ENCRYPTED_KEYS_BUCKET="${STACK_NAME}-keys-encrypted"
AWS_RELEASE_BUCKET="${STACK_NAME}-release"
AWS_LOGS_BUCKET="${STACK_NAME}-logs"
AWS_SNS_ARN=$(aws --region ${REGION} sns list-topics --query 'Topics[0].TopicArn' --output text | cut -d":" -f1,2,3,4,5)":${STACK_NAME}"
INSTANCE_TYPE=$(curl -s http://169.254.169.254/latest/meta-data/instance-type)
INSTANCE_REGION=$(curl -s http://169.254.169.254/latest/dynamic/instance-identity/document | awk -F\" '/region/ {print $4}')
INSTANCE_IP=$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4)
# build settings
SECONDS=0
BUILD_TARGET="release aosp_${DEVICE} ${BUILD_TYPE}"
RELEASE_URL="https://${AWS_RELEASE_BUCKET}.s3.amazonaws.com"
RELEASE_CHANNEL="${DEVICE}-${BUILD_CHANNEL}"
CHROME_CHANNEL="dev"
BUILD_DATE=$(date +%Y.%m.%d.%H)
BUILD_TIMESTAMP=$(date +%s)
BUILD_DIR="$HOME/rattlesnake-os"
KEYS_DIR="${BUILD_DIR}/keys"
CERTIFICATE_SUBJECT='/CN=RattlesnakeOS'
OFFICIAL_FDROID_KEY="43238d512c1e5eb2d6569f4a3afbf5523418b82e0a3ed1552770abb9a9c9ccab"
MARLIN_KERNEL_SOURCE_DIR="${HOME}/kernel/google/marlin"
BUILD_REASON=""
# urls
ANDROID_SDK_URL="https://dl.google.com/android/repository/sdk-tools-linux-4333796.zip"
MANIFEST_URL="https://android.googlesource.com/platform/manifest"
CHROME_URL_LATEST="https://omahaproxy.appspot.com/all.json"
STACK_URL_LATEST="https://api.github.com/repos/dan-v/rattlesnakeos-stack/releases/latest"
FDROID_CLIENT_URL_LATEST="https://gitlab.com/api/v4/projects/36189/repository/tags"
FDROID_PRIV_EXT_URL_LATEST="https://gitlab.com/api/v4/projects/1481578/repository/tags"
KERNEL_SOURCE_URL="https://android.googlesource.com/kernel/msm"
AOSP_URL_BUILD="https://developers.google.com/android/images"
AOSP_URL_BRANCH="https://source.android.com/setup/start/build-numbers"
STACK_UPDATE_MESSAGE=
LATEST_STACK_VERSION=
LATEST_CHROMIUM=
FDROID_CLIENT_VERSION=
FDROID_PRIV_EXT_VERSION=
get_latest_versions() {
log_header ${FUNCNAME}
sudo DEBIAN_FRONTEND=noninteractive apt-get -y install jq
# check if running latest stack
LATEST_STACK_VERSION=$(curl --fail -s "$STACK_URL_LATEST" | jq -r '.name')
if [ -z "$LATEST_STACK_VERSION" ]; then
aws_notify_simple "ERROR: Unable to get latest rattlesnakeos-stack version details. Stopping build."
exit 1
elif [ "$LATEST_STACK_VERSION" == "$STACK_VERSION" ]; then
echo "Running the latest rattlesnakeos-stack version $LATEST_STACK_VERSION"
else
STACK_UPDATE_MESSAGE="WARNING: you should upgrade to the latest version: ${LATEST_STACK_VERSION}"
fi
# check for latest stable chromium version
LATEST_CHROMIUM=$(curl --fail -s "$CHROME_URL_LATEST" | jq -r '.[] | select(.os == "android") | .versions[] | select(.channel == "'$CHROME_CHANNEL'") | .current_version')
if [ -z "$LATEST_CHROMIUM" ]; then
aws_notify_simple "ERROR: Unable to get latest Chromium version details. Stopping build."
exit 1
fi
# fdroid - get latest non alpha tags from gitlab (sorted)
FDROID_CLIENT_VERSION=$(curl --fail -s "$FDROID_CLIENT_URL_LATEST" | jq -r 'sort_by(.name) | reverse | [.[] | select(.name | test("^[0-9]+\\.[0-9]+")) | select(.name | contains("alpha") | not) | select(.name | contains("ota") | not)][0] | .name')
if [ -z "$FDROID_CLIENT_VERSION" ]; then
aws_notify_simple "ERROR: Unable to get latest F-Droid version details. Stopping build."
exit 1
fi
FDROID_PRIV_EXT_VERSION=$(curl --fail -s "$FDROID_PRIV_EXT_URL_LATEST" | jq -r 'sort_by(.name) | reverse | [.[] | select(.name | test("^[0-9]+\\.[0-9]+")) | select(.name | contains("alpha") | not) | select(.name | contains("ota") | not)][0] | .name')
if [ -z "$FDROID_PRIV_EXT_VERSION" ]; then
aws_notify_simple "ERROR: Unable to get latest F-Droid privilege extension version details. Stopping build."
exit 1
fi
# attempt to automatically pick latest build version and branch. note this is likely to break with any page redesign. should also add some validation here.
if [ -z "$AOSP_BUILD" ]; then
AOSP_BUILD=$(curl --fail -s ${AOSP_URL_BUILD} | grep -A1 "${DEVICE}" | egrep '[a-zA-Z]+ [0-9]{4}\)' | grep -F "${ANDROID_VERSION}" | tail -1 | cut -d"(" -f2 | cut -d"," -f1)
if [ -z "$AOSP_BUILD" ]; then
aws_notify_simple "ERROR: Unable to get latest AOSP build information. Stopping build. This lookup is pretty fragile and can break on any page redesign of ${AOSP_URL_BUILD}"
exit 1
fi
fi
if [ -z "$AOSP_BRANCH" ]; then
AOSP_BRANCH=$(curl --fail -s ${AOSP_URL_BRANCH} | grep -A1 "${AOSP_BUILD}" | tail -1 | cut -f2 -d">"|cut -f1 -d"<")
if [ -z "$AOSP_BRANCH" ]; then
aws_notify_simple "ERROR: Unable to get latest AOSP branch information. Stopping build. This can happen if ${AOSP_URL_BRANCH} hasn't been updated yet with newly released factory images."
