1// Copyright (C) 2019 The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7//     http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15// Build rules to build shim apexes.
16
17package {
18    default_applicable_licenses: ["Android-Apache-2.0"],
19}
20
21genrule {
22    name: "com.android.apex.cts.shim.pem",
23    out: ["com.android.apex.cts.shim.pem"],
24    cmd: "openssl genrsa -out $(out) 4096",
25}
26
27genrule {
28    name: "com.android.apex.cts.shim.pubkey",
29    srcs: [":com.android.apex.cts.shim.pem"],
30    out: ["com.android.apex.cts.shim.pubkey"],
31    tools: ["avbtool"],
32    cmd: "$(location avbtool) extract_public_key --key $(in) --output $(out)",
33}
34
35apex_key {
36    name: "com.android.apex.cts.shim.key",
37    private_key: ":com.android.apex.cts.shim.pem",
38    public_key: ":com.android.apex.cts.shim.pubkey",
39    installable: false,
40}
41
42genrule {
43    name: "com.android.apex.cts.shim.debug.pem",
44    out: ["com.android.apex.cts.shim.debug.pem"],
45    cmd: "openssl genrsa -out $(out) 4096",
46}
47
48genrule {
49    name: "com.android.apex.cts.shim.debug.pubkey",
50    srcs: [":com.android.apex.cts.shim.debug.pem"],
51    out: ["com.android.apex.cts.shim.debug.pubkey"],
52    tools: ["avbtool"],
53    cmd: "$(location avbtool) extract_public_key --key $(in) --output $(out)",
54}
55
56apex_key {
57    name: "com.android.apex.cts.shim.debug.key",
58    private_key: ":com.android.apex.cts.shim.debug.pem",
59    public_key: ":com.android.apex.cts.shim.debug.pubkey",
60    installable: false,
61}
62
63genrule {
64    name: "generate_hash_of_dev_null",
65    out: ["hash.txt"],
66    cmd: "sha512sum -b /dev/null | cut -d' ' -f1 | tee $(out)",
67}
68
69prebuilt_etc {
70    name: "hash_of_dev_null",
71    src: ":generate_hash_of_dev_null",
72    filename: "hash.txt",
73    installable: false,
74}
75
76apex {
77    name: "com.android.apex.cts.shim.v3",
78    manifest: "manifest_v3.json",
79    androidManifest: "AndroidManifest.xml",
80    file_contexts: ":apex.test-file_contexts",
81    key: "com.android.apex.cts.shim.key",
82    prebuilts: ["hash_of_dev_null"],
83    apps: [
84        "CtsShim",
85        "CtsShimPriv",
86    ],
87    installable: false,
88    allowed_files: "default_shim_allowed_list.txt",
89    updatable: false,
90}
91
92apex {
93    name: "com.android.apex.cts.shim.v2",
94    manifest: "manifest_v2.json",
95    androidManifest: "AndroidManifest.xml",
96    file_contexts: ":apex.test-file_contexts",
97    key: "com.android.apex.cts.shim.key",
98    prebuilts: ["hash_of_dev_null"],
99    apps: [
100        "CtsShim",
101        "CtsShimPriv",
102    ],
103    installable: false,
104    allowed_files: "default_shim_allowed_list.txt",
105    updatable: false,
106}
107
108apex {
109    name: "com.android.apex.cts.shim.v2_sign_payload_with_different_key",
110    // Use manifest_v2_rebootless to also re-use this APEX in the rebootless update test case.
