GitLab

Due to OEM requests, add a reference implementation for boot/recovery
image signature verification in C. The tool uses OpenSSL for ASN.1 and
crypto routines.

Bug: 18120110
Change-Id: I9f6c59e0b338b68f35ac1c2c4d83c10d31d70cd9

automerge: 8f85f69f

* commit '8f85f69f':
  Support [-j <journal_size>] in mkuserimg.sh

Bug: 18430740

(cherry picked from commit 1ec61e7a)

Change-Id: I8704dfd4f91373261b03d7943e40cc9fdf39a0a7

Bug: 18430740
Change-Id: Ia76cd4ef1b35c48c60c4922d7d28b21978d56159

This change adds -verify flags to keystore and verity signers for
verifying the signatures of the signed content generated by the
same tools. This allows implementers of verified boot to test and
verify the correctness of their implementations.

Bug: 15984840
Change-Id: I327de9c3a9e035cd11dc5022e978c840cd37581c

Clearly mark the comment above main() as an example and fix
the parameters in the example command. Also briefly document
the arguments in the main function for clarity.

Bug: 18376609
Change-Id: I84eaf75799a8128100eb97c70e04563c609e9928

Adds signature verification support to BootSignature.java.

Bug: 15984840
Bug: 18120110
Change-Id: Ib1a67573bdcd0f41e2d920f518de15993c8750e0
(cherry picked from commit 7999c089)

Use the same PKCS8 format as every other signing tool, and update
the signature format to use SHA-256 instead of SHA-1.

Bug: 15984840
Bug: 18120110
Change-Id: I6ac9e3594b5ae572f5b6763f3bd5b1bdb6ba2ad2
(cherry picked from commit 19c6bb5f)

fs_mgr requires an RSA public key in mincrypt format for verifying
dm-verity hash tables. Add support for extracting public keys from
existing X.509 certificates and converting it into mincrypt format
for use with fs_mgr.

Bug: 15984840
Bug: 18120110
Change-Id: Ibcdca116cdc32dfa33d8f5636ec728244cbf6fd5
(cherry picked from commit 82d824a6)

This tool takes a sparse ext4 image file, reads verity metadata
from it, and verifies the signature of the verity table.

Bug: 15984840
Bug: 18120110
Change-Id: I384a9ff885a0ffcd8febf100e76f3a1e5c7bbdab
(cherry picked from commit c18aa9d6)

This reverts commit 7377e002

.

Change-Id: I4b1d83b62ae4d4dd6952663744b1171b3e0d0766
Signed-off-by: Iliyan Malchev <malchev@google.com>

This reverts commit b62eabde.

Change-Id: I98019b7990c5436fe6ad5ef1052729478bccbe17

Add the full X.509v3 certificate to the signature footer for easier
verification.

Change-Id: Ic969e9c1e4ab1a25ffdde2ab818b8edf2ad95253
(cherry picked from commit f67d3764)

In particular this changes the OID to the SHA1 OID and
appends the full BootSignature.

This is cherry-picked from a WIP bug checked into master, but is complete.
The work in finalized by further changes from Sami Tolvanen

Bug: 15984840
Change-Id: Ic43784fc339b9aedf91363c9ec9a453c3bb53294
(cherry picked from commit 1f2ebbd5)