pvmfw: Make pvmfw_embedded_key a proper PEM file
Allow pvmfw_embedded_key to be used for signing (e.g. Microdroid) by
making it hold the whole PEM, not just the binary pubkey, and derive the
pubkey locally from it, for embedding in libpvmfw_embedded_key.
Make it a filegroup as it should have been from the start given that
the key file is not part of the shipping images. Note that we previously
had to use a prebuilt_etc so that Make could obtain the file through
module-target-built-files but now that the pubkey is derived using a
genrule, it is seen by module-target-built-files without playing tricks.
Bug: 342549834
Test: m out/target/product/${PROD}/pvmfw_embedded.avbpubkey
Change-Id: I9a6602b727f719351292597b5b59b3e65936b800
diff --git a/pvmfw/Android.bp b/pvmfw/Android.bp
index 37a321d..7881c7c 100644
--- a/pvmfw/Android.bp
+++ b/pvmfw/Android.bp
@@ -319,15 +319,22 @@
installable: false,
}
-prebuilt_etc {
+filegroup {
name: "pvmfw_embedded_key",
- src: ":avb_testkey_rsa4096_pub_bin",
- installable: false,
+ srcs: [":avb_testkey_rsa4096"],
+}
+
+genrule {
+ name: "pvmfw_embedded_key_pub_bin",
+ tools: ["avbtool"],
+ srcs: [":pvmfw_embedded_key"],
+ out: ["pvmfw_embedded_key_pub.bin"],
+ cmd: "$(location avbtool) extract_public_key --key $(in) --output $(out)",
}
genrule {
name: "pvmfw_embedded_key_rs",
- srcs: [":pvmfw_embedded_key"],
+ srcs: [":pvmfw_embedded_key_pub_bin"],
out: ["lib.rs"],
cmd: "(" +
" echo '#![no_std]';" +