Stop using fs-verity signature in odsign
fs-verity digests are recorded in a signed file that contains the file
path -> digest mapping. We don't really need the extra signature check
in kernel. Persistent attack can still be detected after a reboot. If
the attacker can already damage the run time integrity, the kernel
keyring verification can't really help by itself.
Actually, the signature was originally added because we required
signature for fs-verity, but it has been relaxed since aosp/2281348.
Bug: 258061812
Test: atest odsign_e2e_tests_full
Change-Id: Id0f05055945999fe18d056d89a6f9059807bcee8
3 files changed