ttimasdf/00_MIGRATE_KEY.md

## 00_MIGRATE_KEY.md

      
    Raw
  

              00_MIGRATE_KEY.md
            
          
    Goal

Migrate from self-built (test-key or dev-key) or Official Release from https://download.lineageos.org/, to our self-signed builds, RETAINING DATA!!! and avoid the annoying error:
Can't install this package on top of incompatible data. Please try another package or run a factory reset

Usage

Apply the two patch accordingly, with command below. (Changed a little bit from 156047 and 162144
repo start nokey frameworks/base vendor/cm
cd frameworks/base
git apply ../../android-framework-base.patch
git commit -a -m "nokey"
cd vendor/cm
git apply ../../android-vendor-cm.patch
git commit -a -m "nokey"
cd ../..

Then start a build. And sign as Lineage tutorial.
mka target-files-package dist

Afterwards, look at the keys_migration.sh below, taken unchanged from LineageOS.
Use uncert.py to get your certificates' hexdump. (Assuming your certificates in ~/.android-certs)
export KEYPATH=~/.android-certs
uncert.py $KEYPATH/*.pem

and fill the output into [xxx]_cert_release and release_cert variables of keys_migration.sh accordingly.
Invoke command below to get certs' public keys.
ls $KEYPATH/*.pem | xargs -I% sh -c 'echo -n % && openssl x509 -pubkey -noout -in %'

and fill them into [xxx]_key_release and release_key. (and remove every \n bcoz I'm too lazy to strip them...)
Then, IN RECOVERY, after decrypted and mounted /data partition, push your file to somewhere in your phone, then do it.
adb push keys_migration.sh /tmp/
adb shell /tmp/keys_migration.sh


## android-framework-base.patch
From 920d91caeb45e19c2d60b0835b9557b31d50ba48 Mon Sep 17 00:00:00 2001
From: Sam Mortimer <sam@mortimer.me.uk>
Date: Tue, 10 Jan 2017 22:21:45 -0800
Subject: [PATCH] [DO NOT SUBMIT]Reset all package signatures on boot

Can be used to make a special build that resets all
package signatures without wiping any data.

Change-Id: Iff65f2ed3c9d0f80be7221ff90803eda4732cac0
---
 .../com/android/server/pm/PackageManagerService.java     | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 5a06bb3..84f3d38 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -376,6 +376,8 @@

     static final boolean CLEAR_RUNTIME_PERMISSIONS_ON_UPGRADE = false;

+    private static final boolean RESET_ALL_PACKAGE_SIGNATURES_ON_BOOT = true;
+
     private static final boolean DISABLE_EPHEMERAL_APPS = false;
     private static final boolean HIDE_EPHEMERAL_APIS = true;

@@ -652,6 +654,8 @@

     boolean mFirstBoot;

+    private boolean mResetSignatures;
+
     // System configuration read by SystemConfig.
     final int[] mGlobalGids;
     final SparseArray<ArraySet<String>> mSystemPermissions;
@@ -2337,6 +2341,8 @@ public PackageManagerService(Context context, Installer installer,
                 }
             }

+            mResetSignatures = RESET_ALL_PACKAGE_SIGNATURES_ON_BOOT;
+
             // Collect vendor overlay packages. (Do this before scanning any apps.)
             // For security and version matching reason, only consider
             // overlay packages if they reside in the right directory.
@@ -2577,6 +2583,8 @@ public PackageManagerService(Context context, Installer installer,
             }
             mExpectingBetter.clear();

+            mResetSignatures = false;
+
             // Resolve the storage manager.
             mStorageManagerPackage = getStorageManagerPackageName();

@@ -8485,7 +8493,13 @@ private static void enforceCodePolicy(PackageParser.Package pkg)

             pkg.applicationInfo.uid = pkgSetting.appId;
             pkg.mExtras = pkgSetting;
-            if (shouldCheckUpgradeKeySetLP(pkgSetting, scanFlags)) {
+            if (mResetSignatures) {
+                Slog.d(TAG, "resetting signatures on package " + pkg.packageName);
+                pkgSetting.signatures.mSignatures = pkg.mSignatures;
+                if (pkgSetting.sharedUser != null) {
+                    pkgSetting.sharedUser.signatures.mSignatures = pkg.mSignatures;
+                }
+            } else if (shouldCheckUpgradeKeySetLP(pkgSetting, scanFlags)) {
                 if (checkUpgradeKeySetLP(pkgSetting, pkg)) {
                     // We just determined the app is signed correctly, so bring
                     // over the latest parsed certs.

## android-vendor-cm.patch
From 007d51364477de79c6c1cc13d1af70a2557e3b53 Mon Sep 17 00:00:00 2001
From: Gabriele M <moto.falcon.git@gmail.com>
Date: Fri, 17 Feb 2017 12:16:47 +0100
Subject: [PATCH] Make otasigcheck.sh a nop

This is needed to easily move away from/to builds signed with
something other than the test-keys.

