Commit Graph
5 Commits
Author SHA1 Message Date
Enginex0andGKI Builder ce0ca18d98 Preserve generated keys across keybox rotation
Only invalidate patched cert chains when keybox changes.
Generated key material is independent and survives rotation.
2026-02-06 00:07:46 +01:00
Enginex0andGKI Builder fa28e9fc71 Integrate key persistence with interceptors
Save keys on generation, restore on daemon startup, delete on cleanup.
Re-persist when cert chain updates via updateSubcomponents.
2026-02-06 00:07:46 +01:00
Enginex0andGKI Builder c3822197b1 Add generated key persistence layer
Persist GENERATE-mode keys to disk so they survive daemon restarts.
Binary format with version header, atomic write via tmp+rename.
2026-02-06 00:07:46 +01:00
Enginex0andGKI Builder f276806096 fix(native): block attestation leak when interceptor service is dead
When the Java interceptor process dies, callback->transact() returns
DEAD_OBJECT but the code fell through to the real keystore, exposing
genuine TEE state to requesting apps.

Add pingBinder() liveness check on pre-transact failure. If the
interceptor is confirmed dead, return DEAD_OBJECT to the caller
instead of forwarding to real hardware. Apps see a transient service
error rather than the actual device attestation state.
2026-02-05 23:57:40 +01:00
Enginex0 9aa4a33c5e Add fork-based supervisor daemon for instant restart 2026-02-05 23:57:24 +01:00