security/hakurei.app
security/hakurei.app
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

drop legacy Pixel and Pixel XL support

Browse Source
This commit is contained in:
Daniel Micay 2019-11-04 16:23:29 -05:00
parent 6923bcf430
commit 46d90703df
5 changed files with 6 additions and 106 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
static/build.html
View File

@ -62,8 +62,6 @@
<li>
<a href="#generating-release-signing-keys">Generating release signing keys</a>
<ul>
<li><a href="#android-verified-boot-1.0">Android Verified Boot 1.0</a></li>
<li><a href="#android-verified-boot-2.0">Android Verified Boot 2.0 (AVB)</a></li>
<li><a href="#upgrading-to-android-10">Upgrading to Android 10</a></li>
</ul>
</li>
@ -112,8 +110,6 @@
<p>Smartphone targets:</p>
<ul>
<li>aosp_marlin (Pixel XL)</li>
<li>aosp_sailfish (Pixel)</li>
<li>aosp_taimen (Pixel 2 XL)</li>
<li>aosp_walleye (Pixel 2)</li>
<li>aosp_crosshatch (Pixel 3 XL)</li>
@ -285,7 +281,6 @@ cd ../..</pre>
<p>List of kernels corresponding to officially supported devices:</p>
<ul>
<li>Pixel, Pixel XL: marlin - shared build</li>
<li>Pixel 2, Pixel 2 XL: wahoo - separate taimen and walleye builds due to hardening</li>
<li>Pixel 3, Pixel 3 XL, Pixel 3a, Pixel 3a XL: crosshatch - separate crosshatch, blueline and bonito builds due to hardening</li>
</ul>
@ -310,14 +305,9 @@ git submodule sync
git submodule update --init
./build.sh blueline</pre>
<p>The <code>kernel/google/marlin</code> repository is for the Pixel and Pixel XL, the
<code>kernel/google/wahoo</code> repository is for the Pixel 2 and Pixel 2 XL and the
<code>kernel/google/crosshatch</code> repository is for the Pixel 3 and Pixel 3
XL.</p>
<p><em>For the first generation Pixel (sailfish) and Pixel XL (marlin), signed
releases require building the verity public key into the kernel so the keys need to be
generated per the instructions below before building the kernel.</em></p>
<p>The <code>kernel/google/wahoo</code> repository is for the Pixel 2 and Pixel 2 XL
and the <code>kernel/google/crosshatch</code> repository is for the Pixel 3 and Pixel
3 XL.</p>
<h2 id="setting-up-the-os-build-environment">
<a href="#setting-up-the-os-build-environment">Setting up the OS build environment</a>
@ -438,46 +428,6 @@ mv vendor/android-prepare-vendor/DEVICE/BUILD_ID/vendor/google_devices/* vendor/
sample certificate subject can be replaced with your own information or simply left
as-is.</p>
<p>The Pixel and Pixel XL use Android Verified Boot 1.0. The Pixel 2, Pixel 2 XL,
Pixel 3, Pixel 3 XL, Pixel 3a and Pixel 3a XL use Android Verified Boot 2.0 (AVB).
Follow the appropriate instructions below.</p>
<p><em>For the first generation Pixel (sailfish) and Pixel XL (marlin), signed
releases require building the verity public key into the kernel, so this needs to be
done before building the kernel.</em></p>
<h3 id="android-verified-boot-1.0">
<a href="#android-verified-boot-1.0">Android Verified Boot 1.0</a>
</h3>
<p>To generate keys for marlin (you should use unique keys per device variant):</p>
<pre>mkdir -p keys/marlin
cd keys/marlin
../../development/tools/make_key releasekey '/CN=GrapheneOS/'
../../development/tools/make_key platform '/CN=GrapheneOS/'
../../development/tools/make_key shared '/CN=GrapheneOS/'
../../development/tools/make_key media '/CN=GrapheneOS/'
../../development/tools/make_key networkstack '/CN=GrapheneOS/'
../../development/tools/make_key verity '/CN=GrapheneOS/'
cd ../..</pre>
<p>Generate the verity public key:</p>
<pre>make -j20 generate_verity_key
out/host/linux-x86/bin/generate_verity_key -convert keys/marlin/verity.x509.pem keys/marlin/verity_key</pre>
<p>Generate verity keys in the format used by the kernel for the Pixel and Pixel XL:</p>
<pre>openssl x509 -outform der -in keys/marlin/verity.x509.pem -out kernel/google/marlin/verifiedboot_marlin_relkeys.der.x509</pre>
<p>The same kernel and device repository is used for the Pixel and Pixel XL. There's
no separate sailfish kernel.</p>
<h3 id="android-verified-boot-2.0">
<a href="#android-verified-boot-2.0">Android Verified Boot 2.0 (AVB)</a>
</h3>
<p>To generate keys for crosshatch (you should use unique keys per device
variant):</p>

