IssueTracker

When running the VTS module “vts_security_avb_test”, we found case “AvbTest#SystemHashtree” failed due to “The GSI image is not signed by an official key”. The root cause is the public key of the key which signs the system image doesn’t match any known public keys in the “{VTS_TOOL}/testcases/vts_security_avb_test/arm64”. Currently I can see the known public keys and their sha1 hash are:
1beece88cb28960546f2793f2f58fe2b01918cb3  ./gki-oem-2024.avbpubkey
594f70f6344799cb39fa2fc569a0c646d716a060  ./qcar-gsi.avbpubkey
144820003f9d46c96e9090dcf0e4feb84ca84810  ./q-gsi.avbpubkey
e3cc565489737d7c5a54fff8337fe4279783c8ce  ./r-gsi.avbpubkey
152cb9d664a600bd37fa1ea6713816a4f3265243  ./s-gsi.avbpubkey
b42c87bedcf600d7bebe3dbade2444e9724c3159  ./t-gsi.avbpubkey
We use the GSI image downloaded from: https://developer.android.com/topic/generic-system-image/releases#14-qpr1. The sha1 hash of the public key of the key used to sign system image is like below:
$ avbtool.py info_image --image system.img
Footer version:           1.0
Image size:               2059816960 bytes
Original image size:      2027233280 bytes
VBMeta offset:            2059358208
VBMeta size:              2432 bytes
--
Minimum libavb version:   1.0
Header Block:             256 bytes
Authentication Block:     576 bytes
Auxiliary Block:          1600 bytes
Public key (sha1):        1ffb1af796b18ebf40d18faed213f686720f73f2
Algorithm:                SHA256_RSA4096
Rollback Index:           1701734400
Flags:                    0
Rollback Index Location:  0
Release String:           'avbtool 1.2.0'
Descriptors:
    Hashtree descriptor:
      Version of dm-verity:  1
      Image Size:            2027233280 bytes
      Tree Offset:           2027233280
      Tree Size:             15970304 bytes
      Data Block Size:       4096 bytes
      Hash Block Size:       4096 bytes
      FEC num roots:         2
      FEC offset:            2043203584
      FEC size:              16154624 bytes
      Hash Algorithm:        sha256
      Partition Name:        system
      Salt:                  f2235569a84ede94f1e7cf61ac15e871fda4b80a29ef076a67d266acdda90adb
      Root Digest:           9c0b41e175813e02b1793f117110463469e3226c34eb563beb439285e45814b0
      Flags:                 0
You can see the public key with sha1 hash “1ffb1af796b18ebf40d18faed213f686720f73f2”, it doesn’t match any known public key in VTS tool and that’s why the case failed.
In the AOSP public code, the GSI image was signed by “external/avb/test/data/testkey_rsa2048.pem”, but seems the GSI image downloaded from Google website(https://developer.android.com/topic/generic-system-image/releases#14-qpr1) was signed by an internal key and its public key should be uploaded to VTS tool known keys. The known public key is missing for android 14 (and android 13 as far as I can see).