1# 2# Copyright (C) 2019 The Android Open Source Project 3# 4# Licensed under the Apache License, Version 2.0 (the "License"); 5# you may not use this file except in compliance with the License. 6# You may obtain a copy of the License at 7# 8# http://www.apache.org/licenses/LICENSE-2.0 9# 10# Unless required by applicable law or agreed to in writing, software 11# distributed under the License is distributed on an "AS IS" BASIS, 12# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13# See the License for the specific language governing permissions and 14# limitations under the License. 15# 16 17############################################################ 18# Internal build rules for APPS prebuilt modules 19############################################################ 20 21ifneq (APPS,$(LOCAL_MODULE_CLASS)) 22$(call pretty-error,app_prebuilt_internal.mk is for APPS modules only) 23endif 24 25ifdef LOCAL_COMPRESSED_MODULE 26 ifneq (true,$(LOCAL_COMPRESSED_MODULE)) 27 $(call pretty-error, Unknown value for LOCAL_COMPRESSED_MODULE $(LOCAL_COMPRESSED_MODULE)) 28 endif 29 LOCAL_BUILT_MODULE_STEM := package.apk.gz 30 ifndef LOCAL_INSTALLED_MODULE_STEM 31 PACKAGES.$(LOCAL_MODULE).COMPRESSED := gz 32 LOCAL_INSTALLED_MODULE_STEM := $(LOCAL_MODULE).apk.gz 33 endif 34else # LOCAL_COMPRESSED_MODULE 35 LOCAL_BUILT_MODULE_STEM := package.apk 36 ifndef LOCAL_INSTALLED_MODULE_STEM 37 LOCAL_INSTALLED_MODULE_STEM := $(LOCAL_MODULE).apk 38 endif 39endif # LOCAL_COMPRESSED_MODULE 40 41include $(BUILD_SYSTEM)/base_rules.mk 42built_module := $(LOCAL_BUILT_MODULE) 43 44# Run veridex on product, system_ext and vendor modules. 45# We skip it for unbundled app builds where we cannot build veridex. 46module_run_appcompat := 47ifeq (true,$(non_system_module)) 48ifeq (,$(TARGET_BUILD_APPS)) # ! unbundled app build 49ifneq ($(UNSAFE_DISABLE_HIDDENAPI_FLAGS),true) 50 module_run_appcompat := true 51endif 52endif 53endif 54 55PACKAGES.$(LOCAL_MODULE).OVERRIDES := $(strip $(LOCAL_OVERRIDES_PACKAGES)) 56 57my_extract_apk := $(strip $(LOCAL_EXTRACT_APK)) 58 59# Select dpi-specific source 60ifdef LOCAL_DPI_VARIANTS 61my_dpi := $(firstword $(filter $(LOCAL_DPI_VARIANTS),$(PRODUCT_AAPT_PREF_CONFIG) $(PRODUCT_AAPT_PREBUILT_DPI))) 62ifdef my_dpi 63ifdef LOCAL_DPI_FILE_STEM 64my_prebuilt_dpi_file_stem := $(LOCAL_DPI_FILE_STEM) 65else 66my_prebuilt_dpi_file_stem := $(LOCAL_MODULE)_%.apk 67endif 68my_prebuilt_src_file := $(dir $(my_prebuilt_src_file))$(subst %,$(my_dpi),$(my_prebuilt_dpi_file_stem)) 69 70ifneq ($(strip $(LOCAL_EXTRACT_DPI_APK)),) 71my_extract_apk := $(subst %,$(my_dpi),$(LOCAL_EXTRACT_DPI_APK)) 72endif # LOCAL_EXTRACT_DPI_APK 73endif # my_dpi 74endif # LOCAL_DPI_VARIANTS 75 76ifdef my_extract_apk 77my_extracted_apk := $(intermediates)/extracted.apk 78 79$(my_extracted_apk): PRIVATE_EXTRACT := $(my_extract_apk) 80$(my_extracted_apk): $(my_prebuilt_src_file) 81 @echo Extract APK: $@ 82 $(hide) mkdir -p $(dir $@) && rm -f $@ 83 $(hide) unzip -p $< $(PRIVATE_EXTRACT) >$@ 84 85my_prebuilt_src_file := $(my_extracted_apk) 86my_extracted_apk := 87my_extract_apk := 88ifeq ($(PRODUCT_ALWAYS_PREOPT_EXTRACTED_APK),true) 89# If the product property is set, always preopt for extracted modules to prevent executing out of 90# the APK. 91my_preopt_for_extracted_apk := true 92endif 93endif 94 95rs_compatibility_jni_libs := 96include $(BUILD_SYSTEM)/install_jni_libs.mk 97 98ifeq ($(LOCAL_CERTIFICATE),EXTERNAL) 99 # The magic string "EXTERNAL" means this package will be signed with 100 # the default dev key throughout the build process, but we expect 101 # the final package to be signed with a different key. 102 # 103 # This can be used for packages where we don't have access to the 104 # keys, but want the package to be predexopt'ed. 105 LOCAL_CERTIFICATE := $(DEFAULT_SYSTEM_DEV_CERTIFICATE) 106 PACKAGES.$(LOCAL_MODULE).EXTERNAL_KEY := 1 107 108 $(built_module) : $(LOCAL_CERTIFICATE).pk8 $(LOCAL_CERTIFICATE).x509.pem 109 $(built_module) : PRIVATE_PRIVATE_KEY := $(LOCAL_CERTIFICATE).pk8 110 $(built_module) : PRIVATE_CERTIFICATE := $(LOCAL_CERTIFICATE).x509.pem 111endif 112ifeq ($(LOCAL_CERTIFICATE),) 113 # It is now a build error to add a prebuilt .apk without 114 # specifying a key for it. 115 $(error No LOCAL_CERTIFICATE specified for prebuilt "$(my_prebuilt_src_file)") 116else ifeq ($(LOCAL_CERTIFICATE),PRESIGNED) 117 # The magic string "PRESIGNED" means this package is already checked 118 # signed with its release key. 119 # 120 # By setting .CERTIFICATE but not .PRIVATE_KEY, this package will be 121 # mentioned in apkcerts.txt (with certificate set to "PRESIGNED") 122 # but the dexpreopt process will not try to re-sign the app. 123 PACKAGES.$(LOCAL_MODULE).CERTIFICATE := PRESIGNED 124 PACKAGES := $(PACKAGES) $(LOCAL_MODULE) 125else 126 # If this is not an absolute certificate, assign it to a generic one. 127 ifeq ($(dir $(strip $(LOCAL_CERTIFICATE))),./) 128 LOCAL_CERTIFICATE := $(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))$(LOCAL_CERTIFICATE) 129 endif 130 131 # NOTE(ruperts): Consider moving the logic below out of a conditional, 132 # to avoid the possibility of silently ignoring user settings. 133 134 PACKAGES.$(LOCAL_MODULE).PRIVATE_KEY := $(LOCAL_CERTIFICATE).pk8 135 PACKAGES.$(LOCAL_MODULE).CERTIFICATE := $(LOCAL_CERTIFICATE).x509.pem 136 PACKAGES := $(PACKAGES) $(LOCAL_MODULE) 137 138 $(built_module) : $(LOCAL_CERTIFICATE).pk8 $(LOCAL_CERTIFICATE).x509.pem 139 $(built_module) : PRIVATE_PRIVATE_KEY := $(LOCAL_CERTIFICATE).pk8 140 $(built_module) : PRIVATE_CERTIFICATE := $(LOCAL_CERTIFICATE).x509.pem 141 142 additional_certificates := $(foreach c,$(LOCAL_ADDITIONAL_CERTIFICATES), $(c).x509.pem $(c).pk8) 143 $(built_module): $(additional_certificates) 144 $(built_module): PRIVATE_ADDITIONAL_CERTIFICATES := $(additional_certificates) 145 146 $(built_module): $(LOCAL_CERTIFICATE_LINEAGE) 147 $(built_module): PRIVATE_CERTIFICATE_LINEAGE := $(LOCAL_CERTIFICATE_LINEAGE) 148 149 $(built_module): PRIVATE_ROTATION_MIN_SDK_VERSION := $(LOCAL_ROTATION_MIN_SDK_VERSION) 150endif 151 152ifneq ($(LOCAL_MODULE_STEM),) 153 PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE_STEM) 154else 155 PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE) 156endif 157 158include $(BUILD_SYSTEM)/app_certificate_validate.mk 159 160# Set a actual_partition_tag (calculated in base_rules.mk) for the package. 