Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[DO NOT MERGE]Revert "Relax minimum signature scheme version for apps on system partition"

Browse Source 
This reverts commit b71e398935.

Revert reason: System apps should now have uncompressed dex / library
files in their APKs and should be able to satisfy the minimum V2
signature requirement when targeting API level 30+.

Fixes: 215046612
Test: Manually verified V1 only signed APK targeting API level 30
      on the system image failed to verify.
Change-Id: Ic53d2a3614e7dff4e4bfe18561d3dfbb665bbcb2
This commit is contained in:
Michael Groover
2022-02-18 14:41:10 -08:00
parent 0a771d1712
commit 3c36fd5fee
3 changed files with 13 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
core/java/android/content/pm/PackageParser.java
View File

@@ -1401,11 +1401,9 @@ public class PackageParser {
} }
SigningDetails verified; SigningDetails verified;
if (skipVerify) { if (skipVerify) {
// systemDir APKs are already trusted, save time by not verifying; since the signature // systemDir APKs are already trusted, save time by not verifying
// is not verified and some system apps can have their V2+ signatures stripped allow
// pulling the certs from the jar signature.
verified = ApkSignatureVerifier.unsafeGetCertsWithoutVerification( verified = ApkSignatureVerifier.unsafeGetCertsWithoutVerification(
apkPath, SigningDetails.SignatureSchemeVersion.JAR); apkPath, minSignatureScheme);
} else { } else {
verified = ApkSignatureVerifier.verify(apkPath, minSignatureScheme); verified = ApkSignatureVerifier.verify(apkPath, minSignatureScheme);
} }

6
core/java/android/content/pm/parsing/ParsingPackageUtils.java
View File

@@ -3038,11 +3038,9 @@ public class ParsingPackageUtils {
SigningDetails verified; SigningDetails verified;
try { try {
if (skipVerify) { if (skipVerify) {
// systemDir APKs are already trusted, save time by not verifying; since the // systemDir APKs are already trusted, save time by not verifying
// signature is not verified and some system apps can have their V2+ signatures
// stripped allow pulling the certs from the jar signature.
verified = ApkSignatureVerifier.unsafeGetCertsWithoutVerification( verified = ApkSignatureVerifier.unsafeGetCertsWithoutVerification(
baseCodePath, SigningDetails.SignatureSchemeVersion.JAR); baseCodePath, minSignatureScheme);
} else { } else {
verified = ApkSignatureVerifier.verify(baseCodePath, minSignatureScheme); verified = ApkSignatureVerifier.verify(baseCodePath, minSignatureScheme);
} }

6
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -15193,9 +15193,8 @@ public class PackageManagerService extends IPackageManager.Stub
} }
} }
// If the package is not on a system partition ensure it is signed with at least the // Ensure the package is signed with at least the minimum signature scheme version
// minimum signature scheme version required for its target SDK. // required for its target SDK.
if ((parseFlags & ParsingPackageUtils.PARSE_IS_SYSTEM_DIR) == 0) {
int minSignatureSchemeVersion = int minSignatureSchemeVersion =
ApkSignatureVerifier.getMinimumSignatureSchemeVersionForTargetSdk( ApkSignatureVerifier.getMinimumSignatureSchemeVersionForTargetSdk(
pkg.getTargetSdkVersion()); pkg.getTargetSdkVersion());
@@ -15206,7 +15205,6 @@ public class PackageManagerService extends IPackageManager.Stub
} }
} }
} }
}
@GuardedBy("mLock") @GuardedBy("mLock")
private boolean addBuiltInSharedLibraryLocked(SystemConfig.SharedLibraryEntry entry) { private boolean addBuiltInSharedLibraryLocked(SystemConfig.SharedLibraryEntry entry) {