111    manifest: "manifest_v2_rebootless.json",
112    androidManifest: "AndroidManifest.xml",
113    file_contexts: ":apex.test-file_contexts",
114    key: "com.android.apex.cts.shim.debug.key",
115    prebuilts: ["hash_of_dev_null"],
116    installable: false,
117    allowed_files: "default_shim_allowed_list.txt",
118    updatable: false,
119}
120
121apex {
122    name: "com.android.apex.cts.shim.v2_without_apk_in_apex",
123    manifest: "manifest_v2.json",
124    androidManifest: "AndroidManifest.xml",
125    file_contexts: ":apex.test-file_contexts",
126    key: "com.android.apex.cts.shim.key",
127    prebuilts: ["hash_of_dev_null"],
128    installable: false,
129    allowed_files: "default_shim_allowed_list.txt",
130    updatable: false,
131}
132
133apex {
134    name: "com.android.apex.cts.shim.v2_no_hashtree",
135    manifest: "manifest_v2.json",
136    androidManifest: "AndroidManifest.xml",
137    file_contexts: ":apex.test-file_contexts",
138    key: "com.android.apex.cts.shim.key",
139    prebuilts: ["hash_of_dev_null"],
140    apps: [
141        "CtsShim",
142        "CtsShimPriv",
143    ],
144    installable: false,
145    allowed_files: "default_shim_allowed_list.txt",
146    generate_hashtree: false,
147    updatable: false,
148}
149
150apex {
151    name: "com.android.apex.cts.shim.v2_unsigned_payload",
152    // Use manifest_v2_rebootless to also re-use this APEX in the rebootless update test case.
153    manifest: "manifest_v2_rebootless.json",
154    androidManifest: "AndroidManifest.xml",
155    file_contexts: ":apex.test-file_contexts",
156    key: "com.android.apex.cts.shim.key",
157    prebuilts: ["hash_of_dev_null"],
158    apps: [
159        "CtsShim",
160        "CtsShimPriv",
161    ],
162    installable: false,
163    allowed_files: "default_shim_allowed_list.txt",
164    test_only_unsigned_payload: true,
165    updatable: false,
166}
167
168override_apex {
169    name: "com.android.apex.cts.shim.v2_different_package_name",
170    package_name: "com.android.apex.cts.shim.different",
171    // Use rebootless APEX to re-use this APEX in the rebootless update test case.
172    base: "com.android.apex.cts.shim.v2_rebootless",
173}
174
175genrule {
176    name: "generate_empty_hash",
177    out: ["hash.txt"],
178    cmd: "touch $(out)",
179}
180
181prebuilt_etc {
182    name: "empty_hash",
183    src: ":generate_empty_hash",
184    filename: "hash.txt",
185    installable: false,
186}
187
188// Use empty hash.txt to make sure that this apex has wrong SHA512, hence trying
189// to stage it should fail.
190apex {
191    name: "com.android.apex.cts.shim.v2_wrong_sha",
192    // Use manifest_v2_rebootless to also re-use this APEX in the rebootless update test case.
193    manifest: "manifest_v2_rebootless.json",
194    androidManifest: "AndroidManifest.xml",
195    file_contexts: ":apex.test-file_contexts",
196    key: "com.android.apex.cts.shim.key",
197    prebuilts: ["empty_hash"],
198    installable: false,
199    updatable: false,
200}
201
202prebuilt_etc {
203    name: "apex_shim_additional_file",
204    src: "additional_file",
205    filename: "additional_file",
206    installable: false,
207}
208
209apex {
210    name: "com.android.apex.cts.shim.v2_additional_file",
211    // Use manifest_v2_rebootless to also re-use this APEX in the rebootless update test case.
212    manifest: "manifest_v2_rebootless.json",
213    androidManifest: "AndroidManifest.xml",
214    file_contexts: ":apex.test-file_contexts",
215    key: "com.android.apex.cts.shim.key",
216    prebuilts: [
217        "hash_of_dev_null",
218        "apex_shim_additional_file",
219    ],
220    installable: false,
221    updatable: false,
222}
223
224prebuilt_etc {
225    name: "apex_shim_additional_folder",
226    src: "additional_file",
227    filename: "additional_file",
228    sub_dir: "additional_folder",
229    installable: false,
230}
231
232apex {
233    name: "com.android.apex.cts.shim.v2_additional_folder",
234    // Use manifest_v2_rebootless to also re-use this APEX in the rebootless update test case.