161PACKAGES.$(LOCAL_MODULE).PARTITION := $(actual_partition_tag) 162 163# Disable dex-preopt of prebuilts to save space, if requested. 164ifndef LOCAL_DEX_PREOPT 165ifeq ($(DONT_DEXPREOPT_PREBUILTS),true) 166LOCAL_DEX_PREOPT := false 167endif 168endif 169 170# If the module is a compressed module, we don't pre-opt it because its final 171# installation location will be the data partition. 172ifdef LOCAL_COMPRESSED_MODULE 173LOCAL_DEX_PREOPT := false 174endif 175 176my_dex_jar := $(my_prebuilt_src_file) 177dex_preopt_profile_src_file := $(my_prebuilt_src_file) 178 179####################################### 180# defines built_odex along with rule to install odex 181my_manifest_or_apk := $(my_prebuilt_src_file) 182include $(BUILD_SYSTEM)/dex_preopt_odex_install.mk 183my_manifest_or_apk := 184####################################### 185ifneq ($(LOCAL_REPLACE_PREBUILT_APK_INSTALLED),) 186# There is a replacement for the prebuilt .apk we can install without any processing. 187$(built_module) : $(LOCAL_REPLACE_PREBUILT_APK_INSTALLED) 188 $(transform-prebuilt-to-target) 189 190else # ! LOCAL_REPLACE_PREBUILT_APK_INSTALLED 191 192# If the SDK version is 30 or higher, the apk is signed with a v2+ scheme. 193# Altering it will invalidate the signature. Just do error checks instead. 194do_not_alter_apk := 195ifeq (PRESIGNED,$(LOCAL_CERTIFICATE)) 196 ifneq (,$(LOCAL_SDK_VERSION)) 197 ifeq ($(call math_is_number,$(LOCAL_SDK_VERSION)),true) 198 ifeq ($(call math_gt,$(LOCAL_SDK_VERSION),29),true) 199 do_not_alter_apk := true 200 endif 201 endif 202 # TODO: Add system_current after fixing the existing modules. 203 ifneq ($(filter current test_current core_current,$(LOCAL_SDK_VERSION)),) 204 do_not_alter_apk := true 205 endif 206 endif 207endif 208 209ifeq ($(do_not_alter_apk),true) 210$(built_module) : $(my_prebuilt_src_file) | $(ZIPALIGN) 211 $(transform-prebuilt-to-target) 212 $(check-jni-dex-compression) 213 $(check-package-alignment) 214else 215# Sign and align non-presigned .apks. 216# The embedded prebuilt jni to uncompress. 217ifeq ($(LOCAL_CERTIFICATE),PRESIGNED) 218# For PRESIGNED apks we must uncompress every .so file: 219# even if the .so file isn't for the current TARGET_ARCH, 220# we can't strip the file. 221embedded_prebuilt_jni_libs := 222endif 223ifndef embedded_prebuilt_jni_libs 224# No LOCAL_PREBUILT_JNI_LIBS, uncompress all. 225embedded_prebuilt_jni_libs := 226endif 227$(built_module): PRIVATE_EMBEDDED_JNI_LIBS := $(embedded_prebuilt_jni_libs) 228 229ifdef LOCAL_COMPRESSED_MODULE 230$(built_module) : $(MINIGZIP) 231endif 232 233ifeq ($(module_run_appcompat),true) 234$(built_module) : $(appcompat-files) 235$(LOCAL_BUILT_MODULE): PRIVATE_INSTALLED_MODULE := $(LOCAL_INSTALLED_MODULE) 236endif 237 238ifeq ($(module_run_appcompat),true) 239$(built_module) : $(AAPT2) 240endif 241$(built_module) : $(my_prebuilt_src_file) | $(ZIPALIGN) $(ZIP2ZIP) $(SIGNAPK_JAR) $(SIGNAPK_JNI_LIBRARY_PATH) 242 $(transform-prebuilt-to-target) 243 $(uncompress-prebuilt-embedded-jni-libs) 244 $(remove-unwanted-prebuilt-embedded-jni-libs) 245ifeq (true, $(LOCAL_UNCOMPRESS_DEX)) 246 $(uncompress-dexs) 247endif # LOCAL_UNCOMPRESS_DEX 248ifneq ($(LOCAL_CERTIFICATE),PRESIGNED) 249ifeq ($(module_run_appcompat),true) 250 $(call appcompat-header, aapt2) 251 $(run-appcompat) 252endif # module_run_appcompat 253 $(sign-package) 254 # No need for align-package because sign-package takes care of alignment 255else # LOCAL_CERTIFICATE == PRESIGNED 256 $(align-package) 257endif # LOCAL_CERTIFICATE 258ifdef LOCAL_COMPRESSED_MODULE 259 $(compress-package) 260endif # LOCAL_COMPRESSED_MODULE 261endif # ! do_not_alter_apk 262endif # ! LOCAL_REPLACE_PREBUILT_APK_INSTALLED 263 264 265############################### 266## Install split apks. 267ifdef LOCAL_PACKAGE_SPLITS 268ifdef LOCAL_COMPRESSED_MODULE 269$(error $(LOCAL_MODULE): LOCAL_COMPRESSED_MODULE is not currently supported for split installs) 270endif # LOCAL_COMPRESSED_MODULE 271 272# LOCAL_PACKAGE_SPLITS is a list of apks to be installed. 273built_apk_splits := $(addprefix $(intermediates)/,$(notdir $(LOCAL_PACKAGE_SPLITS))) 274installed_apk_splits := $(addprefix $(my_module_path)/,$(notdir $(LOCAL_PACKAGE_SPLITS))) 275 276# Rules to sign the split apks. 277my_src_dir := $(sort $(dir $(LOCAL_PACKAGE_SPLITS))) 278ifneq (1,$(words $(my_src_dir))) 279$(error You must put all the split source apks in the same folder: $(LOCAL_PACKAGE_SPLITS)) 280endif 281my_src_dir := $(LOCAL_PATH)/$(my_src_dir) 282 283$(built_apk_splits) : $(LOCAL_CERTIFICATE).pk8 $(LOCAL_CERTIFICATE).x509.pem | $(ZIPALIGN) $(ZIP2ZIP) $(SIGNAPK_JAR) $(SIGNAPK_JNI_LIBRARY_PATH) 284$(built_apk_splits) : PRIVATE_PRIVATE_KEY := $(LOCAL_CERTIFICATE).pk8 285$(built_apk_splits) : PRIVATE_CERTIFICATE := $(LOCAL_CERTIFICATE).x509.pem 286$(built_apk_splits) : $(intermediates)/%.apk : $(my_src_dir)/%.apk 287 $(copy-file-to-new-target) 288 $(sign-package) 289 290# Rules to install the split apks. 291$(installed_apk_splits) : $(my_module_path)/%.apk : $(intermediates)/%.apk 292 @echo "Install: $@" 293 $(copy-file-to-new-target) 294 295# Register the additional built and installed files. 296ALL_MODULES.$(my_register_name).INSTALLED += $(installed_apk_splits) 297ALL_MODULES.$(my_register_name).BUILT_INSTALLED += \ 298 $(foreach s,$(LOCAL_PACKAGE_SPLITS),$(intermediates)/$(notdir $(s)):$(my_module_path)/$(notdir $(s))) 299 300# Make sure to install the splits when you run "make <module_name>". 301$(my_all_targets): $(installed_apk_splits) 302 303endif # LOCAL_PACKAGE_SPLITS 304 305########################################################### 306## SBOM generation 307########################################################### 308include $(BUILD_SBOM_GEN)