ELC + ABS

Android Lollipop introduces new features for boot security, with a specification for build-time signing and run-time verification of the boot, recovery, and system images, with the bootloader controlling verification of the boot/recovery images and Linux dm-verity enforcing the integrity of the system image. There are also facilities for enrolling user-supplied keys via Fastboot so that custom images may be verified. In this presentation Andrew will detail how these components work together, the requirements for creating a compatible bootloader, how to use the available tools in AOSP to create signed images and keystores, and some discussion on the implications of these features with respect to OTA updates, covering the new block-level incremental update feature.