explain OFFICIAL_BUILD environment variable

static/build.html

@@ -334,6 +334,17 @@ git submodule update --init
             should be <code>user</code> builds as they are significantly more secure and don't
             make additional performance sacrifices to improve debugging.</p>
 
+            <p>Set <code>OFFICIAL_BUILD=true</code> to include the Updater app. You
+            <strong>must</strong> change the URL in
+            <code>packages/apps/Updater/res/values/config.xml</code> to your own domain. Using the
+            official update server with a build signed with different keys will not work and will
+            essentially perform a denial of service attack on our update service. If you try to
+            use the official URL, the app will download an official update and will detect it as
+            corrupted or tampered. It will delete the update and try to download it over and over
+            again since it will never be signed with your key.</p>
+
+            <pre>export OFFICIAL_BUILD=true</pre>
+
             <h2 id="reproducible-builds">
                 <a href="#reproducible-builds">Reproducible builds</a>
             </h2>
@@ -351,6 +362,11 @@ git submodule update --init
             different keys you need to stick to comparing everything other than the
             signatures.</p>
 
+            <p>Set <code>OFFICIAL_BUILD=true</code> per the instructions above. Note that if you
+            do not change the URL to your own domain, you <strong>must</strong> disable the
+            Updater app before connecting the device to the internet, or you will be performing a
+            denial of service attack on our official update server.</p>
+
             <h2 id="extracting-vendor-files-for-pixel-devices">
                 <a href="#extracting-vendor-files-for-pixel-devices">Extracting vendor files for Pixel devices</a>
             </h2>