some memo, gen key, sign key and gradlew

apksigner 在

./out/host/linux-x86/bin/apksigner 

要用 java 來run，所以要設定好 JAVA_HOME 和 PATH。
在 AOSP 中，lunch 完就都設定好了。
在 AOSP 中signkey 就是：

./out/host/linux-x86/bin/apksigner sign --key build/target/product/security/platform.pk8 \
--cert build/target/product/security/platform.x509.pem \
--out ~/SysApp-signed.apk \
out/target/product/vsoc_x86_64_only/system/priv-app/SysApp/SysApp.apk

platform.pk8 在

./build/make/target/product/security/platform.pk8
./build/make/target/product/security/platform.x509.pem

AOSP 中 OTA 相關的 generate key 說明：Sign build for release。

可以使用這個 app 來測試 privilege 的權限：

• SysTestApp

---

使用 android-studio 的 java - jetbrain runtime，是在 android-studio/jbr，所以要用 gradlew build 的話，在console就要指定 JAVA_HOME

~/sysapp$ JAVA_HOME=~/android-studio/jbr ./gradlew -version

------------------------------------------------------------
Gradle 8.13
------------------------------------------------------------

Build time:    2025-02-25 09:22:14 UTC
Revision:      073314332697ba45c16c0a0ce1891fa6794179ff

Kotlin:        2.0.21
Groovy:        3.0.22
Ant:           Apache Ant(TM) version 1.10.15 compiled on August 25 2024
Launcher JVM:  21.0.6 (JetBrains s.r.o. 21.0.6+-13391695-b895.109)
Daemon JVM:    /home/charles-chang/android-studio/jbr (no JDK specified, using current Java home)
OS:            Linux 6.11.0-28-generic amd64

這個 folder 是android studio sync 丸的 folder，也就是說 gradle/wrapper/ 下 download 好是當版本的 gradle-wrapper.jar 和 gradle-wrapper.properties

---

叫 geminil-cli 找到 Makefile 中 signkey 的地方：

Here's a high-level overview of how it works:

• Build APKs: The build system first compiles your application's source code and resources to create an unsigned APK file.
• Create Target Files Zip: The build system then creates a "target files" zip archive. This zip file contains all the files that will be included in the final
  system image, including your unsigned APK.
• Sign Target Files: The sign_target_files_apks script is then called. This script takes the unsigned target files zip as input, signs all the APKs within it usingn
  the keys specified in build/target/product/security/, and produces a new, signed target files zip.
• Create System Image: Finally, the build system uses the signed target files zip to create the system.img and other partition images.

The following snippet from /mnt/ssd2t/charles-chang/aosp/build/make/core/Makefile (around line 5623) shows how the sign_target_files_apks script is called:

   1 .PHONY: signed-target-files
   2 signed-target-files: $(BUILT_TARGET_FILES_PACKAGE)
   3    @echo"Package target files: $@"
   4 $(hide) ./build/make/tools/releasetools/sign_target_files_apks.py \
   5        --default_key_mappings build/make/target/product/security \
   6       $(INTERNAL_OTA_SIGNING_ARGS) \
   7        -o$(OPTIONS_RECOVERY_AS_BOOT) \
   8       $(BUILT_TARGET_FILES_PACKAGE) $@

In this rule:

• $(BUILT_TARGET_FILES_PACKAGE) is the unsigned target files zip.
• ./build/make/tools/releasetools/sign_target_files_apks.py is the signing script.
• --default_key_mappings build/make/target/product/security tells the script to use the keys in your build/target/product/security directory.
• $@ represents the output file, which is the signed target files zip.

This signed zip is then used by other parts of the build system to generate the final system images.