Change-Id: I293a1c92fa15dd55cf582d5408e17eb7d5529b2a
---
 prebuilt/common/bin/otasigcheck.sh | 89 --------------------------------------
 1 file changed, 89 deletions(-)

diff --git a/prebuilt/common/bin/otasigcheck.sh b/prebuilt/common/bin/otasigcheck.sh
index aba53b0..164cc70 100644
--- a/prebuilt/common/bin/otasigcheck.sh
+++ b/prebuilt/common/bin/otasigcheck.sh
@@ -1,91 +1,2 @@
 #!/sbin/sh
-
-# Validate that the incoming OTA is compatible with an already-installed
-# system
-
-grep -q "Command:.*\"--wipe\_data\"" /tmp/recovery.log
-if [ $? -eq 0 ]; then
-  echo "Data will be wiped after install; skipping signature check..."
-  exit 0
-fi
-
-grep -q "Command:.*\"--headless\"" /tmp/recovery.log
-if [ $? -eq 0 ]; then
-  echo "Headless mode install; skipping signature check..."
-  exit 0
-fi
-
-if [ -f "/data/system/packages.xml" -a -f "/tmp/releasekey" ]; then
-  relkey=$(cat "/tmp/releasekey")
-  OLDIFS="$IFS"
-  IFS=""
-  while read line; do
-    if [ "${#line}" -gt 4094 ]; then
-      continue
-    fi
-    params=${line# *<package *}
-    if [ "$line" != "$params" ]; then
-      kvp=${params%% *}
-      params=${params#* }
-      while [ "$kvp" != "$params" ]; do
-        key=${kvp%%=*}
-        val=${kvp#*=}
-        vlen=$(( ${#val} - 2 ))
-        val=${val:1:$vlen}
-        if [ "$key" = "name" ]; then
-          package="$val"
-        fi
-        kvp=${params%% *}
-        params=${params#* }
-      done
-      continue
-    fi
-    params=${line# *<cert *}
-    if [ "$line" != "$params" ]; then
-      keyidx=""
-      keyval=""
-      kvp=${params%% *}
-      params=${params#* }
-      while [ "$kvp" != "$params" ]; do
-        key=${kvp%%=*}
-        val=${kvp#*=}
-        vlen=$(( ${#val} - 2 ))
-        val=${val:1:$vlen}
-        if [ "$key" = "index" ]; then
-          keyidx="$val"
-        fi
-        if [ "$key" = "key" ]; then
-          keyval="$val"
-        fi
-        kvp=${params%% *}
-        params=${params#* }
-      done
-      if [ -n "$keyidx" ]; then
-        if [ "$package" = "com.android.htmlviewer" ]; then
-          cert_idx="$keyidx"
-        fi
-      fi
-      if [ -n "$keyval" ]; then
-        eval "key_$keyidx=$keyval"
-      fi
-      continue
-    fi
-  done < "/data/system/packages.xml"
-  IFS="$OLDIFS"
-
-  # Tools missing? Err on the side of caution and exit cleanly
-  if [ -z "$cert_idx" ]; then
-    echo "Package cert index not found; skipping signature check..."
-    exit 0
-  fi
-
-  varname="key_$cert_idx"
-  eval "pkgkey=\$$varname"
-
-  if [ "$pkgkey" != "$relkey" ]; then
-     echo "You have an installed system that isn't signed with this build's key, aborting..."
-     exit 124
-  fi
-fi
-
 exit 0

## keys_migration.sh
#!/sbin/sh
# https://github.com/LineageOS/android_vendor_cm/blob/2f7c7decc4cd5b42f044a7841a74468e4cacd694/prebuilt/common/etc/keys-migration.sh

PACKAGES=/data/system/packages.xml
PACKAGES_BACKUP=/data/system/packages-backup.xml
MIGRATION_DONE=/data/system/.keys-migration-done

if [ -f $MIGRATION_DONE ]; then
    exit 0
fi

if [ ! -f $PACKAGES_BACKUP ] && [ ! -f $PACKAGES ]; then
    touch $MIGRATION_DONE
    exit 0
fi