235    manifest: "manifest_v2_rebootless.json",
236    androidManifest: "AndroidManifest.xml",
237    file_contexts: ":apex.test-file_contexts",
238    key: "com.android.apex.cts.shim.key",
239    prebuilts: [
240        "hash_of_dev_null",
241        "apex_shim_additional_folder",
242    ],
243    installable: false,
244    updatable: false,
245}
246
247apex {
248    name: "com.android.apex.cts.shim.v2_with_pre_install_hook",
249    manifest: "manifest_v2_with_pre_install_hook.json",
250    androidManifest: "AndroidManifest.xml",
251    file_contexts: ":apex.test-file_contexts",
252    key: "com.android.apex.cts.shim.key",
253    prebuilts: ["hash_of_dev_null"],
254    installable: false,
255    updatable: false,
256}
257
258apex {
259    name: "com.android.apex.cts.shim.v2_with_post_install_hook",
260    manifest: "manifest_v2_with_post_install_hook.json",
261    androidManifest: "AndroidManifest.xml",
262    file_contexts: ":apex.test-file_contexts",
263    key: "com.android.apex.cts.shim.key",
264    prebuilts: ["hash_of_dev_null"],
265    installable: false,
266    updatable: false,
267}
268
269genrule {
270    name: "generate_hash_v1",
271    srcs: [
272        ":com.android.apex.cts.shim.v2",
273        ":com.android.apex.cts.shim.v2_add_apk_to_apex",
274        ":com.android.apex.cts.shim.v2_without_apk_in_apex",
275        ":com.android.apex.cts.shim.v2_additional_file",
276        ":com.android.apex.cts.shim.v2_additional_folder",
277        ":com.android.apex.cts.shim.v2_different_certificate",
278        ":com.android.apex.cts.shim.v2_different_package_name",
279        ":com.android.apex.cts.shim.v2_no_hashtree",
280        ":com.android.apex.cts.shim.v2_signed_bob",
281        ":com.android.apex.cts.shim.v2_signed_bob_rot",
282        ":com.android.apex.cts.shim.v2_signed_bob_rot_rollback",
283        ":com.android.apex.cts.shim.v2_with_pre_install_hook",
284        ":com.android.apex.cts.shim.v2_with_post_install_hook",
285        ":com.android.apex.cts.shim.v2_sdk_target_p",
286        ":com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p",
287        ":com.android.apex.cts.shim.v2_apk_in_apex_upgrades",
288        ":com.android.apex.cts.shim.v2_rebootless",
289        ":com.android.apex.cts.shim.v2_install_constraints_empty",
290        ":com.android.apex.cts.shim.v2_install_constraints_invalid_fingerprint",
291        ":com.android.apex.cts.shim.v2_install_constraints_no_value",
292        ":com.android.apex.cts.shim.v3",
293        ":com.android.apex.cts.shim.v3_rebootless",
294        ":com.android.apex.cts.shim.v3_signed_bob",
295        ":com.android.apex.cts.shim.v3_signed_bob_rot",
296    ],
297    out: ["hash.txt"],
298    cmd: "sha512sum -b $(in) | cut -d' ' -f1 | tee $(out)",
299}
300
301prebuilt_etc {
302    name: "hash_v1",
303    src: ":generate_hash_v1",
304    filename: "hash.txt",
305    installable: false,
306}
307
308prebuilt_etc {
309    name: "allowlist",
310    srcs: [
311        "signature-permission-allowlist.xml",
312    ],
313    sub_dir: "permissions",
314    installable: false,
315}
316
317apex {
318    name: "com.android.apex.cts.shim.v1",
319    manifest: "manifest.json",
320    androidManifest: "AndroidManifest.xml",
321    file_contexts: ":apex.test-file_contexts",
322    key: "com.android.apex.cts.shim.key",
323    prebuilts: [
324        "hash_v1",
325        "allowlist",
326    ],
327    apps: [
328        "CtsShim",
329        "CtsShimPriv",
330    ],
331    allowed_files: "default_shim_allowed_list.txt",
332    updatable: false,
333}
334
335genrule {
336    name: "com.android.apex.cts.shim_not_pre_installed.pem",
337    out: ["com.android.apex.cts.shim_not_pre_installed.pem"],
