132 lines
4.6 KiB
Python
132 lines
4.6 KiB
Python
"""
|
|
Copyright (C) 2022 The Android Open Source Project
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
"""
|
|
|
|
load("@bazel_skylib//lib:paths.bzl", "paths")
|
|
load("android_app_certificate.bzl", "AndroidAppCertificateInfo")
|
|
|
|
AndroidAppKeystoreInfo = provider(
|
|
"Info needed for Android app keystores",
|
|
fields = {
|
|
"keystore": "JKS .keystore file housing certificate info",
|
|
},
|
|
)
|
|
|
|
def _pk8_to_private_pem(ctx, openssl, pk8_file, private_pem_file):
|
|
"""Converts a .pk8 private key file in DER format to a .pem private key file in PEM format."""
|
|
args = ctx.actions.args()
|
|
args.add("pkcs8")
|
|
args.add_all(["-in", pk8_file])
|
|
args.add_all(["-inform", "DER"])
|
|
args.add_all(["-outform", "PEM"])
|
|
args.add_all(["-out", private_pem_file])
|
|
args.add("-nocrypt") # don't bother encrypting this private key since it is just an intermediate file
|
|
|
|
ctx.actions.run(
|
|
inputs = [pk8_file],
|
|
executable = openssl,
|
|
outputs = [private_pem_file],
|
|
arguments = [args],
|
|
mnemonic = "CreatePrivPEM",
|
|
)
|
|
|
|
def _pem_to_pk12(ctx, openssl, certificate_pem, private_key_pem, pk12_file):
|
|
"""Converts an X.509 certificate and private key pair of PEM files to a single PKCS12 keystore file."""
|
|
args = ctx.actions.args()
|
|
args.add("pkcs12")
|
|
args.add("-export")
|
|
args.add_all(["-in", certificate_pem])
|
|
args.add_all(["-inkey", private_key_pem])
|
|
args.add_all(["-out", pk12_file])
|
|
args.add_all(["-name", "android"])
|
|
# openssl requires a password and will request a
|
|
# password from STDIN if we don't supply one here
|
|
args.add_all(["-passout", "pass:android"])
|
|
|
|
ctx.actions.run(
|
|
inputs = [
|
|
certificate_pem,
|
|
private_key_pem,
|
|
],
|
|
executable = openssl,
|
|
outputs = [pk12_file],
|
|
arguments = [args],
|
|
mnemonic = "CreatePK12",
|
|
)
|
|
|
|
def _pk12_to_keystore(ctx, keytool, pk12_file, keystore_file):
|
|
"""Converts a PKCS12 keystore file to a JKS keystore file."""
|
|
args = ctx.actions.args()
|
|
args.add("-importkeystore")
|
|
args.add_all(["-destkeystore", keystore_file])
|
|
args.add_all(["-srckeystore", pk12_file])
|
|
args.add_all(["-srcstoretype", "PKCS12"])
|
|
args.add_all(["-srcstorepass", "android"])
|
|
# apksigner expects keystores provided by the debug_signing_keys attribute
|
|
# to be secured with the password "android"
|
|
args.add_all(["-deststorepass", "android"])
|
|
|
|
ctx.actions.run(
|
|
inputs = [pk12_file],
|
|
executable = keytool,
|
|
outputs = [keystore_file],
|
|
arguments = [args],
|
|
mnemonic = "CreateKeystore",
|
|
)
|
|
|
|
def _android_app_keystore_rule_impl(ctx):
|
|
openssl = ctx.executable._openssl
|
|
keytool = ctx.executable._keytool
|
|
|
|
private_pem = ctx.actions.declare_file(ctx.attr.name + ".priv.pem")
|
|
pk12 = ctx.actions.declare_file(ctx.attr.name + ".pk12")
|
|
keystore = ctx.actions.declare_file(ctx.attr.name + ".keystore")
|
|
|
|
pk8_file = ctx.attr.certificate[AndroidAppCertificateInfo].pk8
|
|
pem_file = ctx.attr.certificate[AndroidAppCertificateInfo].pem
|
|
_pk8_to_private_pem(ctx, openssl, pk8_file, private_pem)
|
|
_pem_to_pk12(ctx, openssl, pem_file, private_pem, pk12)
|
|
_pk12_to_keystore(ctx, keytool, pk12, keystore)
|
|
|
|
return [
|
|
AndroidAppKeystoreInfo(
|
|
keystore = keystore,
|
|
),
|
|
DefaultInfo(files = depset(direct = [keystore]))
|
|
]
|
|
|
|
"""Converts an android_app_certificate (i.e. pem/pk8 pair) into a JKS keystore"""
|
|
android_app_keystore = rule(
|
|
implementation = _android_app_keystore_rule_impl,
|
|
attrs = {
|
|
"certificate": attr.label(mandatory = True, providers = [AndroidAppCertificateInfo]),
|
|
"_openssl": attr.label(
|
|
default = Label("//prebuilts/build-tools:linux-x86/bin/openssl"),
|
|
allow_single_file = True,
|
|
executable = True,
|
|
cfg = "exec",
|
|
doc = "An OpenSSL compatible tool."
|
|
),
|
|
"_keytool": attr.label(
|
|
default = Label("//prebuilts/jdk/jdk11:linux-x86/bin/keytool"),
|
|
allow_single_file = True,
|
|
executable = True,
|
|
cfg = "exec",
|
|
doc = "The keytool binary."
|
|
),
|
|
},
|
|
provides = [AndroidAppKeystoreInfo],
|
|
)
|