2
static/index.html
View File

@ -105,7 +105,7 @@
<a href="#device-support">Device support</a>
</h2>
<p>In the current early stage of the project, GrapheneOS provides production releases
for the Pixel, Pixel XL, Pixel 2, Pixel 2 XL, Pixel 3, Pixel 3 XL, Pixel 3a and Pixel
for the Pixel 2, Pixel 2 XL, Pixel 3, Pixel 3 XL, Pixel 3a and Pixel
3a XL. <strong>The recommended devices with the best hardware, firmware and software
security along with the longest future support time are the Pixel 3a, Pixel 3a XL,
Pixel 3 and Pixel 3 XL.</strong> It will support other devices in the future, but

4
static/install.html
View File

@ -256,9 +256,7 @@ TMPDIR="$PWD/tmp" ./flash-all.sh</pre>
</h2>
<p>Installation of the stock OS via the stock factory images is the same process
described above. However, before locking, there's an additional step to fully revert
the device to a clean factory state on modern devices with Android Verified Boot 2.0
(AVB) like the Pixel 2, Pixel 2 XL, Pixel 3, Pixel 3 XL, Pixel 3a and Pixel 3a XL. It
isn't necessary for devices with legacy verified boot like the Pixel and Pixel XL.</p>
the device to a clean factory state.</p>
<p>The GrapheneOS factory images flash a non-stock Android Verified Boot key which
needs to be erased to fully revert back to a stock device state. After flashing the
stock factory images and before locking the bootloader, you should erase the custom

