製作跟前面配對的keys放在recovery裏面用於校驗。
java -jar out/host/linux-x86/framework/dumpkey.jar build/target/product/security/testkey.x509.pem > out/target/product/generic/keys
下面部分轉自http://blog.csdn.net/superkris/article/details/7547162 多謝！
通過make -j4編譯出來的system.img使用的是test key,這種類型的key只適用於開發階段，而且這種祕鑰是公開的，誰都可以使用。當發佈一款android產品，就需要另外給整個系統籤個名，防止被別人盜用。這種系統就是release版本的Android系統。
下面就詳細介紹下整個過程。
1、生成加密key文件
要對Android系統進行簽名，需要生成四種類型的key文件。
a)releasekey
b)media
c)shared
d)platform
我們就拿releasekey爲例簡單介紹下生成過程。
1）進入/android_src/development/tools目錄。
/development/tools$ ls
apkcheck etc1tool hosttestlib jdwpspy makedict mkstubs
axl findunused idegen line_endings make_key monkeyrunner zoneinfo
2）使用make_key工具生成簽名文件
development/tools$ sh make_key releasekey '/C=CN/ST=JiangSu/L=NanJing/O=Company/OU=Department/CN=YourName/emailAddress=YourE-mailAddress'
Enter password for 'releasekey' (blank for none; password will be visible): mypassword <------- 設置你的密碼
creating platform.pk8 with password [mypassword]
Generating RSA private key, 2048 bit long modulus
...............+++
........................................................+++
e is 3 (0x3)
這裏要順便介紹下make_key的參數。第一個參數是要生成key的名字，第二個參數是關於你公司的信息。
key的名字很好理解，就是前面提到的4中類型的key，公司信息的參數比較多，它們的含義如下：
C ---> Country Name (2 letter code)
ST ---> State or Province Name (full name)
L ---> Locality Name (eg, city)
O ---> Organization Name (eg, company)
OU ---> Organizational Unit Name (eg, section)
CN ---> Common Name (eg, your name or your server’s hostname)
emailAddress ---> Contact email address
這樣就生成了一組releasekey,另外3種類型的key的生成方法也基本一樣。
生成後的結果如下：
/development/tools$ ls
makedict media.pk8 mkstubs platform.pk8 releasekey.pk8 shared.pk8
make_key media.x509.pem platform.x509.pem releasekey.x509.pem shared.x509.pem
*.pk8是生成的私鑰，而*.x509.pem是公鑰,生成時兩者是成對出現的.
2、把pk8和x509.pem文件拷貝到vendor/sprd/security/product_modul目錄
4、編譯系統
/android_src$ make -j4 PRODUCT-product_modul-user dist
後面多了兩個參數PRODUCT-product_modul-user 和 dist. 編譯完成之後回在/android_src/dist/目錄內生成個product_modul-target_files開頭的zip文件.這就是我們需要進行簽名的文件系統.
5、開始簽名
android_src$ ./build/tools/releasetools/sign_target_files_apks -d vendor/sprd/security/product_modul/ out/dist/product_modul-target_files.zip out/dist/signed_target_files.zip
ERROR: no key specified for:
CalendarWidget.apk
Contacts_yellowpage.apk
SnsAppMain.apk
fbandroid-1.5.0.apk
AnalogClockWidget.apk
MessageWidget.apk
NewsWidget.apk
上面的意思是使用sign_target_files_apks工具採用vendor/sprd/security/product_modul/下的key對product_modul-target_files.zip文件進行簽名,並把簽名結果放在out/dist/signed_target_files.zip裏.
從上面的簽名結果看,簽名並沒有成功,原因是由於有些apk程序已經簽過名了或者找不到對應的key. 可以通過設置過濾,不對上面的程序進行簽名.方法如下:
通過參數"-e <apkname>=" 來過濾這些程序.
android_src$ ./build/tools/releasetools/sign_target_files_apks -d vendor/sprdl/security/product_modul/ -e CalendarWidget.apk= -e Contacts_yellowpage.apk= -e SnsAppMain.apk= -e fbandroid-1.5.0.apk= -e AnalogClockWidget.apk= -e MessageWidget.apk= -e NewsWidget.apk= out/dist/product_modul-target_files.zip out/dist/signed_target_files.zip
Enter password for vendor/Modul/security/product_modul//media key> <----- imput the password
Enter password for vendor/Modul/security/product_modul//platform key> <----- imput the password
Enter password for vendor/Modul/security/product_modul//releasekey key> <----- imput the password
Enter password for vendor/Modul/security/product_modul//shared key> <----- imput the password
rewriting RECOVERY/RAMDISK/default.prop:
replace: ro.build.tags=test-keys
with: ro.build.tags=release-keys
NOT signing: CalendarWidget.apk
NOT signing: Contacts_yellowpage.apk
signing: Mms.apk
signing: SoundRecorder.apk
signing: AccountAndSyncSettings.apk
signing: Camera.apk
.......................................................................
rewriting SYSTEM/build.prop:
replace: ro.build.tags=test-keys
with: ro.build.tags=release-keys
replace: ro.build.description= test-keys
with: ro.build.description= release-keys
replace: ro.build.fingerprint=...........................
with: ro.build.fingerprint=.............................
signing: framework-res.apk
done.
這樣就完成了android系統的簽名工作.
6、生成image文件
android_src$ ./build/tools/releasetools/img_from_target_files out/dist/signed-target-files.zip out/dist/signed-img.zip
creating boot.img...
creating recovery.img...
creating system.img...
creating userdata.img...
cleaning up...
done.
使用img_from_target_files工具生成signed-img.zip文件.signed-img.zip文件包含了boot.img、userdata img、system.img文件等.
7、通過fastboot下載signed-img.zip文件
fastboot update signed-img.zip
通過fastboot就可以把簽了名的系統文件下載到手機上了。
