History

Alice Wang c276b80d8e [hex] Use libhex to encode hex string in avmd and apexutil Bug: 239413416 Test: atest avmdtool_tests libapexutil_rust.test Change-Id: I58fcc32f62bea1cd34b171ac336a1ed13f5735b8		2022-10-12 16:43:30 +00:00
..
src	[hex] Use libhex to encode hex string in avmd and apexutil	2022-10-12 16:43:30 +00:00
tests	[apk_digest] Return SignatureAlgorithmID when fetching apk digest	2022-09-19 20:19:53 +00:00
Android.bp	[hex] Use libhex to encode hex string in avmd and apexutil	2022-10-12 16:43:30 +00:00
README.md	…
TEST_MAPPING	Move AVF tests to avf-pre/postsubmit test group	2022-08-19 15:40:57 +00:00

README.md

The AVMD image format

The AVMD image format is used to descibe the verified code that a VM will load. This repository contains tools and libraries for working with the AVMD image format.

What is it?

When a VM boots, it loads and verifies a set of images that control execution within the VM. Therefore, describing what executes in a VM means describing what is loaded. The AVMD image format is designed, for this purpose, to describe the closure of images that can be loaded and how they should be verified.

Caveats

The AVMD image format will only allow Android supported signing formats. The supported formats are currently limited to AVB and APK.

Verification of the images as they are loaded is the responsibility of the VM. The VM is required to only load the images described and to verify them against the included parameters. If the VM does not follow this requirement, the description of the VM may not be accurate and must not be trusted. Validating that the VM behaves as expected requires audit of all boot stages of the VM.

Using avmdtool

The .avmd file can be created as follows

avmdtool create /tmp/out.avmd \
   --vbmeta pvmfw preload u-boot.bin \
   --vbmeta uboot env_vbmeta disk1/vbmeta.imb \
   --vbmeta uboot vbmeta micordoid/vbmeta.img \
   --apk microdroid payload compos.apk \
   --apk microdroid extra_apk extra_apk.apk \
   --apex-payload microdroid art_apex art.apex

You can read the .avmd file with

avmdtool dump /tmp/out.avmd