From a4a01127d80821340da9b18217c60d7ee7217fd7 Mon Sep 17 00:00:00 2001 From: Michael Groover Date: Tue, 14 Apr 2020 17:07:23 -0700 Subject: [PATCH] Update PM#checkSignatures to support pre-key rotation behavior When key rotation was added in P all of the existing signature methods were updated to support pre-key rotation behavior (eg GET_SIGNATURES returns the first key in the signing lineage), but checkSignatures was not updated to support similar behavior. This commit updates checkSignatures to check the oldest signer in the lineage, if either of the reqested packages has one, if the existing signature check fails. This allows a developer to compare their app signed with a rotated key against both an app signed with the previous key as well as an app signed with only the new key. Bug: 153910385 Test: atest PackageManagerTests Test: atest PackageManagerTest Change-Id: Id0af68bab2b85dc91643551b1f5934c2b8df317f --- .../coretests/res/raw/install_app1_cert5 | Bin 0 -> 12760 bytes .../res/raw/install_app1_cert5_rotated_cert6 | Bin 0 -> 16856 bytes .../coretests/res/raw/install_app1_cert6 | Bin 0 -> 12760 bytes .../res/raw/install_app2_cert5_rotated_cert6 | Bin 0 -> 16856 bytes .../content/pm/PackageManagerTests.java | 50 ++++++++++++++---- .../server/pm/PackageManagerService.java | 21 +++++++- 6 files changed, 58 insertions(+), 13 deletions(-) create mode 100644 core/tests/coretests/res/raw/install_app1_cert5 create mode 100644 core/tests/coretests/res/raw/install_app1_cert5_rotated_cert6 create mode 100644 core/tests/coretests/res/raw/install_app1_cert6 create mode 100644 core/tests/coretests/res/raw/install_app2_cert5_rotated_cert6 diff --git a/core/tests/coretests/res/raw/install_app1_cert5 b/core/tests/coretests/res/raw/install_app1_cert5 new file mode 100644 index 0000000000000000000000000000000000000000..138b6113ea6b9a645abace4b42c91411040af86a GIT binary patch literal 12760 zcmeHOcT^PF((hr2l5>_M3=#(c35tjW1q4BYpyZ4&q#+GCC`c3}D3VbG$w8tdK@e0j zN*IuwL>-WvUyr-&x_-Owy+6P64%O#Q)eTkM{kvUt?)0tJP=(^s0EFP-6CQFN_=%_i zT)@Q=DQs_wa&&VQMwr?<2zesx58eX6-Plsq77dEFMr$T2#9cBnPO>geK_N1StYG<9 z*$Xxibj*>;%2_&2%j8H`mt}J2j}<%K_i@cBeC`W-Z2Ee!2{ z_NqkFNroWG_9lK$D8>XbqB6;)7N6V0pa3UQxh%2*?G^k|GspYTQ|rZtkh9qr`e-XJ zB34otK5au#L~e{Vl}01(`gg5HZlotKHGde7Ny;B=$7DXU@!d))DrKyxiSXY{NJd?Z zj}cK~9I&D}$DF8@TD#db781Q;=8z|tT4VUy70n^7(9!)*0S}xDp^p^&Av<*JU=B|?; zE*u&cD|QS&wyY9Iee{}rITCe1J8oO|PHgKo`M8EE0ioT8fbMe;0I0(O0F8fxKLE%% zShzUaTBw;i*jia4U9tGzebDGYEeB%1K0IUgCYp$bSMMGt-lZw3r!