338    cmd: "openssl genrsa -out $(out) 4096",
339}
340
341genrule {
342    name: "com.android.apex.cts.shim_not_pre_installed.pubkey",
343    srcs: [":com.android.apex.cts.shim_not_pre_installed.pem"],
344    out: ["com.android.apex.cts.shim_not_pre_installed.pubkey"],
345    tools: ["avbtool"],
346    cmd: "$(location avbtool) extract_public_key --key $(in) --output $(out)",
347}
348
349apex_key {
350    name: "com.android.apex.cts.shim_not_pre_installed.key",
351    private_key: ":com.android.apex.cts.shim_not_pre_installed.pem",
352    public_key: ":com.android.apex.cts.shim_not_pre_installed.pubkey",
353    installable: false,
354}
355
356apex {
357    name: "com.android.apex.cts.shim_not_pre_installed",
358    manifest: "manifest_not_pre_installed.json",
359    androidManifest: "AndroidManifestNotPreInstalled.xml",
360    file_contexts: ":apex.test-file_contexts",
361    key: "com.android.apex.cts.shim_not_pre_installed.key",
362    prebuilts: ["hash_of_dev_null"],
363    installable: false,
364    updatable: false,
365}
366
367apex {
368    name: "com.android.apex.cts.shim.v2_different_certificate",
369    // Use manifest_v2_rebootless to also re-use this APEX in the rebootless update test case.
370    manifest: "manifest_v2_rebootless.json",
371    androidManifest: "AndroidManifest.xml",
372    file_contexts: ":apex.test-file_contexts",
373    key: "com.android.apex.cts.shim.key",
374    prebuilts: ["hash_of_dev_null"],
375    installable: false,
376    certificate: ":com.android.apex.cts.shim.debug.cert",
377    updatable: false,
378}
379
380android_app_certificate {
381    name: "com.android.apex.cts.shim.debug.cert",
382    certificate: "com.android.apex.cts.shim.debug.cert",
383}
384
385// Build rules to build shim apex with rotated keys
386
387// We name the original key used to sign cts.shim.v1 package as alice.
388// We then create a second key called bob. The second key bob is used to rotate the
389// original key alice.
390
391// Create private key bob in pem format
392genrule {
393    name: "com.android.apex.rotation.key.bob.pem",
394    out: ["bob.pem"],
395    cmd: "openssl req -x509 -newkey rsa:4096 -nodes -days 999999 -subj '/DN=/EMAILADDRESS=android@android.com/CN=Android/OU=Android/O=Android/L=Mountain View/ST=California/C=US' -keyout $(out)",
396}
397
398// Converts bob's private key to pk8 format
399genrule {
400    name: "com.android.apex.rotation.key.bob.pk8",
401    srcs: [":com.android.apex.rotation.key.bob.pem"],
402    out: ["bob.pk8"],
403    cmd: "openssl pkcs8 -topk8 -inform PEM -outform DER -in $(in) -out $(out) -nocrypt",
404}
405
406// Extract bob's public key from its private key
407genrule {
408    name: "com.android.apex.rotation.key.bob.x509.pem",
409    srcs: [":com.android.apex.rotation.key.bob.pem"],
410    out: ["bob.x509.pem"],
411    cmd: "openssl req -x509 -key $(in) -newkey rsa:4096 -nodes -days 999999 -subj '/DN=/EMAILADDRESS=android@android.com/CN=Android/OU=Android/O=Android/L=Mountain View/ST=California/C=US' -out $(out)",
412}
413
414// Create lineage file for rotating alice to bob
415genrule {
416    name: "com.android.apex.rotation.key.bob.rot",
417    srcs: [
418        "alice.pk8",
419        "alice.x509.pem",
420        ":com.android.apex.rotation.key.bob.pk8",
421        ":com.android.apex.rotation.key.bob.x509.pem",
422    ],
423    out: ["bob.rot"],
424    tools: [":apksigner"],
425    cmd: "$(location :apksigner) rotate --out $(out) --old-signer --key $(location alice.pk8) --cert $(location alice.x509.pem) --new-signer --key $(location :com.android.apex.rotation.key.bob.pk8) --cert $(location :com.android.apex.rotation.key.bob.x509.pem)",
426}
427
428// Create lineage file for rotating alice to bob with rollback capability
