Merge "16k: Sign the APKs to support 4k/16k page sizes" into main
diff --git a/Changes.md b/Changes.md
index 6c0cf70..fc15e60 100644
--- a/Changes.md
+++ b/Changes.md
@@ -1,5 +1,14 @@
# Build System Changes for Android.mk/Android.bp Writers
+## Soong genrules are now sandboxed
+
+Previously, soong genrules could access any files in the source tree, without specifying them as
+inputs. This makes them incorrect in incremental builds, and incompatible with RBE and Bazel.
+
+Now, genrules are sandboxed so they can only access their listed srcs. Modules denylisted in
+genrule/allowlists.go are exempt from this. You can also set `BUILD_BROKEN_GENRULE_SANDBOXING`
+in board config to disable this behavior.
+
## Partitions are no longer affected by previous builds
Partition builds used to include everything in their staging directories, and building an
diff --git a/core/Makefile b/core/Makefile
index 453a013..a253026 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -1060,9 +1060,16 @@
BUILT_RAMDISK_16K_TARGET := $(PRODUCT_OUT)/ramdisk_16k.img
RAMDISK_16K_STAGING_DIR := $(call intermediates-dir-for,PACKAGING,depmod_ramdisk_16k)
+ifneq ($(BOARD_SYSTEM_KERNEL_MODULES),)
+SYSTEM_DLKM_MODULE_PATTERNS := $(foreach path,$(BOARD_SYSTEM_KERNEL_MODULES),%/$(notdir $(path)))
+
+endif
+
+# For non-GKI modules, strip them before install. As debug symbols take up
+# significant space.
$(foreach \
file,\
- $(BOARD_KERNEL_MODULES_16K),\
+ $(filter-out $(SYSTEM_DLKM_MODULE_PATTERNS),$(BOARD_KERNEL_MODULES_16K)),\
$(eval \
$(call copy-and-strip-kernel-module,\
$(file),\
@@ -1071,6 +1078,20 @@
) \
)
+# For GKI modules, copy as-is without stripping, because stripping would
+# remove the signature of kernel modules, and GKI modules must be signed
+# for kernel to load them.
+$(foreach \
+ file,\
+ $(filter $(SYSTEM_DLKM_MODULE_PATTERNS),$(BOARD_KERNEL_MODULES_16K)),\
+ $(eval \
+ $(call copy-one-file,\
+ $(file),\
+ $(RAMDISK_16K_STAGING_DIR)/lib/modules/0.0/$(notdir $(file)) \
+ ) \
+ ) \
+)
+
BOARD_VENDOR_RAMDISK_FRAGMENT.16K.PREBUILT := $(BUILT_RAMDISK_16K_TARGET)
$(BUILT_RAMDISK_16K_TARGET): $(DEPMOD) $(MKBOOTFS) $(EXTRACT_KERNEL) $(COMPRESSION_COMMAND_DEPS)
@@ -2110,6 +2131,7 @@
$(if $(BOARD_$(_var)IMAGE_EROFS_COMPRESSOR),$(hide) echo "$(1)_erofs_compressor=$(BOARD_$(_var)IMAGE_EROFS_COMPRESSOR)" >> $(2))
$(if $(BOARD_$(_var)IMAGE_EROFS_COMPRESS_HINTS),$(hide) echo "$(1)_erofs_compress_hints=$(BOARD_$(_var)IMAGE_EROFS_COMPRESS_HINTS)" >> $(2))
$(if $(BOARD_$(_var)IMAGE_EROFS_PCLUSTER_SIZE),$(hide) echo "$(1)_erofs_pcluster_size=$(BOARD_$(_var)IMAGE_EROFS_PCLUSTER_SIZE)" >> $(2))
+$(if $(BOARD_$(_var)IMAGE_EROFS_BLOCKSIZE),$(hide) echo "$(1)_erofs_blocksize=$(BOARD_$(_var)IMAGE_EROFS_BLOCKSIZE)" >> $(2))
$(if $(BOARD_$(_var)IMAGE_EXTFS_INODE_COUNT),$(hide) echo "$(1)_extfs_inode_count=$(BOARD_$(_var)IMAGE_EXTFS_INODE_COUNT)" >> $(2))
$(if $(BOARD_$(_var)IMAGE_EXTFS_RSV_PCT),$(hide) echo "$(1)_extfs_rsv_pct=$(BOARD_$(_var)IMAGE_EXTFS_RSV_PCT)" >> $(2))
$(if $(BOARD_$(_var)IMAGE_F2FS_SLOAD_COMPRESS_FLAGS),$(hide) echo "$(1)_f2fs_sldc_flags=$(BOARD_$(_var)IMAGE_F2FS_SLOAD_COMPRESS_FLAGS)" >> $(2))
@@ -2199,6 +2221,7 @@
$(if $(BOARD_EROFS_COMPRESSOR),$(hide) echo "erofs_default_compressor=$(BOARD_EROFS_COMPRESSOR)" >> $(1))
$(if $(BOARD_EROFS_COMPRESS_HINTS),$(hide) echo "erofs_default_compress_hints=$(BOARD_EROFS_COMPRESS_HINTS)" >> $(1))
$(if $(BOARD_EROFS_PCLUSTER_SIZE),$(hide) echo "erofs_pcluster_size=$(BOARD_EROFS_PCLUSTER_SIZE)" >> $(1))
+$(if $(BOARD_EROFS_BLOCKSIZE),$(hide) echo "erofs_blocksize=$(BOARD_EROFS_BLOCKSIZE)" >> $(1))
$(if $(BOARD_EROFS_SHARE_DUP_BLOCKS),$(hide) echo "erofs_share_dup_blocks=$(BOARD_EROFS_SHARE_DUP_BLOCKS)" >> $(1))
$(if $(BOARD_EROFS_USE_LEGACY_COMPRESSION),$(hide) echo "erofs_use_legacy_compression=$(BOARD_EROFS_USE_LEGACY_COMPRESSION)" >> $(1))
$(if $(BOARD_EXT4_SHARE_DUP_BLOCKS),$(hide) echo "ext4_share_dup_blocks=$(BOARD_EXT4_SHARE_DUP_BLOCKS)" >> $(1))
@@ -5049,8 +5072,11 @@
APEX_INFO_FILE := $(APEX_OUT)/apex-info-list.xml
# apexd_host scans/activates APEX files and writes /apex/apex-info-list.xml
+# Note that `@echo $(PRIVATE_APEX_FILES)` line is added to trigger the rule when the APEX list is changed.
+$(APEX_INFO_FILE): PRIVATE_APEX_FILES := $(apex_files)
$(APEX_INFO_FILE): $(HOST_OUT_EXECUTABLES)/apexd_host $(apex_files)
@echo "Extracting apexes..."
+ @echo $(PRIVATE_APEX_FILES) > /dev/null
@rm -rf $(APEX_OUT)
@mkdir -p $(APEX_OUT)
$< --vendor_path $(TARGET_OUT_VENDOR) \
diff --git a/core/board_config.mk b/core/board_config.mk
index eb4c5ec..a0e5d36 100644
--- a/core/board_config.mk
+++ b/core/board_config.mk
@@ -188,6 +188,7 @@
BUILD_BROKEN_VENDOR_PROPERTY_NAMESPACE \
BUILD_BROKEN_VINTF_PRODUCT_COPY_FILES \
BUILD_BROKEN_INCORRECT_PARTITION_IMAGES \
+ BUILD_BROKEN_GENRULE_SANDBOXING \
_build_broken_var_list += \
$(foreach m,$(AVAILABLE_BUILD_MODULE_TYPES) \
diff --git a/core/definitions.mk b/core/definitions.mk
index b6b0d69..ebc6c6e 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -2955,7 +2955,7 @@
ifeq ($(HOST_OS),linux)
# Runs appcompat and store logs in $(PRODUCT_OUT)/appcompat
define extract-package
-$(AAPT2) dump resources $@ | awk -F ' |=' '/^Package/{print $$3}' >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log &&
+$(AAPT2) dump resources $@ | awk -F ' |=' '/^Package/{print $$3; exit}' >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log &&
endef
define appcompat-header
$(hide) \
diff --git a/core/packaging/flags.mk b/core/packaging/flags.mk
index ca319ce..a7e8d35 100644
--- a/core/packaging/flags.mk
+++ b/core/packaging/flags.mk
@@ -72,42 +72,28 @@
# $(1): built aconfig flags file (out)
# $(2): installed aconfig flags file (out)
# $(3): input aconfig files for the partition (in)
-# $(4): file format, passed to `aconfig dump` (in)
-# $(5): text placed in aconfig file when no flags present (out)
define generate-partition-aconfig-flag-file
$(eval $(strip $(1)): PRIVATE_OUT := $(strip $(1)))
$(eval $(strip $(1)): PRIVATE_IN := $(strip $(3)))
$(strip $(1)): $(ACONFIG) $(strip $(3))
mkdir -p $$(dir $$(PRIVATE_OUT))
$$(if $$(PRIVATE_IN), \
- $$(ACONFIG) dump --format $(4) --out $$(PRIVATE_OUT) \
+ $$(ACONFIG) dump --format protobuf --out $$(PRIVATE_OUT) \
$$(addprefix --cache ,$$(PRIVATE_IN)), \
- echo $(5) > $$(PRIVATE_OUT) \
+ echo -n > $$(PRIVATE_OUT) \
)
$(call copy-one-file, $(1), $(2))
endef
$(foreach partition, $(_FLAG_PARTITIONS), \
- $(eval aconfig_flag_summaries_textproto.$(partition) := $(PRODUCT_OUT)/$(partition)/etc/aconfig_flags.textproto) \
$(eval aconfig_flag_summaries_protobuf.$(partition) := $(PRODUCT_OUT)/$(partition)/etc/aconfig_flags.pb) \
$(eval $(call generate-partition-aconfig-flag-file, \
- $(TARGET_OUT_FLAGS)/$(partition)/aconfig_flags.textproto, \
- $(aconfig_flag_summaries_textproto.$(partition)), \
- $(sort $(foreach m,$(call register-names-for-partition, $(partition)), \
- $(ALL_MODULES.$(m).ACONFIG_FILES) \
- )), \
- textproto, \
- "# No aconfig flags" \
- )) \
- $(eval $(call generate-partition-aconfig-flag-file, \
$(TARGET_OUT_FLAGS)/$(partition)/aconfig_flags.pb, \
$(aconfig_flag_summaries_protobuf.$(partition)), \
$(sort $(foreach m,$(call register-names-for-partition, $(partition)), \
$(ALL_MODULES.$(m).ACONFIG_FILES) \
)), \
- protobuf, \
- "" \
)) \
)
@@ -117,7 +103,6 @@
required_flags_files := \
$(sort $(foreach partition, $(filter $(IMAGES_TO_BUILD), $(_FLAG_PARTITIONS)), \
$(build_flag_summaries.$(partition)) \
- $(aconfig_flag_summaries_textproto.$(partition)) \
$(aconfig_flag_summaries_protobuf.$(partition)) \
))
@@ -133,7 +118,6 @@
required_flags_files:=
$(foreach partition, $(_FLAG_PARTITIONS), \
$(eval build_flag_summaries.$(partition):=) \
- $(eval aconfig_flag_summaries_textproto.$(partition):=) \
$(eval aconfig_flag_summaries_protobuf.$(partition):=) \
)
diff --git a/core/release_config.bzl b/core/release_config.bzl
index a2f59e6..0c08858 100644
--- a/core/release_config.bzl
+++ b/core/release_config.bzl
@@ -11,6 +11,9 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
+"""
+Export build flags (with values) to make.