if [ -f $PACKAGES_BACKUP ]; then
    mv $PACKAGES_BACKUP $PACKAGES
fi

media_cert_test='308204a830820390a003020102020900f2b98e6123572c4e300d06092a864886f70d0101040500308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d301e170d3038303431353233343035375a170d3335303930313233343035375a308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d30820120300d06092a864886f70d01010105000382010d00308201080282010100ae250c5a16ef97fc2869ac651b3217cc36ba0e86964168d58a049f40ce85867123a3ffb4f6d949c33cf2da3a05c23eacaa57d803889b1759bcf59e7c6f21890ae25085b7ed56aa626c0989ef9ccd36362ca0e8d1b9603fd4d8328767926ccc090c68b775ae7ff30934cc369ef2855a2667df0c667fd0c7cf5d8eba655806737303bb624726eabaedfb72f07ed7a76ab3cb9a381c4b7dcd809b140d891f00213be401f58d6a06a61eadc3a9c2f1c6567285b09ae09342a66fa421eaf93adf7573a028c331d70601ab3af7cc84033ece7c772a3a5b86b0dbe9d777c3a48aa9801edcee2781589f44d9e4113979600576a99410ba81091259dad98c6c68ff784b8f020103a381fc3081f9301d0603551d0e04160414ca293caa8bc0ed3e542eef4205a2bff2b57e4d753081c90603551d230481c13081be8014ca293caa8bc0ed3e542eef4205a2bff2b57e4d75a1819aa48197308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d820900f2b98e6123572c4e300c0603551d13040530030101ff300d06092a864886f70d0101040500038201010084de9516d5e4a87217a73da8487048f53373a5f733f390d61bdf3cc9e5251625bfcaa7c3159cae275d172a9ae1e876d5458127ac542f68290dd510c0029d8f51e0ee156b7b7b5acdb394241b8ec78b74e5c42c5cafae156caf5bd199a23a27524da072debbe378464a533630b0e4d0ffb7e08ecb701fadb6379c74467f6e00c6ed888595380792038756007872c8e3007af423a57a2cab3a282869b64c4b7bd5fc187d0a7e2415965d5aae4e07a6df751b4a75e9793c918a612b81cd0b628aee0168dc44e47b10d3593260849d6adf6d727dc24444c221d3f9ecc368cad07999f2b8105bc1f20d38d41066cc1411c257a96ea4349f5746565507e4e8020a1a81'
media_cert_release=''
platform_cert_test='308204a830820390a003020102020900b3998086d056cffa300d06092a864886f70d0101040500308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d301e170d3038303431353232343035305a170d3335303930313232343035305a308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d30820120300d06092a864886f70d01010105000382010d003082010802820101009c780592ac0d5d381cdeaa65ecc8a6006e36480c6d7207b12011be50863aabe2b55d009adf7146d6f2202280c7cd4d7bdb26243b8a806c26b34b137523a49268224904dc01493e7c0acf1a05c874f69b037b60309d9074d24280e16bad2a8734361951eaf72a482d09b204b1875e12ac98c1aa773d6800b9eafde56d58bed8e8da16f9a360099c37a834a6dfedb7b6b44a049e07a269fccf2c5496f2cf36d64df90a3b8d8f34a3baab4cf53371ab27719b3ba58754ad0c53fc14e1db45d51e234fbbe93c9ba4edf9ce54261350ec535607bf69a2ff4aa07db5f7ea200d09a6c1b49e21402f89ed1190893aab5a9180f152e82f85a45753cf5fc19071c5eec827020103a381fc3081f9301d0603551d0e041604144fe4a0b3dd9cba29f71d7287c4e7c38f2086c2993081c90603551d230481c13081be80144fe4a0b3dd9cba29f71d7287c4e7c38f2086c299a1819aa48197308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d820900b3998086d056cffa300c0603551d13040530030101ff300d06092a864886f70d01010405000382010100572551b8d93a1f73de0f6d469f86dad6701400293c88a0cd7cd778b73dafcc197fab76e6212e56c1c761cfc42fd733de52c50ae08814cefc0a3b5a1a4346054d829f1d82b42b2048bf88b5d14929ef85f60edd12d72d55657e22e3e85d04c831d613d19938bb8982247fa321256ba12d1d6a8f92ea1db1c373317ba0c037f0d1aff645aef224979fba6e7a14bc025c71b98138cef3ddfc059617cf24845cf7b40d6382f7275ed738495ab6e5931b9421765c491b72fb68e080dbdb58c2029d347c8b328ce43ef6a8b15533edfbe989bd6a48dd4b202eda94c6ab8dd5b8399203daae2ed446232e4fe9bd961394c6300e5138e3cfd285e6e4e483538cb8b1b357'
platform_cert_release=''
shared_cert_test='308204a830820390a003020102020900f2a73396bd38767a300d06092a864886f70d0101040500308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d301e170d3038303732333231353735395a170d3335313230393231353735395a308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d30820120300d06092a864886f70d01010105000382010d00308201080282010100c8c2dbfd094a2df45c3ff1a32ed21805ec72fc58d017971bd0f6b52c262d70819d191967e158dfd3a2c7f1b3e0e80ce545d79d2848220211eb86f0fd8312d37b420c113750cc94618ae872f4886463bdc4627caa0c0483c86493e3515571170338bfdcc4cd6addd1c0a2f35f5cf24ed3e4043a3e58e2b05e664ccde12bcb67735fd6df1249c369e62542bc0a4729e53917f5c38ffa52d17b73c9c73798ddb18ed481590875547e66bfc5daca4c25a6eb960ed96923709da302ba646cb496b325e86c5c8b2e7a3377b2bbe4c7cf33254291163f689152ac088550c83c508f4bf5adf0aed5a2dca0583f9ab0ad17650db7eea4b23fdb45885547d0feab72183889020103a381fc3081f9301d0603551d0e04160414cb4c7e2cdbb3f0ada98dab79968d172e9dbb1ed13081c90603551d230481c13081be8014cb4c7e2cdbb3f0ada98dab79968d172e9dbb1ed1a1819aa48197308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d820900f2a73396bd38767a300c0603551d13040530030101ff300d06092a864886f70d0101040500038201010040a8d096997959e917a36c44246b6bac2bae05437ecd89794118f7834720352d1c6f8a39b0869942f4da65981faa2951d33971129ec1921d795671c527d6e249f252829faf5b591310311e2de096500d568ad4114a656dc34a8c6f610453afc1ea7992dba4aa7b3f8543a6e35c0728de77fe97eeac83771fd0ec90f8e4449434ee0b6045783e70c7a2e460249260e003cf7608dc352a4c9ef706def4b26050e978ae2fffd7a3323787014915eb3cc874fcc7a9ae930877c5c8c7d1c2e2a8ee863c89180d1855cedba400e7ba43cccaa7243d397e7c0e8e8e4d7d4f92b6bbead49c0cf018069eddca2e7e2fb4668d89dbbd7950d0cd254180fa1eaafc2a556f84'
shared_cert_release=''
test_cert='308204a830820390a003020102020900936eacbe07f201df300d06092a864886f70d0101050500308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d301e170d3038303232393031333334365a170d3335303731373031333334365a308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d30820120300d06092a864886f70d01010105000382010d00308201080282010100d6931904dec60b24b1edc762e0d9d8253e3ecd6ceb1de2ff068ca8e8bca8cd6bd3786ea70aa76ce60ebb0f993559ffd93e77a943e7e83d4b64b8e4fea2d3e656f1e267a81bbfb230b578c20443be4c7218b846f5211586f038a14e89c2be387f8ebecf8fcac3da1ee330c9ea93d0a7c3dc4af350220d50080732e0809717ee6a053359e6a694ec2cb3f284a0a466c87a94d83b31093a67372e2f6412c06e6d42f15818dffe0381cc0cd444da6cddc3b82458194801b32564134fbfde98c9287748dbf5676a540d8154c8bbca07b9e247553311c46b9af76fdeeccc8e69e7c8a2d08e782620943f99727d3c04fe72991d99df9bae38a0b2177fa31d5b6afee91f020103a381fc3081f9301d0603551d0e04160414485900563d272c46ae118605a47419ac09ca8c113081c90603551d230481c13081be8014485900563d272c46ae118605a47419ac09ca8c11a1819aa48197308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d820900936eacbe07f201df300c0603551d13040530030101ff300d06092a864886f70d010105050003820101007aaf968ceb50c441055118d0daabaf015b8a765a27a715a2c2b44f221415ffdace03095abfa42df70708726c2069e5c36eddae0400be29452c084bc27eb6a17eac9dbe182c204eb15311f455d824b656dbe4dc2240912d7586fe88951d01a8feb5ae5a4260535df83431052422468c36e22c2a5ef994d61dd7306ae4c9f6951ba3c12f1d1914ddc61f1a62da2df827f603fea5603b2c540dbd7c019c36bab29a4271c117df523cdbc5f3817a49e0efa60cbd7f74177e7a4f193d43f4220772666e4c4d83e1bd5a86087cf34f2dec21e245ca6c2bb016e683638050d2c430eea7c26a1c49d3760a58ab7f1a82cc938b4831384324bd0401fa12163a50570e684d'
release_cert=''

