From 803f4194510a7600f129ea79fd415a4defe0778e Mon Sep 17 00:00:00 2001 From: Satoshi Sanno Date: Fri, 8 Feb 2019 18:54:23 +0900 Subject: [PATCH] Fix that the update to v1 signed version fails if apk verity is enabled Symptom: To update APK Signature Scheme v1 signed system priv-app to new v1 signed version fails if apk verity is enabled. Root cause: The package manager gets the verity root hash from apk for apk verity. But, the getting prosess does not consider v1 signed apk. The getting prosess fails if the apk is v1 signed. It causes the update failure. Solution: Always skip apk verity if the apk is v1 signed. Because v1 signed apk always does not have the verity root hash, and apk verity has been skipped in case of that the apk is v2 or v3 signed and the apk does not have the verity root hash. Bug: 124354537 Change-Id: Ieb19ed9a3277bfad09dc67a1abf1d9039c44709f --- core/java/android/util/apk/ApkSignatureVerifier.java | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/core/java/android/util/apk/ApkSignatureVerifier.java b/core/java/android/util/apk/ApkSignatureVerifier.java index de9f55b092004..544cc1c76d4e5 100644 --- a/core/java/android/util/apk/ApkSignatureVerifier.java +++ b/core/java/android/util/apk/ApkSignatureVerifier.java @@ -397,15 +397,18 @@ public class ApkSignatureVerifier { /** * @return the verity root hash in the Signing Block. */ - public static byte[] getVerityRootHash(String apkPath) - throws IOException, SignatureNotFoundException, SecurityException { + public static byte[] getVerityRootHash(String apkPath) throws IOException, SecurityException { // first try v3 try { return ApkSignatureSchemeV3Verifier.getVerityRootHash(apkPath); } catch (SignatureNotFoundException e) { // try older version } - return ApkSignatureSchemeV2Verifier.getVerityRootHash(apkPath); + try { + return ApkSignatureSchemeV2Verifier.getVerityRootHash(apkPath); + } catch (SignatureNotFoundException e) { + return null; + } } /**