@DX^{%krrMaT< z2A4n}2r&#()n2AJeHuj=eqKH;ARLyF5jtLEJ^e08)_ccct|4jL%H5GVdq+PZMS8~| zw#c^h6WyL#3Gqe~L=xBd6{94<_$xu!7{q&m`%$3QGM*1q_M*J#x_GZPG)heS;ilcA z+4ev$FE&o`)QQGs*~xqr0VUn#kb!Ht3?|txucod>u4|yrYq7ps>%dG}XYWNW+#5Q( zr-vz_cFCFCEi1ZIC9+3}lBp-!@6R}QYF=_+)`_*>;9J72Xv}Ai$Dv_a{^=ukJf5XG zG5KYQoI4rQ%XLAPcD%oPqS2atkf54QXN)-Yvg!)YC-~YX#{25Ii&EsYeF?;^sL;;r zj))J#*NK))T6JVW)QA={}vCo$ih8%Z7rZB!~3#qGE^;!DRm16<7I-B(3XX$`3-N>fO;V z>eap&ymQkm)|@ClP;_irJA1-wwzj=EVS{4ZYB7a#oG;aTW>EDIov`I8>j%X?FTOb9 zs~GTkS;PJ9c{%aJOR@gSM8V4b1$>IIg$!&3{ngRU#oQ7pWa@%6#{o!w^nj`W1YiN| zK@JZ5gHHV+0RSH;Qv)u5C4dBk!I7o_3UCD609UYv0Bg2@10V!=f-=?$DIgDybOC!s z06D-M10oGlAoXHiG%zw9p{7DwU zTKS(K77%Bz#ovXbs8)O3-%Swy-#bD6eGWi)6fAU`ctmF1!DN$0q z+H~4#=N++7l(Fny?k*-G)MH-g@R?9SK6za_Vfv0jzk+LC>2rk*=S*gBj z?y$S5mEbG1yW|v0bo)KN1`^I0dm?$_6 zwYswV)pF=CaMH2+J=)QjV3);yQzq_Oqc8Cn48o_r_y)W2>f9`|%y&fh%%1f~nYM#B z4`wkdEO%3B*W>)E;M9pHIxpf=^uwl``lQNBtuI8gUU_4+Gc3H&?JwtFdabzI3ZsQt zVp~|M+S#cef5YL=8J{_#lC9jUIgL){`x5ebP52G!A$5N5mDG2-FtS^a^fa_yY(+&cd`1U7NXyj6$cok@N{lqFP^YzJv8Sm%sl~!ZYb57!2IYiC*ZKh8a zG%T5ax;0%cjp_3#9L#3V-@MQ{xM$G2wfM4?uZ>P_gI}q5iH85NWNnc&t!VMV<(UHi zoBVt{&x&A1ty@bYin{3^o3lD@9VTA@y^nyf)p2)02Xx^9{3CA!2!C5urY<{p(1A|+ z2rSr`qNb=VC#bBhBz#>R4iy_`8uNgHd)pfq~Dk8TvF|RzF zZP+kTq4Q?{W@t^x!A8~^Z3l%ZgnykS1XTB@GbmcFjbftj4@A#wxz&)bsxxjFSVJApE0p63 z31z3?Wvt_j6irKOxlBN+efM~oKX5ei69*{t)hQI%`mxq;8}yPPIwP#&2j zK1kY@PjI14>#S;Xs>bS_l<`P^zUj^IewAnbo~;!R<7!LV&QWk24o|9;C(%c5N*4FBNd*Ib~sF?&_?S-QiVZqtRch7_K~B!Ap$rX`}7Z&%T$T}OP<=MY(2=V`H#0-1XWjgZo zwbqdL_c4rDLsqJvaKytg5YRLb%?F&I5U_7F4B*(c~Sd(Z_tYQDdfJBg9Fg_38d6&37UdK88io*PSt|yy5E2 zEz(ZRXur!jQx&*9-AP`T|4!wjdbH-g|3-@Q>l#(^x9AVogl;_@p!e0y`@GnkrbcHN zCuDD*F5K7AC?Bl3l00GD`bN5!*@(^B%*w*VfW>6Onw^+LTK@u_2py#}&zM=DSHy7Q zrQ&iL3DHW$&+T)}?ZHnI^iPqzW-8&IfSjhVG8H$mve>&%m-#*;!)h<>JMvaP^~&t0 z{=pCP;s>rfGP_c{VI5@e2eld;i{tNEti^el&+%?FFBdQN2Dy+up zw_i$136Ky=v^Oj`(!9M=UoX7NbeP9FoWPXtZ&Y9ZKyFh(y1(Htt4-hIgj5PNWpG?Y zFp3x9RA_w4GcRU4)Y;+PT&QoT`3w97X}ed+Op(W;52JNV(GUzjo$hzO zNO95|%=^>_v&`QM3VhzVv2;d$K(bW zOK$!eo7Lphm6a5=w1w1^5M655g5f~h$~mI(%*&l;K9QU_brQ&t*J6=RO1p}9Cy=R# zZf?4U5##whwXS^7c%FhtS1Ws-HX+=N6Q^kQkrLnOzWDcXi^yfc`Hs~l&0%7IF){UV z{4;~Vt0qfBVpq8?rzo-0DY!>AIrcN5?3iZHxX;tuzhvVqG4S50eA~RavLdE-MfB|8 zd%+tA%+2$%WDc>{we{~r6UY?0UAU7Zza>vyVtUUwFR0k_3~{(|{nNJ&y#wnbbN9mh z{hs1Dlro>hg>d%>9U=lJW(K1aTdy} zpKS>Nb@stcBX|(bHarM2nE}Ot;NTDe(c*CXF$nD@oD`pkFXT$dCMg6$j0eD}MJVCq z_)r~OC<&np()7pcVE9RTQjxQ8QBe^QF>whoshjkqVxn+K5sBZcf3Fk-;r!V+1P_1) zLCC=iftY<>MR^QP!+K!MvZgF!%%xEN`nmh!cVS|BHJ zTw7vdRGeOeldd^id)igmA2I!!5Oq7aUtw&g>3(dQ12?N)L%;z{r8Gu71*eRY#5t^4WM!