media_key_test='MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAriUMWhbvl/woaaxlGzIXzDa6DoaWQWjVigSfQM6FhnEjo/+09tlJwzzy2joFwj6sqlfYA4ibF1m89Z58byGJCuJQhbftVqpibAmJ75zNNjYsoOjRuWA/1Ngyh2eSbMwJDGi3da5/8wk0zDae8oVaJmffDGZ/0MfPXY66ZVgGc3MDu2JHJuq67fty8H7Xp2qzy5o4HEt9zYCbFA2JHwAhO+QB9Y1qBqYercOpwvHGVnKFsJrgk0Kmb6Qh6vk633VzoCjDMdcGAas698yEAz7OfHcqOluGsNvp13fDpIqpgB7c7ieBWJ9E2eQROXlgBXaplBC6gQkSWdrZjGxo/3hLjwIBAw=='
media_key_release=''
platform_key_test='MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAnHgFkqwNXTgc3qpl7MimAG42SAxtcgexIBG+UIY6q+K1XQCa33FG1vIgIoDHzU172yYkO4qAbCazSxN1I6SSaCJJBNwBST58Cs8aBch09psDe2AwnZB00kKA4WutKoc0NhlR6vcqSC0JsgSxh14SrJjBqnc9aAC56v3lbVi+2OjaFvmjYAmcN6g0pt/tt7a0SgSeB6Jp/M8sVJbyzzbWTfkKO42PNKO6q0z1M3GrJ3GbO6WHVK0MU/wU4dtF1R4jT7vpPJuk7fnOVCYTUOxTVge/aaL/SqB9tffqIA0JpsG0niFAL4ntEZCJOqtakYDxUugvhaRXU89fwZBxxe7IJwIBAw=='
platform_key_release=''
shared_key_test='MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAyMLb/QlKLfRcP/GjLtIYBexy/FjQF5cb0Pa1LCYtcIGdGRln4Vjf06LH8bPg6AzlRdedKEgiAhHrhvD9gxLTe0IMETdQzJRhiuhy9IhkY73EYnyqDASDyGST41FVcRcDOL/cxM1q3dHAovNfXPJO0+QEOj5Y4rBeZkzN4SvLZ3Nf1t8SScNp5iVCvApHKeU5F/XDj/pS0Xtzycc3mN2xjtSBWQh1VH5mv8XaykwlpuuWDtlpI3CdowK6ZGy0lrMl6Gxciy56M3eyu+THzzMlQpEWP2iRUqwIhVDIPFCPS/Wt8K7VotygWD+asK0XZQ237qSyP9tFiFVH0P6rchg4iQIBAw=='
shared_key_release=''
test_key='MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEA1pMZBN7GCySx7cdi4NnYJT4+zWzrHeL/Boyo6LyozWvTeG6nCqds5g67D5k1Wf/ZPnepQ+foPUtkuOT+otPmVvHiZ6gbv7IwtXjCBEO+THIYuEb1IRWG8DihTonCvjh/jr7Pj8rD2h7jMMnqk9Cnw9xK81AiDVAIBzLggJcX7moFM1nmppTsLLPyhKCkZsh6lNg7MQk6ZzcuL2QSwG5tQvFYGN/+A4HMDNRE2mzdw7gkWBlIAbMlZBNPv96YySh3SNv1Z2pUDYFUyLvKB7niR1UzEcRrmvdv3uzMjmnnyKLQjngmIJQ/mXJ9PAT+cpkdmd+brjigshd/ox1bav7pHwIBAw=='
release_key=''

sed -i "s#$media_cert_test#$media_cert_release#g" $PACKAGES
sed -i "s#$platform_cert_test#$platform_cert_release#g" $PACKAGES
sed -i "s#$shared_cert_test#$shared_cert_release#g" $PACKAGES
sed -i "s#$test_cert#$release_cert#g" $PACKAGES
sed -i "s#$media_key_test#$media_key_release#g" $PACKAGES
sed -i "s#$platform_key_test#$platform_key_release#g" $PACKAGES
sed -i "s#$shared_key_test#$shared_key_release#g" $PACKAGES
sed -i "s#$test_key#$release_key#g" $PACKAGES

chmod 660 $PACKAGES
chown system:system $PACKAGES

touch $MIGRATION_DONE

## uncert.py
#!/usr/bin/env python3
'''
Print the hex form of x509 certificate, used by PackageManager

Usage:
uncert.py ~/.android-certs/*.pem
'''
from base64 import b64decode
from binascii import hexlify
import sys

for kf in sys.argv[1:]:
    with open(kf) as f:
        cert = ''.join(f.readlines()[1:-1])
    print(kf, hexlify(b64decode(cert)).decode())