exit 1
fi
fi
}
check_for_new_versions() {
log_header ${FUNCNAME}
echo "Checking if any new versions of software exist"
needs_update=false
# check stack version
existing_stack_version=$(aws s3 cp "s3://${AWS_RELEASE_BUCKET}/rattlesnakeos-stack/revision" - || true)
if [ "$existing_stack_version" == "$STACK_VERSION" ]; then
echo "Stack version ($existing_stack_version) is up to date"
else
echo "Last successful build (if there was one) is not with current stack version ${STACK_VERSION}"
needs_update=true
BUILD_REASON="'Stack version $existing_stack_version != $STACK_VERSION'"
fi
# check aosp
existing_aosp_build=$(aws s3 cp "s3://${AWS_RELEASE_BUCKET}/${DEVICE}-vendor" - || true)
if [ "$existing_aosp_build" == "$AOSP_BUILD" ]; then
echo "AOSP build ($existing_aosp_build) is up to date"
else
echo "AOSP needs to be updated to ${AOSP_BUILD}"
needs_update=true
BUILD_REASON="$BUILD_REASON 'AOSP build $existing_aosp_build != $AOSP_BUILD'"
fi
# check chromium
if [ ! -z "$CHROMIUM_PINNED_VERSION" ]; then
log "Setting LATEST_CHROMIUM to pinned version $CHROMIUM_PINNED_VERSION"
LATEST_CHROMIUM="$CHROMIUM_PINNED_VERSION"
fi
existing_chromium=$(aws s3 cp "s3://${AWS_RELEASE_BUCKET}/chromium/revision" - || true)
if [ "$existing_chromium" == "$LATEST_CHROMIUM" ]; then
echo "Chromium build ($existing_chromium) is up to date"
else
echo "Chromium needs to be updated to ${LATEST_CHROMIUM}"
needs_update=true
BUILD_REASON="$BUILD_REASON 'Chromium version $existing_chromium != $LATEST_CHROMIUM'"
fi
# check fdroid
existing_fdroid_client=$(aws s3 cp "s3://${AWS_RELEASE_BUCKET}/fdroid/revision" - || true)
if [ "$existing_fdroid_client" == "$FDROID_CLIENT_VERSION" ]; then
echo "F-Droid build ($existing_fdroid_client) is up to date"
else
echo "F-Droid needs to be updated to ${FDROID_CLIENT_VERSION}"
needs_update=true
BUILD_REASON="$BUILD_REASON 'F-Droid version $existing_fdroid_client != $FDROID_CLIENT_VERSION'"
fi
# check fdroid priv extension
existing_fdroid_priv_version=$(aws s3 cp "s3://${AWS_RELEASE_BUCKET}/fdroid-priv/revision" - || true)
if [ "$existing_fdroid_priv_version" == "$FDROID_PRIV_EXT_VERSION" ]; then
echo "F-Droid privileged extension build ($existing_fdroid_priv_version) is up to date"
else
echo "F-Droid privileged extension needs to be updated to ${FDROID_PRIV_EXT_VERSION}"
needs_update=true
BUILD_REASON="$BUILD_REASON 'F-Droid privileged extension $existing_fdroid_priv_version != $FDROID_PRIV_EXT_VERSION'"
fi
if [ "$needs_update" = true ]; then
echo "New build is required"
else
if [ "$FORCE_BUILD" = true ]; then
message="No build is required, but FORCE_BUILD=true"
echo "$message"
BUILD_REASON="$message"
elif [ "$IGNORE_VERSION_CHECKS" = true ]; then
message="No build is required, but IGNORE_VERSION_CHECKS=true"
echo "$message"
BUILD_REASON="$message"
else
aws_notify "RattlesnakeOS build not required as all components are already up to date."
