new file mode 100644
@@ -0,0 +1,72 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alex Kiernan <alex.kiernan@gmail.com>
+Date: Fri, 6 Nov 2026 09:38:18 +0000
+Subject: [PATCH] libadbd_auth: optionally take the trusted-key paths at build
+ time
+
+libadbd_auth reads trusted host keys from /adb_keys and
+/data/misc/adb/adb_keys, which are Android's locations and rarely exist
+on a Linux system - so a Linux adbd that requires authorization has
+nowhere to be given a key.
+
+When ADBD_AUTH_KEY_PATHS is passed to make - a colon-separated list -
+read keys from those files instead. They are still read on every attempt, so a key
+file that appears after adbd started is picked up.
+
+Without the define nothing changes.
+
+Upstream-Status: Pending
+
+AI-Generated: Claude Opus 5.5 (Claude Code)
+Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
+---
+ debian/system/adbd.mk | 4 ++++
+ .../native/libs/adbd_auth/adbd_auth.cpp | 19 ++++++++++++++++---
+ 2 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/debian/system/adbd.mk b/debian/system/adbd.mk
+index 5e2c5ccaea30..dc82b998e77a 100644
+--- a/debian/system/adbd.mk
++++ b/debian/system/adbd.mk
+@@ -113,6 +113,10 @@ ifeq ($(ADBD_AUTH_UNLESS_DEBUGGABLE),1)
+ CPPFLAGS += -DADBD_AUTH_UNLESS_DEBUGGABLE
+ endif
+
++ifneq ($(ADBD_AUTH_KEY_PATHS),)
++CPPFLAGS += -DADBD_AUTH_KEY_PATHS='"$(ADBD_AUTH_KEY_PATHS)"'
++endif
++
+ STATIC_LIBS = \
+ debian/out/system/libadb.a \
+ debian/out/system/libcrypto_utils.a \
+diff --git a/frameworks/native/libs/adbd_auth/adbd_auth.cpp b/frameworks/native/libs/adbd_auth/adbd_auth.cpp
+index 78896ed553c4..9b76c17b1b39 100644
+--- a/frameworks/native/libs/adbd_auth/adbd_auth.cpp
++++ b/frameworks/native/libs/adbd_auth/adbd_auth.cpp
+@@ -390,10 +390,23 @@ public:
+ }
+ }
+
+- static constexpr const char* key_paths[] = {"/adb_keys", "/data/misc/adb/adb_keys"};
++#if defined(ADBD_AUTH_KEY_PATHS)
++ // A colon-separated list, for systems where AOSP's locations mean nothing.
++ // Read on every attempt, so a file that appears after adbd started counts.
++ static std::vector<std::string> KeyPaths() {
++ return android::base::Split(ADBD_AUTH_KEY_PATHS, ":");
++ }
++#else
++ static std::vector<std::string> KeyPaths() {
++ return {"/adb_keys", "/data/misc/adb/adb_keys"};
++ }
++#endif
+ void IteratePublicKeys(bool (*callback)(void*, const char*, size_t), void* opaque) {
+- for (const auto& path : key_paths) {
+- if (access(path, R_OK) == 0) {
++ for (const auto& path : KeyPaths()) {
++ if (path.empty()) {
++ continue;
++ }
++ if (access(path.c_str(), R_OK) == 0) {
+ LOG(INFO) << "adbd_auth: loading keys from " << path;
+ std::string content;
+ if (!android::base::ReadFileToString(path, &content)) {
@@ -67,6 +67,7 @@ SRC_URI = "https://deb.debian.org/debian/pool/main/a/android-platform-tools/andr
file://0020-adbd-signal-readiness-once-functionfs-is-serviced.patch \
file://0021-liblog-optionally-read-ro.debuggable-from-build.prop.patch \
file://0022-adbd-optionally-require-authorization-unless-the-bui.patch \
+ file://0023-libadbd_auth-optionally-take-the-trusted-key-paths-a.patch \
"
SRC_URI[orig.md5sum] = "352376965cdef7bd7505d8fefdd43d50"
@@ -223,7 +224,8 @@ do_compile() {
for tool in ${TOOLS_TO_BUILD}; do
oe_runmake -f ${S}/debian/system/${tool}.mk -C ${S} \
${@'HAVE_SYSTEMD=1' if bb.utils.contains('PACKAGECONFIG', 'systemd', True, False, d) else ''} \
- ${@'ADBD_AUTH_UNLESS_DEBUGGABLE=1' if bb.utils.contains('PACKAGECONFIG', 'auth-unless-debuggable', True, False, d) else ''}
+ ${@'ADBD_AUTH_UNLESS_DEBUGGABLE=1' if bb.utils.contains('PACKAGECONFIG', 'auth-unless-debuggable', True, False, d) else ''} \
+ ${@'ADBD_AUTH_KEY_PATHS=' + d.getVar('ADBD_AUTH_KEY_PATHS') if d.getVar('ADBD_AUTH_KEY_PATHS') else ''}
done
}
@@ -271,6 +273,9 @@ BBCLASSEXTEND = "native"
PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}"
ADB_DEBUGGABLE_PROP_FILES ?= "${sysconfdir}/build.prop"
+# Where adbd reads trusted host keys, colon-separated. Empty keeps Android's
+# /adb_keys and /data/misc/adb/adb_keys.
+ADBD_AUTH_KEY_PATHS ?= ""
# Apply Android's fs_config ownership/mode tables to files pushed by adbd to
# /system, /vendor and /oem. Off by default: the tables describe Android
# partition images and are meaningless on a generic Linux rootfs.
adbd looks for trusted host keys only in Android's /adb_keys and /data/misc/adb/adb_keys, so a Linux adbd that requires authorization has nowhere sensible to be given one. ADBD_AUTH_KEY_PATHS, colon-separated, replaces that list. AI-Generated: Claude Opus 5.5 (Claude Code) Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> --- ...h-optionally-take-the-trusted-key-paths-a.patch | 72 ++++++++++++++++++++++ .../android-tools/android-tools_35.0.2.bb | 7 ++- 2 files changed, 78 insertions(+), 1 deletion(-)