(QE6m{Yy(hbV|mev~)#6LY%^*(syGo6UM7S>aWCSjGoR)@Py~C zGZOOJ$S0q2aE@tGIhQ{%o^1^Cmbl@y^?l0O#Ksga7Sf|)V^HN8p<)KGQNb(MsMJfK zE5pmA`R=ZTaR%Inon4}OU40WCp|Fl;S)9?gI+?s?Gb76+!yojNhNjbmkyrCVI5sHv zIi>|}l`Or%0jCi1L<6o4X9e+QCBvn|rJ=_WL{j)mCQDH*-R3BVgy;*fI>Ono-CVc~ zaJqoMA3%Z~K#hwBhe9BSKVuF~D2O?DnoW!C%Agtg9My+K{tkiLmv)oq3EJZ>LI*82 zt56L35Op>sC?QgH3^rGEmSj(W^b~;`-$cX=zCpS&&w(!$tv70UR~Ams+&fj_8(Qvp zIrH?@!kGXQ(lcon=d&02&KKClD3y%wTly4zO0Oj%loW9;VO_W%NM&P*Zm|1Eo>y&$ z;?3XwfPM}Lwp-&g9MX#39(5*^*N`tBv2@dO3sCgWqI~NN-4aFIDX+0ZjV^MuZS!a4 z?yEYLoc8oGPOD|#7!`AJYe^-t zt2EK-p~R!A25D5nnWB`bu;>>-+1L$N?8YbQGNu8$sfi^L(18fS@?*CWBv*n zK2IAfTmLSb1k~i2J;5&zG_OR=pAgzoVMEL)3aq_c6}Lh^hgH^Wb>&l;kM-m8&q;k_ z7Rg*NpAQ~CH>+aM!yYep!{t!Qo&HNC~qYZoK8m_rqc zU4*NArAFB?J$P)ATHP^L#6@({^%kmQJ@j1}Noo-?!fLE2k1)L+Qp*ZH9uNc2H;;Yx zKlt?hI5huF>^=_7{~W@stgE{YEp6tY_vd9UMefk8UaOUv_{CVLADMN83j<~pu|9=C5sid zX5ANC)uhB4f?GVI`|}MMV;lYA9LwX)TXVJdM|N3=t4SDicqyd2ddFVsICNU3m!vro zmDbKIy}-m@-Sv%ya;&Spe?>IYW3z4NLIX3q!=h=&81H6&Jt5){+=O;E;#Zq-D?^n7CaOU<0 zwnJ%dKfs;!>_TYLaZ?&4%7;8U+wwgJS#9^eZpBKttTxBjD{)%hX%~bI{E_O=iGGc z7XW{yfA}8YS0g_sEK~o*LIAkx|C^+Ctbr52Kj$_7X`=*O`2ID^`PY;GoQHK z!OXOuGC_|Nk5VCiO;h_*Q5U?jze`&C)xxg{T7Ozd1Fz)&S^(3vel_uHKE|IWzJqUS a{xI=Vc7}#39(Z2>KmZ=iAiMw^Tl*J4rux4C literal 0 HcmV?d00001 diff --git a/core/tests/coretests/res/raw/install_app1_cert5_rotated_cert6 b/core/tests/coretests/res/raw/install_app1_cert5_rotated_cert6 new file mode 100644 index 0000000000000000000000000000000000000000..2da2436d9b16a62ee43e5eb9b2f8a29bf7822311 GIT binary patch literal 16856 zcmeHPbzD^2x1XWAyF)^9=n@erX^>W6=#XaUkWfKV6i|^yQKUmekdh8*kS=LZhi;g6 z#(TZj>$|^rpZEUyy;uXXl0`>fGXN5`N5;Q(7ubi^glPecyF0D0QN z1f4DY-Mqa7T`V141^ir`&$~dNdk@Rhn{`Oq8tm!FT<#GOu@UvM@e2^S=G;;Ekh|&- zLq#8}s+wcqzDW%8^4ui$_*8iu_yEJ2BSgXHetK_4BE)kq4^qCp;CIws^GIo1D4Qi6~& z?XVq%4E4^9(E7yGf^lGyfuSr&E#muRv`+>M0@b2{Ksx^fe-KFC)yC7! z(MHqK)zQut=7q%n-lGOra(Mvzz41k>_IO+hZsYrGm{&iOy`Z=sZ+wmA9>q1Cb_{I3 zaF=l|b^T3}ix>TIqAw|Aghq2^Wkt>w+b?vd$ORs|F4w0V+4;DU=N_9Rr%4~1J}h=D zo1r?@EXCh%1WRH-KhR2I&wk+Nng$2XaXbyv+r$h)m%E}MvL`m6j~*wg|Kz~w=~72n zKmaqFSo&N;liYlP8lSS^X2h^|9*srrdyVv+*gc)eOL~kSc01wo_PM9AtM|vmPmSTF zj- zLNZJV1MHXOC})TI<{Io-MzP;f8BF7+tEg{r&Omk#;DH)4SEPt32b1wz{UdvFJ7Y%1 zbH8ZxtsaO@MGbR)g-NsL2d_*b26&8YCRE^<0cNrT*0L%KiR#|yffb)ku_dLRbfo&s zRlhxM&5wBBBynmPcEH=((3?2cP?%C_JW0FaBKt*2b^0^!n8AXfCPH4a>fY_U<{O)MXr6lt$?B#bOyfKh~GBA^toS2u4@Yg?Frr60fCP5@ zgD(7$0)cpdG&#r0OSXxky;2r3c#M8K&=o+ z9%KzjN01M|UO+2=&=|m8z=1-5q&1+$1!!prw6_6TxB+|F0C}(PNAdzv*1v0l{gf6$ zYWa^K1^|3?;7Z&9iNqe+5Bh*ami-{^9|=Gb0L%a|27s6suz3P$tiSXJG7tM+gX|M~ zpdP7H5s?3=Z;?7N{^&&z;Oi|x?!X2G+FJtUw#c?mka-HE1QbNy$8^Lr&AzhCkXy~xb3dViGtyLyrBk$RExANx^!pw`;i5(WdT!p7Dw zE?M(Fxhh3F)VoF|#Um|Fw>`E%!IVPju?sfkU4k4U0W7v?0r^XXk5#4K`s7D?X`a4| z4aZ>`jtQXH%Hi@A44k~5V?