exit 0
fi
fi
if [ -z "$existing_stack_version" ]; then
BUILD_REASON="Initial build"
fi
}
full_run() {
log_header ${FUNCNAME}
get_latest_versions
check_for_new_versions
initial_key_setup
aws_notify "RattlesnakeOS Build STARTED"
setup_env
check_chromium
aosp_repo_init
aosp_repo_modifications
aosp_repo_sync
aws_import_keys
if [ "${ENABLE_ATTESTATION}" == "true" ]; then
attestation_setup
fi
setup_vendor
build_fdroid
apply_patches
# only marlin and sailfish need kernel rebuilt so that verity_key is included
if [ "${DEVICE}" == "marlin" ] || [ "${DEVICE}" == "sailfish" ]; then
rebuild_marlin_kernel
fi
add_chromium
build_aosp
release "${DEVICE}"
aws_upload
checkpoint_versions
aws_notify "RattlesnakeOS Build SUCCESS"
}
add_chromium() {
log_header ${FUNCNAME}
# replace AOSP webview with latest built chromium webview
aws s3 cp "s3://${AWS_RELEASE_BUCKET}/chromium/SystemWebView.apk" ${BUILD_DIR}/external/chromium-webview/prebuilt/arm64/webview.apk
# add latest built chromium browser to external/chromium
aws s3 cp "s3://${AWS_RELEASE_BUCKET}/chromium/ChromeModernPublic.apk" ${BUILD_DIR}/external/chromium/prebuilt/arm64/
}
build_fdroid() {
log_header ${FUNCNAME}
# build it outside AOSP build tree or hit errors
git clone https://gitlab.com/fdroid/fdroidclient ${HOME}/fdroidclient
pushd ${HOME}/fdroidclient
echo "sdk.dir=${HOME}/sdk" > local.properties
echo "sdk.dir=${HOME}/sdk" > app/local.properties
git checkout $FDROID_CLIENT_VERSION
retry ./gradlew assembleRelease
cp -f app/build/outputs/apk/full/release/app-full-release-unsigned.apk ${BUILD_DIR}/packages/apps/F-Droid/F-Droid.apk
popd
}
attestation_setup() {
sudo DEBIAN_FRONTEND=noninteractive apt-get -y install libffi-dev
cd $HOME
echo "cloning beanstalk cli"
git clone https://github.com/aws/aws-elastic-beanstalk-cli-setup.git
retry ./aws-elastic-beanstalk-cli-setup/scripts/bundled_installer
PLATFORM_CERT_SHA256=$(openssl x509 -noout -fingerprint -sha256 -inform pem -in ${KEYS_DIR}/${DEVICE}/platform.x509.pem | awk -F"=" '{print $2}' | sed 's/://g')
ATTESTATION_DOMAIN=$(aws --region ${REGION} elasticbeanstalk describe-environments | jq -r '.Environments[] | select(.EnvironmentName=="attestation" and .Status!="Terminated") | .CNAME')
echo "ATTESTATION_DOMAIN: ${ATTESTATION_DOMAIN}"
echo "PLATFORM_CERT_SHA256: ${PLATFORM_CERT_SHA256}"
OG_PIXEL3_FINGERPRINT="0F9A9CC8ADE73064A54A35C5509E77994E3AA37B6FB889DD53AF82C3C570C5CF"
OG_PIXEL3_XL_FINGERPRINT="06DD526EE9B1CB92AA19D9835B68B4FF1A48A3AD31D813F27C9A7D6C271E9451"
OG_PIXEL3A_FINGERPRINT="3ADD526EE9B1CB92AA19D9835B68B4FF1A48A3AD31D813F27C9A7D6C271E9451"
PIXEL3_FINGERPRINT=${OG_PIXEL3_FINGERPRINT}
PIXEL3_XL_FINGERPRINT=${OG_PIXEL3_XL_FINGERPRINT}
PIXEL3A_FINGERPRINT=${OG_PIXEL3A_FINGERPRINT}
if [ "${DEVICE}" == "blueline" ]; then
PIXEL3_FINGERPRINT=$(cat ${KEYS_DIR}/${DEVICE}/avb_pkmd.bin | sha256sum | awk '{print $1}' | awk '{ print toupper($0) }')
fi
if [ "${DEVICE}" == "crosshatch" ]; then
PIXEL3_XL_FINGERPRINT=$(cat ${KEYS_DIR}/${DEVICE}/avb_pkmd.bin | sha256sum | awk '{print $1}' | awk '{ print toupper($0) }')
fi
if [ "${DEVICE}" == "sargo" ] || [ "${DEVICE}" == "bonito" ]; then
PIXEL3A_FINGERPRINT=$(cat ${KEYS_DIR}/${DEVICE}/avb_pkmd.bin | sha256sum | awk '{print $1}' | awk '{ print toupper($0) }')
fi
cd $HOME
echo "cloning and building auditor"
git clone https://github.com/RattlesnakeOS/Auditor.git
cd Auditor
sed -i "s/DOMAIN_NAME/${ATTESTATION_DOMAIN}/g" app/src/main/res/values/strings.xml
sed -i "s/attestation.app/${ATTESTATION_DOMAIN}/" app/src/main/java/app/attestation/auditor/RemoteVerifyJob.java
if [ "${DEVICE}" == "blueline" ]; then
sed -i "s/${OG_PIXEL3_FINGERPRINT}/${PIXEL3_FINGERPRINT}/g" app/src/main/java/app/attestation/auditor/AttestationProtocol.java
fi
if [ "${DEVICE}" == "crosshatch" ]; then
sed -i "s/${OG_PIXEL3_XL_FINGERPRINT}/${PIXEL3_XL_FINGERPRINT}/g" app/src/main/java/app/attestation/auditor/AttestationProtocol.java
fi
if [ "${DEVICE}" == "sargo" ] || [ "${DEVICE}" == "bonito" ]; then
sed -i "s/${OG_PIXEL3A_FINGERPRINT}/${PIXEL3A_FINGERPRINT}/g" app/src/main/java/app/attestation/auditor/AttestationProtocol.java
fi
sed -i "s/990E04F0864B19F14F84E0E432F7A393F297AB105A22C1E1B10B442A4A62C42C/${PLATFORM_CERT_SHA256}/" app/src/main/java/app/attestation/auditor/AttestationProtocol.java
echo "sdk.dir=${HOME}/sdk" > local.properties
echo "sdk.dir=${HOME}/sdk" > app/local.properties
./gradlew build && ./gradlew assembleRelease
mkdir -p ${BUILD_DIR}/external/Auditor/prebuilt
cp app/build/outputs/apk/release/app-release-unsigned.apk ${BUILD_DIR}/external/Auditor/prebuilt/Auditor.apk
cd $HOME
echo "cloning attestationserver"
git clone https://github.com/RattlesnakeOS/AttestationServer.git
cd AttestationServer
cat <<EOF > .ebextensions/.config
option_settings:
- option_name: DOMAIN_NAME
value: ${ATTESTATION_DOMAIN}
- option_name: FINGERPRINT_PIXEL3
value: ${PIXEL3_FINGERPRINT}
- option_name: FINGERPRINT_PIXEL3_XL
value: ${PIXEL3_XL_FINGERPRINT}
- option_name: FINGERPRINT_PIXEL3A
value: ${PIXEL3A_FINGERPRINT}
- option_name: SNS_ARN
value: ${AWS_SNS_ARN}
- option_name: REGION
value: ${REGION}
- option_name: EC2_SPOT_PRICE
value: ${ATTESTATION_MAX_SPOT_PRICE}
- option_name: S3_BACKUP_BUCKET
value: s3://${AWS_ATTESTATION_BUCKET}
- option_name: ATTESTATION_APP_SIGNATURE_DIGEST_RELEASE
value: ${PLATFORM_CERT_SHA256}
EOF
sed -i "s/STACK_NAME/${STACK_NAME}/g" .ebextensions/01-setup.config
sed -i "s/STACK_NAME/${STACK_NAME}/g" .ebextensions/sqlite-backup-restore.sh
mkdir -p .elasticbeanstalk
cat <<EOF > .elasticbeanstalk/config.yml
branch-defaults:
master:
environment: attestation
group_suffix: null
environment-defaults:
attestation:
branch: null
repository: null
global:
application_name: ${AWS_ATTESTATION_BUCKET}
branch: null
default_ec2_keyname: null
default_platform: docker
default_region: ${REGION}
include_git_submodules: true
instance_profile: null
platform_name: null
platform_version: null
profile: null
repository: null
sc: git
workspace_type: Application
EOF
echo "deploying eb environment"
$HOME/.ebcli-virtual-env/executables/eb deploy attestation -nh
}
get_encryption_key() {
additional_message=""
if [ "$(aws s3 ls "s3://${AWS_ENCRYPTED_KEYS_BUCKET}/${DEVICE}" | wc -l)" == '0' ]; then
additional_message="Since you have no encrypted signing keys in s3://${AWS_ENCRYPTED_KEYS_BUCKET}/${DEVICE} yet - new signing keys will be generated and encrypted with provided passphrase."
