Add an executable to create a microdroid signature
This is for testing purpose. Creating a microdroid signature and
embedding it in a payload image will be done by VirtManager in the
future.
Bug: 185069443
Test: create a signature following README
create a payload.img with signature
pass --disk=payload.img (check manually /dev/block/vdc1)
Change-Id: I6504dc6b3732c8e00e3bd1ffa5059995962d14b8
diff --git a/apex/Android.bp b/apex/Android.bp
index 41d2f62..9c201b4 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -43,8 +43,9 @@
},
},
binaries: [
- "mk_cdisk",
"fd_server",
+ "mk_cdisk",
+ "mk_microdroid_signature",
"virtmanager",
"vm",
],
diff --git a/microdroid/signature/Android.bp b/microdroid/signature/Android.bp
new file mode 100644
index 0000000..63c2128
--- /dev/null
+++ b/microdroid/signature/Android.bp
@@ -0,0 +1,49 @@
+package {
+ default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_defaults {
+ name: "microdroid_signature_default",
+ host_supported: true,
+ srcs: [
+ "microdroid_signature.proto",
+ "signature.cc",
+ ],
+ shared_libs: [
+ "libbase",
+ "liblog",
+ ],
+ export_include_dirs: ["include"],
+}
+
+cc_library_static {
+ name: "lib_microdroid_signature_proto_lite",
+ recovery_available: true,
+ proto: {
+ export_proto_headers: true,
+ type: "lite",
+ },
+ defaults: ["microdroid_signature_default"],
+ apex_available: [
+ "com.android.virt",
+ ],
+}
+
+cc_binary {
+ name: "mk_microdroid_signature",
+ srcs: [
+ "mk_microdroid_signature.cc",
+ ],
+ shared_libs: [
+ "libbase",
+ "liblog",
+ ],
+ static_libs: [
+ "lib_microdroid_signature_proto_lite",
+ "libjsoncpp",
+ "libprotobuf-cpp-lite",
+ ],
+ apex_available: [
+ "com.android.virt",
+ ],
+}
diff --git a/microdroid/signature/README.md b/microdroid/signature/README.md
index 526f7a8..4f434ee 100644
--- a/microdroid/signature/README.md
+++ b/microdroid/signature/README.md
@@ -13,3 +13,44 @@
|--------|------|----------------------------------------------------------------|
| 0 | 4 | Header. unsigned int32: body length(L) in big endian |
| 4 | L | Body. A protobuf message. [schema](microdroid_signature.proto) |
+
+## How to Create
+
+For testing purpose, use `mk_microdroid_signature` to create a Microdroid Signature.
+
+```
+$ cat signature_config.json
+{
+ "apexes": [
+ {
+ "name": "com.my.hello",
+ "path": "hello.apex"
+ }
+ ]
+}
+$ adb push signature_config.json hello.apex /data/local/tmp/
+$ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/mk_microdroid_signature signature_config.json signature
+```
+
+Then, pass the signature as the first partition of the payload disk image.
+
+```
+$ cat payload_cdisk.json
+{
+ "partitions": [
+ {
+ "label": "signature",
+ "path": "signature"
+ },
+ {
+ "label": "com.my.hello",
+ "path": "hello.apex"
+ }
+ ]
+}
+$ adb push payload_cdisk.json /data/local/tmp/
+$ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/mk_cdisk payload_cdisk.json payload.img
+$ adb shell 'cd /data/local/tmp; /apex/com.android.virt/bin/crosvm .... --disk=payload.img'
+```
+
+In the future, [VirtManager](../../virtmanager) will handle these stuffs.
\ No newline at end of file
diff --git a/microdroid/signature/include/microdroid/signature.h b/microdroid/signature/include/microdroid/signature.h
new file mode 100644
index 0000000..abacd6e
--- /dev/null
+++ b/microdroid/signature/include/microdroid/signature.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android-base/result.h>
+#include <microdroid_signature.pb.h>
+
+#include <iostream>
+#include <string>
+
+namespace android {
+namespace microdroid {
+
+base::Result<MicrodroidSignature> ReadMicrodroidSignature(const std::string& path);
+
+base::Result<void> WriteMicrodroidSignature(const MicrodroidSignature& signature,
+ std::ostream& out);
+
+} // namespace microdroid
+} // namespace android
diff --git a/microdroid/signature/mk_microdroid_signature.cc b/microdroid/signature/mk_microdroid_signature.cc
new file mode 100644
index 0000000..d5cb1a5
--- /dev/null
+++ b/microdroid/signature/mk_microdroid_signature.cc
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <fstream>
+#include <iostream>
+#include <string>
+
+#include <android-base/file.h>
+#include <android-base/result.h>
+#include <json/json.h>
+
+#include "microdroid/signature.h"
+
+using android::base::Dirname;
+using android::base::ErrnoError;
+using android::base::Error;
+using android::base::Result;
+using android::microdroid::MicrodroidSignature;
+using android::microdroid::WriteMicrodroidSignature;
+
+Result<uint32_t> GetFileSize(const std::string& path) {
+ struct stat st;
+ if (lstat(path.c_str(), &st) == -1) {
+ return ErrnoError() << "Can't lstat " << path;