+"""
load("//build/bazel/utils:schema_validation.bzl", "validate")
@@ -73,7 +76,16 @@
}
def flag(name, partitions, default):
- "Declare a flag."
+ """Declare a flag.
+
+ Args:
+ name: name of the flag
+ partitions: the partitions where this should be recorded.
+ default: the default value of the flag.
+
+ Returns:
+ A dictionary containing the flag declaration.
+ """
if not partitions:
fail("At least 1 partition is required")
if not name.startswith("RELEASE_"):
@@ -96,14 +108,29 @@
}
def value(name, value):
- "Define the flag value for a particular configuration."
+ """Define the flag value for a particular configuration.
+
+ Args:
+ name: The name of the flag.
+ value: The value for the flag.
+
+ Returns:
+ A dictionary containing the name and value to be used.
+ """
return {
"name": name,
"value": value,
}
def _format_value(val):
- "Format the starlark type correctly for make"
+ """Format the starlark type correctly for make.
+
+ Args:
+ val: The value to format
+
+ Returns:
+ The value, formatted correctly for make.
+ """
if type(val) == "NoneType":
return ""
elif type(val) == "bool":
@@ -112,7 +139,15 @@
return val
def release_config(all_flags, all_values):
- "Return the make variables that should be set for this release config."
+ """Return the make variables that should be set for this release config.
+
+ Args:
+ all_flags: A list of flag objects (from flag() calls).
+ all_values: A list of value objects (from value() calls).
+
+ Returns:
+ A dictionary of {name: value} variables for make.
+ """
validate(all_flags, _all_flags_schema)
validate(all_values, _all_values_schema)
diff --git a/core/soong_config.mk b/core/soong_config.mk
index e541c12..be6a795 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -8,6 +8,7 @@
ifndef AFDO_PROFILES
# Set AFDO_PROFILES
-include vendor/google_data/pgo_profile/sampling/afdo_profiles.mk
+include toolchain/pgo-profiles/sampling/afdo_profiles.mk
else
$(error AFDO_PROFILES can only be set from soong_config.mk. For product-specific fdo_profiles, please use PRODUCT_AFDO_PROFILES)
endif
@@ -15,6 +16,10 @@
# PRODUCT_AFDO_PROFILES takes precedence over product-agnostic profiles in AFDO_PROFILES
ALL_AFDO_PROFILES := $(PRODUCT_AFDO_PROFILES) $(AFDO_PROFILES)
+ifneq (,$(filter-out environment undefined,$(origin GENRULE_SANDBOXING)))
+ $(error GENRULE_SANDBOXING can only be provided via an environment variable, use BUILD_BROKEN_GENRULE_SANDBOXING to disable genrule sandboxing in board config)
+endif
+
ifeq ($(WRITE_SOONG_VARIABLES),true)
# Create soong.variables with copies of makefile settings. Runs every build,
@@ -280,7 +285,8 @@
$(call add_json_bool, BuildBrokenClangProperty, $(filter true,$(BUILD_BROKEN_CLANG_PROPERTY)))
$(call add_json_bool, BuildBrokenClangAsFlags, $(filter true,$(BUILD_BROKEN_CLANG_ASFLAGS)))
$(call add_json_bool, BuildBrokenClangCFlags, $(filter true,$(BUILD_BROKEN_CLANG_CFLAGS)))
-$(call add_json_bool, GenruleSandboxing, $(filter true,$(GENRULE_SANDBOXING)))
+# Use the value of GENRULE_SANDBOXING if set, otherwise use the inverse of BUILD_BROKEN_GENRULE_SANDBOXING
+$(call add_json_bool, GenruleSandboxing, $(if $(GENRULE_SANDBOXING),$(filter true,$(GENRULE_SANDBOXING)),$(if $(filter true,$(BUILD_BROKEN_GENRULE_SANDBOXING)),,true)))
$(call add_json_bool, BuildBrokenEnforceSyspropOwner, $(filter true,$(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER)))
$(call add_json_bool, BuildBrokenTrebleSyspropNeverallow, $(filter true,$(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW)))
$(call add_json_bool, BuildBrokenUsesSoongPython2Modules, $(filter true,$(BUILD_BROKEN_USES_SOONG_PYTHON2_MODULES)))
@@ -313,7 +319,7 @@
$(call add_json_list, BuildVersionTags, $(BUILD_VERSION_TAGS))
$(call add_json_str, ReleaseVersion, $(_RELEASE_VERSION))
-$(call add_json_str, ReleaseAconfigValueSets, $(RELEASE_ACONFIG_VALUE_SETS))
+$(call add_json_list, ReleaseAconfigValueSets, $(RELEASE_ACONFIG_VALUE_SETS))
$(call add_json_str, ReleaseAconfigFlagDefaultPermission, $(RELEASE_ACONFIG_FLAG_DEFAULT_PERMISSION))
$(call add_json_bool, ReleaseDefaultModuleBuildFromSource, $(RELEASE_DEFAULT_MODULE_BUILD_FROM_SOURCE))
@@ -380,6 +386,8 @@
$(call add_json_bool, CopyImagesForTargetFilesZip, $(filter true,$(COPY_IMAGES_FOR_TARGET_FILES_ZIP)))
$(call add_json_bool, BoardAvbEnable, $(filter true,$(BOARD_AVB_ENABLE)))
+
+ $(call add_json_list, ProductPackages, $(sort $(PRODUCT_PACKAGES)))
$(call end_json_map)
$(call add_json_bool, NextReleaseHideFlaggedApi, $(filter true,$(PRODUCT_NEXT_RELEASE_HIDE_FLAGGED_API)))
diff --git a/core/version_util.mk b/core/version_util.mk
index 4b069db..0cc3442 100644
--- a/core/version_util.mk
+++ b/core/version_util.mk
@@ -92,11 +92,21 @@
# this variable also includes future codenames. For example, while AOSP is still
# merging into U, but V development has started, ALL_CODENAMES will only be U,
# but ALL_PREVIEW_CODENAMES will be U and V.
+#
+# REL is filtered out of the list. The codename of the current release is
+# replaced by "REL" when the build is configured as a release rather than a
+# preview. For example, PLATFORM_VERSION_CODENAME.UpsideDownCake will be "REL"
+# rather than UpsideDownCake in a -next target when the upcoming release is
+# UpsideDownCake. "REL" is a codename (and android.os.Build relies on this:
+# https://cs.android.com/android/platform/superproject/main/+/main:frameworks/base/core/java/android/os/Build.java;l=484-487;drc=316e3d16c9f34212f3beace7695289651d15a071),
+# so it should be in PLATFORM_VERSION_ALL_CODENAMES, but it definitely is not a
+# preview codename.
PLATFORM_VERSION_ALL_PREVIEW_CODENAMES :=
$(foreach version,$(ALL_VERSIONS),\
$(eval _codename := $(PLATFORM_VERSION_CODENAME.$(version)))\
- $(if $(filter $(_codename),$(PLATFORM_VERSION_ALL_PREVIEW_CODENAMES)),,\
- $(eval PLATFORM_VERSION_ALL_PREVIEW_CODENAMES += $(_codename))))
+ $(if $(filter REL,$(_codename)),,\
+ $(if $(filter $(_codename),$(PLATFORM_VERSION_ALL_PREVIEW_CODENAMES)),,\
+ $(eval PLATFORM_VERSION_ALL_PREVIEW_CODENAMES += $(_codename)))))
# And convert from space separated to comma separated.
PLATFORM_VERSION_ALL_CODENAMES := \
diff --git a/envsetup.sh b/envsetup.sh
index 63837ec..9d27c9d 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -1613,8 +1613,8 @@
# Return the Bazel label of a Soong module if it is converted with bp2build.
function bmod()
(
- if [ $# -ne 1 ]; then
- echo "usage: bmod <module>" >&2
+ if [ $# -eq 0 ]; then
+ echo "usage: bmod <module 1> <module 2> ... <module n>" >&2
return 1
fi
@@ -1631,19 +1631,24 @@
return 1
fi
- local target_label=$(python3 -c "import json
-module = '$1'
+ modules=()
+ for m in "$@"; do
+ modules+=("\"$m\",")
+ done
+ local res=$(python3 -c "import json
+modules = [${modules[*]}]
converted_json='$converted_json'
bp2build_converted_map = json.load(open(converted_json))
-if module not in bp2build_converted_map:
- exit(1)
-print(bp2build_converted_map[module] + ':' + module)")
+for module in modules:
+ if module not in bp2build_converted_map:
+ print(module + ' is not converted to Bazel.')
+ else:
+ print(bp2build_converted_map[module] + ':' + module)")
- if [ -z "${target_label}" ]; then
- echo "$1 is not converted to Bazel." >&2
- return 1
- else
- echo "${target_label}"
+ echo "${res}"
+ unconverted_count=$(echo "${res}" | grep -c "not converted to Bazel")
+ if [[ ${unconverted_count} -ne 0 ]]; then
+ return 1
fi
)
diff --git a/target/board/emulator_arm/AndroidBoard.mk b/target/board/emulator_arm/AndroidBoard.mk
deleted file mode 100644
index 7911f61..0000000
--- a/target/board/emulator_arm/AndroidBoard.mk
+++ /dev/null
@@ -1 +0,0 @@
-LOCAL_PATH := $(call my-dir)
diff --git a/target/board/emulator_arm/BoardConfig.mk b/target/board/emulator_arm/BoardConfig.mk
deleted file mode 100644
index 287824f..0000000
--- a/target/board/emulator_arm/BoardConfig.mk
+++ /dev/null
@@ -1,37 +0,0 @@
-# Copyright (C) 2020 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# arm emulator specific definitions
-TARGET_ARCH := arm
-TARGET_ARCH_VARIANT := armv7-a-neon
-TARGET_CPU_VARIANT := generic
-TARGET_CPU_ABI := armeabi-v7a
-TARGET_CPU_ABI2 := armeabi
-
-include build/make/target/board/BoardConfigGsiCommon.mk
-include build/make/target/board/BoardConfigEmuCommon.mk
-
-BOARD_USERDATAIMAGE_PARTITION_SIZE := 576716800
-
-# Wifi.
