Use computed salt for AVB-signed images.
We want the generated images being identical for the same source files.
Currently the generated ext4 image (either from make_ext4fs or mke2fs)
is reproducible, but the AVB footer added by avbtool contain changes
because of the random salt being used.
This CL changes the avbtool invocation to specify "--salt <hexstring>"
(already supported by avbtool) to use reproducible salt that's computed
based on fingerprints (or thumbprints if applicable).
Bug: 67023482
Test: Regenerate images from the same source as follows:
Use a target_files.zip from an AVB-enabled target.
$ zip -d target_files.zip IMAGES/\*
$ ./build/make/tools/releasetools/add_img_to_target_files.py \
-v target_files.zip
Repeat the above commands and compare the generated images.
Change-Id: Id9db17ae0132ca3a820b4be5a5ef06ca3fef71ed
(cherry picked from commit 8f05cca1d9989ecb2e5a5d12f1410b6eca8c75b6)
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index 789fefe..9726125 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -353,6 +353,10 @@
algorithm = OPTIONS.info_dict.get("avb_" + partition + "_algorithm")
if key_path and algorithm:
cmd.extend(["--key", key_path, "--algorithm", algorithm])
+ avb_salt = OPTIONS.info_dict.get("avb_salt")
+ # make_vbmeta_image doesn't like "--salt" (and it's not needed).
+ if avb_salt and partition != "vbmeta":
+ cmd.extend(["--salt", avb_salt])
def _BuildBootableImage(sourcedir, fs_config_file, info_dict=None,