Initial commit of certify_bootimg.py
Adding a new script, certify_bootimg.py, to add boot
certificates for a given boot image. The script adds
two certificates: 'boot' and 'generic_kernel'. The former
is to certify the entire boot.img, while the latter
is to certify the kernel packed in the boot.img.
It assumes all boot certificates are within the last 16K
of the boot image, i.e., the boot signature block, before
adding the AVB footer.
It also adds a non-signed AVB hash footer, for device with
AVB to use the output boot image directly if it is unlocked,
where the verification error is allowed.
An usage example:
certify_bootimg --boot_img boot.img \
--algorithm SHA256_RSA4096 \
--key external/avb/test/data/testkey_rsa4096.pem \
--extra_args "--prop foo:bar" \
--extra_args "--prop gki:nice" \
--output boot-certified.img
Bug: 223288963
Test: atest --host certify_bootimg_test
Change-Id: Id03d9967b89d87f3d3e0ce08b886909c68fac18c
5 files changed