fi
wait_time="10m"
error_message=""
while [ 1 ]; do
aws sns publish --region ${REGION} --topic-arn "$AWS_SNS_ARN" \
--message="$(printf "%s Need to login to the EC2 instance and provide the encryption passphrase (${wait_time} timeout before shutdown). You may need to open up SSH in the default security group, see the FAQ for details. %s\n\nssh ubuntu@%s 'printf \"Enter encryption passphrase: \" && read -s k && echo \"\$k\" > %s'" "$error_message" "$additional_message" "${INSTANCE_IP}" "${ENCRYPTION_PIPE}")"
error_message=""
log "Waiting for encryption passphrase (with $wait_time timeout) to be provided over named pipe $ENCRYPTION_PIPE"
set +e
ENCRYPTION_KEY=$(timeout $wait_time cat $ENCRYPTION_PIPE)
if [ $? -ne 0 ]; then
set -e
log "Timeout ($wait_time) waiting for encryption passphrase"
aws_notify_simple "Timeout ($wait_time) waiting for encryption passphrase. Terminating build process."
exit 1
fi
set -e
if [ -z "$ENCRYPTION_KEY" ]; then
error_message="ERROR: Empty encryption passphrase received - try again."
log "$error_message"
continue
fi
log "Received encryption passphrase over named pipe $ENCRYPTION_PIPE"
if [ "$(aws s3 ls "s3://${AWS_ENCRYPTED_KEYS_BUCKET}/${DEVICE}" | wc -l)" == '0' ]; then
log "No existing encrypting keys - new keys will be generated later in build process."
else
log "Verifying encryption passphrase is valid by syncing encrypted signing keys from S3 and decrypting"
aws s3 sync "s3://${AWS_ENCRYPTED_KEYS_BUCKET}" "${KEYS_DIR}"
decryption_error=false
set +e
for f in $(find "${KEYS_DIR}" -type f -name '*.gpg'); do
output_file=$(echo $f | awk -F".gpg" '{print $1}')
log "Decrypting $f to ${output_file}..."
gpg -d --batch --passphrase "${ENCRYPTION_KEY}" $f > $output_file
if [ $? -ne 0 ]; then
log "Failed to decrypt $f"
decryption_error=true
fi
done
set -e
if [ "$decryption_error" = true ]; then
log
error_message="ERROR: Failed to decrypt signing keys with provided passphrase - try again."
log "$error_message"
continue
fi
fi
break
done
}
initial_key_setup() {
# setup in memory file system to hold keys
log "Mounting in memory filesystem at ${KEYS_DIR} to hold keys"
mkdir -p $KEYS_DIR
sudo mount -t tmpfs -o size=20m tmpfs $KEYS_DIR || true
# additional steps for getting encryption key up front
if [ "$ENCRYPTED_KEYS" = true ]; then
log "Encrypted keys option was specified"
# send warning if user has selected encrypted keys option but still has normal keys
if [ "$(aws s3 ls "s3://${AWS_KEYS_BUCKET}/${DEVICE}" | wc -l)" != '0' ]; then
if [ "$(aws s3 ls "s3://${AWS_ENCRYPTED_KEYS_BUCKET}/${DEVICE}" | wc -l)" == '0' ]; then
aws_notify_simple "It looks like you have selected --encrypted-keys option and have existing signing keys in s3://${AWS_KEYS_BUCKET}/${DEVICE} but you haven't migrated your keys to s3://${AWS_ENCRYPTED_KEYS_BUCKET}/${DEVICE}. This means new encrypted signing keys will be generated and you'll need to flash a new factory image on your device. If you want to keep your existing keys - cancel this build and follow the steps on migrating your keys in the FAQ."
