# Copyright (C) 2008 The Android Open Source Project # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. import copy import errno import getopt import getpass import imp import os import platform import re import shutil import subprocess import sys import tempfile import threading import time import zipfile try: from hashlib import sha1 as sha1 except ImportError: from sha import sha as sha1 # missing in Python 2.4 and before if not hasattr(os, "SEEK_SET"): os.SEEK_SET = 0 class Options(object): pass OPTIONS = Options() OPTIONS.search_path = "out/host/linux-x86" OPTIONS.verbose = False OPTIONS.tempfiles = [] OPTIONS.device_specific = None OPTIONS.extras = {} OPTIONS.info_dict = None # Values for "certificate" in apkcerts that mean special things. SPECIAL_CERT_STRINGS = ("PRESIGNED", "EXTERNAL") class ExternalError(RuntimeError): pass def Run(args, **kwargs): """Create and return a subprocess.Popen object, printing the command line on the terminal if -v was specified.""" if OPTIONS.verbose: print " running: ", " ".join(args) return subprocess.Popen(args, **kwargs) def CloseInheritedPipes(): """ Gmake in MAC OS has file descriptor (PIPE) leak. We close those fds before doing other work.""" if platform.system() != "Darwin": return for d in range(3, 1025): try: stat = os.fstat(d) if stat is not None: pipebit = stat[0] & 0x1000 if pipebit != 0: os.close(d) except OSError: pass def LoadInfoDict(zip, type): """Read and parse the META/misc_info.txt key/value pairs from the input target files and return a dict.""" d = {} try: for line in zip.read("META/misc_info.txt").split("\n"): line = line.strip() if not line or line.startswith("#"): continue k, v = line.split("=", 1) d[k] = v except KeyError: # ok if misc_info.txt doesn't exist pass # backwards compatibility: These values used to be in their own # files. Look for them, in case we're processing an old # target_files zip. if "mkyaffs2_extra_flags" not in d: try: d["mkyaffs2_extra_flags"] = zip.read("META/mkyaffs2-extra-flags.txt").strip() except KeyError: # ok if flags don't exist pass if "recovery_api_version" not in d: try: d["recovery_api_version"] = zip.read("META/recovery-api-version.txt").strip() except KeyError: raise ValueError("can't find recovery API version in input target-files") if "tool_extensions" not in d: try: d["tool_extensions"] = zip.read("META/tool-extensions.txt").strip() except KeyError: # ok if extensions don't exist pass try: data = zip.read("META/imagesizes.txt") for line in data.split("\n"): if not line: continue name, value = line.split(" ", 1) if not value: continue if name == "blocksize": d[name] = value else: d[name + "_size"] = value except KeyError: pass def makeint(key): if key in d: d[key] = int(d[key], 0) makeint("recovery_api_version") makeint("blocksize") makeint("system_size") makeint("userdata_size") makeint("recovery_size") makeint("boot_size") d["fstab"] = LoadRecoveryFSTab(zip, type) return d def LoadRecoveryFSTab(zip, type): class Partition(object): pass try: if type == 'MTD': data = zip.read("RECOVERY/recovery.fstab") elif type == 'MMC': data = zip.read("RECOVERY/RAMDISK/etc/recovery_mmc.fstab") except KeyError: print "Warning: could not find RECOVERY/RAMDISK/etc/recovery.fstab in %s." % zip data = "" d = {} for line in data.split("\n"): line = line.strip() if not line or line.startswith("#"): continue pieces = line.split() if not (3 <= len(pieces) <= 4): raise ValueError("malformed recovery.fstab line: \"%s\"" % (line,)) p = Partition() p.mount_point = pieces[0] p.fs_type = pieces[1] p.device = pieces[2] p.length = 0 options = None if len(pieces) >= 4: if pieces[3].startswith("/"): p.device2 = pieces[3] if len(pieces) >= 5: options = pieces[4] else: p.device2 = None options = pieces[3] else: p.device2 = None if options: options = options.split(",") for i in options: if i.startswith("length="): p.length = int(i[7:]) else: print "%s: unknown option \"%s\"" % (p.mount_point, i) d[p.mount_point] = p return d def DumpInfoDict(d): for k, v in sorted(d.items()): print "%-25s = (%s) %s" % (k, type(v).