From 2a685c85570fdb8734f9967af9b94a73723df8a5 Mon Sep 17 00:00:00 2001
From: Victor Hsieh <victorhsieh@google.com>
Date: Wed, 26 Oct 2022 17:20:35 -0700
Subject: [PATCH] VerityUtilsTest: add a test case of external signature

Bug: 253668864
Test: atest FrameworksCoreTests:com.android.internal.security.VerityUtilsTest
Change-Id: I70a8fc399e09ed611a907e3fcc7506d7c370a397
---
 core/tests/coretests/Android.bp               |   1 +
 core/tests/coretests/res/raw/fsverity_sig     | Bin 0 -> 672 bytes
 .../internal/security/VerityUtilsTest.java    |  21 ++++++++++++++++++
 3 files changed, 22 insertions(+)
 create mode 100644 core/tests/coretests/res/raw/fsverity_sig

diff --git a/core/tests/coretests/Android.bp b/core/tests/coretests/Android.bp
index a767f834c765d..48cfc87d7d55e 100644
--- a/core/tests/coretests/Android.bp
+++ b/core/tests/coretests/Android.bp
@@ -82,6 +82,7 @@ android_test {
 
     resource_dirs: ["res"],
     resource_zips: [":FrameworksCoreTests_apks_as_resources"],
+    java_resources: [":ApkVerityTestCertDer"],
 
     data: [
         ":BstatsTestApp",
diff --git a/core/tests/coretests/res/raw/fsverity_sig b/core/tests/coretests/res/raw/fsverity_sig
new file mode 100644
index 0000000000000000000000000000000000000000..b2f335dc034217b5ab292aa7c243b0d07777b234
GIT binary patch
literal 672
zcmXqLVw%IosnzDu_MMlJooPW6Q?Ef2QzsK6qanWmFB@k<n+IbmGYb<VD}w<yLLsAJ
z6H^LMVFFO0fu(_tA-4f18*?ZNn=n&oFpR^&!{qE}C}6+`lHuZEcg#yE%Fj$;;$&DB
zz2#(NI(IC(4L}Q_PGJOE$kN2b(0{n=Kubboa!QvMZ_%rzi|0?|m1tN#%TT+$HC-Z3
z<bUsx|EdlXW;ty?lzYRb>6izHYmNPTqfN8qD`wu>ZfVQ#aURPjhVuCrpPtci`F9|y
z?qc$j=u5w!^Cg@)IBAWoplz{@cze;2@Gm<4Py2rb2!2*I(^+z)tEg^Y_PzT}|2)m&
z<Vwt4-xn@z<g~xjB=9%y-6vDc!V`145AZJLiTD`Z#r6G5W8plT1L-UR##x8;ITxMW
zaGY_!#ncr_i_~v?*t7AU!v0;B_PSncFUKyN!hJw_f7|huCBoWjO8@V4P5HX(kgtp5
z`Now8*|`}W$*MLc=<103b4~iTSM$L|&Wp-hKl*E2E6y~DTX%TFCJz;!keIj3O}CBm
zV&bFaKm1&ua3Q;&!I?k%kJLWK+)~|$H|xcEzSsBv%z3@@w*Ixw&Q}X{9$n71?sRMV
zbIIE(VC8~$LhjdNCAPXnMW^$G?PiyZD4oG`PfMb=RLl0yM!%Eck5VPe6plWSQ(}45
zv!c@Fai)*hQccSrHEflMGuJf5#9m8T-P)X2?YF}5MfgePLZ)jP`~KeNH*Y_=nyo#D
z-Hkg&Y;NTmlRD*xUANUgMla1!Qe5Az{lfcC^R%_sZ2O<OFIuGWv^mdGZzpHdKkq&_
qF@p=2Ei?jo)#i6LtY8XOzGVE-K#X~5=Deg5Mz!(}tdb`lzXAaCF%sPX

literal 0
HcmV?d00001

diff --git a/core/tests/coretests/src/com/android/internal/security/VerityUtilsTest.java b/core/tests/coretests/src/com/android/internal/security/VerityUtilsTest.java
index d1d8018fc4151..151365481f204 100644
--- a/core/tests/coretests/src/com/android/internal/security/VerityUtilsTest.java
+++ b/core/tests/coretests/src/com/android/internal/security/VerityUtilsTest.java
@@ -22,8 +22,11 @@ import static org.junit.Assert.assertTrue;
 import android.platform.test.annotations.Presubmit;
 
 import androidx.test.filters.SmallTest;
+import androidx.test.platform.app.InstrumentationRegistry;
 import androidx.test.runner.AndroidJUnit4;
 
+import com.android.frameworks.coretests.R;
+
 import org.bouncycastle.asn1.ASN1Encoding;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.bouncycastle.asn1.nist.NISTObjectIdentifiers;
@@ -61,6 +64,7 @@ import java.time.Duration;
 import java.time.Instant;
 import java.util.Arrays;
 import java.util.Date;
+import java.util.HexFormat;
 
 @Presubmit
 @SmallTest
@@ -222,6 +226,23 @@ public class VerityUtilsTest {
         assertFalse(verifySignature(pkcs7Signature, SAMPLE_DIGEST, mCertificateDerEncoded));
     }
 
+    @Test
+    public void testSignatureGeneratedExternally() throws Exception {
+        var context = InstrumentationRegistry.getInstrumentation().getContext();
+        byte[] cert = getClass().getClassLoader().getResourceAsStream("ApkVerityTestCert.der")
+                .readAllBytes();
+        // The signature is generated by:
+        //   fsverity sign <(echo -n fs-verity) fsverity_sig --key=ApkVerityTestKey.pem \
+        //   --cert=ApkVerityTestCert.pem
+        byte[] sig = context.getResources().openRawResource(R.raw.fsverity_sig).readAllBytes();
+        // The fs-verity digest is generated by:
+        //   fsverity digest --compact <(echo -n fs-verity)
+        byte[] digest = HexFormat.of().parseHex(
+                "3d248ca542a24fc62d1c43b916eae5016878e2533c88238480b26128a1f1af95");
+
+        assertTrue(verifySignature(sig, digest, cert));
+    }
+
     private static boolean verifySignature(
             byte[] pkcs7Signature, byte[] fsverityDigest, byte[] certificateDerEncoded) {
         return VerityUtils.verifyPkcs7DetachedSignature(