fi
fi
sudo DEBIAN_FRONTEND=noninteractive apt-get -y install gpg
if [ ! -e "$ENCRYPTION_PIPE" ]; then
mkfifo $ENCRYPTION_PIPE
fi
get_encryption_key
fi
}
setup_env() {
log_header ${FUNCNAME}
# setup build dir
mkdir -p "$BUILD_DIR"
# install required packages
sudo apt-get update
sudo DEBIAN_FRONTEND=noninteractive apt-get -y install repo gperf jq openjdk-8-jdk git-core gnupg flex bison build-essential zip curl zlib1g-dev gcc-multilib g++-multilib libc6-dev-i386 lib32ncurses5-dev x11proto-core-dev libx11-dev lib32z-dev ccache libgl1-mesa-dev libxml2-utils xsltproc unzip python-networkx liblz4-tool pxz
sudo DEBIAN_FRONTEND=noninteractive apt-get -y build-dep "linux-image-$(uname --kernel-release)"
# temporary workaround as java 11 is default version and not compatible with sdkmanager
sudo update-java-alternatives --jre-headless --jre --set java-1.8.0-openjdk-amd64 || true
sudo update-java-alternatives --set java-1.8.0-openjdk-amd64 || true
# setup android sdk (required for fdroid build)
if [ ! -f "${HOME}/sdk/tools/bin/sdkmanager" ]; then
mkdir -p ${HOME}/sdk
cd ${HOME}/sdk
retry wget ${ANDROID_SDK_URL} -O sdk-tools.zip
unzip sdk-tools.zip
yes | ./tools/bin/sdkmanager --licenses
./tools/android update sdk -u --use-sdk-wrapper
# workaround for license issue with f-droid using older sdk (didn't spend time to debug issue further)
yes | ./tools/bin/sdkmanager "build-tools;27.0.3" "platforms;android-27"
fi
# setup git
git config --get --global user.name || git config --global user.name 'unknown'
git config --get --global user.email || git config --global user.email 'unknown@localhost'
git config --global color.ui true
}
check_chromium() {
log_header ${FUNCNAME}
current=$(aws s3 cp "s3://${AWS_RELEASE_BUCKET}/chromium/revision" - || true)
log "Chromium current: $current"
log "Chromium latest: $LATEST_CHROMIUM"
if [ "$LATEST_CHROMIUM" == "$current" ]; then
log "Chromium latest ($LATEST_CHROMIUM) matches current ($current)"
else
log "Building chromium $LATEST_CHROMIUM"
build_chromium $LATEST_CHROMIUM
fi
rm -rf $HOME/chromium
}
build_chromium() {
log_header ${FUNCNAME}
CHROMIUM_REVISION=$1
DEFAULT_VERSION=$(echo $CHROMIUM_REVISION | awk -F"." '{ printf "%s%03d52\n",$3,$4}')
# depot tools setup
if [ ! -d "$HOME/depot_tools" ]; then
retry git clone https://chromium.googlesource.com/chromium/tools/depot_tools.git $HOME/depot_tools
fi
export PATH="$PATH:$HOME/depot_tools"
# fetch chromium
mkdir -p $HOME/chromium
cd $HOME/chromium
fetch --nohooks android
cd src
# checkout specific revision
git checkout "$CHROMIUM_REVISION" -f
# install dependencies
echo ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true | sudo debconf-set-selections
log "Installing chromium build dependencies"
sudo ./build/install-build-deps-android.sh
# run gclient sync (runhooks will run as part of this)
log "Running gclient sync (this takes a while)"
for i in {1..5}; do
yes | gclient sync --with_branch_heads --jobs 32 -RDf && break
done
# cleanup any files in tree not part of this revision
git clean -dff
# reset any modifications
git checkout -- .
# generate configuration
mkdir -p out/Default
cat <<EOF > out/Default/args.gn
target_os = "android"
target_cpu = "arm64"
is_debug = false
is_official_build = true
is_component_build = false
symbol_level = 1
ffmpeg_branding = "Chrome"
proprietary_codecs = true
android_channel = "stable"
android_default_version_name = "$CHROMIUM_REVISION"
android_default_version_code = "$DEFAULT_VERSION"
EOF
gn gen out/Default
log "Building chromium system_webview_apk target"
autoninja -C out/Default/ system_webview_apk
log "Building chromium chrome_modern_public_apk target"
autoninja -C out/Default/ chrome_modern_public_apk
# upload to s3 for future builds
aws s3 cp "out/Default/apks/SystemWebView.apk" "s3://${AWS_RELEASE_BUCKET}/chromium/SystemWebView.apk"
aws s3 cp "out/Default/apks/ChromeModernPublic.apk" "s3://${AWS_RELEASE_BUCKET}/chromium/ChromeModernPublic.apk"
echo "${CHROMIUM_REVISION}" | aws s3 cp - "s3://${AWS_RELEASE_BUCKET}/chromium/revision"
}
aosp_repo_init() {
log_header ${FUNCNAME}
cd "${BUILD_DIR}"
repo init --manifest-url "$MANIFEST_URL" --manifest-branch "$AOSP_BRANCH" --depth 1 || true
}
aosp_repo_modifications() {
log_header ${FUNCNAME}
cd "${BUILD_DIR}"
# TODO: remove revision=dev from platform_external_chromium in future release, didn't want to break build for anyone on beta 10.x build
# make modifications to default AOSP
if ! grep -q "RattlesnakeOS" .repo/manifest.xml; then
# really ugly awk script to add additional repos to manifest
awk -i inplace \
-v ANDROID_VERSION="$ANDROID_VERSION" \
-v FDROID_CLIENT_VERSION="$FDROID_CLIENT_VERSION" \
