Optional PCKS#11 for signing with Yubikey/Trezor etc.
lrvick opened this issue · 2 comments
lrvick commented
Optional PCKS#11 for signing with Yubikey/Trezor etc.
lrvick commented
Will need to adapt image signing tools to use a scheme like the following: https://developers.yubico.com/PIV/Guides/Android_code_signing.html
chirayudesai commented
I looked into this briefly, and wrote down my findings at https://gitlab.com/calyxos/calyxos/wikis/Offline-signing
TL;DR:
- Some AOSP scripts will need slight modifications
- Need a signapk which supports keys stored on dedicated hardware
- Need to write an external program that's called by avbtool to sign things using keys stored on dedicated hardware.