fix(attestation): persist vbmeta boot key and hash across reboots

resetprop overrides for ro.boot.* props don't survive reboots. On
devices where the kernel doesn't set ro.boot.vbmeta.public_key_digest,
the fallback chain hit random generation on every boot, producing a
different RootOfTrust hash each time.

Added file-based persistence (boot_hash.bin, boot_key.bin) as a
fallback layer between TEE cache and random generation. Once a value
is determined from any source, it's written to disk and reused on
subsequent boots.

Verified on Redmi 14C: second boot reads from persistent file instead
of regenerating random bytes.

This commit is contained in:

Enginex0

2026-03-10 12:58:49 +01:00

parent 1bfe628317

commit 25f3f753ff

2 changed files with 39 additions and 5 deletions

									
										module/uninstall.sh
									
		+1
		
												View File
												
				@@ -9,3 +9,4 @@ done

				rm -rf "$CONFIG_DIR/persistent_keys"

				rm -f "$CONFIG_DIR/tee_status.txt"

				rm -f "$CONFIG_DIR/boot_hash.bin" "$CONFIG_DIR/boot_key.bin"