In Android AOSP, open-source build trees include public RSA test keys inside build/make/target/product/security/. Shipping production ROM firmware or system apps signed with these public test keys creates a critical security vulnerability. releasekey.x509.pem and releasekey.pk8 act as the default production cryptographic key pair for signing system packages and OTA updates.

The 4 Core Cryptographic Key Pairs in AOSP

  • `releasekey`: Default fallback key used to sign system applications and packages that do not specify an explicit certificate.

  • `platform`: Signs core platform packages (e.g. Settings.apk, SystemUI.apk) granting android.uid.system privileges.

  • `media`: Signs media framework services (e.g. MediaProvider.apk).

  • `shared`: Signs packages sharing data across contacts/home providers.

Generating Custom Private Keys & Re-Signing Target Files

AOSP Signing Shell Commandsbash
# 1. Generate new private RSA keys & X.509 certificates
./development/tools/make_key releasekey "/CN=Lynxbee Production/"
./development/tools/make_key platform "/CN=Lynxbee Platform/"
./development/tools/make_key shared "/CN=Lynxbee Shared/"
./development/tools/make_key media "/CN=Lynxbee Media/"
 
# 2. Re-sign compiled target-files.zip archive with new release keys
sign_target_files_apks -o -d my_private_keys/ \
    out/target/product/<device>/obj/PACKAGING/target_files_intermediates/target-files.zip \
    signed-target-files.zip