[ASUS ZenFone 8] bnsmb:
If you are using a local repository for an Android-based operating system to create your own image of a custom ROM for a phone, it is important to add the security patches released by Google on a monthly basis. For custom ROMs that are actively maintained, this is done by the maintainer of the custom ROM and you can simply get them via an "repo sync" after the patches have been applied by the maintainer.

However, if the custom ROM is no longer actively supported, you will need to do this yourself (as long as Google releases security patches for the Android version used by the custom ROM).

For the OmniROM there is an official script to apply an Android Security Patch to the OmniROM repositories available here:

https://github.com/omnirom/android_vendor_omni/blob/android-14.0/utils/aosp-merge.sh

The list of forked AOSP repositories for the OmniROM is available here:

https://github.com/omnirom/android_vendor_omni/blob/android-14.0/utils/aosp-forked-list

The script and the list are already part of the OmniROM repositories so no need to download them

xtrnaw7@fedora01:/data/develop/android/OmniROM_14.0$ ls -l vendor/omni/utils/
total 56
-rw-r--r--. 1 xtrnaw7 xtrnaw7 1159 Nov 20 19:04 Android.mk
-rw-r--r--. 1 xtrnaw7 xtrnaw7 480 Nov 20 19:04 aosp-forked-list
-rwxr-xr-x. 1 xtrnaw7 xtrnaw7 2528 Nov 20 19:04 aosp-merge.sh
-rwxr-xr-x. 1 xtrnaw7 xtrnaw7 1927 Dec 12 15:16 aosp-push-merge.sh
-rwxr-xr-x. 1 xtrnaw7 xtrnaw7 2532 Nov 20 19:04 caf-merge.sh
-rwxr-xr-x. 1 xtrnaw7 xtrnaw7 1847 Nov 20 19:04 caf-push-merge.sh
-rw-r--r--. 1 xtrnaw7 xtrnaw7 135 Nov 20 19:04 caf-repos-list
-rwxr-xr-x. 1 xtrnaw7 xtrnaw7 1942 Nov 20 19:04 fork_aosp.sh
-rwxr-xr-x. 1 xtrnaw7 xtrnaw7 1966 Nov 20 19:04 fork_github.sh
-rwxr-xr-x. 1 xtrnaw7 xtrnaw7 8350 Nov 20 19:04 kernel-upstream.sh
drwxr-xr-x. 5 xtrnaw7 xtrnaw7 4096 Nov 20 19:04 omni_emulator
-rw-r--r--. 1 xtrnaw7 xtrnaw7 1129 Nov 20 19:04 README.md
xtrnaw7@fedora01:/data/develop/android/OmniROM_14.0$

To use that script for applying an Android Security Patch do:

# optional: create a backup of the existing default.xml
#
cp .repo/manifests/default.xml .repo/manifests/default.xml.org.$( date +%Y-%m-%d)

# correct tag in the default.xml; in this example android-14.0.0_r27 is the tag for the new security patch
#
sed -i -e "s/android-14.0.0_r[0-9][0-9]/android-14.0.0_r27/g" .repo/manifests/default.xml

# check the result:
#
diff .repo/manifests/default.xml .repo/manifests/default.xml.org.$( date +%Y-%m-%d)

# start the merge of the security patch
#
cd <omnirom_repository_dir>

cd vendor/omni/utils

./aosp-merge.sh

and enter the git tag for the Android Security Patch that should be applied (e.g. android-14.0.0_r27 for the security patch 2024-02-05 for Android 14).

Answer the question "Do you want to merge it like squash ? type yes or no" with yes.

When done check the result - the value for PLATFORM_SECURITY_PATCH should now contain the new patch level:

xtrnaw7@fedora01:/data/develop/android/OmniROM_14.0$ grep '^[[:space:]]*PLATFORM_SECURITY_PATCH[[:space:]]*:=' ./build/make/core/version_defaults.mk
PLATFORM_SECURITY_PATCH := 2024-02-05
xtrnaw7@fedora01:/data/develop/android/OmniROM_14.0$

If the scripts logs some merge conflicts, you must resolve them manually -- see the file ./vendor/omni/utils/README.md for how to handle merge conflicts.

See here for an example log output from the script.

Notes:

The list of available Android Security Patches and the git tags used for them is available on this Website:

https://source.android.com/docs/setup/reference/build-numbers#source-code-tags-and-builds

If the merge does not work as expected (e.g. the PLATFORM_SECURITY_PATCH is still the old value after executing the script), add some debug code (the echo commands in the excerpt below) to the script aosp-merge.sh:

xtrnaw7@fedora01:/data/develop/android/OmniROM_14.0/vendor/omni/utils$ grep -B2 -A4 "++++" aosp-merge.sh
ret=$(git pull https://android.googlesource.com/platform/$aosp_project ${ref} 2>&1);

echo "++++"
echo "$ret"
echo "----"

if echo $ret | grep "CONFLICT (content)" > /dev/null ; then
xtrnaw7@fedora01:/data/develop/android/OmniROM_14.0/vendor/omni/utils$

The git option pull.rebase must be false for updating the AOSP repositories. Use

git config -l

to check the current value, e.g:

[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/OmniROM_14.0 ] $ git config -l
filter.lfs.clean=git-lfs clean -- %f
filter.lfs.smudge=git-lfs smudge -- %f
filter.lfs.process=git-lfs filter-process
filter.lfs.required=true
color.ui=auto
filter.lfs.clean=git-lfs clean -- %f
filter.lfs.smudge=git-lfs smudge -- %f
filter.lfs.process=git-lfs filter-process
filter.lfs.required=true
pull.rebase=false
[ OmniRom 14 Dev - xtrnaw7@t15g /data/develop/android/OmniROM_14.0 ] $

Use

git config --global pull.rebase false

to correct the option (The option can also be set for each repository if the global setting is not feasible)

I did not know these infos when I started to collect all the information for this HowTo. Therefor I did a lot of investigations and tests to figure out how the process for applying an Android Security Patch to an Custom ROM distribution works.

If you are interested in the details, you can read the entry on my website

http://bnsmb.de/My_HowTos_for_Andro...ndroid_Security_patches_to_a_local_repository

There is also another script for applying an Android security patchset that I wrote before I found the official script for it. But I recommend to use the official script for applying the security patchset.

Update 04.04.2024

Since QPR2 for Android 14 released in Q1 2024 the security patch level is not defined in the file ./build/make/core/version_defaults.mk anymore. Therefor the grep command used above to print the security patchlevel of an Android repository tree fails.

To print the security patch level configured in a local Android repository tree the script scripts_on_linux/scripts_on_linux/print_security_patch can be used:

Example:

[ OmniRom 14 Dev - xtrnaw7@t15g /devpool001/develop/OmniROM_14.0 ] $ ../scripts_on_linux/print_security_patch
The repository uses the new definitions
The current security patch is "2024-04-05"
The current build_id is "ap1a"
[ OmniRom 14 Dev - xtrnaw7@t15g /devpool001/develop/OmniROM_14.0 ] $

(see Infos for buildinga CustomROM image or and/check the source code of the script for details)

If the security patch level is not updated after applying the new security patch, check that the repository build/release is listed in the file ./vendor/omni/utils/aosp-forked-list.

Spoiler content hidden.