# To get their public keys:
# ls ~/.android-certs/*.pem | xargs -I% sh -c 'echo -n % && openssl x509 -pubkey -noout -in %'
	From 920d91caeb45e19c2d60b0835b9557b31d50ba48 Mon Sep 17 00:00:00 2001
	From: Sam Mortimer <sam@mortimer.me.uk>
	Date: Tue, 10 Jan 2017 22:21:45 -0800
	Subject: [PATCH] [DO NOT SUBMIT]Reset all package signatures on boot

	Can be used to make a special build that resets all
	package signatures without wiping any data.

	Change-Id: Iff65f2ed3c9d0f80be7221ff90803eda4732cac0
	---
	.../com/android/server/pm/PackageManagerService.java \| 16 +++++++++++++++-
	1 file changed, 15 insertions(+), 1 deletion(-)

	diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
	index 5a06bb3..84f3d38 100644
	--- a/services/core/java/com/android/server/pm/PackageManagerService.java
	+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
	@@ -376,6 +376,8 @@

	static final boolean CLEAR_RUNTIME_PERMISSIONS_ON_UPGRADE = false;

	+ private static final boolean RESET_ALL_PACKAGE_SIGNATURES_ON_BOOT = true;
	+
	private static final boolean DISABLE_EPHEMERAL_APPS = false;
	private static final boolean HIDE_EPHEMERAL_APIS = true;

	@@ -652,6 +654,8 @@

	boolean mFirstBoot;

	+ private boolean mResetSignatures;
	+
	// System configuration read by SystemConfig.
	final int[] mGlobalGids;
	final SparseArray<ArraySet<String>> mSystemPermissions;
	@@ -2337,6 +2341,8 @@ public PackageManagerService(Context context, Installer installer,
	}
	}

	+ mResetSignatures = RESET_ALL_PACKAGE_SIGNATURES_ON_BOOT;
	+
	// Collect vendor overlay packages. (Do this before scanning any apps.)
	// For security and version matching reason, only consider
	// overlay packages if they reside in the right directory.
	@@ -2577,6 +2583,8 @@ public PackageManagerService(Context context, Installer installer,
	}
	mExpectingBetter.clear();

	+ mResetSignatures = false;
	+
	// Resolve the storage manager.
	mStorageManagerPackage = getStorageManagerPackageName();

	@@ -8485,7 +8493,13 @@ private static void enforceCodePolicy(PackageParser.Package pkg)

	pkg.applicationInfo.uid = pkgSetting.appId;
	pkg.mExtras = pkgSetting;
	- if (shouldCheckUpgradeKeySetLP(pkgSetting, scanFlags)) {
	+ if (mResetSignatures) {
	+ Slog.d(TAG, "resetting signatures on package " + pkg.packageName);
	+ pkgSetting.signatures.mSignatures = pkg.mSignatures;
	+ if (pkgSetting.sharedUser != null) {
	+ pkgSetting.sharedUser.signatures.mSignatures = pkg.mSignatures;
	+ }
	+ } else if (shouldCheckUpgradeKeySetLP(pkgSetting, scanFlags)) {
	if (checkUpgradeKeySetLP(pkgSetting, pkg)) {
	// We just determined the app is signed correctly, so bring
	// over the latest parsed certs.
	From 007d51364477de79c6c1cc13d1af70a2557e3b53 Mon Sep 17 00:00:00 2001
	From: Gabriele M <moto.falcon.git@gmail.com>
	Date: Fri, 17 Feb 2017 12:16:47 +0100
	Subject: [PATCH] Make otasigcheck.sh a nop

	This is needed to easily move away from/to builds signed with
	something other than the test-keys.

	Change-Id: I293a1c92fa15dd55cf582d5408e17eb7d5529b2a
	---
	prebuilt/common/bin/otasigcheck.sh \| 89 --------------------------------------
	1 file changed, 89 deletions(-)