__name__, v) def BuildBootableImage(sourcedir): """Take a kernel, cmdline, and ramdisk directory from the input (in 'sourcedir'), and turn them into a boot image. Return the image data, or None if sourcedir does not appear to contains files for building the requested image.""" if (not os.access(os.path.join(sourcedir, "RAMDISK"), os.F_OK) or not os.access(os.path.join(sourcedir, "kernel"), os.F_OK)): return None ramdisk_img = tempfile.NamedTemporaryFile() img = tempfile.NamedTemporaryFile() p1 = Run(["mkbootfs", os.path.join(sourcedir, "RAMDISK")], stdout=subprocess.PIPE) p2 = Run(["minigzip"], stdin=p1.stdout, stdout=ramdisk_img.file.fileno()) p2.wait() p1.wait() assert p1.returncode == 0, "mkbootfs of %s ramdisk failed" % (targetname,) assert p2.returncode == 0, "minigzip of %s ramdisk failed" % (targetname,) cmd = ["mkbootimg", "--kernel", os.path.join(sourcedir, "kernel")] fn = os.path.join(sourcedir, "cmdline") if os.access(fn, os.F_OK): cmd.append("--cmdline") cmd.append(open(fn).read().rstrip("\n")) fn = os.path.join(sourcedir, "base") if os.access(fn, os.F_OK): cmd.append("--base") cmd.append(open(fn).read().rstrip("\n")) fn = os.path.join(sourcedir, "pagesize") if os.access(fn, os.F_OK): cmd.append("--pagesize") cmd.append(open(fn).read().rstrip("\n")) pagesize = open(fn).read().rstrip("\n") else: pagesize = 2048 cmd.extend(["--ramdisk", ramdisk_img.name, "--output", img.name]) p = Run(cmd, stdout=subprocess.PIPE) p.communicate() assert p.returncode == 0, "mkbootimg of %s image failed" % ( os.path.basename(sourcedir),) fn = os.path.join(sourcedir, "sign-key") if os.access(fn, os.F_OK): # Signature key found # Get SHA256 of raw image sha256 = tempfile.NamedTemporaryFile() p = Run(["openssl", "dgst", "-sha256", "-binary", img.name], stdout=sha256) p.communicate() # Create signature signature = tempfile.NamedTemporaryFile() p = Run(["openssl", "rsautl", "-sign", "-in", sha256.name, "-inkey", os.path.join(sourcedir, "sign-key"), "-out", signature.name], stdout=subprocess.PIPE) p.communicate() # Create padding of pagesize signature_pad = tempfile.NamedTemporaryFile() p = Run(["dd", "if=/dev/zero", "of="+signature_pad.name, "bs="+pagesize, "count=1"], stdout=subprocess.PIPE) p.communicate() # Add Signature. p = Run(["dd", "if="+signature.name, "of="+signature_pad.name, "conv=notrunc"], stdout=subprocess.PIPE) p.communicate() signedimg = tempfile.NamedTemporaryFile() p = Run(["cat", img.name, signature_pad.name], stdout=signedimg) p.communicate() img.close() img = signedimg # Close all files sha256.close() signature.close() signature_pad.close() img.seek(os.SEEK_SET, 0) data = img.read() ramdisk_img.close() img.close() return data def GetBootableImage(name, prebuilt_name, unpack_dir, tree_subdir): """Return a File object (with name 'name') with the desired bootable image. Look for it in 'unpack_dir'/BOOTABLE_IMAGES under the name 'prebuilt_name', otherwise construct it from the source files in 'unpack_dir'/'tree_subdir'.""" prebuilt_path = os.path.join(unpack_dir, "BOOTABLE_IMAGES", prebuilt_name) if os.path.exists(prebuilt_path): print "using prebuilt %s..." % (prebuilt_name,) return File.FromLocalFile(name, prebuilt_path) else: print "building image from target_files %s..." % (tree_subdir,) return File(name, BuildBootableImage(os.path.join(unpack_dir, tree_subdir))) def UnzipTemp(filename, pattern=None): """Unzip the given archive into a temporary directory and return the name. If filename is of the form "foo.zip+bar.zip", unzip foo.zip into a temp dir, then unzip bar.zip into that_dir/BOOTABLE_IMAGES. Returns (tempdir, zipobj) where zipobj is a zipfile.ZipFile (of the main file), open for reading. """ tmp = tempfile.mkdtemp(prefix="targetfiles-") OPTIONS.tempfiles.append(tmp) def unzip_to_dir(filename, dirname): cmd = ["unzip", "-o", "-q", filename, "-d", dirname] if pattern is not None: cmd.append(pattern) p = Run(cmd, stdout=subprocess.PIPE) p.communicate() if p.returncode != 0: raise ExternalError("failed to unzip input target-files \"%s\"" % (filename,)) m = re.match(r"^(.*[.]zip)\+(.*[.]zip)$", filename, re.IGNORECASE) if m: unzip_to_dir(m.group(1), tmp) unzip_to_dir(m.group(2), os.path.join(tmp, "BOOTABLE_IMAGES")) filename = m.group(1) else: unzip_to_dir(filename, tmp) return tmp, zipfile.ZipFile(filename, "r") def GetKeyPasswords(keylist): """Given a list of keys, prompt the user to enter passwords for those which require them. Return a {key: password} dict. password will be None if the key has no password.""" no_passwords = [] need_passwords = [] devnull = open("/dev/null", "w+b") for k in sorted(keylist): # We don't need a password for things that aren't really keys. if k in SPECIAL_CERT_STRINGS: no_passwords.append(k) continue p = Run(["openssl", "pkcs8", "-in", k+".pk8", "-inform", "DER", "-nocrypt"], stdin=devnull.fileno(), stdout=devnull.fileno(), stderr=subprocess.STDOUT) p.communicate() if p.returncode == 0: no_passwords.append(k) else: need_passwords.append(k) devnull.close() key_passwords = PasswordManager().GetPasswords(need_passwords) key_passwords.update(dict.fromkeys(no_passwords, None)) return key_passwords def SignFile(input_name, output_name, key, password, align=None, whole_file=False): """Sign the input_name zip/jar/apk, producing output_name. Use the given key and password (the latter may be None if the key does not have a password. If align is an integer > 1, zipalign is run to align stored files in the output zip on 'align'-byte boundaries. If whole_file is true, use the "-w" option to SignApk to embed a signature that covers the whole file in the archive comment of the zip file. """ if align == 0 or align == 1: align = None if align: temp = tempfile.NamedTemporaryFile() sign_name = temp.name else: sign_name = output_name cmd = ["java", "-Xmx2048m", "-jar", os.path.join(OPTIONS.search_path, "framework", "signapk.jar")] if whole_file: cmd.append("-w") cmd.extend([key + ".x509.pem", key + ".pk8", input_name, sign_name]) p = Run(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE) if password is not None: password += "\n" p.communicate(password) if p.returncode != 0: raise ExternalError("signapk.jar failed: return code %s" % (p.returncode,)) if align: p = Run(["zipalign", "-f", str(align), sign_name, output_name]) p.communicate() if p.returncode != 0: raise ExternalError("zipalign failed: return code %s" % (p.returncode,)) temp.close() def CheckSize(data, target, info_dict): """Check the data string passed against the max size limit, if any, for the given target. Raise exception if the data is too big. Print a warning if the data is nearing the maximum size.""" if target.endswith(".img"): target = target[:-4] mount_point = "/" + target if info_dict["fstab"]: if mount_point == "/userdata": mount_point = "/data" p = info_dict["fstab"][mount_point] fs_type = p.fs_type limit = info_dict.get(p.device + "_size", None) if not fs_type or not limit: return if fs_type == "yaffs2": # image size should be increased by 1/64th to account for the # spare area (64 bytes per 2k page) limit = limit / 2048 * (2048+64) size = len(data) pct = float(size) * 100.0 / limit msg = "%s size (%d) is %.2f%% of limit (%d)" % (target, size, pct, limit) if pct >= 99.0: raise ExternalError(msg) elif pct >= 95.0: print print " WARNING: ", msg print elif OPTIONS.verbose: print " ", msg def ReadApkCerts(tf_zip): """Given a target_files ZipFile, parse the META/apkcerts.txt file and return a {package: cert} dict.""" certmap = {} for line in tf_zip.read("META/apkcerts.txt").split("\n"): line = line.strip() if not line: continue m = re.match(r'^name="(.*)"\s+certificate="(.*)"\s+' r'private_key="(.*)"$', line) if m: name, cert, privkey = m.groups() if cert in SPECIAL_CERT_STRINGS and not privkey: certmap[name] = cert elif (cert.endswith(".x509.pem") and privkey.endswith(".pk8") and cert[:-9] == privkey[:-4]): certmap[name] = cert[:-9] else: raise ValueError("failed to parse line from apkcerts.txt:\n" + line) return certmap COMMON_DOCSTRING = """ -p (--path)