From 6e719f3f52820a7252e6ef2907b6f9c169130a7f Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Sun, 8 May 2022 18:45:28 -0400 Subject: [PATCH] update signing / delta examples --- static/build.html | 46 ++++++++++++++-------------------------------- 1 file changed, 14 insertions(+), 32 deletions(-) diff --git a/static/build.html b/static/build.html index 00729408..de78bc75 100644 --- a/static/build.html +++ b/static/build.html @@ -527,9 +527,9 @@ vendor/adevtool/bin/run ota-firmware vendor/adevtool/config/DEVICE.yml -f vendor
source script/envsetup.sh
-

Select the desired build target (redfin is the Pixel 5):

+

Select the desired build target (raven is the Pixel 6 Pro):

-
choosecombo release redfin user
+
choosecombo release raven user

For a development build, you may want to replace user with userdebug in order to have better debugging support. Production builds @@ -645,11 +645,11 @@ vendor/adevtool/bin/run ota-firmware vendor/adevtool/config/DEVICE.yml -f vendor

The encryption passphrase for all the keys generated for a device needs to match for compatibility with the GrapheneOS scripts.

-

To generate keys for redfin (you should use unique keys per device +

To generate keys for raven (you should use unique keys per device variant):

-
mkdir -p keys/redfin
-cd keys/redfin
+                    
mkdir -p keys/raven
+cd keys/raven
 ../../development/tools/make_key releasekey '/CN=GrapheneOS/'
 ../../development/tools/make_key platform '/CN=GrapheneOS/'
 ../../development/tools/make_key shared '/CN=GrapheneOS/'
@@ -664,7 +664,7 @@ cd ../..

Generate a signify key for signing factory images:

-
signify -G -n -p keys/redfin/factory.pub -s keys/redfin/factory.sec
+
signify -G -n -p keys/raven/factory.pub -s keys/raven/factory.sec

Remove the -n switch to set a passphrase. The signify tool doesn't provide a way to change the passphrase without generating a new key, so @@ -679,7 +679,7 @@ cd ../..

You can (re-)encrypt your signing keys using the encrypt_keys script, which will prompt for the old passphrase (if any) and new passphrase:

-
script/encrypt_keys.sh keys/redfin
+
script/encrypt_keys.sh keys/raven

The script/decrypt_keys.sh script can be used to remove encryption, which is not recommended. The script exists primarily for internal usage to decrypt @@ -723,10 +723,10 @@ cd ../..

Generate a signed release build with the release.sh script:

-
script/release.sh redfin
+
script/release.sh raven

The factory images and update package will be in - out/release-redfin-$BUILD_NUMBER. The update zip performs a full OS + out/release-raven-$BUILD_NUMBER. The update zip performs a full OS installation so it can be used to update from any previous version. More efficient incremental updates are used for official over-the-air GrapheneOS updates and can be generated by keeping around past signed target_files zips and generating @@ -769,34 +769,16 @@ cd ../.. delta updates by passing the device, source version build number and target version build number. For example:

-
script/generate_delta.sh redfin 2021102503 2021102613
+
script/generate_delta.sh raven 2021102503 2021102613

The script assumes that the releases are organized in the following directory structure:

releases
-├── 2021102503
-│   └── release-redfin-2021102503
-│       ├── otatools
-│       ├── redfin-beta
-│       ├── redfin-factory-2021102503.zip
-│       ├── redfin-factory-2021102503.zip.sig
-│       ├── redfin-img-2021102503.zip
-│       ├── redfin-ota_update-2021102503.zip
-│       ├── redfin-stable
-│       ├── redfin-target_files-2021102503.zip
-│       └── redfin-testing
-└── 2021102613
-    └── release-redfin-2021102613
-        ├── otatools
-        ├── redfin-beta
-        ├── redfin-factory-2021102613.zip
-        ├── redfin-factory-2021102613.zip.sig
-        ├── redfin-img-2021102613.zip
-        ├── redfin-ota_update-2021102613.zip
-        ├── redfin-stable
-        ├── redfin-target_files-2021102613.zip
-        └── redfin-testing
+├── 2022050700 +│   └── release-raven-2022050700 +└── 2022050800 + └── release-raven-2022050800

Incremental updates are uploaded alongside the update packages and update metadata on the static web server used as an update server. The update client will