	diff --git a/prebuilt/common/bin/otasigcheck.sh b/prebuilt/common/bin/otasigcheck.sh
	index aba53b0..164cc70 100644
	--- a/prebuilt/common/bin/otasigcheck.sh
	+++ b/prebuilt/common/bin/otasigcheck.sh
	@@ -1,91 +1,2 @@
	#!/sbin/sh
	-
	-# Validate that the incoming OTA is compatible with an already-installed
	-# system
	-
	-grep -q "Command:.*\"--wipe\_data\"" /tmp/recovery.log
	-if [ $? -eq 0 ]; then
	- echo "Data will be wiped after install; skipping signature check..."
	- exit 0
	-fi
	-
	-grep -q "Command:.*\"--headless\"" /tmp/recovery.log
	-if [ $? -eq 0 ]; then
	- echo "Headless mode install; skipping signature check..."
	- exit 0
	-fi
	-
	-if [ -f "/data/system/packages.xml" -a -f "/tmp/releasekey" ]; then
	- relkey=$(cat "/tmp/releasekey")
	- OLDIFS="$IFS"
	- IFS=""
	- while read line; do
	- if [ "${#line}" -gt 4094 ]; then
	- continue
	- fi
	- params=${line# <package }
	- if [ "$line" != "$params" ]; then
	- kvp=${params%% *}
	- params=${params#* }
	- while [ "$kvp" != "$params" ]; do
	- key=${kvp%%=*}
	- val=${kvp#*=}
	- vlen=$(( ${#val} - 2 ))
	- val=${val:1:$vlen}
	- if [ "$key" = "name" ]; then
	- package="$val"
	- fi
	- kvp=${params%% *}
	- params=${params#* }
	- done
	- continue
	- fi
	- params=${line# <cert }
	- if [ "$line" != "$params" ]; then
	- keyidx=""
	- keyval=""
	- kvp=${params%% *}
	- params=${params#* }
	- while [ "$kvp" != "$params" ]; do
	- key=${kvp%%=*}
	- val=${kvp#*=}
	- vlen=$(( ${#val} - 2 ))
	- val=${val:1:$vlen}
	- if [ "$key" = "index" ]; then
	- keyidx="$val"
	- fi
	- if [ "$key" = "key" ]; then
	- keyval="$val"
	- fi
	- kvp=${params%% *}
	- params=${params#* }
	- done
	- if [ -n "$keyidx" ]; then
	- if [ "$package" = "com.android.htmlviewer" ]; then
	- cert_idx="$keyidx"
	- fi
	- fi
	- if [ -n "$keyval" ]; then
	- eval "key_$keyidx=$keyval"
	- fi
	- continue
	- fi
	- done < "/data/system/packages.xml"
	- IFS="$OLDIFS"
	-
	- # Tools missing? Err on the side of caution and exit cleanly
	- if [ -z "$cert_idx" ]; then
	- echo "Package cert index not found; skipping signature check..."
	- exit 0
	- fi
	-
	- varname="key_$cert_idx"
	- eval "pkgkey=\$$varname"
	-
	- if [ "$pkgkey" != "$relkey" ]; then
	- echo "You have an installed system that isn't signed with this build's key, aborting..."
	- exit 124
	- fi
	-fi
	-
	exit 0
	#!/sbin/sh
	# https://github.com/LineageOS/android_vendor_cm/blob/2f7c7decc4cd5b42f044a7841a74468e4cacd694/prebuilt/common/etc/keys-migration.sh

	PACKAGES=/data/system/packages.xml
	PACKAGES_BACKUP=/data/system/packages-backup.xml
	MIGRATION_DONE=/data/system/.keys-migration-done

	if [ -f $MIGRATION_DONE ]; then
	exit 0
	fi

	if [ ! -f $PACKAGES_BACKUP ] && [ ! -f $PACKAGES ]; then
	touch $MIGRATION_DONE
	exit 0
	fi