429genrule {
430    name: "com.android.apex.rotation.key.bob.rot.rollback",
431    srcs: [
432        "alice.pk8",
433        "alice.x509.pem",
434        ":com.android.apex.rotation.key.bob.pk8",
435        ":com.android.apex.rotation.key.bob.x509.pem",
436    ],
437    out: ["bob.rot"],
438    tools: [":apksigner"],
439    cmd: "$(location :apksigner) rotate --out $(out) --old-signer --key $(location alice.pk8) --cert $(location alice.x509.pem) --set-rollback true --new-signer --key $(location :com.android.apex.rotation.key.bob.pk8) --cert $(location :com.android.apex.rotation.key.bob.x509.pem)",
440}
441
442// v2 cts shim package signed by bob, without lineage
443genrule {
444    name: "com.android.apex.cts.shim.v2_signed_bob",
445    out: ["com.android.apex.cts.shim.v2_signed_bob"],
446    tools: [":apksigner"],
447    srcs: [
448        ":com.android.apex.cts.shim.v2",
449        ":com.android.apex.rotation.key.bob.x509.pem",
450        ":com.android.apex.rotation.key.bob.pk8",
451    ],
452    dist: {
453        targets: ["com.android.apex.cts.shim.v2_signed_bob"],
454        dest: "com.android.apex.cts.shim.v2_signed_bob.apex",
455    },
456    cmd: "$(location :apksigner) sign --v1-signing-enabled false --v2-signing-enabled false --key $(location :com.android.apex.rotation.key.bob.pk8) --cert $(location :com.android.apex.rotation.key.bob.x509.pem) --out $(out) $(location :com.android.apex.cts.shim.v2)",
457}
458
459// v2 cts shim package signed by bob + lineage
460genrule {
461    name: "com.android.apex.cts.shim.v2_signed_bob_rot",
462    out: ["com.android.apex.cts.shim.v2_signed_bob_rot"],
463    tools: [":apksigner"],
464    srcs: [
465        ":com.android.apex.cts.shim.v2",
466        ":com.android.apex.rotation.key.bob.x509.pem",
467        ":com.android.apex.rotation.key.bob.pk8",
468        ":com.android.apex.rotation.key.bob.rot",
469    ],
470    dist: {
471        targets: ["com.android.apex.cts.shim.v2_signed_bob_rot"],
472        dest: "com.android.apex.cts.shim.v2_signed_bob_rot.apex",
473    },
474    cmd: "$(location :apksigner) sign --v1-signing-enabled false --v2-signing-enabled false --key $(location :com.android.apex.rotation.key.bob.pk8) --cert $(location :com.android.apex.rotation.key.bob.x509.pem) --lineage $(location :com.android.apex.rotation.key.bob.rot) --rotation-min-sdk-version 28 --out $(out) $(location :com.android.apex.cts.shim.v2)",
475}
476
477// v2 cts shim package signed by bob + lineage + rollback capability
478genrule {
479    name: "com.android.apex.cts.shim.v2_signed_bob_rot_rollback",
480    out: ["com.android.apex.cts.shim.v2_signed_bob_rot_rollback"],
481    tools: [":apksigner"],
482    srcs: [
483        ":com.android.apex.cts.shim.v2",
484        ":com.android.apex.rotation.key.bob.x509.pem",
485        ":com.android.apex.rotation.key.bob.pk8",
486        ":com.android.apex.rotation.key.bob.rot.rollback",
487    ],
488    dist: {
489        targets: ["com.android.apex.cts.shim.v2_signed_bob_rot_rollback"],
490        dest: "com.android.apex.cts.shim.v2_signed_bob_rot_rollback.apex",
491    },
492    cmd: "$(location :apksigner) sign --v1-signing-enabled false --v2-signing-enabled false --key $(location :com.android.apex.rotation.key.bob.pk8) --cert $(location :com.android.apex.rotation.key.bob.x509.pem) --lineage $(location :com.android.apex.rotation.key.bob.rot.rollback) --rotation-min-sdk-version 28 --out $(out) $(location :com.android.apex.cts.shim.v2)",
493}
494
495// v3 cts shim package signed by bob
496genrule {
497    name: "com.android.apex.cts.shim.v3_signed_bob",
498    out: ["com.android.apex.cts.shim.v3_signed_bob"],
499    tools: [":apksigner"],
