Closed 0cwa closed 2 months ago
yes, this is expected.
i haven't written the documentation yet as this project still is in its early stages. but for now, below info should suffice is what i believe.
when you call generate_keys
function from util_functions.sh
(read below for step by step process), it calls base64_encode
function in exchange.sh
for encoding the keys to base64
so that it can be used in ci
environments. in fact, it does prints out the base64 values in terminal (or where ever the function is called).
you need to copy the values and add it as repository secret
in your github fork. once that is done, these keys should automatically be fetched from there and decoded.
to generate keys, you can execute these in your command line:
cd pixeneos
source src/util_functions.sh && generate_keys
# you'll be asked for passphrases interactively since you've passed an env variable prior to this
# once done, you should now see base64 encoded values being printed.
Ok, cool, that works!
This is an issue with Github actions still. There's also a thing with Cargo.toml not being found, maybe related? My keys are properly in base64, I can decode what I put in with base64 -d and the variables mentioned are set as repository secrets under Actions.
2024-09-04T13:02:30.6022007Z Current runner version: '2.319.1'
2024-09-04T13:02:30.6046303Z ##[group]Operating System
2024-09-04T13:02:30.6047099Z Ubuntu
2024-09-04T13:02:30.6047469Z 22.04.4
2024-09-04T13:02:30.6047826Z LTS
2024-09-04T13:02:30.6048257Z ##[endgroup]
2024-09-04T13:02:30.6048674Z ##[group]Runner Image
2024-09-04T13:02:30.6049187Z Image: ubuntu-22.04
2024-09-04T13:02:30.6049602Z Version: 20240901.1.0
2024-09-04T13:02:30.6051443Z Included Software: https://github.com/actions/runner-images/blob/ubuntu22/20240901.1/images/ubuntu/Ubuntu2204-Readme.md
2024-09-04T13:02:30.6053015Z Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu22%2F20240901.1
2024-09-04T13:02:30.6053893Z ##[endgroup]
2024-09-04T13:02:30.6054310Z ##[group]Runner Image Provisioner
2024-09-04T13:02:30.6054873Z 2.0.384.1
2024-09-04T13:02:30.6055270Z ##[endgroup]
2024-09-04T13:02:30.6070968Z ##[group]GITHUB_TOKEN Permissions
2024-09-04T13:02:30.6072840Z Actions: write
2024-09-04T13:02:30.6073531Z Attestations: write
2024-09-04T13:02:30.6074142Z Checks: write
2024-09-04T13:02:30.6074525Z Contents: write
2024-09-04T13:02:30.6074989Z Deployments: write
2024-09-04T13:02:30.6075416Z Discussions: write
2024-09-04T13:02:30.6075814Z Issues: write
2024-09-04T13:02:30.6076269Z Metadata: read
2024-09-04T13:02:30.6076688Z Packages: write
2024-09-04T13:02:30.6077074Z Pages: write
2024-09-04T13:02:30.6077552Z PullRequests: write
2024-09-04T13:02:30.6077986Z RepositoryProjects: write
2024-09-04T13:02:30.6078524Z SecurityEvents: write
2024-09-04T13:02:30.6078944Z Statuses: write
2024-09-04T13:02:30.6079297Z ##[endgroup]
2024-09-04T13:02:30.6082363Z Secret source: Actions
2024-09-04T13:02:30.6082987Z Prepare workflow directory
2024-09-04T13:02:30.6992582Z Prepare all required actions
2024-09-04T13:02:30.7152363Z Getting action download info
2024-09-04T13:02:30.9601969Z Download action repository 'actions/checkout@v4' (SHA:692973e3d937129bcbf40652eb9f2f61becf3332)
2024-09-04T13:02:31.0614211Z Download action repository 'dtolnay/rust-toolchain@master' (SHA:7b1c307e0dcbda6122208f10795a713336a9b35a)
2024-09-04T13:02:31.2358607Z Download action repository 'Swatinem/rust-cache@v2.7.3' (SHA:23bce251a8cd2ffc3c1075eaa2367cf899916d84)
2024-09-04T13:02:31.4847319Z Download action repository 'actions/setup-python@v5' (SHA:f677139bbe7f9c59b41e40162b753c062f5d49a3)
2024-09-04T13:02:31.5698093Z Download action repository 'softprops/action-gh-release@v2' (SHA:c062e08bd532815e2082a85e87e3ef29c3e6d191)
2024-09-04T13:02:31.8572498Z Complete job name: build
2024-09-04T13:02:31.9403400Z ##[group]Run # Convert inputs to proper boolean values
2024-09-04T13:02:31.9404147Z [36;1m# Convert inputs to proper boolean values[0m
2024-09-04T13:02:31.9404767Z [36;1mroot=true[0m
2024-09-04T13:02:31.9405172Z [36;1mmagisk_preinit_device=sda15[0m
2024-09-04T13:02:31.9405657Z [36;1m[0m
2024-09-04T13:02:31.9406161Z [36;1m# Ensure that the boolean comparison is correctly handled[0m
2024-09-04T13:02:31.9406821Z [36;1mif [ "$root" == "true" ] && [ -z "$magisk_preinit_device" ]; then[0m
2024-09-04T13:02:31.9407633Z [36;1m echo -e "::error:: magisk-preinit-device is required when root is true."[0m
2024-09-04T13:02:31.9408252Z [36;1m exit 1[0m