(hmP;yypgQlG03~78(boD$49H$1`4Qw>useT9d3D z!8e#!H>!@0>t@?oL)enCC)9FP2Xq%EQ+d8btnUi8`#&Ks7`T?+ZOBD*6P%erBn(TY z3K?!!EwxsD%ch%~xzY2E(FTiyj8c?TOm%kQ1DA-tW6x;aLD90BcmA9Go35mCjD2}< zcMW~6Bt3)tpyo0)xsjWf)+4y)E?Bo3&~#h8a#r>T2PKkfKjMiCZhOUY8b4USIp})=3zBpr{L<8IJsIZO~twB z?JvsiKEB;7+VXfMl8flGa(0DIL-euO{ZSuJJZD=eIDsUGuh)1vM@p$E`E4((@h-~h za_D}SfYW?o&$_QG71sl)mEIbdYkayk{8{7-qoC~9=a&})Uw>5INyvP~gn13&zkK^3 zbH1>C!+PfCLWMMZFsNuWm!;s~a?j|g>A>OI`&OPdD*1h0<&q5w-e;0E#nO}_CFd%O zg&{Y1c{pDdbD6guZcHc{W`1hQ>AZ zFw&<0BYlddlD<5@s+O|gbv=20VTh=tfS$5TyqQxIgytR`|BSeL%A(BB`7UfiCW{G(76<&zb@f`)Xx^ONSd{$;PDTJ;};LTtBH5CX!lL+(cLa7 zR$vGS~|cyk+e7ZMiUfYscZFx4WbFO;!}gD8PwP4+jz^Llff+QXizK zMkjv=rO&?aAx}O8y~Fu36H7Cem>MD?BrN11yqiL|IAu$5=GusF)X_mW%;n7O(Ad|; z(AD&@Syw+T&&kHZ%94ev*U7=o!r9ru!RnT)6)i`vla;fDr32BD)#z|b-d$%&c3yNC zIlCOXPFl?CsD}^do9?K-M1xg@#EFb~8TvcgycpPNnUte7)wia;w))PqL{MuheaGj0 zY45h{w})trvm0FC|!xU3zPZY!qD@kyRnL&qGG9Qg{|Hi zc?EI^b>P!FpRg@fg&i&Q5Z4xTt9{an*F6i_PxEN0RwwS79MKlI`C^zl*f4*6ttms3 z$}Ca9**Q~iu(Ltoj_y|K9JIAvdVt=X+1|>|#=?}rV$PlgpFrB=GL;Y&sR!q@RaijG z_~WZ36%-O8Z6YzShg!`}GCq&gry$%#7xg``3%Gr?tnd zmIL$83Mk2nicdEuXReqYe|}z6`8Abyiu%@ZVenu=qmyXg{L$c(8{$soT<=`oAtWm8 zrt6O0OG@z(;7fGWuewomU8}1TJfTD6GmaWp{I?` zs`1BhySNuYFZksr97TG#b}y%oC;OW7FrB=vb7+Oa!{d0WJq?1+(keo}$kjxJ!4}jj z!=q$^KSfYqTq~UX()HZV6jAp{`fzjhunX5y&OC50ZBmlorRFI1>q#NcE4rf8oxBP+ z^`Yy{oXWlyH88AYGIY$s*OXE!EK6*|yWN8=9T3Mh{Y+k?+Wg$<#n#N)!;GT^(f6Gv z?O;BNK1$Z~(Rjq)xB=|n~NFrIA7nVO7=7H!%0NEf#oC^&P!#u z%@Zp|XheTTe!fJ%U04{DI5|k;d~TBs`xa?(W1N5V{q;wD%l2a#Ym(PJ)@SucW!tJN znU98_jR`hrglz3)w>-ei*Y%fRxC%`@7C4?AgzFdGe7C;uxuz6iSakeociAx#b|Ss} zx?9n&UTIh3K4Oy(R()eKO)xxgcjeVrW80E^1oUF4ziou&Rq4nyhTmsOKYWUWz3==! z;7e}&>YFv?wN#ar^z;QZm0fx@weLVcZCf(9v)L*=!ZQST7nne=6!aJrQZh7Ly7{t| zCYu_y;i8=DpZ8SH8!nOH8tUb)P$oxvv!N9)JyqtpIGFS?aSgV~ztXwWs5_1iqJ5nH zEa|0bn1;p1n5YK3N}4hYm7-5JZi5xG9Ru5WTT9$U7^`|{lsg+m4MQp@|${O}S#Vf<)l-HR^Qf#JQ0<@-?~ zw_l*SmN&vIZty#7Q0DGVGmMVgMIxll1h>v{AK@{Rlm{5};nu%~YxRDb3^Xy#?!NuD zw3+laDKh{Hickok5I`Y-LI8yT3IP-XC(z|n1ra*4QfJB5s0La#P8X^Zxjw@`&l^{6NDZP zCI(IfjE5Eu27~(N9*L2pSM8ZY%6r&zO-zJWEGLgZiX3KHG<-_PyT`iBapYQ8nf2FL#ikbO+&4qFWN*DzkZh!W$aInOD2<}&NFs<^7QL_RulR@6@l4+Hq zZ;fvf7WjA-C7N;|dU{2Sdk5!yBe^z%@a8YHT}Tn%HYTf zKb7o@8bynt7KFkXS5|V@crFz>B`BB9p4kQ!&t%r%;z$a4lrpY92qSZ_ove5IM4bQ5 z$)CI6Xk_v=h`+-gtsX%sa%;*1M?puSWWv_l*gI4yB!