500    srcs: [
501        ":com.android.apex.cts.shim.v3",
502        ":com.android.apex.rotation.key.bob.x509.pem",
503        ":com.android.apex.rotation.key.bob.pk8",
504    ],
505    dist: {
506        targets: ["com.android.apex.cts.shim.v3_signed_bob"],
507        dest: "com.android.apex.cts.shim.v3_signed_bob.apex",
508    },
509    cmd: "$(location :apksigner) sign --v1-signing-enabled false --v2-signing-enabled false --key $(location :com.android.apex.rotation.key.bob.pk8) --cert $(location :com.android.apex.rotation.key.bob.x509.pem) --out $(out) $(location :com.android.apex.cts.shim.v3)",
510}
511
512// v3 cts shim package signed by bob + lineage
513genrule {
514    name: "com.android.apex.cts.shim.v3_signed_bob_rot",
515    out: ["com.android.apex.cts.shim.v3_signed_bob_rot"],
516    tools: [":apksigner"],
517    srcs: [
518        ":com.android.apex.cts.shim.v3",
519        ":com.android.apex.rotation.key.bob.x509.pem",
520        ":com.android.apex.rotation.key.bob.pk8",
521        ":com.android.apex.rotation.key.bob.rot",
522    ],
523    dist: {
524        targets: ["com.android.apex.cts.shim.v3_signed_bob_rot"],
525        dest: "com.android.apex.cts.shim.v3_signed_bob_rot.apex",
526    },
527    cmd: "$(location :apksigner) sign --v1-signing-enabled false --v2-signing-enabled false --key $(location :com.android.apex.rotation.key.bob.pk8) --cert $(location :com.android.apex.rotation.key.bob.x509.pem) --lineage $(location :com.android.apex.rotation.key.bob.rot) --rotation-min-sdk-version 28 --out $(out) $(location :com.android.apex.cts.shim.v3)",
528}
529
530// This one is only used in ApexdHostTest and not meant to be installed
531// and hence shouldn't be allowed in hash.txt of v1 shim APEX.
532apex {
533    name: "com.android.apex.cts.shim.v2_legacy",
534    manifest: "manifest_v2.json",
535    androidManifest: "AndroidManifest.xml",
536    file_contexts: ":apex.test-file_contexts",
537    key: "com.android.apex.cts.shim.key",
538    prebuilts: ["hash_of_dev_null"],
539    apps: [
540        "CtsShim",
541        "CtsShimPriv",
542    ],
543    installable: false,
544    min_sdk_version: "29",
545    updatable: false,
546}
547
548genrule {
549    name: "com.android.apex.cts.shim.v2_no_pb",
550    srcs: [":com.android.apex.cts.shim.v2_legacy"],
551    out: ["com.android.apex.cts.shim.v2_no_pb.apex"],
552    tools: ["zip2zip"],
553    cmd: "$(location zip2zip) -i $(in) -x apex_manifest.pb -o $(out)",
554}
555
556// Apex shim that targets an old sdk (P)
557apex {
558    name: "com.android.apex.cts.shim.v2_sdk_target_p",
559    // Use manifest_v2_rebootless to also re-use this APEX in the rebootless update test case.
560    manifest: "manifest_v2_rebootless.json",
561    androidManifest: "AndroidManifestSdkTargetP.xml",
562    file_contexts: ":apex.test-file_contexts",
563    key: "com.android.apex.cts.shim.key",
564    prebuilts: ["hash_of_dev_null"],
565    installable: false,
566    apps: [
567        "CtsShim",
568        "CtsShimPriv",
569    ],
570    updatable: false,
571}
572
573// Apex shim with apk-in-apex that targets sdk P
574apex {
575    name: "com.android.apex.cts.shim.v2_apk_in_apex_sdk_target_p",
576    manifest: "manifest_v2.json",
577    androidManifest: "AndroidManifest.xml",
578    file_contexts: ":apex.test-file_contexts",
579    key: "com.android.apex.cts.shim.key",
580    prebuilts: ["hash_of_dev_null"],
581    apps: ["CtsShimTargetPSdk"],
582    installable: false,
583    updatable: false,
584}
585
586// Apex shim with unsigned apk
587genrule {
588    name: "com.android.apex.cts.shim.v2_unsigned_apk_container",
589    // Use shim.v2_rebootless to re-use same APEX in the rebootless update test case.