-BOARD_WLAN_DEVICE := emulator
-BOARD_HOSTAPD_DRIVER := NL80211
-BOARD_WPA_SUPPLICANT_DRIVER := NL80211
-BOARD_HOSTAPD_PRIVATE_LIB := lib_driver_cmd_simulated
-BOARD_WPA_SUPPLICANT_PRIVATE_LIB := lib_driver_cmd_simulated
-WPA_SUPPLICANT_VERSION := VER_0_8_X
-WIFI_DRIVER_FW_PATH_PARAM := "/dev/null"
-WIFI_DRIVER_FW_PATH_STA := "/dev/null"
-WIFI_DRIVER_FW_PATH_AP := "/dev/null"
diff --git a/target/board/emulator_arm/device.mk b/target/board/emulator_arm/device.mk
deleted file mode 100644
index af023eb..0000000
--- a/target/board/emulator_arm/device.mk
+++ /dev/null
@@ -1,18 +0,0 @@
-#
-# Copyright (C) 2020 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
-PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
diff --git a/target/board/emulator_arm/system_ext.prop b/target/board/emulator_arm/system_ext.prop
deleted file mode 100644
index 64829f3..0000000
--- a/target/board/emulator_arm/system_ext.prop
+++ /dev/null
@@ -1,5 +0,0 @@
-#
-# system.prop for generic sdk
-#
-
-rild.libpath=/vendor/lib/libreference-ril.so
diff --git a/target/board/emulator_x86/BoardConfig.mk b/target/board/emulator_x86/BoardConfig.mk
deleted file mode 100644
index 8f79166..0000000
--- a/target/board/emulator_x86/BoardConfig.mk
+++ /dev/null
@@ -1,40 +0,0 @@
-# Copyright (C) 2020 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# x86 emulator specific definitions
-TARGET_CPU_ABI := x86
-TARGET_ARCH := x86
-TARGET_ARCH_VARIANT := x86
-
-TARGET_PRELINK_MODULE := false
-
-include build/make/target/board/BoardConfigGsiCommon.mk
-include build/make/target/board/BoardConfigEmuCommon.mk
-
-# Resize to 4G to accommodate ASAN and CTS
-BOARD_USERDATAIMAGE_PARTITION_SIZE := 4294967296
-
-BOARD_SEPOLICY_DIRS += device/generic/goldfish/sepolicy/x86
-
-# Wifi.
-BOARD_WLAN_DEVICE := emulator
-BOARD_HOSTAPD_DRIVER := NL80211
-BOARD_WPA_SUPPLICANT_DRIVER := NL80211
-BOARD_HOSTAPD_PRIVATE_LIB := lib_driver_cmd_simulated
-BOARD_WPA_SUPPLICANT_PRIVATE_LIB := lib_driver_cmd_simulated
-WPA_SUPPLICANT_VERSION := VER_0_8_X
-WIFI_DRIVER_FW_PATH_PARAM := "/dev/null"
-WIFI_DRIVER_FW_PATH_STA := "/dev/null"
-WIFI_DRIVER_FW_PATH_AP := "/dev/null"
diff --git a/target/board/emulator_x86/device.mk b/target/board/emulator_x86/device.mk
deleted file mode 100644
index 8a9d8da..0000000
--- a/target/board/emulator_x86/device.mk
+++ /dev/null
@@ -1,27 +0,0 @@
-#
-# Copyright (C) 2020 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
-PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
-
-ifdef NET_ETH0_STARTONBOOT
- PRODUCT_VENDOR_PROPERTIES += net.eth0.startonboot=1
-endif
-
-# Ensure we package the BIOS files too.
-PRODUCT_HOST_PACKAGES += \
- bios.bin \
- vgabios-cirrus.bin \
diff --git a/target/board/emulator_x86/system_ext.prop b/target/board/emulator_x86/system_ext.prop
deleted file mode 100644
index 64829f3..0000000
--- a/target/board/emulator_x86/system_ext.prop
+++ /dev/null
@@ -1,5 +0,0 @@
-#
-# system.prop for generic sdk
-#
-
-rild.libpath=/vendor/lib/libreference-ril.so
diff --git a/target/product/AndroidProducts.mk b/target/product/AndroidProducts.mk
index 473a275..c3bc14b 100644
--- a/target/product/AndroidProducts.mk
+++ b/target/product/AndroidProducts.mk
@@ -66,14 +66,9 @@
$(LOCAL_DIR)/mainline_system_x86_64.mk \
$(LOCAL_DIR)/mainline_system_x86_arm.mk \
$(LOCAL_DIR)/ndk.mk \
- $(LOCAL_DIR)/sdk_arm64.mk \
$(LOCAL_DIR)/sdk.mk \
$(LOCAL_DIR)/sdk_phone_arm64.mk \
- $(LOCAL_DIR)/sdk_phone_armv7.mk \
$(LOCAL_DIR)/sdk_phone_x86_64.mk \
- $(LOCAL_DIR)/sdk_phone_x86.mk \
- $(LOCAL_DIR)/sdk_x86_64.mk \
- $(LOCAL_DIR)/sdk_x86.mk \
endif
diff --git a/target/product/base_system.mk b/target/product/base_system.mk
index aa08002..328eeb2 100644
--- a/target/product/base_system.mk
+++ b/target/product/base_system.mk
@@ -53,6 +53,7 @@
com.android.btservices \
com.android.configinfrastructure \
com.android.conscrypt \
+ com.android.crashrecovery \
com.android.devicelock \
com.android.extservices \
com.android.healthfitness \
@@ -294,7 +295,7 @@
# These packages are not used on Android TV
ifneq ($(PRODUCT_IS_ATV),true)
PRODUCT_PACKAGES += \
- SoundPicker \
+ $(RELEASE_PACKAGE_SOUND_PICKER) \
endif
diff --git a/target/product/default_art_config.mk b/target/product/default_art_config.mk
index 04e9748..f7c92aa 100644
--- a/target/product/default_art_config.mk
+++ b/target/product/default_art_config.mk
@@ -65,6 +65,7 @@
com.android.btservices:framework-bluetooth \
com.android.configinfrastructure:framework-configinfrastructure \
com.android.conscrypt:conscrypt \
+ com.android.crashrecovery:framework-crashrecovery \
com.android.devicelock:framework-devicelock \
com.android.healthfitness:framework-healthfitness \
com.android.i18n:core-icu4j \
@@ -93,6 +94,7 @@
com.android.appsearch:service-appsearch \
com.android.art:service-art \
com.android.configinfrastructure:service-configinfrastructure \
+ com.android.crashrecovery:service-crashrecovery \
com.android.healthfitness:service-healthfitness \
com.android.media:service-media-s \
com.android.ondevicepersonalization:service-ondevicepersonalization \
diff --git a/target/product/generic_system.mk b/target/product/generic_system.mk
index ab36eb1..6d40436 100644
--- a/target/product/generic_system.mk
+++ b/target/product/generic_system.mk
@@ -104,10 +104,6 @@
libpolicy-subsystem
-ifneq ($(KEEP_VNDK),true)
-PRODUCT_PACKAGES += llndk.libraries.txt
-endif
-
# Include all zygote init scripts. "ro.zygote" will select one of them.
PRODUCT_COPY_FILES += \
system/core/rootdir/init.zygote32.rc:system/etc/init/hw/init.zygote32.rc \
diff --git a/target/product/gsi/Android.mk b/target/product/gsi/Android.mk
index 655a666..fa3d1da 100644
--- a/target/product/gsi/Android.mk
+++ b/target/product/gsi/Android.mk
@@ -230,7 +230,9 @@
# Filter LLNDK libs moved to APEX to avoid pulling them into /system/LIB
LOCAL_REQUIRED_MODULES := \
- $(filter-out $(LLNDK_MOVED_TO_APEX_LIBRARIES),$(LLNDK_LIBRARIES))
+ $(filter-out $(LLNDK_MOVED_TO_APEX_LIBRARIES),$(LLNDK_LIBRARIES)) \
+ llndk.libraries.txt
+
include $(BUILD_PHONY_PACKAGE)
diff --git a/target/product/handheld_system.mk b/target/product/handheld_system.mk
index 6c93dd7..00b62bc 100644
--- a/target/product/handheld_system.mk
+++ b/target/product/handheld_system.mk
@@ -40,6 +40,7 @@
BuiltInPrintService \
CalendarProvider \
cameraserver \
+ com.android.nfcservices \
CameraExtensionsProxy \
CaptivePortalLogin \
CertInstaller \
@@ -56,7 +57,6 @@
MmsService \
MtpService \
MusicFX \
- NfcNci \
PacProcessor \
preinstalled-packages-platform-handheld-system.xml \
PrintRecommendationService \
diff --git a/target/product/sdk.mk b/target/product/sdk.mk
index e4cb7ff..fff8d4c 100644
--- a/target/product/sdk.mk
+++ b/target/product/sdk.mk
@@ -14,8 +14,19 @@
# limitations under the License.
#
-# Don't modify this file - It's just an alias!
+# This is a simple product that uses configures the minimum amount
+# needed to build the SDK (without the emulator).
-$(call inherit-product, $(SRC_TARGET_DIR)/product/sdk_x86.mk)
+# In order to build the bootclasspath sources, the bootclasspath needs to
+# be setup via default_art_config.mk. The sources only really make sense
+# together with a device (e.g. the emulator). So if the SDK sources change
+# to be built with the device, this could be removed.
+$(call inherit-product, $(SRC_TARGET_DIR)/product/default_art_config.mk)
+
+$(call inherit-product, $(SRC_TARGET_DIR)/product/languages_default.mk)
PRODUCT_NAME := sdk
+PRODUCT_BRAND := Android
+PRODUCT_DEVICE := mainline_x86
+
+PRODUCT_NEXT_RELEASE_HIDE_FLAGGED_API := true
diff --git a/target/product/sdk_arm64.mk b/target/product/sdk_arm64.mk
deleted file mode 100644
index 3eb9304..0000000
--- a/target/product/sdk_arm64.mk
+++ /dev/null
@@ -1,26 +0,0 @@
-#
-# Copyright (C) 2014 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-$(call inherit-product, $(SRC_TARGET_DIR)/product/languages_default.mk)
-
-TARGET_SUPPORTS_32_BIT_APPS := true
-TARGET_SUPPORTS_64_BIT_APPS := true
-
-PRODUCT_NAME := sdk_arm64
-PRODUCT_BRAND := Android
-PRODUCT_DEVICE := mainline_arm64
-
-PRODUCT_NEXT_RELEASE_HIDE_FLAGGED_API := true
diff --git a/target/product/sdk_phone_armv7.mk b/target/product/sdk_phone_armv7.mk
deleted file mode 100644
index 293b1ea..0000000
--- a/target/product/sdk_phone_armv7.mk
+++ /dev/null
@@ -1,66 +0,0 @@
-#
-# Copyright (C) 2007 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-PRODUCT_USE_DYNAMIC_PARTITIONS := true
-
-# This is a build configuration for a full-featured build of the
-# Open-Source part of the tree. It's geared toward a US-centric
-# build quite specifically for the emulator, and might not be
-# entirely appropriate to inherit from for on-device configurations.
-
-# Enable mainline checking for exact this product name
-ifeq (sdk_phone_armv7,$(TARGET_PRODUCT))
-PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
-endif
-
-#
-# All components inherited here go to system image
-#
-$(call inherit-product, $(SRC_TARGET_DIR)/product/generic_system.mk)
-
-#
-# All components inherited here go to system_ext image
-#
-$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
-
-#
-# All components inherited here go to product image
-#
-$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
-
-#
-# All components inherited here go to vendor image
-#
-$(call inherit-product-if-exists, build/make/target/product/ramdisk_stub.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/board/emulator_arm/device.mk)
-
-# keep this apk for sdk targets for now
-PRODUCT_PACKAGES += \
- EmulatorSmokeTests
-
-
-# Overrides
-PRODUCT_BRAND := Android
-PRODUCT_NAME := sdk_phone_armv7
-PRODUCT_DEVICE := emulator_arm
-PRODUCT_MODEL := Android SDK built for arm
-# Disable <uses-library> checks for SDK product. It lacks some libraries (e.g.