	if [ -f $PACKAGES_BACKUP ]; then
	mv $PACKAGES_BACKUP $PACKAGES
	fi

	media_cert_test='308204a830820390a003020102020900f2b98e6123572c4e300d06092a864886f70d0101040500308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d301e170d3038303431353233343035375a170d3335303930313233343035375a308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d30820120300d06092a864886f70d01010105000382010d00308201080282010100ae250c5a16ef97fc2869ac651b3217cc36ba0e86964168d58a049f40ce85867123a3ffb4f6d949c33cf2da3a05c23eacaa57d803889b1759bcf59e7c6f21890ae25085b7ed56aa626c0989ef9ccd36362ca0e8d1b9603fd4d8328767926ccc090c68b775ae7ff30934cc369ef2855a2667df0c667fd0c7cf5d8eba655806737303bb624726eabaedfb72f07ed7a76ab3cb9a381c4b7dcd809b140d891f00213be401f58d6a06a61eadc3a9c2f1c6567285b09ae09342a66fa421eaf93adf7573a028c331d70601ab3af7cc84033ece7c772a3a5b86b0dbe9d777c3a48aa9801edcee2781589f44d9e4113979600576a99410ba81091259dad98c6c68ff784b8f020103a381fc3081f9301d0603551d0e04160414ca293caa8bc0ed3e542eef4205a2bff2b57e4d753081c90603551d230481c13081be8014ca293caa8bc0ed3e542eef4205a2bff2b57e4d75a1819aa48197308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d820900f2b98e6123572c4e300c0603551d13040530030101ff300d06092a864886f70d0101040500038201010084de9516d5e4a87217a73da8487048f53373a5f733f390d61bdf3cc9e5251625bfcaa7c3159cae275d172a9ae1e876d5458127ac542f68290dd510c0029d8f51e0ee156b7b7b5acdb394241b8ec78b74e5c42c5cafae156caf5bd199a23a27524da072debbe378464a533630b0e4d0ffb7e08ecb701fadb6379c74467f6e00c6ed888595380792038756007872c8e3007af423a57a2cab3a282869b64c4b7bd5fc187d0a7e2415965d5aae4e07a6df751b4a75e9793c918a612b81cd0b628aee0168dc44e47b10d3593260849d6adf6d727dc24444c221d3f9ecc368cad07999f2b8105bc1f20d38d41066cc1411c257a96ea4349f5746565507e4e8020a1a81'
	media_cert_release=''
	platform_cert_test='308204a830820390a003020102020900b3998086d056cffa300d06092a864886f70d0101040500308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d301e170d3038303431353232343035305a170d3335303930313232343035305a308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d30820120300d06092a864886f70d01010105000382010d003082010802820101009c780592ac0d5d381cdeaa65ecc8a6006e36480c6d7207b12011be50863aabe2b55d009adf7146d6f2202280c7cd4d7bdb26243b8a806c26b34b137523a49268224904dc01493e7c0acf1a05c874f69b037b60309d9074d24280e16bad2a8734361951eaf72a482d09b204b1875e12ac98c1aa773d6800b9eafde56d58bed8e8da16f9a360099c37a834a6dfedb7b6b44a049e07a269fccf2c5496f2cf36d64df90a3b8d8f34a3baab4cf53371ab27719b3ba58754ad0c53fc14e1db45d51e234fbbe93c9ba4edf9ce54261350ec535607bf69a2ff4aa07db5f7ea200d09a6c1b49e21402f89ed1190893aab5a9180f152e82f85a45753cf5fc19071c5eec827020103a381fc3081f9301d0603551d0e041604144fe4a0b3dd9cba29f71d7287c4e7c38f2086c2993081c90603551d230481c13081be80144fe4a0b3dd9cba29f71d7287c4e7c38f2086c299a1819aa48197308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d820900b3998086d056cffa300c0603551d13040530030101ff300d06092a864886f70d01010405000382010100572551b8d93a1f73de0f6d469f86dad6701400293c88a0cd7cd778b73dafcc197fab76e6212e56c1c761cfc42fd733de52c50ae08814cefc0a3b5a1a4346054d829f1d82b42b2048bf88b5d14929ef85f60edd12d72d55657e22e3e85d04c831d613d19938bb8982247fa321256ba12d1d6a8f92ea1db1c373317ba0c037f0d1aff645aef224979fba6e7a14bc025c71b98138cef3ddfc059617cf24845cf7b40d6382f7275ed738495ab6e5931b9421765c491b72fb68e080dbdb58c2029d347c8b328ce43ef6a8b15533edfbe989bd6a48dd4b202eda94c6ab8dd5b8399203daae2ed446232e4fe9bd961394c6300e5138e3cfd285e6e4e483538cb8b1b357'
	platform_cert_release=''
	shared_cert_test='308204a830820390a003020102020900f2a73396bd38767a300d06092a864886f70d0101040500308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d301e170d3038303732333231353735395a170d3335313230393231353735395a308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d30820120300d06092a864886f70d01010105000382010d00308201080282010100c8c2dbfd094a2df45c3ff1a32ed21805ec72fc58d017971bd0f6b52c262d70819d191967e158dfd3a2c7f1b3e0e80ce545d79d2848220211eb86f0fd8312d37b420c113750cc94618ae872f4886463bdc4627caa0c0483c86493e3515571170338bfdcc4cd6addd1c0a2f35f5cf24ed3e4043a3e58e2b05e664ccde12bcb67735fd6df1249c369e62542bc0a4729e53917f5c38ffa52d17b73c9c73798ddb18ed481590875547e66bfc5daca4c25a6eb960ed96923709da302ba646cb496b325e86c5c8b2e7a3377b2bbe4c7cf33254291163f689152ac088550c83c508f4bf5adf0aed5a2dca0583f9ab0ad17650db7eea4b23fdb45885547d0feab72183889020103a381fc3081f9301d0603551d0e04160414cb4c7e2cdbb3f0ada98dab79968d172e9dbb1ed13081c90603551d230481c13081be8014cb4c7e2cdbb3f0ada98dab79968d172e9dbb1ed1a1819aa48197308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d820900f2a73396bd38767a300c0603551d13040530030101ff300d06092a864886f70d0101040500038201010040a8d096997959e917a36c44246b6bac2bae05437ecd89794118f7834720352d1c6f8a39b0869942f4da65981faa2951d33971129ec1921d795671c527d6e249f252829faf5b591310311e2de096500d568ad4114a656dc34a8c6f610453afc1ea7992dba4aa7b3f8543a6e35c0728de77fe97eeac83771fd0ec90f8e4449434ee0b6045783e70c7a2e460249260e003cf7608dc352a4c9ef706def4b26050e978ae2fffd7a3323787014915eb3cc874fcc7a9ae930877c5c8c7d1c2e2a8ee863c89180d1855cedba400e7ba43cccaa7243d397e7c0e8e8e4d7d4f92b6bbead49c0cf018069eddca2e7e2fb4668d89dbbd7950d0cd254180fa1eaafc2a556f84'
	shared_cert_release=''
	test_cert='308204a830820390a003020102020900936eacbe07f201df300d06092a864886f70d0101050500308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d301e170d3038303232393031333334365a170d3335303731373031333334365a308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d30820120300d06092a864886f70d01010105000382010d00308201080282010100d6931904dec60b24b1edc762e0d9d8253e3ecd6ceb1de2ff068ca8e8bca8cd6bd3786ea70aa76ce60ebb0f993559ffd93e77a943e7e83d4b64b8e4fea2d3e656f1e267a81bbfb230b578c20443be4c7218b846f5211586f038a14e89c2be387f8ebecf8fcac3da1ee330c9ea93d0a7c3dc4af350220d50080732e0809717ee6a053359e6a694ec2cb3f284a0a466c87a94d83b31093a67372e2f6412c06e6d42f15818dffe0381cc0cd444da6cddc3b82458194801b32564134fbfde98c9287748dbf5676a540d8154c8bbca07b9e247553311c46b9af76fdeeccc8e69e7c8a2d08e782620943f99727d3c04fe72991d99df9bae38a0b2177fa31d5b6afee91f020103a381fc3081f9301d0603551d0e04160414485900563d272c46ae118605a47419ac09ca8c113081c90603551d230481c13081be8014485900563d272c46ae118605a47419ac09ca8c11a1819aa48197308194310b3009060355040613025553311330110603550408130a43616c69666f726e6961311630140603550407130d4d6f756e7461696e20566965773110300e060355040a1307416e64726f69643110300e060355040b1307416e64726f69643110300e06035504031307416e64726f69643122302006092a864886f70d0109011613616e64726f696440616e64726f69642e636f6d820900936eacbe07f201df300c0603551d13040530030101ff300d06092a864886f70d010105050003820101007aaf968ceb50c441055118d0daabaf015b8a765a27a715a2c2b44f221415ffdace03095abfa42df70708726c2069e5c36eddae0400be29452c084bc27eb6a17eac9dbe182c204eb15311f455d824b656dbe4dc2240912d7586fe88951d01a8feb5ae5a4260535df83431052422468c36e22c2a5ef994d61dd7306ae4c9f6951ba3c12f1d1914ddc61f1a62da2df827f603fea5603b2c540dbd7c019c36bab29a4271c117df523cdbc5f3817a49e0efa60cbd7f74177e7a4f193d43f4220772666e4c4d83e1bd5a86087cf34f2dec21e245ca6c2bb016e683638050d2c430eea7c26a1c49d3760a58ab7f1a82cc938b4831384324bd0401fa12163a50570e684d'
	release_cert=''