{%i1N~6MqxxvNcZkht(QIMxJbZ#T7~foFX9y!7_TyXHfqHro#=j z*xs_oc26XpR@F=UCkq#+eU6HM6P}A)a78YB5^lolk&Bv0A^;2s2jK6km4J+08km0C zInB37uNz&~A64_r++lu`V&VZAP8jI@B}VIyg>vk}`bpB{dqE6On=Jbp8fu12_k{Y^ z#}6tYsE9w$=~Vtj`c8(#v4$1!W!l(RS9_e0-S-}%HRAY8oRN~uxzawTh`I_r(^vQ`uj#1_Y>My@^Ate0Je#; z*?(!XBgo+dP@{w1W)G0=1o#f{4G14l_CImW=)h1!{N|cZ0OS{bxaP4yure-BruHwE z{P$iK>6#@W;zCjo2t*750bH{%GAsUj7D6dR4k7)`pX2@T=TPB)+0pMH_deh<8M!Z# z99AYCIIcYH62!zc4cKz}rqrc69E;}S>otRu*x56-x#slc@_XyYF5$qTnb>vNlQO;noaUbBb$h*RAP=B(*A7ha~0 zrjEL|01v#db0;U+oHB55#E9QQS)#KWT(g$a?IkOaes`$+!B_T^tSqK*LII`qjMqlo zK@=F*&e?=kHg{gI<|}TOZB-R`Why(SYE-Y*5?qfLrCpAI(WHjSd;Fbqmg_OB7FHz{ zU#sG`dk()Jr_*=R0SRt(f8ZX0?BC$ykft_@t^XUM13X6IRz z8h%998PPSS18Fs@S8u1ONk<=pTzz>#TK%N+Dfl^dd^pcrW+SQs-i7PBji_85VUo|iXYhT4ZNWdCvGfp z?6DYy&V&|}TvTVLq$^N!L?jf{B^_RCiora58C|tS%fDwo+)}f-?4)l$$-qpoY8S=Z zG^@~sApas^>UPUSCU-3_>}Ng5%+fW5|-N7#Etd`FDj zZ;U+6t7b%qXlmQM&ai0!vq2ybAy=?Lpi2P9x@93h#sg6T=7EWty`W|<|KDdXfGvQi z0scNyL8gJv4X{!74%EE^4Eq0m??9Ra(lovkkS^n^*60csEP~{#@Z^Xe6Y3D|nj?)5nIITsGnvt&d7uwd^l><13r{pzg-vGeH?bLDJmJ&mZvDEa6-zX(TH$lN zSZo}t0pcKyLSR>XDQ6dreKE1Fa^(XEiV2wrveH{xlIy_lM^ApSe)*Eaf?`>(GlJQz zy342zGj$gxq5b5nGfa#p&N5MTl>B)RR+90Ld+DzaHxU7TUS6s;LeObfDNuTA&A zsW;GU8VnpFK6=xRcU}O4FF%27$(XH-+VSG(%&z2*Rr&|D&0D=WZXPVXX9+$~GURlO z9DWG0kXT#PGFpMwx|Y&)NDtCcwp_YR;VVaTReB9)YkONZ#-BO48AGtWYi-%}#`zka zUvKpdaB{)eb;DLr?_+vw9dXz-26f@f`{ zgKvW{r@lq*kVRk2MaUp9K9F(kTpP^RaCW2VnMmKi^>Bll^8#-QEC_!yCSP06tH0Y7 zN}v!xA%H>vg#Zcx6apv&Pzaz9Kp}ua0ENK+0)Zdv{PH^LEP9UiELWY~tesdyg>}@y zXcRzH){lPx_&GKm`40eprGM~$0KY2vIbfOmFB(FDmnMG`)Q(hu2l~fx&421B1ztq{ zHOl$dgZ~_dhK&9ElRALNw4WkDe>D6N3h`^0+Mf*#fiwHNptWB${2HM3r-lsRO#ZtD oAYAKL6~D$~{HbD__$L)VMQ7-!V*=L&yrKoRCgeiK6=d$e0K8B3F8}}l literal 0 HcmV?d00001 diff --git a/core/tests/coretests/res/raw/install_app1_cert6 b/core/tests/coretests/res/raw/install_app1_cert6 new file mode 100644 index 0000000000000000000000000000000000000000..256e03a2de54997dcac284f78bc7c138b7d2889a GIT binary patch literal 12760 zcmeHOcT^Nhv!5mB-~y6CkRS*w8AL!N3kXP7GLj`H$w5Ja1SJR}ASgKsk~2s~5G11n z$t=1A$zk8DUheh!zWbf;yuaRihniDc)!kDyv%j9I)4N@xri6|`2H=2)Pk6{x;1_}d z7=W|63(q|hPX{+w9y=3jd+z&o_fEP2Ao$4}rB*eP_C`zUb9TW*L`+0|OkCVV_8AYP zn=_ZKA}DAcD=KDaIj$4CxH_*BJB^edct>NHk@!UOc=fl>yBdqbXg1ATyNt$LCD*?o<-!y!VM5`*Lw z*X%Y@mZ$b1p15vQ)fI*l?s~x%6FOInbc_+-y( zaWTAdR6`bIVl)XFDK)!&pF^THOzrcyQmPH!xlUfVBGc75H4Nb&tN#=j6t#0TNew=B zo@xss(HzDrmj%D?7u_JjRp4N@ryg0!)?_s2wea1~x{%_AfrfKdyB>V>KvREMGH06@ zxr{U_mhBpUZeA(qIpVcYI}v$8K5bpsBd}*fJgugLjbl3;&@To7fI2h)Q2RId1AvtM zU1taDyDBF3))wY2t|3v|o*pReu;qCyob0eywV2i6zuyh!dqGFnkX^(U_5@C=cD(T zT@l0MnQO}Z%ew-f!iHGCx?Ew-^Ie)m4sht)osdUhdKrihn2F2J#VWa>dzXFD#}*NN z)|u=+Q(bY;mKRdnB79^LxXanr*cUt2Sddh%J4v-GT5*6 zyMa_=>4!