From 8db9f17d65c28d5a2dba22780284e8348bb32034 Mon Sep 17 00:00:00 2001
From: Artem Smirnov <artem@smirnov.page>
Date: Sat, 22 Aug 2026 22:55:07 +0300
Subject: [PATCH 1/3] encrypt-keys/decrypt-keys: handle all AVB keys

---
 decrypt-keys | 11 +++++++----
 encrypt-keys | 11 +++++++----
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/decrypt-keys b/decrypt-keys
index b621d1e02c..fbd34cdea9 100755
--- a/decrypt-keys
+++ b/decrypt-keys
@@ -6,6 +6,8 @@ source "$(dirname ${BASH_SOURCE[0]})/common.sh"
 
 [[ $# -ne 1 ]] && user_error "expected 1 argument (key directory)"
 
+export PATH="$PWD/prebuilts/build-tools/linux-x86/bin:$PATH"
+
 cd $1
 
 [[ "${password+defined}" = defined ]] || read -rp "Enter key passphrase (empty if none): " -s password
@@ -24,13 +26,14 @@ for key in ${signing_keys[@]}; do
     fi
 done
 
-if [[ -f avb.pem ]]; then
+for key in avb.pem avb_mldsa.pem; do
+    [[ -f $key ]] || continue
     if [[ -n $password ]]; then
-        openssl pkcs8 -topk8 -in avb.pem -passin env:password -out "$tmp/avb.pem" -nocrypt
+        openssl pkcs8 -topk8 -in $key -passin env:password -out "$tmp/$key" -nocrypt
     else
-        openssl pkcs8 -topk8 -in avb.pem -out "$tmp/avb.pem" -nocrypt
+        openssl pkcs8 -topk8 -in $key -out "$tmp/$key" -nocrypt
     fi
-fi
+done
 
 unset password
 
diff --git a/encrypt-keys b/encrypt-keys
index 90ab9b0cda..ecee2c3e17 100755
--- a/encrypt-keys
+++ b/encrypt-keys
@@ -6,6 +6,8 @@ source "$(dirname ${BASH_SOURCE[0]})/common.sh"
 
 [[ $# -ne 1 ]] && user_error "expected 1 argument (key directory)"
 
+export PATH="$PWD/prebuilts/build-tools/linux-x86/bin:$PATH"
+
 cd $1
 
 read -rp "Enter old key passphrase (empty if none): " -s password
@@ -35,13 +37,14 @@ for key in ${signing_keys[@]}; do
     fi
 done
 
-if [[ -f avb.pem ]]; then
+for key in avb.pem avb_mldsa.pem; do
+    [[ -f $key ]] || continue
     if [[ -n $password ]]; then
-        openssl pkcs8 -topk8 -in avb.pem -passin env:password -out "$tmp/avb.pem" -passout env:new_password -scrypt
+        openssl pkcs8 -topk8 -in $key -passin env:password -out "$tmp/$key" -passout env:new_password -scrypt
     else
-        openssl pkcs8 -topk8 -in avb.pem -out "$tmp/avb.pem" -passout env:new_password -scrypt
+        openssl pkcs8 -topk8 -in $key -out "$tmp/$key" -passout env:new_password -scrypt
     fi
-fi
+done
 
 unset password
 unset new_password

From 9f2fb5d8cc5a3ecd3b45c88b561d5d45d622d483 Mon Sep 17 00:00:00 2001
From: Artem Smirnov <artem@smirnov.page>
Date: Sat, 22 Aug 2026 22:55:07 +0300
Subject: [PATCH 2/3] generate-keys: generate ML-DSA-65 AVB key

---
 generate-keys | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/generate-keys b/generate-keys
index 5c38a53eed..790f9b8cfd 100755
--- a/generate-keys
+++ b/generate-keys
@@ -4,6 +4,8 @@ source "$(dirname ${BASH_SOURCE[0]})/common.sh"
 
 devices=($*)
 
+export PATH="$PWD/prebuilts/build-tools/linux-x86/bin:$PATH"
+
 for device in ${devices[@]}; do
     mkdir -p keys/$device
     cd keys/$device
@@ -13,5 +15,7 @@ for device in ${devices[@]}; do
     done
     openssl genrsa 4096 | openssl pkcs8 -topk8 -scrypt -out avb.pem
     ../../external/avb/avbtool.py extract_public_key --key avb.pem --output avb_pkmd.bin
+    openssl genpkey -algorithm ML-DSA-65 | openssl pkcs8 -topk8 -scrypt -out avb_mldsa.pem
+    ../../external/avb/avbtool.py extract_public_key --key avb_mldsa.pem --output avb_mldsa_pkmd.bin
     cd ../..
 done

From cf420518fe7f11f8db5de729537891cf0c423ee1 Mon Sep 17 00:00:00 2001
From: Artem Smirnov <artem@smirnov.page>
Date: Sat, 22 Aug 2026 22:55:07 +0300
Subject: [PATCH 3/3] use ML-DSA-65 for Pixel 11 vbmeta signing

---
 generate-release.sh | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/generate-release.sh b/generate-release.sh
index 736dfd1d3b..32b9974868 100755
--- a/generate-release.sh
+++ b/generate-release.sh
@@ -70,10 +70,17 @@ else
     user_error "$DEVICE is not supported by the release script"
 fi
 
-AVB_PKMD="$KEY_DIR/avb_pkmd.bin"
-AVB_ALGORITHM=SHA256_RSA4096
+if [[ $DEVICE == @(grizzly|cubs|kodiak|yogi) ]]; then
+    AVB_KEY="$KEY_DIR/avb_mldsa.pem"
+    AVB_PKMD="$KEY_DIR/avb_mldsa_pkmd.bin"
+    AVB_ALGORITHM=MLDSA65
+else
+    AVB_KEY="$KEY_DIR/avb.pem"
+    AVB_PKMD="$KEY_DIR/avb_pkmd.bin"
+    AVB_ALGORITHM=SHA256_RSA4096
+fi
 
-sign_target_files_apks -o -d "$KEY_DIR" --avb_vbmeta_key "$KEY_DIR/avb.pem" --avb_vbmeta_algorithm $AVB_ALGORITHM \
+sign_target_files_apks -o -d "$KEY_DIR" --avb_vbmeta_key "$AVB_KEY" --avb_vbmeta_algorithm $AVB_ALGORITHM \
     --extra_apks com.android.adbd.apex="$KEY_DIR/releasekey" \
     --extra_apex_payload_key com.android.adbd.apex="$KEY_DIR/avb.pem" \
     --extra_apks AdServicesApk.apk="$KEY_DIR/releasekey" \