commit de53f7df433afbc22e8fd88cae46f0890689b081
author Kelvin Zhang <zhangkelvin@google.com> Tue Oct 03 12:21:28 2023 -0700
committer Kelvin Zhang <zhangkelvin@google.com> Tue Oct 03 12:26:08 2023 -0700
tree 68c93f0efae8d01ed10c68502ff05ac07a7d95be
parent d61f2efdbb6760e8ac377d95a84e52be8e279a04

Use deterministic salt for boot image avb footer

avbtool by default generates a random salt everytime, this makes builds
less reproducible. Use sha256 checksum of kernel image as the hex to
make the build reproducible.

Test: th
Bug: 293313353

Change-Id: I959b3dee77654098ab9fde475f11eaee8d40c790

core/Makefile

diff --git a/core/Makefile b/core/Makefile
index fc2a132..e77b8e7 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -1233,6 +1233,7 @@
   $(AVBTOOL) add_hash_footer \
           --image $(1) \
           $(call get-partition-size-argument,$(call get-bootimage-partition-size,$(1),boot)) \
+          --salt `sha256sum "$(kernel)" | cut -d " " -f 1` \
           --partition_name boot $(INTERNAL_AVB_BOOT_SIGNING_ARGS) \
           $(BOARD_AVB_BOOT_ADD_HASH_FOOTER_ARGS)
 endef