From 1b4789a3371a09a7a6bb7c4aa5ca7fccd493bd04 Mon Sep 17 00:00:00 2001 From: Andrew Gunnerson Date: Thu, 4 Jun 2026 21:25:39 -0400 Subject: [PATCH] README.md: Document how keys correspond to AOSP keys Fixes: #604 Signed-off-by: Andrew Gunnerson --- README.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/README.md b/README.md index b29221e..92d4a40 100644 --- a/README.md +++ b/README.md @@ -134,6 +134,23 @@ The commands above are provided for convenience. avbroot is compatible with any If you lose your AVB or OTA signing key, you will no longer be able to sign new OTA zips. You will have to generate new signing keys and unlock your bootloader again (triggering a data wipe). Follow the [Usage section](#usage) as if doing an initial setup. +### AOSP keys + +If you're building Android from source, this is how avbroot's keys correspond to AOSP's keys: + +| avbroot | AOSP | +|----------------|-----------------------| +| `avb.key` | `avb.pem` | +| `avb_pkmd.bin` | `avb_pkmd.bin` | +| `ota.key` | `releasekey.pk8` | +| `ota.crt` | `releasekey.x509.pem` | + +To use an AOSP `releasekey.pk8` key with avbroot, it must be converted from DER to PEM first: + +```bash +openssl pkcs8 -topk8 -scrypt -in releasekey.pk8 -out ota.key -outform PEM +``` + ## Initial setup 1. Make sure that the version of fastboot is 35 or newer. Older versions have bugs that prevent the `fastboot flashall` command (required later) from working properly.