Add flag extend_vb_chain_to_updated_apk as read-only
Due to a limitation in the current flag infra (b/299647580; device
config not yet initialized for the code to be flagged in package
manager), the only way forward is to make the flag read-only. It
effectively turns the flag into a build-time flag, and remains to be off
until Gantry ramp-up.
Bug: 277344944
Test: Use the flag in package manager, it doesn't crash in the flag infra
Change-Id: I059980ca0e15c24b54c3fece7bc69a8301246c7a
diff --git a/core/java/android/security/flags.aconfig b/core/java/android/security/flags.aconfig
index cfc6f48..800149c 100644
--- a/core/java/android/security/flags.aconfig
+++ b/core/java/android/security/flags.aconfig
@@ -20,3 +20,11 @@
description: "Feature flag for deprecating .fsv_sig"
bug: "277916185"
}
+
+flag {
+ name: "extend_vb_chain_to_updated_apk"
+ namespace: "hardware_backed_security"
+ description: "Use v4 signature and fs-verity to chain verification of allowlisted APKs to Verified Boot"
+ bug: "277916185"
+ is_fixed_read_only: true
+}