+ }
+ return static_cast<uint32_t>(st.st_size);
+}
+
+// config JSON schema:
+// {
+// "apexes": [
+// {
+// "name": string, // the apex name
+// "path": string, // the path to the apex file
+// // absolute or relative to the config file
+// "publicKey": string, // optional
+// "rootDigest": string, // optional
+// }
+// ]
+// }
+
+Result<MicrodroidSignature> LoadConfig(const std::string& config_file) {
+ MicrodroidSignature signature;
+ signature.set_version(1);
+
+ const std::string dirname = Dirname(config_file);
+ std::ifstream in(config_file);
+ Json::CharReaderBuilder builder;
+ Json::Value root;
+ Json::String errs;
+ if (!parseFromStream(builder, in, &root, &errs)) {
+ return Error() << "bad config: " << errs;
+ }
+
+ for (const Json::Value& apex : root["apexes"]) {
+ auto apex_signature = signature.add_apexes();
+
+ Json::Value name = apex["name"];
+ Json::Value path = apex["path"];
+ Json::Value publicKey = apex["publicKey"];
+ Json::Value rootDigest = apex["rootDigest"];
+
+ if (name.isString()) {
+ apex_signature->set_name(name.asString());
+ } else {
+ return Error() << "bad config: apexes.name should be a string: " << path;
+ }
+
+ if (path.isString()) {
+ std::string apex_path = path.asString();
+
+ // resolve path with the config_file's dirname if not absolute
+ bool is_absolute = !apex_path.empty() && apex_path[0] == '/';
+ if (!is_absolute) {
+ apex_path = dirname + "/" + apex_path;
+ }
+
+ auto file_size = GetFileSize(apex_path);
+ if (!file_size.ok()) {
+ return Error() << "I/O error: " << file_size.error();
+ }
+ apex_signature->set_size(file_size.value());
+ } else {
+ return Error() << "bad config: apexes.path should be a string: " << path;
+ }
+
+ if (publicKey.isString()) {
+ apex_signature->set_publickey(publicKey.asString());
+ } else if (!publicKey.isNull()) {
+ return Error() << "bad config: apexes.publicKey should be a string or null: "
+ << publicKey;
+ }
+
+ if (rootDigest.isString()) {
+ apex_signature->set_rootdigest(rootDigest.asString());
+ } else if (!rootDigest.isNull()) {
+ return Error() << "bad config: apexes.rootDigest should be a string or null: "
+ << rootDigest;
+ }
+ }
+
+ return signature;
+}
+
+int main(int argc, char** argv) {
+ if (argc != 3) {
+ std::cerr << "Usage: " << argv[0] << " <config> <output>\n";
+ return 1;
+ }
+
+ auto config = LoadConfig(argv[1]);
+ if (!config.ok()) {
+ std::cerr << config.error() << '\n';
+ return 1;
+ }
+
+ std::ofstream out(argv[2]);
+ auto result = WriteMicrodroidSignature(*config, out);
+ if (!result.ok()) {
+ std::cerr << result.error() << '\n';
+ return 1;
+ }
+ return 0;
+}
\ No newline at end of file
diff --git a/microdroid/signature/signature.cc b/microdroid/signature/signature.cc
new file mode 100644
index 0000000..446159e
--- /dev/null
+++ b/microdroid/signature/signature.cc
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "microdroid/signature.h"
+
+#include <android-base/endian.h>
+#include <android-base/file.h>
+
+using android::base::ErrnoError;
+using android::base::Error;
+using android::base::Result;
+
+namespace android {
+namespace microdroid {
+
+Result<MicrodroidSignature> ReadMicrodroidSignature(const std::string& path) {
+ std::string content;
+ if (!base::ReadFileToString(path, &content)) {
+ return ErrnoError() << "Failed to read " << path;
+ }
+
+ // read length prefix (4-byte, big-endian)
+ uint32_t size;
+ const size_t length_prefix_bytes = sizeof(size);
+ if (content.size() < length_prefix_bytes) {
+ return Error() << "Invalid signature: size == " << content.size();
+ }
+ size = be32toh(*reinterpret_cast<uint32_t*>(content.data()));
+ if (content.size() < length_prefix_bytes + size) {
+ return Error() << "Invalid signature: size(" << size << ") mimatches to the content size("
+ << content.size() - length_prefix_bytes << ")";
+ }
+ content = content.substr(length_prefix_bytes, size);
+
+ // parse content
+ MicrodroidSignature signature;
+ if (!signature.ParseFromString(content)) {
+ return Error() << "Can't parse MicrodroidSignature from " << path;
+ }
+ return signature;
+}
+
+Result<void> WriteMicrodroidSignature(const MicrodroidSignature& signature, std::ostream& out) {
+ // prepare content
+ std::string content;
+ if (!signature.SerializeToString(&content)) {
+ return Error() << "Failed to write protobuf.";
+ }
+
+ // write length prefix (4-byte, big-endian)
+ uint32_t size = htobe32(static_cast<uint32_t>(content.size()));
+ out.write(reinterpret_cast<const char*>(&size), sizeof(size));
+
+ // write content
+ out << content;
+
+ return {};
+}
+
+} // namespace microdroid
+} // namespace android
\ No newline at end of file