%*B@Swi9iu7SY_)avp{BDqeure=V&w(XG)Ic}{HPLgGJfyAq#ru!dGSRP z+(LlQ%Xf^Q&kNp_^~aT5LCx$BPcFac zyeKdKFNhWdA07NAj-W(gkD3QfP@?)yiTzXoB>~8^AY*`txq^o?sAK(YK2U9!A0wza zu>{9aK4n1pPjid%iSg$w0${E;0UW`@2(&i=`^{0dXe0p14`1L1NT@a$N`j1feozEK zgZ+6ORG$FIsC)f)g!9KBD1UtAQ@^Oj?|x7F{!_mwdz4?4{O3H1500AMGjVYNqvEdl z{m6KgP^cnVhml*2Sd!C=NcE1#`O^AivI%zBX_#Lb;TQ(e z>NbbczMcF)l<_%YMA{qrRqMPLC5__|oof?86^4Ca#|&LgQ!&=f0L~fWb&NWU;%1t4 ziX&nl44xoT7?$>fZDZ&dCQ(4^OpfK|ps1Gt&X8n6=Fk)eu*&KRBZQ`QDr$D{<_7u z4^ln1HV(geCmsJ7>%|T7ih#c?fU1BEGJ4e z?Y&tMD;Z%qyK;vfSGTyn;Jwm%8}~vlY_4fgwCs(gL=>GuhsD7-&vL)Nl>Zym;(iN+ z1_I8o46i&msGsh*;LjA7K5-*caX@`;GMQs7Wc52whvzeB{(wSCk2V|89Y|U#5uZyu zh5t~8Vu_ht1(SMa8vK0~-CZn}bL0Y~f{N2~&20Rd*6&B_cMBJ9xaGawxnoZ%N!Oo) za8%Z0i__4`^J#r^Lvr}e)zuKTnTuv^T9iG;+4tm}f`C|3)u$YhzU|qpnajF|dHrJ^ z5j&)C#+h4ra62L2I<#J z&L=O#PA;Zj6fP$-6&)wl$K_zDb{?#=FU@ zOO1BAxou|)-miMtQ?NygF7?&8*hi(PBA!2*qT><&`buKnJGWPED<& zHe1jDH=DXMS9S$4=u+DJ=A*BxZC1Q>nTIBgDx%UWOv4`H1~BY^XBRhhDG??C|u zX(Gs|oT4JDDaECDQ;z4Bh7=bcOhANNL(VSBz_tZO8H~U`Ca(Tu{6^d9dUHfhTS8u0 zIK#L>g3SBdAD>5$AHdnZjKzJfr=407wY=c|lrmpL-zih}0{V>b^CEt=7nFU*jSW~c zxQbbL&8Y^Kq!$>7+M;aH*<`}MF5m!4$8#@9T2((GqN0bQ=J(vHiMMW2?dV&gJ6x41 z!{Fx5e1Z9L8*QR!?uv%<45Z5Uh@EEmLL(=BfXqNmRIdI)uJwo#^R`n1hxw+II$~7X zB|~tOust7JqFqBssU<~i>*0&($Nn61yWt;iWclB3D}NSSQ_?O*asfF$t5TM9K58dh zBfN|>Rkt5rz?|opfe;VY`d<2wU4?;6?|b=p#iep~d^?|Z@;-G=qDx#GS{sBvv)U<+ z-cd+|1h@tW0-5|@;s^rDZ)KWmHaBFmWp&us)7kg-Wf;pe$jM<(24W@yVk5PZqmvZF zCMP3J9va2H-dUOv7xn3Z_vrSpdCGBX_`UDNz&{UVwD-BcReyoV|9OZ}YU z%GC=jyCSSAYh$zBp5=Ut*m!m%G+tk~Yrl5L{>)nm&*NcgUiIz6J|k)0 z_MOcS7gOIwtG+EbuRFqXKi5KcVoA^`OW$nt-ePN+?V2b>?x95LsF1@-+qO$JUKCk( zD?`q$P-C<}f*53bAXJzxk zYCAK3wg%UJkxiBVo0sU8Ygpmbr-Yv5gJ}+=Vac_kFrEJG;kx))YC)#U^vF1ZH2=Li z8K?N3>_~>nV(uhFg6O2>QiS+bDPPv7{S)CV7Q$C3_;~sGVBAEob^aJktkla45tI?3 z$Kxd_a;ZTUJe6?Pyo00Fibe+hfot>^3wxPN7)KbH`d;6;tmeQwd287%;fqCkg#z8U z4?2AenhAwAx`kXj(n`IX0MCX6_kCe9&$pxlMPup24?6(`&G)qT=#78{rtE#uz32J zeBbOsb>g=zi*tvgjwxxS)OT7UzEn)}FUF3!6wLF~nm}KP!9I(kZ-oV-jmSj3V2jx# zwK*`iHod!CWjkmG-+j;HW__bGGtPXXR~SLfzg76j!^0LibTcL1PihKZ4Xkv(?m6gd2};&+*e_8$(GKU}=XZJ97#IB{98t(z)J4PZ zD|uu#+H10J9Jl_^YQ#@x^#y z3JPtDzSSF^EaLm_3j3{+#S72uV|wQnRmFRZ96L`AdX@4YM}2~gQ#tHO)-Ef`Bs5jb z6N-=IMvVC#6I{KW=yPayNb|=s>NMd9TYAjyfQjbz?