Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BinaryTransparencyService: Print lineage of rotated keys.

Browse Source 
There are preloaded apps where the signing keys have been rotated.
Thus, we are adding the printing/display of the lineage of rotated
keys within the `printPackageSignerDetails` method, which will be
invoked when `get mba_info -v` command is executed.

Bug: 261501773
Test: Manual.
	adb shell cmd transparency get mba_info -v
Change-Id: I9e78c84acb355f48afc9713d6a94e0a2b6524f81
This commit is contained in:
Billy Lau
2022-12-08 15:31:04 -06:00
parent a044500a4b
commit 0000111186
1 changed files with 29 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
services/core/java/com/android/server/BinaryTransparencyService.java
View File

@@ -542,7 +542,7 @@ public class BinaryTransparencyService extends SystemService {
}
}
pw.println("First install time (ms): " + packageInfo.firstInstallTime);
pw.println("Last update time (ms): " + packageInfo.lastUpdateTime);
pw.println("Last update time (ms): " + packageInfo.lastUpdateTime);
// TODO(b/261493591): Determination of whether a package is preinstalled can be
// made more robust
boolean isPreloaded = (packageInfo.firstInstallTime
@@ -574,9 +574,10 @@ public class BinaryTransparencyService extends SystemService {
pw.println("ERROR: Package's signingInfo is null.");
return;
}
// TODO(b/261501773): Handle printing of lineage of rotated keys.
pw.println("--- Package Signer Info ---");
pw.println("Has multiple signers: " + signerInfo.hasMultipleSigners());
pw.println("Signing key has been rotated: "
+ signerInfo.hasPastSigningCertificates());
Signature[] packageSigners = signerInfo.getApkContentsSigners();
for (Signature packageSigner : packageSigners) {
byte[] packageSignerDigestBytes =
@@ -590,8 +591,31 @@ public class BinaryTransparencyService extends SystemService {
} catch (CertificateException e) {
Slog.e(TAG,
"Failed to obtain public key of signer for cert with hash: "
+ packageSignerDigestHextring);
e.printStackTrace();
+ packageSignerDigestHextring, e);
}
}
if (!signerInfo.hasMultipleSigners()
&& signerInfo.hasPastSigningCertificates()) {
pw.println("== Signing Cert Lineage (Excluding The Most Recent) ==");
pw.println("(Certs are sorted in the order of rotation, beginning with the "
+ "original signing cert)");
Signature[] signingCertHistory = signerInfo.getSigningCertificateHistory();
for (int i = 0; i < (signingCertHistory.length - 1); i++) {
Signature signature = signingCertHistory[i];
byte[] signatureDigestBytes = PackageUtils.computeSha256DigestBytes(
signature.toByteArray());
String certHashHexString = HexEncoding.encodeToString(
signatureDigestBytes, false);
pw.println(" ++ Signer cert #" + (i + 1) + " ++");
pw.println(" Cert SHA256-digest: " + certHashHexString);
try {
PublicKey publicKey = signature.getPublicKey();
pw.println(" Signing key algorithm: " + publicKey.getAlgorithm());
} catch (CertificateException e) {
Slog.e(TAG, "Failed to obtain public key of signer for cert "
+ "with hash: " + certHashHexString, e);
}
}
}
@@ -630,7 +654,7 @@ public class BinaryTransparencyService extends SystemService {
pw.println("Component factory: "
+ packageInfo.applicationInfo.appComponentFactory);
pw.println("Process name: " + packageInfo.applicationInfo.processName);
pw.println("Task affinity : " + packageInfo.applicationInfo.taskAffinity);
pw.println("Task affinity: " + packageInfo.applicationInfo.taskAffinity);
pw.println("UID: " + packageInfo.applicationInfo.uid);
pw.println("Shared UID: " + packageInfo.sharedUserId);