-# RadioConfigLib), which makes it impossible to translate their module names to
-# library name, so the check fails.
-PRODUCT_BROKEN_VERIFY_USES_LIBRARIES := true
-
-PRODUCT_NEXT_RELEASE_HIDE_FLAGGED_API := true
diff --git a/target/product/sdk_phone_x86.mk b/target/product/sdk_phone_x86.mk
deleted file mode 100644
index 90cd8d5..0000000
--- a/target/product/sdk_phone_x86.mk
+++ /dev/null
@@ -1,61 +0,0 @@
-#
-# Copyright (C) 2009 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-PRODUCT_USE_DYNAMIC_PARTITIONS := true
-
-# This is a build configuration for a full-featured build of the
-# Open-Source part of the tree. It's geared toward a US-centric
-# build quite specifically for the emulator, and might not be
-# entirely appropriate to inherit from for on-device configurations.
-
-#
-# All components inherited here go to system image
-#
-$(call inherit-product, $(SRC_TARGET_DIR)/product/generic_system.mk)
-
-# Enable mainline checking for exact this product name
-ifeq (sdk_phone_x86,$(TARGET_PRODUCT))
-PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
-endif
-
-#
-# All components inherited here go to system_ext image
-#
-$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
-
-#
-# All components inherited here go to product image
-#
-$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
-
-#
-# All components inherited here go to vendor image
-#
-$(call inherit-product-if-exists, device/generic/goldfish/x86-vendor.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/board/emulator_x86/device.mk)
-
-# Overrides
-PRODUCT_BRAND := Android
-PRODUCT_NAME := sdk_phone_x86
-PRODUCT_DEVICE := emulator_x86
-PRODUCT_MODEL := Android SDK built for x86
-# Disable <uses-library> checks for SDK product. It lacks some libraries (e.g.
-# RadioConfigLib), which makes it impossible to translate their module names to
-# library name, so the check fails.
-PRODUCT_BROKEN_VERIFY_USES_LIBRARIES := true
-
-PRODUCT_NEXT_RELEASE_HIDE_FLAGGED_API := true
diff --git a/target/product/sdk_x86.mk b/target/product/sdk_x86.mk
deleted file mode 100644
index a6e3bcd..0000000
--- a/target/product/sdk_x86.mk
+++ /dev/null
@@ -1,26 +0,0 @@
-#
-# Copyright (C) 2014 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# This is a simple product that uses configures the minimum amount
-# needed to build the SDK (without the emulator).
-
-$(call inherit-product, $(SRC_TARGET_DIR)/product/languages_default.mk)
-
-PRODUCT_NAME := sdk_x86_64
-PRODUCT_BRAND := Android
-PRODUCT_DEVICE := mainline_x86
-
-PRODUCT_NEXT_RELEASE_HIDE_FLAGGED_API := true
diff --git a/target/product/sdk_x86_64.mk b/target/product/sdk_x86_64.mk
deleted file mode 100644
index af73007..0000000
--- a/target/product/sdk_x86_64.mk
+++ /dev/null
@@ -1,29 +0,0 @@
-#
-# Copyright (C) 2014 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# This is a simple product that uses configures the minimum amount
-# needed to build the SDK (without the emulator).
-
-$(call inherit-product, $(SRC_TARGET_DIR)/product/languages_default.mk)
-
-TARGET_SUPPORTS_32_BIT_APPS := true
-TARGET_SUPPORTS_64_BIT_APPS := true
-
-PRODUCT_NAME := sdk_x86_64
-PRODUCT_BRAND := Android
-PRODUCT_DEVICE := mainline_x86_64
-
-PRODUCT_NEXT_RELEASE_HIDE_FLAGGED_API := true
diff --git a/tools/aconfig/fake_device_config/Android.bp b/tools/aconfig/fake_device_config/Android.bp
index 5f62ae9..7420aa8 100644
--- a/tools/aconfig/fake_device_config/Android.bp
+++ b/tools/aconfig/fake_device_config/Android.bp
@@ -15,7 +15,7 @@
java_library {
name: "fake_device_config",
srcs: ["src/**/*.java"],
- sdk_version: "core_platform",
- host_supported: true,
+ sdk_version: "core_current",
+ host_supported: true,
}
diff --git a/tools/aconfig/printflags/src/main.rs b/tools/aconfig/printflags/src/main.rs
index 88fdea9..4110317 100644
--- a/tools/aconfig/printflags/src/main.rs
+++ b/tools/aconfig/printflags/src/main.rs
@@ -18,7 +18,7 @@
use aconfig_protos::aconfig::Flag_state as State;
use aconfig_protos::aconfig::Parsed_flags as ProtoParsedFlags;
-use anyhow::{bail, Result};
+use anyhow::{bail, Context, Result};
use regex::Regex;
use std::collections::HashMap;
use std::process::Command;
@@ -39,6 +39,19 @@
flags
}
+fn xxd(bytes: &[u8]) -> String {
+ let n = 8.min(bytes.len());
+ let mut v = Vec::with_capacity(n);
+ for byte in bytes.iter().take(n) {
+ v.push(format!("{:02x}", byte));
+ }
+ let trailer = match bytes.len() {
+ 0..=8 => "",
+ _ => " ..",
+ };
+ format!("[{}{}]", v.join(" "), trailer)
+}
+
fn main() -> Result<()> {
// read device_config
let output = Command::new("/system/bin/device_config").arg("list").output()?;
@@ -60,7 +73,10 @@
eprintln!("warning: failed to read {}", path);
continue;
};
- let parsed_flags: ProtoParsedFlags = protobuf::Message::parse_from_bytes(&bytes)?;
+ let parsed_flags: ProtoParsedFlags = protobuf::Message::parse_from_bytes(&bytes)
+ .with_context(|| {
+ format!("failed to parse {} ({}, {} byte(s))", path, xxd(&bytes), bytes.len())
+ })?;
for flag in parsed_flags.parsed_flag {
let key = format!("{}/{}.{}", flag.namespace(), flag.package(), flag.name());
let value = format!("{:?} + {:?} ({})", flag.permission(), flag.state(), partition);
@@ -85,7 +101,7 @@
use super::*;
#[test]
- fn test_foo() {
+ fn test_parse_device_config() {
let input = r#"
namespace_one/com.foo.bar.flag_one=true
namespace_one/com.foo.bar.flag_two=false
@@ -107,4 +123,16 @@
let actual = parse_device_config(input);
assert_eq!(expected, actual);
}
+
+ #[test]
+ fn test_xxd() {
+ let input = [0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9];
+ assert_eq!("[]", &xxd(&input[0..0]));
+ assert_eq!("[00]", &xxd(&input[0..1]));
+ assert_eq!("[00 01]", &xxd(&input[0..2]));
+ assert_eq!("[00 01 02 03 04 05 06]", &xxd(&input[0..7]));
+ assert_eq!("[00 01 02 03 04 05 06 07]", &xxd(&input[0..8]));
+ assert_eq!("[00 01 02 03 04 05 06 07 ..]", &xxd(&input[0..9]));
+ assert_eq!("[00 01 02 03 04 05 06 07 ..]", &xxd(&input));
+ }
}
diff --git a/tools/aconfig/src/codegen_cpp.rs b/tools/aconfig/src/codegen_cpp.rs
index 5eadf2a..aeb57a3 100644
--- a/tools/aconfig/src/codegen_cpp.rs
+++ b/tools/aconfig/src/codegen_cpp.rs
@@ -34,13 +34,17 @@
let class_elements: Vec<ClassElement> =
parsed_flags_iter.map(|pf| create_class_element(package, pf)).collect();
let readwrite = class_elements.iter().any(|item| item.readwrite);
+ let has_fixed_read_only = class_elements.iter().any(|item| item.is_fixed_read_only);
let header = package.replace('.', "_");
+ let package_macro = header.to_uppercase();
let cpp_namespace = package.replace('.', "::");
ensure!(codegen::is_valid_name_ident(&header));
let context = Context {
header: &header,
+ package_macro: &package_macro,
cpp_namespace: &cpp_namespace,
package,
+ has_fixed_read_only,
readwrite,
for_test: codegen_mode == CodegenMode::Test,
class_elements,
@@ -79,8 +83,10 @@
#[derive(Serialize)]
pub struct Context<'a> {
pub header: &'a str,
+ pub package_macro: &'a str,
pub cpp_namespace: &'a str,
pub package: &'a str,
+ pub has_fixed_read_only: bool,
pub readwrite: bool,
pub for_test: bool,
pub class_elements: Vec<ClassElement>,
@@ -89,8 +95,10 @@
#[derive(Serialize)]
pub struct ClassElement {
pub readwrite: bool,
+ pub is_fixed_read_only: bool,
pub default_value: String,
pub flag_name: String,
+ pub flag_macro: String,
pub device_config_namespace: String,
pub device_config_flag: String,
}
@@ -98,12 +106,14 @@
fn create_class_element(package: &str, pf: &ProtoParsedFlag) -> ClassElement {
ClassElement {
readwrite: pf.permission() == ProtoFlagPermission::READ_WRITE,
+ is_fixed_read_only: pf.is_fixed_read_only(),
default_value: if pf.state() == ProtoFlagState::ENABLED {
"true".to_string()
} else {
"false".to_string()
},
flag_name: pf.name().to_string(),
+ flag_macro: pf.name().to_uppercase(),
device_config_namespace: pf.namespace().to_string(),
device_config_flag: codegen::create_device_config_ident(package, pf.name())
.expect("values checked at flag parse time"),
@@ -118,6 +128,14 @@
const EXPORTED_PROD_HEADER_EXPECTED: &str = r#"
#pragma once
+#ifndef COM_ANDROID_ACONFIG_TEST
+#define COM_ANDROID_ACONFIG_TEST(FLAG) COM_ANDROID_ACONFIG_TEST_##FLAG
+#endif
+
+#ifndef COM_ANDROID_ACONFIG_TEST_ENABLED_FIXED_RO
+#define COM_ANDROID_ACONFIG_TEST_ENABLED_FIXED_RO true
+#endif
+
#ifdef __cplusplus
#include <memory>
@@ -149,7 +167,7 @@
}
inline bool enabled_fixed_ro() {
- return true;
+ return COM_ANDROID_ACONFIG_TEST_ENABLED_FIXED_RO;
}
inline bool enabled_ro() {
@@ -319,7 +337,7 @@
}
virtual bool enabled_fixed_ro() override {
- return true;
+ return COM_ANDROID_ACONFIG_TEST_ENABLED_FIXED_RO;
}
virtual bool enabled_ro() override {
@@ -348,7 +366,7 @@
}
bool com_android_aconfig_test_enabled_fixed_ro() {
- return true;
+ return COM_ANDROID_ACONFIG_TEST_ENABLED_FIXED_RO;
}
bool com_android_aconfig_test_enabled_ro() {
@@ -365,6 +383,7 @@
#include "com_android_aconfig_test.h"
#include <server_configurable_flags/get_flags.h>
#include <unordered_map>
+#include <string>
namespace com::android::aconfig::test {
diff --git a/tools/aconfig/src/codegen_java.rs b/tools/aconfig/src/codegen_java.rs
index c4fc405..43c2ecf 100644
--- a/tools/aconfig/src/codegen_java.rs
+++ b/tools/aconfig/src/codegen_java.rs
@@ -118,21 +118,30 @@
const EXPECTED_FEATUREFLAGS_COMMON_CONTENT: &str = r#"
package com.android.aconfig.test;
+ // TODO(b/303773055): Remove the annotation after access issue is resolved.
