Android 系统自定义签名
1. 工具make_key
生成x509.pem（公钥） 和pk8 （私钥）
openssl req -new -x509 -sha1 -key ${two} -out $1.x509.pem \
-days 10000 -subj "$2" &
openssl pkcs8 -in ${one} -topk8 -outform DER -out $1.pk8 -nocrypt
#development/tools/make_key
#!/bin/bash
#
# Copyright (C) 2009 The Android Open Source Project
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Generates a public/private key pair suitable for use in signing
# android .apks and OTA update packages.
if [ "$#" -ne 2 ]; then
cat <
Creates .pk8 key and .x509.pem cert. Cert contains the
given .
EOF
exit 2
fi
if [[ -e $1.pk8 || -e $1.x509.pem ]]; then
echo "$1.pk8 and/or $1.x509.pem already exist; please delete them first"
echo "if you want to replace them."
exit 1
fi
# Use named pipes to connect get the raw RSA private key to the cert-
# and .pk8-creating programs, to avoid having the private key ever
# touch the disk.
tmpdir=$(mktemp -d)
trap 'rm -rf ${tmpdir}; echo; exit 1' EXIT INT QUIT
one=${tmpdir}/one
two=${tmpdir}/two
mknod ${one} p
mknod ${two} p
chmod 0600 ${one} ${two}
read -p "Enter password for '$1' (blank for none; password will be visible): " \
password
( openssl genrsa -f4 2048 | tee ${one} > ${two} ) &
openssl req -new -x509 -sha1 -key ${two} -out $1.x509.pem \
-days 10000 -subj "$2" &
if [ "${password}" == "" ]; then
echo "creating ${1}.pk8 with no password"
openssl pkcs8 -in ${one} -topk8 -outform DER -out $1.pk8 -nocrypt
else
echo "creating ${1}.pk8 with password [${password}]"
echo $password | openssl pkcs8 -in ${one} -topk8 -outform DER -out $1.pk8 \
-passout stdin
fi
wait
wait
2.参数
C ---> Country Name (2 letter code)
ST ---> State or Province Name (full name)
L ---> Locality Name (eg, city)
O ---> Organization Name (eg, company)
OU ---> Organizational Unit Name (eg, section)
CN ---> Common Name (eg, your name or your server’s hostname)
emailAddress ---> Contact email address
development/tools/make_key testkey '/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/[email protected]'
development/tools/make_key platform '/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/[email protected]'
development/tools/make_key shared '/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/[email protected]'
development/tools/make_key media '/C=US/ST=California/L=Mountain View/O=Android/OU=Android/CN=Android/[email protected]'
The following standard test keys are currently included:
testkey -- a generic key for packages that do not otherwise specify a key.
platform -- a test key for packages that are part of the core platform.
shared -- a test key for things that are shared in the home/contacts process.
media -- a test key for packages that are part of the media/download system.
These test keys are used strictly in development, and should never be assumed
to convey any sort of validity. When $BUILD_SECURE=true, the code should not
honor these keys in any context.
3.build releasekey
/build/core/config.mk中定义变量：
DEFAULT_SYSTEM_DEV_CERTIFICATE := build/target/product/security/releasekey
主makefile文件里面：
ifeq ($(DEFAULT_SYSTEM_DEV_CERTIFICATE),build/target/product/security/releasekey)
BUILD_VERSION_TAGS += release-keys
4.check
keytool
keytool -printcert -file verity.x509.pem
Owner: [email protected], CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US
Issuer: [email protected], CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US
Serial number: 970f983909aa8949
Valid from: Fri Nov 07 03:07:40 CST 2014 until: Tue Mar 25 03:07:40 CST 2042
Certificate fingerprints:
MD5: DB:18:D3:11:F5:07:48:95:95:B5:A4:50:BB:2D:C4:95
SHA1: 14:A3:3C:EB:E3:E8:66:7B:40:9E:F8:14:2A:9D:56:25:9E:C8:32:8E
SHA256: 8A:D1:27:AB:AE:82:85:B5:82:EA:36:74:5F:22:0A:B8:FE:39:7F:FB:3B:06:8D:F1:9C:A2:2D:12:2C:7B:3B:86
Signature algorithm name: SHA1withRSA
build.prop中可以查看到变量：
ro.build.tags=release-keys
5.verity
以检测到 system “发生过” 改动，比如用户使用 root 软件强行植入 su 文件，但最后删除了 su， 这种情况也能检测出来。一旦检验不过，系统就不能正常启动.
./octopus-f1/fstab.sun8i
/dev/block/by-name/system /system ext4 ro,barrier=1 wait,verify
build/target/product/verity.mk
PRODUCT_SUPPORTS_BOOT_SIGNER := true
PRODUCT_SUPPORTS_VERITY := true
# The dev key is used to sign boot and recovery images, and the verity
# metadata table. Actual product deliverables will be re-signed by hand.
# We expect this file to exist with the suffixes ".x509.pem" and ".pk8".
PRODUCT_VERITY_SIGNING_KEY := build/target/product/security/verity
PRODUCT_PACKAGES += \
verity_key
生成verity_key
#!/bin/bash
TARGET_PATH=device/softwinner/common/verity/rsa_key
DM_MERGE=$TARGET_PATH/./../dm_merge
TABLE=$TARGET_PATH/table
SIGN=$TARGET_PATH/sign
RSA_KEY=$TARGET_PATH/verity_key
JAVA_TOOL=$ANDROID_HOST_OUT/framework/dumpkey.jar
openssl genrsa -out $TARGET_PATH/rsa_key.pair 2048
openssl rsa -in $TARGET_PATH/rsa_key.pair -pubout -out $TARGET_PATH/rsa.pk
openssl req -new -out $TARGET_PATH/CertReq.csr -key $TARGET_PATH/rsa_key.pair -subj "/C=NC/ST=GD/L=ZH/O=W/OU=W/CN=0"
openssl x509 -req -in $TARGET_PATH/CertReq.csr -out $TARGET_PATH/Cert.pem -signkey $TARGET_PATH/rsa_key.pair -sha256
openssl x509 -in $TARGET_PATH/Cert.pem -inform PEM -out $TARGET_PATH/Cert.der -outform DER
java -jar ${JAVA_TOOL} $TARGET_PATH/Cert.der > $TARGET_PATH/the_key
echo " Certificat key " >$TARGET_PATH/rsa_info
cat $TARGET_PATH/the_key>>$TARGET_PATH/key_info
echo "****** Dm_meger debug info ******">>$TARGET_PATH/key_info
${DM_MERGE} -c $TARGET_PATH/the_key ${RSA_KEY} -d >>$TARGET_PATH/key_info
echo "*********************************">>$TARGET_PATH/key_info
echo " RSA key format in android libmincrypt " >>$TARGET_PATH/key_info
cat ${RSA_KEY} >> $TARGET_PATH/key_info
rm -f $TARGET_PATH/CertReq.csr $TARGET_PATH/Cert.pem
echo "Dm-Verity Rsa key ready !"
exit 0