}=MQ>ZYQctcE7Hikw}ais}Ox z(7qvtJDo27o^Of(?;<^rEv-Q-os_C<*K;{tcCw{O6(PX7`ej@3r12^VuC_+z5_x>M z8xva5LZTeUrNOw~*cF#`uBEQ6CiQWAfGQ#7d0du$pt3Q1OhB1g{)HSPg^c^-CWnvI zp0?BreC|u<@6|FemFRmPRCKrOZfppsDDVr7_HyZ*(6lT`64^hwrK$HY3R}F;P2ypa z^qw@d#3a-xFR1uFAAYz|{p)V~fuZe*#n3Q+zt?E?rA;ozx4Ep~8+=q-s4wM(n{(_$^e3LMrR0|A#jGk83JbroFQb{*=^@aGfGSJq%#Q25$oZ=!6t`4GuHb`*O2o{8P2n&MDy+lWYprPRc zW8M%sT#htV7$FueM~FhmE+GVhj|sq_yreK89bkeZdG9#?Vhl!qTnqrWmAzI;g^M93|> znwqP_?n8#5aKgm9w7&KFLY~a#n~lnR*EBinWaaARI)YnK0#u73E|kfEQch^#Btl-P z!EVCnK=9~@Feos{B;RXS^C^-FtyFTEuqYoyNKWfNfia+lnK39~6ai%C(YRbl{6&&Q z&%tdjltDuDF4H-{2v8?LF)(515D4;D%)u!IF^2$5l$XlO2I}HBNlLWORjS!^iW@c% z8q>(tdCzgt=259Kb1aJvJw4YI(mkdIYcpt2>Y%JiK_7!%&$=ii8!UyFi@SHcA7nuC zx|{VQ(Q#ap@{7n1z(d0Z-Rse&b-+0@8>2Ac4+drJB?`{Yvy}lUx`nXHa1+uHspTXj zRXv|fGjs63TS_6~ref>&#-m140r|z3l$gn>^KV!qWAf|c_7qwoF!!>;D>taPwk?O= z)vPbtYFbXxG7v0VgmJb^OLrroYr^^tHhS`JV-{6DYVik(Std$%GRI7FS$$TABRuq8 z5E2YnDz81o-qyLiPsjdN$JwxQil2zGuHE$*8@1(%+WI71M>L?eHBm$Wh7b7~8oQ5Fs_0ob~s*f!JU+ zowdnIUo8pcNZjyo65)gl%Vgptv%l7S_sjAR%50(RQ0>}8$OlqCO*M{CcUqSCrK;=b zdJN+V?|9aTZao)Oq{4X+euH|2E@b?=%!ySy`JD(##w!7`H3uhdB2M*+Gz+}3Y*nvs zR!>t0BwM&~9_)SV9uwWX^HGKNIP21p;c$QUAh%1a(^2nJ0jzoUSE1j^zv6A=vR}-F zQZ36TQuZCC?-R1};Lj}VG`egS1d{+dep%#g?-7Rs)$6A145=07Ggbc5`whF5NLG7R z5QDRr{ZC@{G&wg}X{?_nXX&%#e3qQglJoy0Ia7kk7>Pup%9DUo{rBV?fh)g#aUG6` zN3))-xT%*J<(XjVMIIX_Pr4NYWto_*D6(1ZeU-+n`&OY7 z#h@U8*Fl8FvaY%%HcH~J@x?4Esxz%6)cZ*U857lYvTLd5Zq?RHs@Am_HVL<0)ASNE z9YMCv)fLNs-IMj;6Qy5Ds>~}3=Fd{02_bAIg21M%G%~O%>+}tPUu)A* zZvgzA{^5Oq-<|wgunhg1hX8QR|1XN#Q4a8cf39o(%SQ>g?EQO{^Y0h`wGItc`}r4j zf|Y5%RDzxwo>n{jUZ(b!p*DDD|Eg&1cMrc8X#M3O6}*%G?g1><`rXCvB^Q6WAO_2G a|8((70fw3qCiuMo02@47KzIQds`X#t9 zlB1G`k=x_mp6&7ObMC$0d;h$5ss3tegu8c|H6K~sx=b1;zkRuWV)9^;;Xoi$;j*B*N?NdJf6R>@ z{qAWX#0F30B4+6fQSB{k7v8A*qWaki_UD_}xES8Ik|zpmt96)H$vIPmqEm?#Yr~x<*?Y6jHEm7{ivr&#O}!Q& z`U-8-j(TbO>mFu0{;N~c0d!JrvDF1{{1&fY81THae4d>(#1yy7<^YCEAT{>QL7~{* z+Mx^g5R0>oI<;i}=<@O0>$3XzSyi#AOaKwTmNbCOtF++q*X~HAbuPAEGxRk+%^H?F z$vH*TQL;O`Kb{<3FkegBa+5eV4SlgAFfdbeITTY*6BjS0W)dj_0f1Tz0MPq49RL9G zUJfvCR|jodFIOi=xF5O$q8>JQk;#ML?|ojd`*07RoXhNP1O~J3&AS+V7kEk4n6XI* zg_^>Z%lMHF(L6F(?Cd1+O(F~U20K{fy9-ropATV+pEB#ys=b}+Qzyrj3T_y)zqnU# zl*?=JG5{MvCId*@Fwuv5&qzx`BcW#nHSep&MMevQRjn(u-=&MsqwRURezL&C*x=hF8SdXAYEcgH*j z_QlKL{3FVBDmNQWsOpFY#<`Z0)>s-$#uOLQ^58L{MShzPtOZftrgQTs$sgn8ox#S; z7C2sZvHln@1V7AF12ouV)4MKY;J>7W z(OUk$AbJpdOz=v4K#9g4-48~fM3?;}uAd1|5`s(*G8TxKAGpE5G|oTu2RaY`QG@Oi zXRscvQwfy+s&COcvHsDE0O;&(0UvO)2HV?$<&NmK80UfWKXidVAffZ*XbCcU{GbVf z0sY5u&}E_^qtEr<5#FDbp!{*kKlP$Bzw7;3_TSZuZjaWBmjBw1o&#&`J#67{&?+1p z1LKpl?~<#Mf3V*3JLoD|le$;aQ~0hcrs<+xEYrofyH3%PP*NeN8nMt9Eys<@7r_}N z3=J3QnqqP1*_o@js+ZL-2kxGSCD6;{-^Hp86qZ-&Vy5;!GBvG~mR@fYJ*ly(J6Ihm zS}h#m_r30e?3vu{Li(=WKUc&gckFdK>D{((IUcsQdn+1QWi7iC?R0n9!`?J{eO^IA zN2P)O1RrLD$qMV;RF%HFk7q%$;s1L2U2n^1_1V!