-v FDROID_PRIV_EXT_VERSION="$FDROID_PRIV_EXT_VERSION" \
'1;/<repo-hooks in-project=/{
print " ";
print " <remote name=\"github\" fetch=\"https://github.com/RattlesnakeOS/\" revision=\"" ANDROID_VERSION "\" />";
print " <remote name=\"fdroid\" fetch=\"https://gitlab.com/fdroid/\" />";
<% if .CustomManifestRemotes %>
<% range $i, $r := .CustomManifestRemotes %>
print " <remote name=\"<% .Name %>\" fetch=\"<% .Fetch %>\" revision=\"<% .Revision %>\" />";
<% end %>
<% end %>
print " ";
<% if .CustomManifestProjects %><% range $i, $r := .CustomManifestProjects %>
print " <project path=\"<% .Path %>\" name=\"<% .Name %>\" remote=\"<% .Remote %>\" />";
<% end %>
<% end %>
<% if .EnableAttestation %>
print " <project path=\"external/Auditor\" name=\"platform_external_Auditor\" remote=\"github\" />";
<% end %>
print " <project path=\"external/chromium\" name=\"platform_external_chromium\" remote=\"github\" revision=\"dev\" />";
print " <project path=\"packages/apps/Updater\" name=\"platform_packages_apps_Updater\" remote=\"github\" />";
print " <project path=\"packages/apps/F-Droid\" name=\"platform_external_fdroid\" remote=\"github\" />";
print " <project path=\"packages/apps/F-DroidPrivilegedExtension\" name=\"privileged-extension\" remote=\"fdroid\" revision=\"refs/tags/" FDROID_PRIV_EXT_VERSION "\" />";
print " <project path=\"vendor/android-prepare-vendor\" name=\"android-prepare-vendor\" remote=\"github\" />"}' .repo/manifest.xml
# remove things from manifest
sed -i '/packages\/apps\/Browser2/d' .repo/manifest.xml
sed -i '/packages\/apps\/Calendar/d' .repo/manifest.xml
sed -i '/packages\/apps\/QuickSearchBox/d' .repo/manifest.xml
else
log "Skipping modification of .repo/manifest.xml as they have already been made"
fi
}
aosp_repo_sync() {
log_header ${FUNCNAME}
cd "${BUILD_DIR}"
# sync with retries
for i in {1..10}; do
repo sync -c --no-tags --no-clone-bundle --jobs 32 && break
done
}
setup_vendor() {
log_header ${FUNCNAME}
# new dependency to extract ota partitions
sudo DEBIAN_FRONTEND=noninteractive apt-get -y install python-protobuf
# get vendor files (with timeout)
timeout 30m "${BUILD_DIR}/vendor/android-prepare-vendor/execute-all.sh" --debugfs --keep --yes --device "${DEVICE}" --buildID "${AOSP_BUILD}" --output "${BUILD_DIR}/vendor/android-prepare-vendor"
aws s3 cp - "s3://${AWS_RELEASE_BUCKET}/${DEVICE}-vendor" --acl public-read <<< "${AOSP_BUILD}" || true
# copy vendor files to build tree
mkdir --parents "${BUILD_DIR}/vendor/google_devices" || true
rm -rf "${BUILD_DIR}/vendor/google_devices/$DEVICE" || true
mv "${BUILD_DIR}/vendor/android-prepare-vendor/${DEVICE}/$(tr '[:upper:]' '[:lower:]' <<< "${AOSP_BUILD}")/vendor/google_devices/${DEVICE}" "${BUILD_DIR}/vendor/google_devices"
# smaller devices need big brother vendor files
if [ "$DEVICE" != "$DEVICE_FAMILY" ]; then
rm -rf "${BUILD_DIR}/vendor/google_devices/$DEVICE_FAMILY" || true
mv "${BUILD_DIR}/vendor/android-prepare-vendor/$DEVICE/$(tr '[:upper:]' '[:lower:]' <<< "${AOSP_BUILD}")/vendor/google_devices/$DEVICE_FAMILY" "${BUILD_DIR}/vendor/google_devices"
fi
}
apply_patches() {
log_header ${FUNCNAME}
patch_custom
patch_aosp_removals
patch_add_apps
patch_base_config
patch_settings_app
patch_device_config
patch_updater
patch_priv_ext
patch_launcher
patch_broken_alarmclock
patch_broken_messaging
patch_disable_apex
}
# currently don't have a need for apex updates (https://source.android.com/devices/tech/ota/apex)
patch_disable_apex() {
log_header ${FUNCNAME}
# pixel 1 devices do not support apex so nothing to patch
# pixel 2 devices opt in here
sed -i 's@$(call inherit-product, $(SRC_TARGET_DIR)/product/updatable_apex.mk)@@' ${BUILD_DIR}/device/google/wahoo/device.mk
# all other devices use mainline and opt in here
sed -i 's@$(call inherit-product, $(SRC_TARGET_DIR)/product/updatable_apex.mk)@@' ${BUILD_DIR}/build/make/target/product/mainline_system.mk
}
# TODO: remove once this once fix from upstream makes it into release branch
# https://android.googlesource.com/platform/packages/apps/DeskClock/+/e6351b3b85b2f5d53d43e4797d3346ce22a5fa6f%5E%21/
patch_broken_alarmclock() {
log_header ${FUNCNAME}
if ! grep -q "android.permission.FOREGROUND_SERVICE" ${BUILD_DIR}/packages/apps/DeskClock/AndroidManifest.xml; then
sed -i '/<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" \/>/a <uses-permission android:name="android.permission.FOREGROUND_SERVICE" \/>' ${BUILD_DIR}/packages/apps/DeskClock/AndroidManifest.xml
sed -i 's@<uses-sdk android:minSdkVersion="19" android:targetSdkVersion="28" />@<uses-sdk android:minSdkVersion="19" android:targetSdkVersion="25" />@' ${BUILD_DIR}/packages/apps/DeskClock/AndroidManifest.xml