+ import android.compat.annotation.UnsupportedAppUsage;
/** @hide */
public interface FeatureFlags {
@com.android.aconfig.annotations.AssumeFalseForR8
+ @UnsupportedAppUsage
boolean disabledRo();
+ @UnsupportedAppUsage
boolean disabledRw();
@com.android.aconfig.annotations.AssumeTrueForR8
+ @UnsupportedAppUsage
boolean enabledFixedRo();
@com.android.aconfig.annotations.AssumeTrueForR8
+ @UnsupportedAppUsage
boolean enabledRo();
+ @UnsupportedAppUsage
boolean enabledRw();
}
"#;
const EXPECTED_FLAG_COMMON_CONTENT: &str = r#"
package com.android.aconfig.test;
+ // TODO(b/303773055): Remove the annotation after access issue is resolved.
+ import android.compat.annotation.UnsupportedAppUsage;
/** @hide */
public final class Flags {
/** @hide */
@@ -147,20 +156,25 @@
public static final String FLAG_ENABLED_RW = "com.android.aconfig.test.enabled_rw";
@com.android.aconfig.annotations.AssumeFalseForR8
+ @UnsupportedAppUsage
public static boolean disabledRo() {
return FEATURE_FLAGS.disabledRo();
}
+ @UnsupportedAppUsage
public static boolean disabledRw() {
return FEATURE_FLAGS.disabledRw();
}
@com.android.aconfig.annotations.AssumeTrueForR8
+ @UnsupportedAppUsage
public static boolean enabledFixedRo() {
return FEATURE_FLAGS.enabledFixedRo();
}
@com.android.aconfig.annotations.AssumeTrueForR8
+ @UnsupportedAppUsage
public static boolean enabledRo() {
return FEATURE_FLAGS.enabledRo();
}
+ @UnsupportedAppUsage
public static boolean enabledRw() {
return FEATURE_FLAGS.enabledRw();
}
@@ -168,6 +182,8 @@
const EXPECTED_FAKEFEATUREFLAGSIMPL_CONTENT: &str = r#"
package com.android.aconfig.test;
+ // TODO(b/303773055): Remove the annotation after access issue is resolved.
+ import android.compat.annotation.UnsupportedAppUsage;
import java.util.HashMap;
import java.util.Map;
/** @hide */
@@ -176,22 +192,27 @@
resetAll();
}
@Override
+ @UnsupportedAppUsage
public boolean disabledRo() {
return getValue(Flags.FLAG_DISABLED_RO);
}
@Override
+ @UnsupportedAppUsage
public boolean disabledRw() {
return getValue(Flags.FLAG_DISABLED_RW);
}
@Override
+ @UnsupportedAppUsage
public boolean enabledFixedRo() {
return getValue(Flags.FLAG_ENABLED_FIXED_RO);
}
@Override
+ @UnsupportedAppUsage
public boolean enabledRo() {
return getValue(Flags.FLAG_ENABLED_RO);
}
@Override
+ @UnsupportedAppUsage
public boolean enabledRw() {
return getValue(Flags.FLAG_ENABLED_RW);
}
@@ -241,14 +262,18 @@
let expect_featureflagsimpl_content = r#"
package com.android.aconfig.test;
+ // TODO(b/303773055): Remove the annotation after access issue is resolved.
+ import android.compat.annotation.UnsupportedAppUsage;
import android.provider.DeviceConfig;
/** @hide */
public final class FeatureFlagsImpl implements FeatureFlags {
@Override
+ @UnsupportedAppUsage
public boolean disabledRo() {
return false;
}
@Override
+ @UnsupportedAppUsage
public boolean disabledRw() {
return getValue(
"aconfig_test",
@@ -257,14 +282,17 @@
);
}
@Override
+ @UnsupportedAppUsage
public boolean enabledFixedRo() {
return true;
}
@Override
+ @UnsupportedAppUsage
public boolean enabledRo() {
return true;
}
@Override
+ @UnsupportedAppUsage
public boolean enabledRw() {
return getValue(
"aconfig_test",
@@ -346,29 +374,36 @@
"#;
let expect_featureflagsimpl_content = r#"
package com.android.aconfig.test;
+ // TODO(b/303773055): Remove the annotation after access issue is resolved.
+ import android.compat.annotation.UnsupportedAppUsage;
/** @hide */
public final class FeatureFlagsImpl implements FeatureFlags {
@Override
+ @UnsupportedAppUsage
public boolean disabledRo() {
throw new UnsupportedOperationException(
"Method is not implemented.");
}
@Override
+ @UnsupportedAppUsage
public boolean disabledRw() {
throw new UnsupportedOperationException(
"Method is not implemented.");
}
@Override
+ @UnsupportedAppUsage
public boolean enabledFixedRo() {
throw new UnsupportedOperationException(
"Method is not implemented.");
}
@Override
+ @UnsupportedAppUsage
public boolean enabledRo() {
throw new UnsupportedOperationException(
"Method is not implemented.");
}
@Override
+ @UnsupportedAppUsage
public boolean enabledRw() {
throw new UnsupportedOperationException(
"Method is not implemented.");
diff --git a/tools/aconfig/templates/FakeFeatureFlagsImpl.java.template b/tools/aconfig/templates/FakeFeatureFlagsImpl.java.template
index d2cea95..72a896f 100644
--- a/tools/aconfig/templates/FakeFeatureFlagsImpl.java.template
+++ b/tools/aconfig/templates/FakeFeatureFlagsImpl.java.template
@@ -1,4 +1,6 @@
package {package_name};
+// TODO(b/303773055): Remove the annotation after access issue is resolved.
+import android.compat.annotation.UnsupportedAppUsage;
import java.util.HashMap;
import java.util.Map;
@@ -11,6 +13,7 @@
{{ for item in class_elements}}
@Override
+ @UnsupportedAppUsage
public boolean {item.method_name}() \{
return getValue(Flags.FLAG_{item.flag_name_constant_suffix});
}
diff --git a/tools/aconfig/templates/FeatureFlags.java.template b/tools/aconfig/templates/FeatureFlags.java.template
index 9350d60..02305e6 100644
--- a/tools/aconfig/templates/FeatureFlags.java.template
+++ b/tools/aconfig/templates/FeatureFlags.java.template
@@ -1,4 +1,6 @@
package {package_name};
+// TODO(b/303773055): Remove the annotation after access issue is resolved.
+import android.compat.annotation.UnsupportedAppUsage;
/** @hide */
public interface FeatureFlags \{
@@ -10,6 +12,7 @@
@com.android.aconfig.annotations.AssumeFalseForR8
{{ -endif- }}
{{ endif }}
+ @UnsupportedAppUsage
boolean {item.method_name}();
{{ endfor }}
}
diff --git a/tools/aconfig/templates/FeatureFlagsImpl.java.template b/tools/aconfig/templates/FeatureFlagsImpl.java.template
index 3913fa4..1620dfe 100644
--- a/tools/aconfig/templates/FeatureFlagsImpl.java.template
+++ b/tools/aconfig/templates/FeatureFlagsImpl.java.template
@@ -1,4 +1,6 @@
package {package_name};
+// TODO(b/303773055): Remove the annotation after access issue is resolved.
+import android.compat.annotation.UnsupportedAppUsage;
{{ if not is_test_mode }}
{{ if is_read_write- }}
import android.provider.DeviceConfig;
@@ -7,6 +9,7 @@
public final class FeatureFlagsImpl implements FeatureFlags \{
{{ for item in class_elements}}
@Override
+ @UnsupportedAppUsage
public boolean {item.method_name}() \{
{{ -if item.is_read_write }}
return getValue(
@@ -49,6 +52,7 @@
public final class FeatureFlagsImpl implements FeatureFlags \{
{{ for item in class_elements}}
@Override
+ @UnsupportedAppUsage
public boolean {item.method_name}() \{
throw new UnsupportedOperationException(
"Method is not implemented.");
diff --git a/tools/aconfig/templates/Flags.java.template b/tools/aconfig/templates/Flags.java.template
index 39024a8..66c4c5a 100644
--- a/tools/aconfig/templates/Flags.java.template
+++ b/tools/aconfig/templates/Flags.java.template
@@ -1,5 +1,8 @@
package {package_name};
+// TODO(b/303773055): Remove the annotation after access issue is resolved.
