sign non-PRESIGNED prebuilt apks

Since dev keys can now vary per device, we can't assume they are
checked in with the correct signature.

Change-Id: I7577a3a6bd98d005c15936c99b2944acc4412798

diff --git a/core/prebuilt.mk b/core/prebuilt.mk
index 8c03341..54a7fa9 100644 (file)
--- a/core/prebuilt.mk
+++ b/core/prebuilt.mk
@@ -54,47 +54,18 @@ endif
 
 PACKAGES.$(LOCAL_MODULE).OVERRIDES := $(strip $(LOCAL_OVERRIDES_PACKAGES))
 
-# Ensure that prebuilt .apks have been aligned.
-ifneq ($(filter APPS,$(LOCAL_MODULE_CLASS)),)
-$(built_module) : $(LOCAL_PATH)/$(LOCAL_SRC_FILES) | $(ZIPALIGN)
-       $(transform-prebuilt-to-target-with-zipalign)
-else
-ifneq ($(LOCAL_PREBUILT_STRIP_COMMENTS),)
-$(built_module) : $(LOCAL_PATH)/$(LOCAL_SRC_FILES)
-       $(transform-prebuilt-to-target-strip-comments)
-else
-$(built_module) : $(LOCAL_PATH)/$(LOCAL_SRC_FILES) | $(ACP)
-       $(transform-prebuilt-to-target)
-endif
-endif
-
-ifeq ($(LOCAL_IS_HOST_MODULE)$(LOCAL_MODULE_CLASS),JAVA_LIBRARIES)
-# for target java libraries, the LOCAL_BUILT_MODULE is in a product-specific dir,
-# while the deps should be in the common dir, so we make a copy in the common dir.
-# For nonstatic library, $(common_javalib_jar) is the dependency file,
-# while $(common_classes_jar) is used to link.
-common_classes_jar := $(call intermediates-dir-for,JAVA_LIBRARIES,$(LOCAL_MODULE),,COMMON)/classes.jar
-common_javalib_jar := $(dir $(common_classes_jar))javalib.jar
-
-$(common_classes_jar) : $(LOCAL_PATH)/$(LOCAL_SRC_FILES) | $(ACP)
-       $(transform-prebuilt-to-target)
-
-$(common_javalib_jar) : $(common_classes_jar) | $(ACP)
-       $(transform-prebuilt-to-target)
-
-# make sure the classes.jar and javalib.jar are built before $(LOCAL_BUILT_MODULE)
-$(built_module) : $(common_javalib_jar)
-endif # TARGET JAVA_LIBRARIES
-
 ifeq ($(LOCAL_CERTIFICATE),EXTERNAL)
   # The magic string "EXTERNAL" means this package will be signed with
-  # the test key throughout the build process, but we expect the final
-  # package to be signed with a different key.
+  # the default dev key throughout the build process, but we expect
+  # the final package to be signed with a different key.
   #
   # This can be used for packages where we don't have access to the
   # keys, but want the package to be predexopt'ed.
   LOCAL_CERTIFICATE := $(DEFAULT_SYSTEM_DEV_CERTIFICATE)
   PACKAGES.$(LOCAL_MODULE).EXTERNAL_KEY := 1
+
+  $(built_module) : PRIVATE_PRIVATE_KEY := $(LOCAL_CERTIFICATE).pk8
+  $(built_module) : PRIVATE_CERTIFICATE := $(LOCAL_CERTIFICATE).x509.pem
 endif
 ifeq ($(LOCAL_CERTIFICATE),)
   ifneq ($(filter APPS,$(LOCAL_MODULE_CLASS)),)
@@ -120,8 +91,51 @@ else
   PACKAGES.$(LOCAL_MODULE).PRIVATE_KEY := $(LOCAL_CERTIFICATE).pk8
   PACKAGES.$(LOCAL_MODULE).CERTIFICATE := $(LOCAL_CERTIFICATE).x509.pem
   PACKAGES := $(PACKAGES) $(LOCAL_MODULE)
+
+  $(built_module) : PRIVATE_PRIVATE_KEY := $(LOCAL_CERTIFICATE).pk8
+  $(built_module) : PRIVATE_CERTIFICATE := $(LOCAL_CERTIFICATE).x509.pem
 endif
 
+ifneq ($(filter APPS,$(LOCAL_MODULE_CLASS)),)
+ifeq ($(LOCAL_CERTIFICATE),PRESIGNED)
+# Ensure that presigned .apks have been aligned.
+$(built_module) : $(LOCAL_PATH)/$(LOCAL_SRC_FILES) | $(ZIPALIGN)
+       $(transform-prebuilt-to-target-with-zipalign)
+else
+# Sign and align non-presigned .apks.
+$(built_module) : $(LOCAL_PATH)/$(LOCAL_SRC_FILES) | $(ACP) $(ZIPALIGN) $(SIGNAPK_JAR)
+       $(transform-prebuilt-to-target)
+       $(sign-package)
+       $(align-package)
+endif
+else
+ifneq ($(LOCAL_PREBUILT_STRIP_COMMENTS),)
+$(built_module) : $(LOCAL_PATH)/$(LOCAL_SRC_FILES)
+       $(transform-prebuilt-to-target-strip-comments)
+else
+$(built_module) : $(LOCAL_PATH)/$(LOCAL_SRC_FILES) | $(ACP)
+       $(transform-prebuilt-to-target)
+endif
+endif
+
+ifeq ($(LOCAL_IS_HOST_MODULE)$(LOCAL_MODULE_CLASS),JAVA_LIBRARIES)
+# for target java libraries, the LOCAL_BUILT_MODULE is in a product-specific dir,
+# while the deps should be in the common dir, so we make a copy in the common dir.
+# For nonstatic library, $(common_javalib_jar) is the dependency file,
+# while $(common_classes_jar) is used to link.
+common_classes_jar := $(call intermediates-dir-for,JAVA_LIBRARIES,$(LOCAL_MODULE),,COMMON)/classes.jar
+common_javalib_jar := $(dir $(common_classes_jar))javalib.jar
+
+$(common_classes_jar) : $(LOCAL_PATH)/$(LOCAL_SRC_FILES) | $(ACP)
+       $(transform-prebuilt-to-target)
+
+$(common_javalib_jar) : $(common_classes_jar) | $(ACP)
+       $(transform-prebuilt-to-target)
+
+# make sure the classes.jar and javalib.jar are built before $(LOCAL_BUILT_MODULE)
+$(built_module) : $(common_javalib_jar)
+endif # TARGET JAVA_LIBRARIES
+
 ifneq ($(prebuilt_module_is_a_library),)
   ifneq ($(LOCAL_IS_HOST_MODULE),)
        $(transform-host-ranlib-copy-hack)