Android BSPCertificationSecurity

Getting a custom Qualcomm Android build through CTS, VTS and GTS

The failure classes we hit most often on custom Android builds, and the order to fix them in.

AtomToApp engineering · 4 November 2026 · 7 min read

A custom Android device cannot ship Google services without passing the Compatibility, Vendor and GMS test suites. On a production kiosk BSP we took a vendor tree from hundreds of failures to passing runs. The failures fall into a few classes, and the order you fix them in matters.

1. Boot image and kernel

  • VTS expects the Generic Kernel Image. Ship Google's certified GKI boot image as boot.img and keep vendor drivers as vendor modules, which is also how an NFC driver was delivered on this project.
  • Merge the monthly security patches and track kernel CVEs. GTS checks the security patch level you declare against what is actually in the build.

2. Verified boot and signing

  • AVB diagnostics will flag vbmeta partitions signed with test keys. Every partition must be signed with production keys through the ABL and OEM signing flow before you can pass, and before you can safely ship OTA.
  • Set up A/B OTA at the same time. A device that passes certification but cannot be updated in the field is not finished.

3. SELinux and privileged apps

  • Privileged apps need explicit privapp permission allowlists; CTS fails on any privileged permission that is not declared.
  • Resolve SELinux denials properly with policy, not by relaxing enforcement.

4. HALs and media

VTS exercises every HAL you declare in the manifest. Graphics composer, NFC, USB and health HALs were the ones that needed real work on this board. Media is a common trap: VP9 inside MP4 did not play until MP4 and MOV were kept off the Qualcomm parser.

5. Track it like a project

We kept a tracker of every GMS and CTS work item (privapp allowlists, SELinux policy, kernel CVEs, vendor releases) with an owner and a status. Certification is a programme, not a single test run, and the tracker is what lets you tell a client exactly how far from approval the build is.

If you are stuck

Send us the failing test names and your build tree layout. We have usually seen the failure before and can quote the diagnosis and the first batch of fixes as a fixed milestone.

Have a similar problem?

Send a brief and the engineer who wrote this replies within one working day.

Request a quote