+import android.compat.annotation.UnsupportedAppUsage;
+
/** @hide */
public final class Flags \{
{{- for item in class_elements}}
@@ -14,6 +17,7 @@
@com.android.aconfig.annotations.AssumeFalseForR8
{{ -endif- }}
{{ endif }}
+ @UnsupportedAppUsage
public static boolean {item.method_name}() \{
return FEATURE_FLAGS.{item.method_name}();
}
diff --git a/tools/aconfig/templates/cpp_exported_header.template b/tools/aconfig/templates/cpp_exported_header.template
index 4d56dbc..6413699 100644
--- a/tools/aconfig/templates/cpp_exported_header.template
+++ b/tools/aconfig/templates/cpp_exported_header.template
@@ -1,9 +1,25 @@
#pragma once
+{{ if not for_test- }}
+{{ if has_fixed_read_only- }}
+#ifndef {package_macro}
+#define {package_macro}(FLAG) {package_macro}_##FLAG
+#endif
+{{ for item in class_elements- }}
+{{ if item.is_fixed_read_only- }}
+#ifndef {package_macro}_{item.flag_macro}
+#define {package_macro}_{item.flag_macro} {item.default_value}
+#endif
+{{ endif }}
+{{ -endfor }}
+{{ -endif }}
+{{ -endif }}
+
#ifdef __cplusplus
#include <memory>
+
namespace {cpp_namespace} \{
class flag_provider_interface \{
@@ -15,7 +31,7 @@
{{ if for_test }}
virtual void {item.flag_name}(bool val) = 0;
{{ -endif }}
- {{ endfor }}
+ {{ -endfor }}
{{ if for_test }}
virtual void reset_flags() \{}
@@ -29,10 +45,14 @@
{{ if for_test }}
return provider_->{item.flag_name}();
{{ -else- }}
- {{ if not item.readwrite- }}
- return {item.default_value};
- {{ -else- }}
+ {{ if item.readwrite- }}
return provider_->{item.flag_name}();
+ {{ -else- }}
+ {{ if item.is_fixed_read_only }}
+ return {package_macro}_{item.flag_macro};
+ {{ -else- }}
+ return {item.default_value};
+ {{ -endif }}
{{ -endif }}
{{ -endif }}
}
@@ -42,7 +62,7 @@
provider_->{item.flag_name}(val);
}
{{ -endif }}
-{{ endfor }}
+{{ -endfor }}
{{ if for_test }}
inline void reset_flags() \{
@@ -61,7 +81,7 @@
{{ if for_test }}
void set_{header}_{item.flag_name}(bool val);
{{ -endif }}
-{{ endfor - }}
+{{ -endfor }}
{{ if for_test }}
void {header}_reset_flags();
diff --git a/tools/aconfig/templates/cpp_source_file.template b/tools/aconfig/templates/cpp_source_file.template
index c0e7343..0f1b845 100644
--- a/tools/aconfig/templates/cpp_source_file.template
+++ b/tools/aconfig/templates/cpp_source_file.template
@@ -4,6 +4,7 @@
{{ endif }}
{{ if for_test }}
#include <unordered_map>
+#include <string>
{{ endif }}
namespace {cpp_namespace} \{
@@ -57,7 +58,11 @@
"{item.device_config_flag}",
"{item.default_value}") == "true";
{{ -else- }}
- return {item.default_value};
+ {{ if item.is_fixed_read_only }}
+ return {package_macro}_{item.flag_macro};
+ {{ -else- }}
+ return {item.default_value};
+ {{ -endif }}
{{ -endif }}
}
{{ endfor }}
@@ -78,10 +83,14 @@
{{ if for_test }}
return {cpp_namespace}::{item.flag_name}();
{{ -else- }}
- {{ if not item.readwrite- }}
- return {item.default_value};
- {{ -else- }}
+ {{ if item.readwrite- }}
return {cpp_namespace}::{item.flag_name}();
+ {{ -else- }}
+ {{ if item.is_fixed_read_only }}
+ return {package_macro}_{item.flag_macro};
+ {{ -else- }}
+ return {item.default_value};
+ {{ -endif }}
{{ -endif }}
{{ -endif }}
}
diff --git a/tools/finalization/finalize-sdk-rel.sh b/tools/finalization/finalize-sdk-rel.sh
index cb7d1fc..d4ed380 100755
--- a/tools/finalization/finalize-sdk-rel.sh
+++ b/tools/finalization/finalize-sdk-rel.sh
@@ -45,9 +45,7 @@
git -C "$top/cts" mv hostsidetests/theme/assets/${FINAL_PLATFORM_CODENAME} hostsidetests/theme/assets/${FINAL_PLATFORM_SDK_VERSION}
# system/sepolicy
- mkdir -p "$top/system/sepolicy/prebuilts/api/${FINAL_PLATFORM_SDK_VERSION}.0/"
- cp -r "$top/system/sepolicy/public/" "$top/system/sepolicy/prebuilts/api/${FINAL_PLATFORM_SDK_VERSION}.0/"
- cp -r "$top/system/sepolicy/private/" "$top/system/sepolicy/prebuilts/api/${FINAL_PLATFORM_SDK_VERSION}.0/"
+ system/sepolicy/tools/finalize-sdk-rel.sh "$top" "$FINAL_PLATFORM_SDK_VERSION"
# prebuilts/abi-dumps/ndk
mkdir -p "$top/prebuilts/abi-dumps/ndk/$FINAL_PLATFORM_SDK_VERSION"
diff --git a/tools/protos/metadata_file.proto b/tools/protos/metadata_file.proto
index ac1129a..47562c5 100644
--- a/tools/protos/metadata_file.proto
+++ b/tools/protos/metadata_file.proto
@@ -92,6 +92,8 @@
SBOMRef sbom_ref = 10;
}
+ // Identifiers for the package.
+ repeated Identifier identifier = 11;
}
// URL associated with a third-party package.
@@ -278,4 +280,136 @@
// https://spdx.github.io/spdx-spec/v2.3/package-information/#72-package-spdx-identifier-field or
// https://spdx.github.io/spdx-spec/v2.3/file-information/#82-file-spdx-identifier-field
optional string element_id = 3;
+}
+
+// Identifier for a third-package package.
+// See go/tp-metadata-id.
+message Identifier {
+ // The type of the identifier. Either an "ecosystem" value from
+ // https://ossf.github.io/osv-schema/#affectedpackage-field such as "Go",
+ // "npm" or "PyPI". The "value" and "version" fields follow the same rules as
+ // defined in the OSV spec.
+
+ // Or one of:
+ // - "Git": The "value" field is the URL of the upstream git repository this
+ // package is retrieved from.
+ // For example:
+ // - https://github.com/git/git
+ // - git://git.kernel.org/pub/scm/git/git
+ //
+ // Use of a git URL requires that the package "version" value must specify a
+ // specific git tag or revision. This must not be a branch name.
+ //
+ // - "SVN": The "value" field is the URL of the upstream SVN repository this
+ // package is retrieved from.
+ // For example:
+ // - http://llvm.org/svn/llvm-project/llvm/
+ //
+ // Use of an SVN URL requires that the package "version" value must specify
+ // a specific SVN tag or revision. This must not be a branch name.
+ //
+ // - "Hg": The "value" field is the URL of the upstream mercurial repository
+ // this package is retrieved from.
+ // For example:
+ // - https://mercurial-scm.org/repo/evolve
+ //
+ // Use of a mercurial URL requires that the package "version" value must
+ // specify a specific tag or revision. This must not be a branch name.
+ //
+ // - "Darcs": the "value" field is the URL of the upstream darcs repository
+ // this package is retrieved from.
+ // For example:
+ // - https://hub.darcs.net/hu.dwim/hu.dwim.util
+ //
+ // Use of a Darcs URL requires that the package "version" value must
+ // specify a specific tag or revision. This must not be a branch name.
+ //
+ // - "Piper": The "value" field is the URL of the upstream piper location.
+ // This is primarily used when a package is being migrated into third_party
+ // from elsewhere in Piper, or when a package is being newly developed in
+ // third_party.
+ //
+ // - "VCS": This is a generic fallback for an unlisted VCS system. The
+ // "value" field is the URL of the repository for this VCS.
+ //
+ // - "Archive": The "value" field is the URL of the archive containing the
+ // source code for the package, for example a zip or tgz file.
+ //
+ // - "PrebuiltByAlphabet": This type should be used for archives of primarily
+ // Google-owned source code (may contain non-Google-owned dependencies),
+ // which has been built using production Google infrastructure, and copied
+ // into third_party.
+ //
+ // - "LocalSource": The "value" field is the URL identifying where the local
+ // copy of the package source code can be found.
+ // Examples:
+ // - https://android.googlesource.com/platform/external/apache-http/
+ //
+ // Typically, the metadata files describing a package reside in the same
+ // directory as the source code for the package. In a few rare cases where
+ // they are separate, the LocalSource URL identifies where to find the
+ // source code. This only describes where to find the local copy of the
+ // source; there should always be an additional URL describing where the
+ // package was retrieved from.
+ //
+ // - "Other": An identifier that does not fit any other type. This may also
+ // indicate that the Source code was received via email or some other
+ // out-of-band way. This is most commonly used with commercial software
+ // received directly from the Vendor. In the case of email, the "value" field
+ // can be used to provide additional information about how it was received.
+ optional string type = 1;
+
+ // A human readable string to indicate why a third-package package does not
+ // have this identifier type set.
+ // Example:
+ // identifier {
+ // type: "PyPI"
+ // omission_reason: "Only on Git. Not published to PyPI."
+ // }
+ optional string omission_reason = 2;
+
+ // The value of the package identifier as defined by the "type".
+ // Example:
+ // identifier {
+ // type: "PyPI"
+ // value: "django"
+ // version: "3.2.8"
+ // }
+ optional string value = 3;
+
+ // The version associated with this package as defined by the "type".
+ // Example:
+ // identifier {
+ // type: "PyPI"
+ // value: "django"
+ // version: "3.2.8"
+ // }
+ optional string version = 4;
+
+ // The closest version associated with this package as defined by the "type".
+ // This should only be set by automated infrastructure by applying automated
+ // heuristics, such as the closest git tag or package version from a package
+ // manifest file (e.g. pom.xml).
+ //
+ // For most identifier types, only one of `version` or `closest_version`
+ // should be set (not both). The exception is source repository types such as
+ // "Git", where `version` will refer to a git commit, and `closest_version`
+ // refers to a git tag.
+ // Example:
+ // identifier {
+ // type: "Git",
+ // value: "https://github.com/my/repo"
+ // version: "e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e"
+ // closest_version: "v1.4"
+ // }
+ optional string closest_version = 5;
+
+ // When `true`, this Identifier represents the location from which the source
+ // code for this package was originally obtained. This should only be set for
+ // *one* Identifier in a third_party package's METADATA.
+
+ // For external packages, this is typically for the Identifier associated
+ // with the version control system or package manager that was used to
+ // check out or download the code.
+ optional bool primary_source = 6;
}
\ No newline at end of file
diff --git a/tools/releasetools/Android.bp b/tools/releasetools/Android.bp
index 971518a..ee266b7 100644
--- a/tools/releasetools/Android.bp
+++ b/tools/releasetools/Android.bp
@@ -235,6 +235,9 @@
"rangelib.py",
"sparse_img.py",
],
+ data: [
+ ":zip2zip",
+ ],
// Only the tools that are referenced directly are listed as required modules. For example,
// `avbtool` is not here, as the script always uses the one from info_dict['avb_avbtool'].
required: [
@@ -249,7 +252,6 @@
"signapk",
"toybox",
"unpack_bootimg",
- "zip2zip",
],
}
diff --git a/tools/releasetools/apex_utils.py b/tools/releasetools/apex_utils.py
index bfc87b8..1ddffc1 100644
--- a/tools/releasetools/apex_utils.py
+++ b/tools/releasetools/apex_utils.py
@@ -68,7 +68,7 @@
self.avbtool = avbtool if avbtool else "avbtool"
self.sign_tool = sign_tool
- def ProcessApexFile(self, apk_keys, payload_key, signing_args=None, is_sepolicy=False):
+ def ProcessApexFile(self, apk_keys, payload_key, signing_args=None):
"""Scans and signs the payload files and repack the apex
Args:
@@ -86,13 +86,9 @@
'list', self.apex_path]
entries_names = common.RunAndCheckOutput(list_cmd).split()
apk_entries = [name for name in entries_names if name.endswith('.apk')]
- sepolicy_entries = []
- if is_sepolicy:
- sepolicy_entries = [name for name in entries_names if
- name.startswith('./etc/SEPolicy') and name.endswith('.zip')]
# No need to sign and repack, return the original apex path.
- if not apk_entries and not sepolicy_entries and self.sign_tool is None:
+ if not apk_entries and self.sign_tool is None:
logger.info('No apk file to sign in %s', self.apex_path)
return self.apex_path
@@ -108,14 +104,14 @@
' %s', entry)
payload_dir, has_signed_content = self.ExtractApexPayloadAndSignContents(
- apk_entries, sepolicy_entries, apk_keys, payload_key, signing_args)
+ apk_entries, apk_keys, payload_key, signing_args)
if not has_signed_content:
- logger.info('No contents have been signed in %s', self.apex_path)
+ logger.info('No contents has been signed in %s', self.apex_path)
return self.apex_path
return self.RepackApexPayload(payload_dir, payload_key, signing_args)
- def ExtractApexPayloadAndSignContents(self, apk_entries, sepolicy_entries, apk_keys, payload_key, signing_args):
+ def ExtractApexPayloadAndSignContents(self, apk_entries, apk_keys, payload_key, signing_args):
"""Extracts the payload image and signs the containing apk files."""
if not os.path.exists(self.debugfs_path):
raise ApexSigningError(
@@ -133,11 +129,11 @@
'extract',
self.apex_path, payload_dir]
common.RunAndCheckOutput(extract_cmd)
- assert os.path.exists(self.apex_path)
has_signed_content = False
for entry in apk_entries:
apk_path = os.path.join(payload_dir, entry)
+ assert os.path.exists(self.apex_path)
key_name = apk_keys.get(os.path.basename(entry))
if key_name in common.SPECIAL_CERT_STRINGS:
@@ -154,37 +150,6 @@
codename_to_api_level_map=self.codename_to_api_level_map)
has_signed_content = True
- for entry in sepolicy_entries:
- sepolicy_path = os.path.join(payload_dir, entry)
-
- if not 'etc' in entry:
- logger.warning('Sepolicy path does not contain the intended directory name etc:'
- ' %s', entry)
-
- key_name = apk_keys.get(os.path.basename(entry))
- if key_name is None:
- logger.warning('Failed to find signing keys for {} in'
- ' apex {}, payload key will be used instead.'