48
static/releases.html
View File

@ -57,8 +57,6 @@
<li><a href="#blueline-stable">Pixel 3</a></li>
<li><a href="#taimen-stable">Pixel 2 XL</a></li>
<li><a href="#walleye-stable">Pixel 2</a></li>
<li><a href="#marlin-stable">Pixel XL (legacy)</a></li>
<li><a href="#sailfish-stable">Pixel (legacy)</a></li>
</ul>
</li>
<li>
@ -70,8 +68,6 @@
<li><a href="#blueline-beta">Pixel 3</a></li>
<li><a href="#taimen-beta">Pixel 2 XL</a></li>
<li><a href="#walleye-beta">Pixel 2</a></li>
<li><a href="#marlin-beta">Pixel XL (legacy)</a></li>
<li><a href="#sailfish-beta">Pixel (legacy)</a></li>
</ul>
</li>
<li>
@ -206,28 +202,6 @@
<li><a href="https://releases.grapheneos.org/walleye-ota_update-2019.10.07.21.zip">walleye-ota_update-2019.10.07.21.zip</a></li>
</ul>
</section>
<section id="marlin-stable">
<h3>
<a href="#marlin-stable">Pixel XL (legacy)</a>
</h3>
<p>Version: <a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/QP1A.191005.007.A1.2019.10.07.21">QP1A.191005.007.A1.2019.10.07.21</a></p>
<ul>
<li><a href="https://releases.grapheneos.org/marlin-factory-2019.10.07.21.zip">marlin-factory-2019.10.07.21.zip</a></li>
<li><a href="https://releases.grapheneos.org/marlin-factory-2019.10.07.21.zip.sig">marlin-factory-2019.10.07.21.zip.sig</a></li>
<li><a href="https://releases.grapheneos.org/marlin-ota_update-2019.10.07.21.zip">marlin-ota_update-2019.10.07.21.zip</a></li>
</ul>
</section>
<section id="sailfish-stable">
<h3>
<a href="#sailfish-stable">Pixel (legacy)</a>
</h3>
<p>Version: <a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/QP1A.191005.007.A1.2019.10.07.21">QP1A.191005.007.A1.2019.10.07.21</a></p>
<ul>
<li><a href="https://releases.grapheneos.org/sailfish-factory-2019.10.07.21.zip">sailfish-factory-2019.10.07.21.zip</a></li>
<li><a href="https://releases.grapheneos.org/sailfish-factory-2019.10.07.21.zip.sig">sailfish-factory-2019.10.07.21.zip.sig</a></li>
<li><a href="https://releases.grapheneos.org/sailfish-ota_update-2019.10.07.21.zip">sailfish-ota_update-2019.10.07.21.zip</a></li>
</ul>
</section>
</section>
<section id="beta-channel">
@ -301,28 +275,6 @@
<li><a href="https://releases.grapheneos.org/walleye-ota_update-2019.10.07.21.zip">walleye-ota_update-2019.10.07.21.zip</a></li>
</ul>
</section>
<section id="marlin-beta">
<h3>
<a href="#marlin-beta">Pixel XL (legacy)</a>
</h3>
<p>Version: <a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/QP1A.191005.007.A1.2019.10.07.21">QP1A.191005.007.A1.2019.10.07.21</a></p>
<ul>
<li><a href="https://releases.grapheneos.org/marlin-factory-2019.10.07.21.zip">marlin-factory-2019.10.07.21.zip</a></li>
<li><a href="https://releases.grapheneos.org/marlin-factory-2019.10.07.21.zip.sig">marlin-factory-2019.10.07.21.zip.sig</a></li>
<li><a href="https://releases.grapheneos.org/marlin-ota_update-2019.10.07.21.zip">marlin-ota_update-2019.10.07.21.zip</a></li>
</ul>
</section>
<section id="sailfish-beta">
<h3>
<a href="#sailfish-beta">Pixel (legacy)</a>
</h3>
<p>Version: <a href="https://github.com/GrapheneOS/platform_manifest/releases/tag/QP1A.191005.007.A1.2019.10.07.21">QP1A.191005.007.A1.2019.10.07.21</a></p>
<ul>
<li><a href="https://releases.grapheneos.org/sailfish-factory-2019.10.07.21.zip">sailfish-factory-2019.10.07.21.zip</a></li>
<li><a href="https://releases.grapheneos.org/sailfish-factory-2019.10.07.21.zip.sig">sailfish-factory-2019.10.07.21.zip.sig</a></li>
<li><a href="https://releases.grapheneos.org/sailfish-ota_update-2019.10.07.21.zip">sailfish-ota_update-2019.10.07.21.zip</a></li>
</ul>
</section>
</section>
<h2 id="changelog">

2
static/releases.js
View File

@ -4,7 +4,7 @@
const baseUrl = "https://releases.grapheneos.org/";
const versionBaseUrl = "https://github.com/GrapheneOS/platform_manifest/releases/tag/";
const devices = ["bonito", "sargo", "crosshatch", "blueline", "taimen", "walleye", "marlin", "sailfish"];
const devices = ["bonito", "sargo", "crosshatch", "blueline", "taimen", "walleye"];
const channels = ["stable", "beta"];
for (const channel of channels) {