590    srcs: [":com.android.apex.cts.shim.v2_rebootless"],
591    out: ["com.android.apex.cts.shim.v2_unsigned_apk_container.apex"],
592    cmd: "cp -v $(in) $(out) && zip -d $(out) META-INF*",
593    dist: {
594        targets: ["com.android.apex.cts.shim.v2_unsigned_apk_container"],
595        dest: "com.android.apex.cts.shim.v2_unsigned_apk_container.apex",
596    },
597}
598
599// Apex shim for testing rebootless updates
600apex {
601    name: "com.android.apex.cts.shim.v2_rebootless",
602    manifest: "manifest_v2_rebootless.json",
603    file_contexts: ":apex.test-file_contexts",
604    key: "com.android.apex.cts.shim.key",
605    prebuilts: ["hash_of_dev_null"],
606    installable: false,
607    updatable: false,
608}
609
610apex {
611    name: "com.android.apex.cts.shim.v3_rebootless",
612    manifest: "manifest_v3_rebootless.json",
613    file_contexts: ":apex.test-file_contexts",
614    key: "com.android.apex.cts.shim.key",
615    prebuilts: ["hash_of_dev_null"],
616    installable: false,
617    updatable: false,
618}
619
620// Apex shim with upgraded apk-in-apexes
621apex {
622    name: "com.android.apex.cts.shim.v2_apk_in_apex_upgrades",
623    manifest: "manifest_v2.json",
624    androidManifest: "AndroidManifest.xml",
625    file_contexts: ":apex.test-file_contexts",
626    key: "com.android.apex.cts.shim.key",
627    prebuilts: ["hash_of_dev_null"],
628    apps: [
629        "CtsShim",
630        "CtsShimPrivUpgrade",
631    ],
632    installable: false,
633    updatable: false,
634}
635
636apex {
637    name: "com.android.apex.cts.shim.v2_install_constraints_empty",
638    manifest: "manifest_v2.json",
639    androidManifest: "AndroidManifestInstallConstraints_empty.xml",
640    file_contexts: ":apex.test-file_contexts",
641    key: "com.android.apex.cts.shim.key",
642    prebuilts: ["hash_of_dev_null"],
643    installable: false,
644    updatable: false,
645}
646
647apex {
648    name: "com.android.apex.cts.shim.v2_install_constraints_invalid_fingerprint",
649    manifest: "manifest_v2.json",
650    androidManifest: "AndroidManifestInstallConstraints_invalid_fingerprint.xml",
651    file_contexts: ":apex.test-file_contexts",
652    key: "com.android.apex.cts.shim.key",
653    prebuilts: ["hash_of_dev_null"],
654    installable: false,
655    updatable: false,
656}
657
658apex {
659    name: "com.android.apex.cts.shim.v2_install_constraints_no_value",
660    manifest: "manifest_v2.json",
661    androidManifest: "AndroidManifestInstallConstraints_no_value.xml",
662    file_contexts: ":apex.test-file_contexts",
663    key: "com.android.apex.cts.shim.key",
664    prebuilts: ["hash_of_dev_null"],
665    installable: false,
666    updatable: false,
667}
668
669// Apex shim for running a new app in an apex
670apex {
671    name: "com.android.apex.cts.shim.v2_add_apk_to_apex",
672    manifest: "manifest_v2.json",
673    file_contexts: ":apex.test-file_contexts",
674    key: "com.android.apex.cts.shim.key",
675    prebuilts: ["hash_of_dev_null"],
676    apps: ["CtsShimAddApkToApex"],
677    installable: false,
678    updatable: false,
679}
680