diff --git a/mobile_install/adapters/android_binary.bzl b/mobile_install/adapters/android_binary.bzl index 89fb1c107..bcf60ae99 100644 --- a/mobile_install/adapters/android_binary.bzl +++ b/mobile_install/adapters/android_binary.bzl @@ -59,6 +59,7 @@ def extract(target, ctx): debug_signing_keys = ctx.rule.files.debug_signing_keys, debug_signing_lineage_file = utils.only(ctx.rule.files.debug_signing_lineage_file, allow_empty = True), key_rotation_min_sdk = ctx.rule.attr.key_rotation_min_sdk, + keystore_signing_password = ctx.rule.attr.keystore_signing_password, merged_manifest = target[AndroidIdeInfo].generated_manifest, native_libs = target[AndroidIdeInfo].native_libs, package = java_package, diff --git a/mobile_install/apks.bzl b/mobile_install/apks.bzl index 69a7cfe5f..93a32c327 100644 --- a/mobile_install/apks.bzl +++ b/mobile_install/apks.bzl @@ -60,7 +60,7 @@ def _patch_split_manifests(ctx, orig_manifest, split_manifests, out_manifest_pac progress_message = "MI Patch split manifests", ) -def _make_split_apk(ctx, dirs, artifacts, debug_signing_keys, debug_signing_lineage_file, key_rotation_min_sdk, out): +def _make_split_apk(ctx, dirs, artifacts, debug_signing_keys, debug_signing_lineage_file, key_rotation_min_sdk, keystore_signing_password, out): unsigned = utils.isolated_declare_file(ctx, out.basename + "_unsigned", sibling = out) args = ctx.actions.args() @@ -87,7 +87,7 @@ def _make_split_apk(ctx, dirs, artifacts, debug_signing_keys, debug_signing_line progress_message = "MI Making split app %s" % out.path, ) - _zipalign_sign(ctx, unsigned, out, debug_signing_keys, debug_signing_lineage_file, key_rotation_min_sdk) + _zipalign_sign(ctx, unsigned, out, debug_signing_keys, debug_signing_lineage_file, key_rotation_min_sdk, keystore_signing_password) def make_split_apks( ctx, @@ -101,6 +101,7 @@ def make_split_apks( debug_signing_keys, debug_signing_lineage_file, key_rotation_min_sdk, + keystore_signing_password, sibling): """Create a split for each dex and for resources""" manifest_package_name = utils.isolated_declare_file(ctx, "manifest_package_name.txt", sibling = sibling) @@ -159,6 +160,7 @@ def make_split_apks( debug_signing_keys, debug_signing_lineage_file, key_rotation_min_sdk, + keystore_signing_password, split, ) splits.append(split) @@ -185,18 +187,18 @@ def make_split_apks( # Resources are now in the base apk to support RRO. Previously they were a separate split, but # base reinstalls no longer require a full reinstall. base = utils.isolated_declare_file(ctx, "splits/base.apk", sibling = sibling) - _make_split_apk(ctx, [compiled], [resource_apk, java8_legacy], debug_signing_keys, debug_signing_lineage_file, key_rotation_min_sdk, base) + _make_split_apk(ctx, [compiled], [resource_apk, java8_legacy], debug_signing_keys, debug_signing_lineage_file, key_rotation_min_sdk, keystore_signing_password, base) splits.append(base) return manifest_package_name, splits -def _zipalign_sign(ctx, unsigned_apk, signed_apk, debug_signing_keys, debug_signing_lineage_file, key_rotation_min_sdk): +def _zipalign_sign(ctx, unsigned_apk, signed_apk, debug_signing_keys, debug_signing_lineage_file, key_rotation_min_sdk, keystore_signing_password): """Zipalign and signs the given apk.""" signing_params = ((("--lineage %s " % debug_signing_lineage_file.path) if debug_signing_lineage_file else "") + (("--rotation-min-sdk-version %s " % key_rotation_min_sdk) if key_rotation_min_sdk else "") + " --next-signer ".join([ - "--ks %s --ks-pass pass:android" % debug_signing_key.path + "--ks %s --ks-pass pass:%s" % (debug_signing_key.path, keystore_signing_password) for debug_signing_key in debug_signing_keys ]) + " --v1-signing-enabled true" + diff --git a/mobile_install/process.bzl b/mobile_install/process.bzl index d1524801c..1fe04ec25 100644 --- a/mobile_install/process.bzl +++ b/mobile_install/process.bzl @@ -38,6 +38,7 @@ def process( debug_signing_keys = [], debug_signing_lineage_file = None, key_rotation_min_sdk = None, + keystore_signing_password = "android", apk = None, sibling = None): """Processes the data in the mi and return data to pass up the graph. @@ -57,6 +58,7 @@ def process( debug_signing_keys: Debug keystores to be used to sign the apk. debug_signing_lineage_file: File containing the signing lineage. key_rotation_min_sdk: String of the minimum API level to rotate signing keys for. + keystore_signing_password: String. The password for the signing keystores. apk: The generated apk for