- ' Use "-e <name>=" to specify a key'
- .format(entry, self.apex_path))
- key_name = payload_key
-
- if key_name in common.SPECIAL_CERT_STRINGS:
- logger.info('Not signing: %s due to special cert string', sepolicy_path)
- continue
-
- if OPTIONS.sign_sepolicy_path is not None:
- sig_path = os.path.join(payload_dir, sepolicy_path + '.sig')
- fsv_sig_path = os.path.join(payload_dir, sepolicy_path + '.fsv_sig')
- old_sig = common.MakeTempFile()
- old_fsv_sig = common.MakeTempFile()
- os.rename(sig_path, old_sig)
- os.rename(fsv_sig_path, old_fsv_sig)
-
- logger.info('Signing sepolicy file %s in apex %s', sepolicy_path, self.apex_path)
- if common.SignSePolicy(sepolicy_path, key_name, self.key_passwords.get(key_name)):
- has_signed_content = True
-
if self.sign_tool:
logger.info('Signing payload contents in apex %s with %s', self.apex_path, self.sign_tool)
# Pass avbtool to the custom signing tool
@@ -368,8 +333,7 @@
def SignUncompressedApex(avbtool, apex_file, payload_key, container_key,
container_pw, apk_keys, codename_to_api_level_map,
- no_hashtree, signing_args=None, sign_tool=None,
- is_sepolicy=False):
+ no_hashtree, signing_args=None, sign_tool=None):
"""Signs the current uncompressed APEX with the given payload/container keys.
Args:
@@ -382,7 +346,6 @@
no_hashtree: Don't include hashtree in the signed APEX.
signing_args: Additional args to be passed to the payload signer.
sign_tool: A tool to sign the contents of the APEX.
- is_sepolicy: Indicates if the apex is a sepolicy.apex
Returns:
The path to the signed APEX file.
@@ -392,8 +355,7 @@
apk_signer = ApexApkSigner(apex_file, container_pw,
codename_to_api_level_map,
avbtool, sign_tool)
- apex_file = apk_signer.ProcessApexFile(
- apk_keys, payload_key, signing_args, is_sepolicy)
+ apex_file = apk_signer.ProcessApexFile(apk_keys, payload_key, signing_args)
# 2a. Extract and sign the APEX_PAYLOAD_IMAGE entry with the given
# payload_key.
@@ -447,8 +409,7 @@
def SignCompressedApex(avbtool, apex_file, payload_key, container_key,
container_pw, apk_keys, codename_to_api_level_map,
- no_hashtree, signing_args=None, sign_tool=None,
- is_sepolicy=False):
+ no_hashtree, signing_args=None, sign_tool=None):
"""Signs the current compressed APEX with the given payload/container keys.
Args:
@@ -460,7 +421,6 @@
codename_to_api_level_map: A dict that maps from codename to API level.
no_hashtree: Don't include hashtree in the signed APEX.
signing_args: Additional args to be passed to the payload signer.
- is_sepolicy: Indicates if the apex is a sepolicy.apex
Returns:
The path to the signed APEX file.
@@ -487,8 +447,7 @@
codename_to_api_level_map,
no_hashtree,
signing_args,
- sign_tool,
- is_sepolicy)
+ sign_tool)
# 3. Compress signed original apex.
compressed_apex_file = common.MakeTempFile(prefix='apex-container-',
@@ -515,8 +474,8 @@
def SignApex(avbtool, apex_data, payload_key, container_key, container_pw,
- apk_keys, codename_to_api_level_map, no_hashtree,
- signing_args=None, sign_tool=None, is_sepolicy=False):
+ apk_keys, codename_to_api_level_map,
+ no_hashtree, signing_args=None, sign_tool=None):
"""Signs the current APEX with the given payload/container keys.
Args:
@@ -528,7 +487,6 @@
codename_to_api_level_map: A dict that maps from codename to API level.
no_hashtree: Don't include hashtree in the signed APEX.
signing_args: Additional args to be passed to the payload signer.
- is_sepolicy: Indicates if the apex is a sepolicy.apex
Returns:
The path to the signed APEX file.
@@ -554,8 +512,7 @@
no_hashtree=no_hashtree,
apk_keys=apk_keys,
signing_args=signing_args,
- sign_tool=sign_tool,
- is_sepolicy=is_sepolicy)
+ sign_tool=sign_tool)
elif apex_type == 'COMPRESSED':
return SignCompressedApex(
avbtool,
@@ -567,8 +524,7 @@
no_hashtree=no_hashtree,
apk_keys=apk_keys,
signing_args=signing_args,
- sign_tool=sign_tool,
- is_sepolicy=is_sepolicy)
+ sign_tool=sign_tool)
else:
# TODO(b/172912232): support signing compressed apex
raise ApexInfoError('Unsupported apex type {}'.format(apex_type))
diff --git a/tools/releasetools/build_image.py b/tools/releasetools/build_image.py
index 5e4130c..34b7172 100755
--- a/tools/releasetools/build_image.py
+++ b/tools/releasetools/build_image.py
@@ -353,6 +353,8 @@
if compress_hints:
build_command.extend(["--compress-hints", compress_hints])
+ build_command.extend(["-b", prop_dict.get("erofs_blocksize", "4096")])
+
build_command.extend(["--mount-point", prop_dict["mount_point"]])
if target_out:
build_command.extend(["--product-out", target_out])
@@ -711,6 +713,7 @@
"erofs_default_compressor",
"erofs_default_compress_hints",
"erofs_pcluster_size",
+ "erofs_blocksize",
"erofs_share_dup_blocks",
"erofs_sparse_flag",
"erofs_use_legacy_compression",
@@ -762,6 +765,7 @@
(True, "{}_erofs_compressor", "erofs_compressor"),
(True, "{}_erofs_compress_hints", "erofs_compress_hints"),
(True, "{}_erofs_pcluster_size", "erofs_pcluster_size"),
+ (True, "{}_erofs_blocksize", "erofs_blocksize"),
(True, "{}_erofs_share_dup_blocks", "erofs_share_dup_blocks"),
(True, "{}_extfs_inode_count", "extfs_inode_count"),
(True, "{}_f2fs_compress", "f2fs_compress"),
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index 0f3c430..8ee983f 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -75,9 +75,7 @@
if "ANDROID_HOST_OUT" in os.environ:
self.search_path = os.environ["ANDROID_HOST_OUT"]
self.signapk_shared_library_path = "lib64" # Relative to search_path
- self.sign_sepolicy_path = None
self.extra_signapk_args = []
- self.extra_sign_sepolicy_args = []
self.aapt2_path = "aapt2"
self.java_path = "java" # Use the one on the path by default.
self.java_args = ["-Xmx4096m"] # The default JVM args.
@@ -97,7 +95,6 @@
self.cache_size = None
self.stash_threshold = 0.8
self.logfile = None
- self.sepolicy_name = 'sepolicy.apex'
OPTIONS = Options()
@@ -2629,38 +2626,6 @@
proc.returncode, stdoutdata))
-def SignSePolicy(sepolicy, key, password):
- """Sign the sepolicy zip, producing an fsverity .fsv_sig and
- an RSA .sig signature files.
- """
-
- if OPTIONS.sign_sepolicy_path is None:
- logger.info("No sign_sepolicy_path specified, %s was not signed", sepolicy)
- return False
-
- java_library_path = os.path.join(
- OPTIONS.search_path, OPTIONS.signapk_shared_library_path)
-
- cmd = ([OPTIONS.java_path] + OPTIONS.java_args +
- ["-Djava.library.path=" + java_library_path,
- "-jar", os.path.join(OPTIONS.search_path, OPTIONS.sign_sepolicy_path)] +
- OPTIONS.extra_sign_sepolicy_args)
-
- cmd.extend([key + OPTIONS.public_key_suffix,
- key + OPTIONS.private_key_suffix,
- sepolicy, os.path.dirname(sepolicy)])
-
- proc = Run(cmd, stdin=subprocess.PIPE)
- if password is not None:
- password += "\n"
- stdoutdata, _ = proc.communicate(password)
- if proc.returncode != 0:
- raise ExternalError(
- "Failed to run sign sepolicy: return code {}:\n{}".format(
- proc.returncode, stdoutdata))
- return True
-
-
def CheckSize(data, target, info_dict):
"""Checks the data string passed against the max size limit.
@@ -2836,8 +2801,7 @@
opts, args = getopt.getopt(
argv, "hvp:s:x:" + extra_opts,
["help", "verbose", "path=", "signapk_path=",
- "signapk_shared_library_path=", "extra_signapk_args=",
- "sign_sepolicy_path=", "extra_sign_sepolicy_args=", "aapt2_path=",
+ "signapk_shared_library_path=", "extra_signapk_args=", "aapt2_path=",
"java_path=", "java_args=", "android_jar_path=", "public_key_suffix=",
"private_key_suffix=", "boot_signer_path=", "boot_signer_args=",
"verity_signer_path=", "verity_signer_args=", "device_specific=",
@@ -2861,10 +2825,6 @@
OPTIONS.signapk_shared_library_path = a
elif o in ("--extra_signapk_args",):
OPTIONS.extra_signapk_args = shlex.split(a)
- elif o in ("--sign_sepolicy_path",):
- OPTIONS.sign_sepolicy_path = a
- elif o in ("--extra_sign_sepolicy_args",):
- OPTIONS.extra_sign_sepolicy_args = shlex.split(a)
elif o in ("--aapt2_path",):
OPTIONS.aapt2_path = a
elif o in ("--java_path",):
diff --git a/tools/releasetools/img_from_target_files.py b/tools/releasetools/img_from_target_files.py
index a3e3681..b7a5ad8 100755
--- a/tools/releasetools/img_from_target_files.py
+++ b/tools/releasetools/img_from_target_files.py
@@ -67,6 +67,7 @@
OPTIONS.use_fastboot_info = True
OPTIONS.build_super_image = None
+
def LoadOptions(input_file):
"""Loads information from input_file to OPTIONS.