2024-09-04T13:02:31.9408588Z [36;1mfi[0m
2024-09-04T13:02:31.9435329Z shell: /usr/bin/bash -e {0}
2024-09-04T13:02:31.9435857Z env:
2024-09-04T13:02:31.9436200Z CARGO_INCREMENTAL: 1
2024-09-04T13:02:31.9436577Z DEVICE_NAME: bramble
2024-09-04T13:02:31.9437044Z INTERACTIVE_MODE: false
2024-09-04T13:02:31.9437566Z GRAPHENEOS_UPDATE_CHANNEL: stable
2024-09-04T13:02:31.9438051Z RUST_BACKTRACE: short
2024-09-04T13:02:31.9438421Z RUSTUP_MAX_RETRIES: 10
2024-09-04T13:02:31.9438809Z ##[endgroup]
2024-09-04T13:02:31.9840258Z ##[group]Run actions/checkout@v4
2024-09-04T13:02:31.9840744Z with:
2024-09-04T13:02:31.9841103Z fetch-depth: 0
2024-09-04T13:02:31.9841557Z repository: 0cwa/PixeneOS
2024-09-04T13:02:31.9842127Z token: ***
2024-09-04T13:02:31.9842487Z ssh-strict: true
2024-09-04T13:02:31.9842907Z ssh-user: git
2024-09-04T13:02:31.9843565Z persist-credentials: true
2024-09-04T13:02:31.9844025Z clean: true
2024-09-04T13:02:31.9844416Z sparse-checkout-cone-mode: true
2024-09-04T13:02:31.9844868Z fetch-tags: false
2024-09-04T13:02:31.9845293Z show-progress: true
2024-09-04T13:02:31.9845671Z lfs: false
2024-09-04T13:02:31.9846001Z submodules: false
2024-09-04T13:02:31.9846455Z set-safe-directory: true
2024-09-04T13:02:31.9846795Z env:
2024-09-04T13:02:31.9847115Z CARGO_INCREMENTAL: 1
2024-09-04T13:02:31.9847564Z DEVICE_NAME: bramble
2024-09-04T13:02:31.9847927Z INTERACTIVE_MODE: false
2024-09-04T13:02:31.9848385Z GRAPHENEOS_UPDATE_CHANNEL: stable
2024-09-04T13:02:31.9848926Z RUST_BACKTRACE: short
2024-09-04T13:02:31.9849359Z RUSTUP_MAX_RETRIES: 10
2024-09-04T13:02:31.9850083Z ##[endgroup]
2024-09-04T13:02:32.1566548Z Syncing repository: 0cwa/PixeneOS
2024-09-04T13:02:32.1568304Z ##[group]Getting Git version info
2024-09-04T13:02:32.1569170Z Working directory is '/home/runner/work/PixeneOS/PixeneOS'
2024-09-04T13:02:32.1570386Z [command]/usr/bin/git version
2024-09-04T13:02:32.1570955Z git version 2.46.0
2024-09-04T13:02:32.1589619Z ##[endgroup]
2024-09-04T13:02:32.1603134Z Temporarily overriding HOME='/home/runner/work/_temp/14171ef5-8c85-4b79-b55a-a3678f960c70' before making global git config changes
2024-09-04T13:02:32.1604266Z Adding repository directory to the temporary git global config as a safe directory
2024-09-04T13:02:32.1615392Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/PixeneOS/PixeneOS
2024-09-04T13:02:32.1651048Z Deleting the contents of '/home/runner/work/PixeneOS/PixeneOS'
2024-09-04T13:02:32.1654322Z ##[group]Initializing the repository
2024-09-04T13:02:32.1658154Z [command]/usr/bin/git init /home/runner/work/PixeneOS/PixeneOS
2024-09-04T13:02:32.1719014Z hint: Using 'master' as the name for the initial branch. This default branch name
2024-09-04T13:02:32.1720364Z hint: is subject to change. To configure the initial branch name to use in all
2024-09-04T13:02:32.1721705Z hint: of your new repositories, which will suppress this warning, call:
2024-09-04T13:02:32.1723043Z hint:
2024-09-04T13:02:32.1724032Z hint: git config --global init.defaultBranch
source src/util_functions.sh && generate_keys
Once generated, you should base64 encoded keys, copy that and update it and try again once.
Just to let you know, you need to set up below mentioned secrets in order for PixeneOS to work:
# keys are expected to be base64 format
AVB_KEY
CERT_OTA
OTA_KEY
# you email for pushing ota to server
EMAIL
# passphrase that you used to generate keys
PASSPHRASE_AVB
PASSPHRASE_OTA
Could it be an issue where there is no passphrase for the keys and therefore didn't set the passphrase tokens? I figured if you have access to the tokens, you already also have access to the passphrase, so there's little point in adding a passphrase
No, passphrase is mandatory to be passed even if it is empty.
Passphrase is required to:
Also, do note that not having a passphrase for signing will lead to severe security risks.
Also, do note that not having a passphrase for signing will lead to severe security risks.
Why is that?
Also, do note that not having a passphrase for signing will lead to severe security risks.
Why is that?
It solely exist for the sake of encryption. When you decide to not pass the passphrase, you're accepting the risk of having your keys unencrypted which can be easily accessed by anyone who has access to your PC.
Yes, it is solely optional but I wouldn't recommend that.
I get this issue with git actions and locally building:
Git ENV Secrets are set to: AVB_KEY CERT_OTA OTA_KEY