fi
}
# TODO: remove once this once fix from upstream makes it into release branch
# https://android.googlesource.com/platform/packages/apps/Messaging/+/8e71d1b707123e1b48b5529b1661d53762922400%5E%21/
patch_broken_messaging() {
log_header ${FUNCNAME}
if ! grep -q "android:targetSdkVersion=\"24\"" ${BUILD_DIR}/packages/apps/Messaging/AndroidManifest.xml; then
sed -i 's@<uses-sdk android:minSdkVersion="19" android:targetSdkVersion="28" />@<uses-sdk android:minSdkVersion="19" android:targetSdkVersion="24" />@' ${BUILD_DIR}/packages/apps/Messaging/AndroidManifest.xml
fi
}
patch_aosp_removals() {
log_header ${FUNCNAME}
# loop over all make files as these keep changing and remove components
for mk_file in ${BUILD_DIR}/build/make/target/product/*.mk; do
# remove Browser2
sed -i '/Browser2/d' ${mk_file}
# remove Calendar
sed -i '/Calendar \\/d' ${mk_file}
sed -i '/Calendar.apk/d' ${mk_file}
# remove QuickSearchBox
sed -i '/QuickSearchBox/d' ${mk_file}
done
}
# TODO: most of this is fragile and unforgiving
patch_custom() {
log_header ${FUNCNAME}
cd $BUILD_DIR
# allow custom patches to be applied
patches_dir="$HOME/patches"
<% if .CustomPatches %>
<% range $i, $r := .CustomPatches %>
retry git clone <% $r.Repo %> ${patches_dir}/<% $i %>
<% range $r.Patches %>
log "Applying patch <% . %>"
patch -p1 --no-backup-if-mismatch < ${patches_dir}/<% $i %>/<% . %>
<% end %>
<% end %>
<% end %>
# allow custom scripts to be applied
scripts_dir="$HOME/scripts"
<% if .CustomScripts %>
<% range $i, $r := .CustomScripts %>
retry git clone <% $r.Repo %> ${scripts_dir}/<% $i %>
<% range $r.Scripts %>
log "Applying shell script <% . %>"
. ${scripts_dir}/<% $i %>/<% . %>
<% end %>
<% end %>
<% end %>
# allow prebuilt applications to be added to build tree
prebuilt_dir="$BUILD_DIR/packages/apps/Custom"
<% if .CustomPrebuilts %>
<% range $i, $r := .CustomPrebuilts %>
log "Putting custom prebuilts from <% $r.Repo %> in build tree location ${prebuilt_dir}/<% $i %>"
retry git clone <% $r.Repo %> ${prebuilt_dir}/<% $i %>
<% range .Modules %>
log "Adding custom PRODUCT_PACKAGES += <% . %> to $(get_package_mk_file)"
sed -i "\$aPRODUCT_PACKAGES += <% . %>" $(get_package_mk_file)
<% end %>
<% end %>
<% end %>
# allow custom hosts file
hosts_file_location="$BUILD_DIR/system/core/rootdir/etc/hosts"
if [ -z "$HOSTS_FILE" ]; then
log "No custom hosts file requested"
else
log "Replacing hosts file with $HOSTS_FILE"
retry wget -O $hosts_file_location "$HOSTS_FILE"
fi
}
patch_base_config() {
log_header ${FUNCNAME}
# enable swipe up gesture functionality as option
sed -i 's@<bool name="config_swipe_up_gesture_setting_available">false</bool>@<bool name="config_swipe_up_gesture_setting_available">true</bool>@' ${BUILD_DIR}/frameworks/base/core/res/res/values/config.xml
}
patch_settings_app() {
log_header ${FUNCNAME}
# fix for cards not disappearing in settings app
sed -i 's@<bool name="config_use_legacy_suggestion">true</bool>@<bool name="config_use_legacy_suggestion">false</bool>@' ${BUILD_DIR}/packages/apps/Settings/res/values/config.xml
}
patch_device_config() {
log_header ${FUNCNAME}
# set proper model names
sed -i 's@PRODUCT_MODEL := AOSP on msm8996@PRODUCT_MODEL := Pixel XL@' ${BUILD_DIR}/device/google/marlin/aosp_marlin.mk
sed -i 's@PRODUCT_MANUFACTURER := google@PRODUCT_MANUFACTURER := Google@' ${BUILD_DIR}/device/google/marlin/aosp_marlin.mk
sed -i 's@PRODUCT_MODEL := AOSP on msm8996@PRODUCT_MODEL := Pixel@' ${BUILD_DIR}/device/google/marlin/aosp_sailfish.mk
sed -i 's@PRODUCT_MANUFACTURER := google@PRODUCT_MANUFACTURER := Google@' ${BUILD_DIR}/device/google/marlin/aosp_sailfish.mk
sed -i 's@PRODUCT_MODEL := AOSP on taimen@PRODUCT_MODEL := Pixel 2 XL@' ${BUILD_DIR}/device/google/taimen/aosp_taimen.mk
sed -i 's@PRODUCT_MODEL := AOSP on walleye@PRODUCT_MODEL := Pixel 2@' ${BUILD_DIR}/device/google/muskie/aosp_walleye.mk
sed -i 's@PRODUCT_MODEL := AOSP on crosshatch@PRODUCT_MODEL := Pixel 3 XL@' ${BUILD_DIR}/device/google/crosshatch/aosp_crosshatch.mk || true
sed -i 's@PRODUCT_MODEL := AOSP on blueline@PRODUCT_MODEL := Pixel 3@' ${BUILD_DIR}/device/google/crosshatch/aosp_blueline.mk || true
sed -i 's@PRODUCT_MODEL := AOSP on bonito@PRODUCT_MODEL := Pixel 3a XL@' ${BUILD_DIR}/device/google/bonito/aosp_bonito.mk || true
sed -i 's@PRODUCT_MODEL := AOSP on sargo@PRODUCT_MODEL := Pixel 3a@' ${BUILD_DIR}/device/google/bonito/aosp_sargo.mk || true
}
get_package_mk_file() {
mk_file=${BUILD_DIR}/build/make/target/product/handheld_system.mk
if [ ! -f ${mk_file} ]; then
log "Expected handheld_system.mk or core.mk do not exist"
exit 1
fi
echo ${mk_file}
}
patch_add_apps() {
log_header ${FUNCNAME}
