commit f0151b1514d22fef5b54065af93c5175e135ea0e
author Treehugger Robot <treehugger-gerrit@google.com> Tue Apr 23 07:32:47 2019 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Tue Apr 23 07:32:47 2019 +0000
tree 3467acd098ae2208385d25630ba42c094c8e29e6
parent 7b3e97b1ea8062df0610c8e82f6bcef3803be785
parent 78369ebbc199ad4507cc0a67f42ed5d67bcf4e77

Merge "Avoid signing debuggable boot-debug.img"

tools/releasetools/sign_target_files_apks.py

diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index 64e7ca8..9aa9499 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -602,6 +602,13 @@
         print("    Rewriting AVB public key of system_other in /product")
         common.ZipWrite(output_tf_zip, public_key, filename)
 
+    # Should NOT sign boot-debug.img.
+    elif filename in (
+        "BOOT/RAMDISK/force_debuggable",
+        "RECOVERY/RAMDISK/force_debuggable"
+        "RECOVERY/RAMDISK/first_stage_ramdisk/force_debuggable"):
+      raise common.ExternalError("debuggable boot.img cannot be signed")
+
     # A non-APK file; copy it verbatim.
     else:
       common.ZipWriteStr(output_tf_zip, out_info, data)