Do we need to sign APEX files during the build?

[petefoth]

We don't currently sign APEX files during the build. I don't know

1. What the implications are of not signing them
2. Whether we need to add code to
   a. generate the apk-specific keys
   b. sign the APEXes during the build

Background

• APEX files are used in OTA updates ¹
• LOS Wiki describes how to
  • generate APEX keys ²
  • using the keys when generating and signing target files ³. Some of the apks are signed using the release key, some use the newly generated apk-specific keys
• The /e/OS Docker image
  • does not generate apk-specific keys when generating signing keys ⁴
  • signs each apk with the apk-specific key if the key files exist ⁵ before calling ota_from_target_files

Footnotes

1. https://source.android.com/docs/core/ota/apex ↩

2. https://wiki.lineageos.org/signing_builds#generate-keys-without-a-password ↩

3. https://wiki.lineageos.org/signing_builds#generating-and-signing-target-files ↩

4. https://gitlab.e.foundation/e/os/docker-lineage-cicd/-/blob/master/src/init.sh?ref_type=heads#L35 ↩

5. https://gitlab.e.foundation/e/os/docker-lineage-cicd/-/blob/master/src/build.sh?ref_type=heads#L382 ↩