@@ -105,6 +106,13 @@
common.RunAndCheckOutput(cmd)
+def LocatePartitionEntry(partition_name, namelist):
+ for subdir in ["IMAGES", "PREBUILT_IMAGES", "RADIO"]:
+ entry_name = os.path.join(subdir, partition_name + ".img")
+ if entry_name in namelist:
+ return entry_name
+
+
def EntriesForUserImages(input_file):
"""Returns the user images entries to be copied.
@@ -122,13 +130,18 @@
]
if OPTIONS.use_fastboot_info:
entries.append('META/fastboot-info.txt:fastboot-info.txt')
+ ab_partitions = []
with zipfile.ZipFile(input_file) as input_zip:
namelist = input_zip.namelist()
+ if "META/ab_partitions.txt" in namelist:
+ ab_partitions = input_zip.read(
+ "META/ab_partitions.txt").decode().strip().split()
if 'PREBUILT_IMAGES/kernel_16k' in namelist:
entries.append('PREBUILT_IMAGES/kernel_16k:kernel_16k')
if 'PREBUILT_IMAGES/ramdisk_16k.img' in namelist:
entries.append('PREBUILT_IMAGES/ramdisk_16k.img:ramdisk_16k.img')
+ visited_partitions = set(OPTIONS.dynamic_partition_list)
for image_path in [name for name in namelist if name.startswith('IMAGES/')]:
image = os.path.basename(image_path)
if OPTIONS.bootable_only and image not in ('boot.img', 'recovery.img', 'bootloader', 'init_boot.img'):
@@ -143,7 +156,14 @@
continue
if image in dynamic_images:
continue
+ partition_name = image.rstrip(".img")
+ visited_partitions.add(partition_name)
entries.append('{}:{}'.format(image_path, image))
+ for part in [part for part in ab_partitions if part not in visited_partitions]:
+ entry = LocatePartitionEntry(part, namelist)
+ image = os.path.basename(entry)
+ if entry is not None:
+ entries.append('{}:{}'.format(entry, image))
return entries
diff --git a/tools/releasetools/ota_from_target_files.py b/tools/releasetools/ota_from_target_files.py
index d4420c9..7be9876 100755
--- a/tools/releasetools/ota_from_target_files.py
+++ b/tools/releasetools/ota_from_target_files.py
@@ -827,6 +827,15 @@
return ExtractTargetFiles(target_file)
+def ValidateCompressinParam(target_info):
+ vabc_compression_param = OPTIONS.vabc_compression_param
+ if vabc_compression_param:
+ minimum_api_level_required = VABC_COMPRESSION_PARAM_SUPPORT[vabc_compression_param]
+ if target_info.vendor_api_level < minimum_api_level_required:
+ raise ValueError("Specified VABC compression param {} is only supported for API level >= {}, device is on API level {}".format(
+ vabc_compression_param, minimum_api_level_required, target_info.vendor_api_level))
+
+
def GenerateAbOtaPackage(target_file, output_file, source_file=None):
"""Generates an Android OTA package that has A/B update payload."""
# If input target_files are directories, create a copy so that we can modify
@@ -834,6 +843,8 @@
target_info = common.BuildInfo(OPTIONS.info_dict, OPTIONS.oem_dicts)
if OPTIONS.disable_vabc and target_info.is_release_key:
raise ValueError("Disabling VABC on release-key builds is not supported.")
+ ValidateCompressinParam(target_info)
+ vabc_compression_param = target_info.vabc_compression_param
target_file = ExtractOrCopyTargetFiles(target_file)
if source_file is not None:
@@ -862,10 +873,11 @@
if not source_info.is_vabc or not target_info.is_vabc:
logger.info("Either source or target does not support VABC, disabling.")
OPTIONS.disable_vabc = True
- if source_info.vabc_compression_param != target_info.vabc_compression_param:
+ if OPTIONS.vabc_compression_param is None and \
+ source_info.vabc_compression_param != target_info.vabc_compression_param:
logger.info("Source build and target build use different compression methods {} vs {}, default to source builds parameter {}".format(
source_info.vabc_compression_param, target_info.vabc_compression_param, source_info.vabc_compression_param))
- OPTIONS.vabc_compression_param = source_info.vabc_compression_param
+ vabc_compression_param = source_info.vabc_compression_param
# Virtual AB Compression was introduced in Androd S.
# Later, we backported VABC to Android R. But verity support was not
@@ -879,9 +891,9 @@
assert "ab_partitions" in OPTIONS.info_dict, \
"META/ab_partitions.txt is required for ab_update."
source_info = None
- if target_info.vabc_compression_param:
+ if OPTIONS.vabc_compression_param is None and vabc_compression_param:
minimum_api_level_required = VABC_COMPRESSION_PARAM_SUPPORT[
- target_info.vabc_compression_param]
+ vabc_compression_param]
if target_info.vendor_api_level < minimum_api_level_required:
logger.warning(
"This full OTA is configured to use VABC compression algorithm"
@@ -891,10 +903,10 @@
" served to a device running old build, OTA might fail due to "
"unsupported compression parameter. For safety, gz is used because "
"it's supported since day 1.".format(
- target_info.vabc_compression_param,
+ vabc_compression_param,
minimum_api_level_required,
target_info.vendor_api_level))
- OPTIONS.vabc_compression_param = "gz"
+ vabc_compression_param = "gz"
if OPTIONS.partial == []:
logger.info(
@@ -950,6 +962,9 @@
logger.error("VABC XOR not supported on this vendor, disabling")
OPTIONS.enable_vabc_xor = False
+ if OPTIONS.vabc_compression_param:
+ vabc_compression_param = OPTIONS.vabc_compression_param
+
additional_args = []
# Prepare custom images.
@@ -964,9 +979,9 @@
elif OPTIONS.partial:
target_file = GetTargetFilesZipForPartialUpdates(target_file,
OPTIONS.partial)
- if OPTIONS.vabc_compression_param:
+ if vabc_compression_param != target_info.vabc_compression_param:
target_file = GetTargetFilesZipForCustomVABCCompression(
- target_file, OPTIONS.vabc_compression_param)
+ target_file, vabc_compression_param)
if OPTIONS.skip_postinstall:
target_file = GetTargetFilesZipWithoutPostinstallConfig(target_file)
# Target_file may have been modified, reparse ab_partitions
diff --git a/tools/releasetools/sign_apex.py b/tools/releasetools/sign_apex.py
index d739982..a0a94f6 100755
--- a/tools/releasetools/sign_apex.py
+++ b/tools/releasetools/sign_apex.py
@@ -56,7 +56,6 @@
import common
logger = logging.getLogger(__name__)
-OPTIONS = common.OPTIONS
def SignApexFile(avbtool, apex_file, payload_key, container_key, no_hashtree,
@@ -75,8 +74,7 @@
no_hashtree=no_hashtree,
apk_keys=apk_keys,
signing_args=signing_args,
- sign_tool=sign_tool,
- is_sepolicy=apex_file.endswith(OPTIONS.sepolicy_name))
+ sign_tool=sign_tool)
def main(argv):
diff --git a/tools/releasetools/test_sign_apex.py b/tools/releasetools/test_sign_apex.py
index 7723de7..8470f20 100644
--- a/tools/releasetools/test_sign_apex.py
+++ b/tools/releasetools/test_sign_apex.py
@@ -59,21 +59,6 @@
self.assertTrue(os.path.exists(signed_test_apex))
@test_utils.SkipIfExternalToolsUnavailable()
- def test_SignSepolicyApex(self):
- test_apex = os.path.join(self.testdata_dir, 'sepolicy.apex')
- payload_key = os.path.join(self.testdata_dir, 'testkey_RSA4096.key')
- container_key = os.path.join(self.testdata_dir, 'testkey')
- apk_keys = {'SEPolicy-33.zip': os.path.join(self.testdata_dir, 'testkey')}
- signed_test_apex = sign_apex.SignApexFile(
- 'avbtool',
- test_apex,
- payload_key,
- container_key,
- False,
- None)
- self.assertTrue(os.path.exists(signed_test_apex))
-
- @test_utils.SkipIfExternalToolsUnavailable()
def test_SignCompressedApexFile(self):
apex = os.path.join(test_utils.get_current_dir(), 'com.android.apex.compressed.v1.capex')
payload_key = os.path.join(self.testdata_dir, 'testkey_RSA4096.key')
diff --git a/tools/releasetools/testdata/sepolicy.apex b/tools/releasetools/testdata/sepolicy.apex
deleted file mode 100644
index 2c646cd..0000000
--- a/tools/releasetools/testdata/sepolicy.apex
+++ /dev/null
Binary files differ
diff --git a/tools/sbom/generate-sbom.py b/tools/sbom/generate-sbom.py
index b19be87..0a8f10a 100755
--- a/tools/sbom/generate-sbom.py
+++ b/tools/sbom/generate-sbom.py
@@ -82,6 +82,46 @@
'vndk_prebuilt_shared',
]
+THIRD_PARTY_IDENTIFIER_TYPES = [
+ # Types defined in metadata_file.proto
+ 'Git',
+ 'SVN',
+ 'Hg',
+ 'Darcs',
+ 'VCS',
+ 'Archive',
+ 'PrebuiltByAlphabet',
+ 'LocalSource',
+ 'Other',
+ # OSV ecosystems defined at https://ossf.github.io/osv-schema/#affectedpackage-field.
+ 'Go',
+ 'npm',
+ 'OSS-Fuzz',
+ 'PyPI',
+ 'RubyGems',
+ 'crates.io',
+ 'Hackage',
+ 'GHC',
+ 'Packagist',
+ 'Maven',
+ 'NuGet',
+ 'Linux',
+ 'Debian',
+ 'Alpine',
+ 'Hex',
+ 'Android',
+ 'GitHub Actions',
+ 'Pub',
+ 'ConanCenter',
+ 'Rocky Linux',
+ 'AlmaLinux',
+ 'Bitnami',
+ 'Photon OS',
+ 'CRAN',
+ 'Bioconductor',
+ 'SwiftURL'
+]
+
def get_args():
parser = argparse.ArgumentParser()
@@ -360,6 +400,20 @@
return True
+# Validate identifiers in a package's METADATA.
+# 1) Only known identifier type is allowed
+# 2) Only one identifier's primary_source can be true
+def validate_package_metadata(metadata_file_path, package_metadata):
+ primary_source_found = False
+ for identifier in package_metadata.third_party.identifier:
+ if identifier.type not in THIRD_PARTY_IDENTIFIER_TYPES:
+ sys.exit(f'Unknown value of third_party.identifier.type in {metadata_file_path}/METADATA: {identifier.type}.')
+ if primary_source_found and identifier.primary_source:
+ sys.exit(
+ f'Field "primary_source" is set to true in multiple third_party.identifier in {metadata_file_path}/METADATA.')
+ primary_source_found = identifier.primary_source
+
+
def report_metadata_file(metadata_file_path, installed_file_metadata, report):
if metadata_file_path:
report[INFO_METADATA_FOUND_FOR_PACKAGE].append(
@@ -372,6 +426,8 @@
with open(metadata_file_path + '/METADATA', 'rt') as f:
text_format.Parse(f.read(), package_metadata)
+ validate_package_metadata(metadata_file_path, package_metadata)
+
if not metadata_file_path in metadata_file_protos:
metadata_file_protos[metadata_file_path] = package_metadata
if not package_metadata.name: