From 7bf9b2671667828d1553c92bf4f64cc749b74d0b Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Tue, 27 Jun 2023 22:47:07 -0400 Subject: drop legacy info on APEX components --- static/build.html | 33 +++++++++++---------------------- 1 file changed, 11 insertions(+), 22 deletions(-) (limited to 'static/build.html') diff --git a/static/build.html b/static/build.html index c8260be5..ce8c4531 100644 --- a/static/build.html +++ b/static/build.html @@ -28,6 +28,7 @@ + {{js|/js/redirect.js}}
@@ -80,7 +81,7 @@
  • @@ -606,27 +607,15 @@ cd ../.. the keys in tmpfs to perform signing.

    -
    -

    Enabling updatable APEX components

    - -

    GrapheneOS uses the TARGET_FLATTEN_APEX := true format to - include APEX components as part of the base OS and disables support for - out-of-band APEX component updates. This reduces complexity and attack - surface along with simplifying key management since there aren't a bunch - of additional components to sign. GrapheneOS has no use for out-of-band - updates to APEX components since we update the OS for each device and - don't need partial out-of-band updates for portable components.

    - -

    APEX components that aren't flattened are a signed APK (used to verify - updates) with an embedded filesystem image signed with an AVB key (for - verified boot). Our release signing scripts has support for signing - non-flattened APEX components with the releasekey and AVB key for the - device. This secures it but wouldn't be usable for shipping out-of-band - updates to APEX components across multiple devices. You could switch to - using a single shared APEX APK signing key and AVB signing key. You'll - also need to add parameters for additional device-specific APEX components - not included in our release signing script which was set up based on the - Pixel 6 and Pixel 6 Pro.

    +
    +

    APEX components

    + +

    GrapheneOS currently doesn't use out-of-date updates to APEX + components, so these are all signed with the OS releasekey and verified + boot key to avoid needing many extra pairs of keys. Each APEX needs an APK + signing key and verified boot signing key. If you want to ship out-of-band + updates to APEX components, you'll need to deal with this and you should + make a separate pair of keys for each one.

    Consult the upstream documentation on generating these keys. It will likely be covered here in the future, especially if non-flattened APEX -- cgit v1.3.1