the app. sibling: The path to the launcher file. @@ -109,6 +111,7 @@ def process( debug_signing_keys, debug_signing_lineage_file, key_rotation_min_sdk, + keystore_signing_password, sibling, ) diff --git a/providers/providers.bzl b/providers/providers.bzl index d6fb946eb..8a4f15aff 100644 --- a/providers/providers.bzl +++ b/providers/providers.bzl @@ -44,6 +44,7 @@ StarlarkApkInfo = provider( keystore = "Keystore used to sign the APK. Deprecated, prefer signing_keys.", signing_keys = "List of keys used to sign the APK", signing_lineage = "Optional sigining lineage file", + keystore_signing_password = "Keystore password (defaults to android)", signed_apk = "Signed APK", unsigned_apk = "Unsigned APK", ), @@ -190,6 +191,7 @@ ApkInfo = provider( signed_apk = "Returns a signed APK built from the target.", signing_keys = "Returns a list of signing keystores that were used to sign the APK.", signing_min_v3_rotation_api_version = "Returns the minimum API version for signing the APK with key rotation.", + keystore_signing_password = "Returns the keystore password (defaults to android)", ), ) diff --git a/rules/android_binary/attrs.bzl b/rules/android_binary/attrs.bzl index 9620890aa..09d3421f2 100644 --- a/rules/android_binary/attrs.bzl +++ b/rules/android_binary/attrs.bzl @@ -175,6 +175,12 @@ ATTRS = _attrs.replace( """, cfg = android_platforms_transition, ), + keystore_signing_password = attr.string( + doc = """ + The password for the KeyStore that contains the signer's key and certificate. + """, + default = "android", + ), key_rotation_min_sdk = attr.string( doc = """ Sets the minimum Android platform version (API Level) for which an APK's diff --git a/rules/android_binary/impl.bzl b/rules/android_binary/impl.bzl index fc9be2182..2ad096839 100644 --- a/rules/android_binary/impl.bzl +++ b/rules/android_binary/impl.bzl @@ -984,6 +984,7 @@ def _process_apk_packaging(ctx, packaged_resources_ctx, native_libs_ctx, dex_ctx signing_keys = signing_keys, signing_lineage = ctx.file.debug_signing_lineage_file, signing_key_rotation_min_sdk = ctx.attr.key_rotation_min_sdk, + keystore_signing_password = ctx.attr.keystore_signing_password, deterministic_signing = False, java_toolchain = common.get_java_toolchain(ctx), deploy_info_writer = get_android_toolchain(ctx).deploy_info_writer.files_to_run, diff --git a/rules/apk_packaging.bzl b/rules/apk_packaging.bzl index 848109baf..1fd9cdd3c 100644 --- a/rules/apk_packaging.bzl +++ b/rules/apk_packaging.bzl @@ -54,6 +54,7 @@ def _process( signing_keys = [], signing_lineage = None, signing_key_rotation_min_sdk = None, + keystore_signing_password = "android", stamp_signing_key = None, deterministic_signing = False, java_toolchain = None, @@ -84,6 +85,7 @@ def _process( signing_keys: Sequence of Files. The keystores to be used to sign the APK. signing_lineage: File. The signing lineage for signing_keys. signing_key_rotation_min_sdk: The minimum API version for signing the APK with key rotation. + signing_password: String. The password for the signing keystores. Defaults to "android". stamp_signing_key: File. The keystore to be used to sign the APK with stamp signing. deterministic_signing: Boolean. Whether to enable deterministic DSA signing. java_toolchain: The JavaToolchain target. @@ -136,6 +138,7 @@ def _process( out_apk = signed_apk, in_apk = zipaligned_apk, signing_keys = signing_keys, + keystore_signing_password = keystore_signing_password, stamp_signing_key = stamp_signing_key, deterministic_signing = deterministic_signing, signing_lineage = signing_lineage, @@ -320,6 +323,7 @@ def _sign_apk( out_apk, in_apk, signing_keys = [], + keystore_signing_password = "android", stamp_signing_key = None, deterministic_signing = True, signing_lineage = None, @@ -351,7 +355,7 @@ def _sign_apk( if i > 0: args.add("--next-signer") args.add("--ks", signing_keys[i]) - args.add("--ks-pass", "pass:android") + args.add("--ks-pass", "pass:{keystore_signing_password}".format(keystore_signing_password = keystore_signing_password)) args.add("--v1-signing-enabled", ctx.fragments.android.apk_signing_method_v1) args.add("--v1-signer-name", "CERT") @@ -371,7 +375,7 @@ def _sign_apk( inputs.append(stamp_signing_key) args.add("--stamp-signer") args.add("--ks", stamp_signing_key) - args.add("--ks-pass", "pass:android") + args.add("--ks-pass", "pass:{keystore_signing_password}".format(keystore_signing_password = keystore_signing_password)) args.add("--out", out_apk) args.add(in_apk)