	media_key_test='MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAriUMWhbvl/woaaxlGzIXzDa6DoaWQWjVigSfQM6FhnEjo/+09tlJwzzy2joFwj6sqlfYA4ibF1m89Z58byGJCuJQhbftVqpibAmJ75zNNjYsoOjRuWA/1Ngyh2eSbMwJDGi3da5/8wk0zDae8oVaJmffDGZ/0MfPXY66ZVgGc3MDu2JHJuq67fty8H7Xp2qzy5o4HEt9zYCbFA2JHwAhO+QB9Y1qBqYercOpwvHGVnKFsJrgk0Kmb6Qh6vk633VzoCjDMdcGAas698yEAz7OfHcqOluGsNvp13fDpIqpgB7c7ieBWJ9E2eQROXlgBXaplBC6gQkSWdrZjGxo/3hLjwIBAw=='
	media_key_release=''
	platform_key_test='MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAnHgFkqwNXTgc3qpl7MimAG42SAxtcgexIBG+UIY6q+K1XQCa33FG1vIgIoDHzU172yYkO4qAbCazSxN1I6SSaCJJBNwBST58Cs8aBch09psDe2AwnZB00kKA4WutKoc0NhlR6vcqSC0JsgSxh14SrJjBqnc9aAC56v3lbVi+2OjaFvmjYAmcN6g0pt/tt7a0SgSeB6Jp/M8sVJbyzzbWTfkKO42PNKO6q0z1M3GrJ3GbO6WHVK0MU/wU4dtF1R4jT7vpPJuk7fnOVCYTUOxTVge/aaL/SqB9tffqIA0JpsG0niFAL4ntEZCJOqtakYDxUugvhaRXU89fwZBxxe7IJwIBAw=='
	platform_key_release=''
	shared_key_test='MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEAyMLb/QlKLfRcP/GjLtIYBexy/FjQF5cb0Pa1LCYtcIGdGRln4Vjf06LH8bPg6AzlRdedKEgiAhHrhvD9gxLTe0IMETdQzJRhiuhy9IhkY73EYnyqDASDyGST41FVcRcDOL/cxM1q3dHAovNfXPJO0+QEOj5Y4rBeZkzN4SvLZ3Nf1t8SScNp5iVCvApHKeU5F/XDj/pS0Xtzycc3mN2xjtSBWQh1VH5mv8XaykwlpuuWDtlpI3CdowK6ZGy0lrMl6Gxciy56M3eyu+THzzMlQpEWP2iRUqwIhVDIPFCPS/Wt8K7VotygWD+asK0XZQ237qSyP9tFiFVH0P6rchg4iQIBAw=='
	shared_key_release=''
	test_key='MIIBIDANBgkqhkiG9w0BAQEFAAOCAQ0AMIIBCAKCAQEA1pMZBN7GCySx7cdi4NnYJT4+zWzrHeL/Boyo6LyozWvTeG6nCqds5g67D5k1Wf/ZPnepQ+foPUtkuOT+otPmVvHiZ6gbv7IwtXjCBEO+THIYuEb1IRWG8DihTonCvjh/jr7Pj8rD2h7jMMnqk9Cnw9xK81AiDVAIBzLggJcX7moFM1nmppTsLLPyhKCkZsh6lNg7MQk6ZzcuL2QSwG5tQvFYGN/+A4HMDNRE2mzdw7gkWBlIAbMlZBNPv96YySh3SNv1Z2pUDYFUyLvKB7niR1UzEcRrmvdv3uzMjmnnyKLQjngmIJQ/mXJ9PAT+cpkdmd+brjigshd/ox1bav7pHwIBAw=='
	release_key=''

	sed -i "s#$media_cert_test#$media_cert_release#g" $PACKAGES
	sed -i "s#$platform_cert_test#$platform_cert_release#g" $PACKAGES
	sed -i "s#$shared_cert_test#$shared_cert_release#g" $PACKAGES
	sed -i "s#$test_cert#$release_cert#g" $PACKAGES
	sed -i "s#$media_key_test#$media_key_release#g" $PACKAGES
	sed -i "s#$platform_key_test#$platform_key_release#g" $PACKAGES
	sed -i "s#$shared_key_test#$shared_key_release#g" $PACKAGES
	sed -i "s#$test_key#$release_key#g" $PACKAGES

	chmod 660 $PACKAGES
	chown system:system $PACKAGES

	touch $MIGRATION_DONE
	#!/usr/bin/env python3
	'''
	Print the hex form of x509 certificate, used by PackageManager

	Usage:
	uncert.py ~/.android-certs/*.pem
	'''
	from base64 import b64decode
	from binascii import hexlify
	import sys

	for kf in sys.argv[1:]:
	with open(kf) as f:
	cert = ''.join(f.readlines()[1:-1])
	print(kf, hexlify(b64decode(cert)).decode())

	# To get their public keys:
	# ls ~/.android-certs/*.pem \| xargs -I% sh -c 'echo -n % && openssl x509 -pubkey -noout -in %'