mk_file=$(get_package_mk_file)
sed -i "\$aPRODUCT_PACKAGES += Updater" ${mk_file}
sed -i "\$aPRODUCT_PACKAGES += F-DroidPrivilegedExtension" ${mk_file}
sed -i "\$aPRODUCT_PACKAGES += F-Droid" ${mk_file}
sed -i "\$aPRODUCT_PACKAGES += chromium" ${mk_file}
if [ "${ENABLE_ATTESTATION}" == "true" ]; then
sed -i "\$aPRODUCT_PACKAGES += Auditor" ${mk_file}
fi
# add any modules defined in custom manifest projects
<% if .CustomManifestProjects %><% range $i, $r := .CustomManifestProjects %><% range $j, $q := .Modules %>
log "Adding custom PRODUCT_PACKAGES += <% $q %> to ${mk_file}"
sed -i "\$aPRODUCT_PACKAGES += <% $q %>" ${mk_file}
<% end %>
<% end %>
<% end %>
}
patch_updater() {
log_header ${FUNCNAME}
cd "$BUILD_DIR"/packages/apps/Updater/res/values
sed --in-place --expression "s@s3bucket@${RELEASE_URL}/@g" config.xml
}
fdpe_hash() {
keytool -list -printcert -file "$1" | grep 'SHA256:' | tr --delete ':' | cut --delimiter ' ' --fields 3
}
patch_priv_ext() {
log_header ${FUNCNAME}
# 0.2.9 added whitelabel support, so BuildConfig.APPLICATION_ID needs to be set now
sed -i 's@BuildConfig.APPLICATION_ID@"org.fdroid.fdroid.privileged"@' ${BUILD_DIR}/packages/apps/F-DroidPrivilegedExtension/app/src/main/java/org/fdroid/fdroid/privileged/PrivilegedService.java
unofficial_releasekey_hash=$(fdpe_hash "${KEYS_DIR}/${DEVICE}/releasekey.x509.pem")
unofficial_platform_hash=$(fdpe_hash "${KEYS_DIR}/${DEVICE}/platform.x509.pem")
sed -i 's/'${OFFICIAL_FDROID_KEY}'")/'${unofficial_releasekey_hash}'"),\n new Pair<>("org.fdroid.fdroid", "'${unofficial_platform_hash}'")/' \
"${BUILD_DIR}/packages/apps/F-DroidPrivilegedExtension/app/src/main/java/org/fdroid/fdroid/privileged/ClientWhitelist.java"
}
patch_launcher() {
log_header ${FUNCNAME}
# disable QuickSearchBox widget on home screen
sed -i.original "s/QSB_ON_FIRST_SCREEN = true;/QSB_ON_FIRST_SCREEN = false;/" "${BUILD_DIR}/packages/apps/Launcher3/src/com/android/launcher3/config/BaseFlags.java"
# fix compile error with uninitialized variable
sed -i.original "s/boolean createEmptyRowOnFirstScreen;/boolean createEmptyRowOnFirstScreen = false;/" "${BUILD_DIR}/packages/apps/Launcher3/src/com/android/launcher3/provider/ImportDataTask.java"
}
rebuild_marlin_kernel() {
log_header ${FUNCNAME}
# checkout kernel source on proper commit
mkdir -p "${MARLIN_KERNEL_SOURCE_DIR}"
retry git clone "${KERNEL_SOURCE_URL}" "${MARLIN_KERNEL_SOURCE_DIR}"
# TODO: make this a bit more robust
kernel_commit_id=$(lz4cat "${BUILD_DIR}/device/google/marlin-kernel/Image.lz4-dtb" | grep -a 'Linux version' | cut -d ' ' -f3 | cut -d'-' -f2 | sed 's/^g//g')
cd "${MARLIN_KERNEL_SOURCE_DIR}"
log "Checking out kernel commit ${kernel_commit_id}"
git checkout ${kernel_commit_id}
# run in another shell to avoid it mucking with environment variables for normal AOSP build
(
set -e;
export PATH="${BUILD_DIR}/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/bin:${PATH}";
export PATH="${BUILD_DIR}/prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.9/bin:${PATH}";
export PATH="${BUILD_DIR}/prebuilts/misc/linux-x86/lz4:${PATH}";
export PATH="${BUILD_DIR}/prebuilts/misc/linux-x86/dtc:${PATH}";
export PATH="${BUILD_DIR}/prebuilts/misc/linux-x86/libufdt:${PATH}";
ln --verbose --symbolic ${KEYS_DIR}/${DEVICE}/verity_user.der.x509 ${MARLIN_KERNEL_SOURCE_DIR}/verity_user.der.x509;
cd ${MARLIN_KERNEL_SOURCE_DIR};
make O=out ARCH=arm64 marlin_defconfig;
make -j$(nproc --all) O=out ARCH=arm64 CROSS_COMPILE=aarch64-linux-android- CROSS_COMPILE_ARM32=arm-linux-androideabi-
cp -f out/arch/arm64/boot/Image.lz4-dtb ${BUILD_DIR}/device/google/marlin-kernel/;
rm -rf ${BUILD_DIR}/out/build_*;
)
}
build_aosp() {
log_header ${FUNCNAME}
cd "$BUILD_DIR"
############################
# from original setup.sh script
############################
source build/envsetup.sh
export LANG=C
export _JAVA_OPTIONS=-XX:-UsePerfData
export BUILD_NUMBER=$(cat out/build_number.txt 2>/dev/null || date --utc +%Y.%m.%d.%H)
log "BUILD_NUMBER=$BUILD_NUMBER"
export DISPLAY_BUILD_NUMBER=true
chrt -b -p 0 $$
choosecombo $BUILD_TARGET
log "Running target-files-package"
retry make -j $(nproc) target-files-package
log "Running brillo_update_payload"
retry make -j $(nproc) brillo_update_payload
}
get_radio_image() {
grep -Po "require version-$1=\K.+" vendor/$2/vendor-board-info.txt | tr '[:upper:]' '[:lower:]'
}
release() {
log_header ${FUNCNAME}
cd "$BUILD_DIR"
############################
# from original setup.sh script
############################
source build/envsetup.sh
export LANG=C
export _JAVA_OPTIONS=-XX:-UsePerfData
export BUILD_NUMBER=$(cat out/build_number.txt 2>/dev/null || date --utc +%Y.%m.%d.%H)