(JF5)j*qU!Ddp z&}DWU>5RQH@(SVDO3jYWKTtsi$b93UBgnzGQ0z%>^|e_^|2+C_>jQDFy$EW8^jK4K zS@2+G@AG=tY8c8s3}s^7aDbFt*dlVw-`96F@Eg2`sZDWR(cf!abPHxDMq2>?yxMBZ zJ0l_@?^M!XcyKIJAxydVy~f*Vzm7^+O@Bh=OpL)7TtoVTb9npzzXh%3pTAUNO@+Y z>62^u+lP>f_2#nGo{SnWLrvz#i409iSq9DTvW*j?=U#Eknp#MtBbXyk&dP7uPA%Q(r+v+`g~1+?_51dO0!Syf4BH7U_etBnNM<*Y~+*^)ZXxd z5nIh$2Ht@D_sF+&WL{ug*N>) z(~Ou@(^FR1uv{?(1)1RpS*hKL{{~BuuDfmDLh-5gDF%9SvwbHc#}c&UL7bmP3E<%Y z=$n;?@P)55psl8WjCL*B%0}}1>N+Zd28Qzd!cb930Yeqfd)nR+SICtQ*iLXCdyYYx zj+N&kSUQZ93%DvbRTkCtQ(T=J6%b+3o&#<*A=N=k6LinbDY#L0cf*ZBI=;vU~`%%g7oE%V)e zTO$;kvc!nXzACv`1%~+of%zdJGZAbmYl{@;oToNJ+U(f2Bu`t;C8(&lSy8I!80>$# zS4g{lsTg^!$MdH++HoXQP!Sa&^e<`_?)xM`LMZPo=i} z7FH^#vy<`d`n$58udWA*T}%@~6eN12(yv7qe50MiHs@LClgzu5uWf#p>Xq}g$}IF~ zt-p;}wW8xp>9HNlZ8aPX`8v53T%VnBLohaZ(zGT6r>B?adG5G)KlM z4M)dO)e76aG4%^!7ivF8&*mu9<%g9T}=nmqp5yN`#(noh4b`t~a7rFN9i@tkg(0pQI zu%g&ED8`-C9kp8wDMS@fkQSGmY>!V}u{@s3DX!c|(Fd+V);c%EvQaVRRi z0(&LSx$_R9i_OR5*Yung{g>~C!^Yw>PF6%&W5BP3R7 zbvLGEjviQ=ER=q4&d2`5$?;9lahd8%N_yy|3>){z+7*;Z(+Lw@RSLV3U)cl+>67$4 zZ*O{7&rs;9v0P6l1w)%@fI7i?dhngPvNl`PY_4{a;FjjOF4W;BaZz8S#;0W1IICZ` z@>(Y9+_J<5mkj8@iU!@Q89q|EZpl<#%CFTjO?&pW)-vX*tx@Gb--hY^i6tpSeUN-F z$5i393f6m+!BkT2Frypk46VFW^&3x)@3eETS$$d4t=aWv{Af9StZumQUa7T{Un0~Z zGs&JUXiq+RZFk;dP8rW!w6Dj>qfXp<6+ z?*X;#i(S#+WWVB!h^pM0a@87qzm^y(7i1t)b{X5%*a(mQ5RU4m9j znog@yrTJdrW{tRoqaJdlN0Kv#!tE| zxTEL4T;+cOd)}FUZRL4~*VYaCep`Uxy7rK{oIq=jcdUzf(#ZUqrLBP+x?u~3m<3Zo zE=h*r&__D=KW~4!uc&48n4ZRSu^b^++J;&!EUsncIw);XmDkZN17Io(UsZHJ?s)}2 z>=yCM^CPIl*>ZIICOG$F-Uz{Q%Od;bK`8 z7^`6iFp)yv?2_t~VeWk1CMvq_SDa|ce%jq5V%F0?6L5#K<9RmAy{p}{!C#)my^@T1 z*js+*DS0%>TP_Im{sk2CJm1x_wGS9z7eaFMpgK?n5N`%zEJ`eLDhz)3d4y!zCDJuF z<_gGdb3O)dC=5TbV=!@`DQLLjHVVh(mFh&gze1BatG5erl=G?PmZ zUN?^vkZDV}?TJ?~M;s2Sf~d_QI!r2AeQSBZyvBKPT#G9Ru()1~3^JEMrzK@@F*zo=pfM34C;q#zctJoCA!dFtEOvoXE zI0%zAY(ZHEB`_YYX~gxEKXyu%NU5rq3Q7_#NuP_p_c|gEz21sm_axfhs{i@&h!8X& zJdl4ZR)W&4M}cabw(OP!vRBrcxZnQ#(5eKMuG)ror_Ait{1H!vZHbvLc!UNzTxBUu zmefnbn7U96S&KJE-4PJ!GFM5U1sC<29Tp+%O40J>ie>RymD@yQ^Lz7JTpw>6qIV3> z74AI7Qz|JwDKbki#z+WkZpAY@EIywp?qx`q8ldmJVbwrTXx4q27W{;vZT@_+2$Ads z4c4f%4c8Bm!+}xX3-f2@)hRYM;}1WiVLX!L_4FWGxkDBIfvBLQY0A`X?28&=UsnLR zLMoWO$b}&+618pp_HkO^n>#0M4fS(6>p&}%b$$IqaJIkvLl!mZsN1j{9L_u=VVwFY zxU>in8wZF1Xq#s?`(N7Z5PCR))aYWk-3_KYK)wb31%wYQ`=7XGOmHZk{^6RDAoBA+ zUGr!NLu*d&PZS_MQFX zSU>i9OI@1%MAd-!$!l8{N>jPMZ;d-chr%{>xj0j*0*vhlZFd%Uq_Zv|vQ{{R{O@Tz zNM*bklZM%n7Al9A&8a<~c{?+&uQY?er`4BflW(|kE18~bob5(th#Yuze}fg7 zmBkoAB%r*SSzyW)N{*%WokeJA`&%w^q0-m#ovI?grz);#TGh+7ga-FSX%=t8snc%C z`~IDCmg_dD7FNF?zEZ_+%dT}CD>rTV;QxYiW})V;tmvyv`g*?1gtSV}t^Kl9J&_Ha zN^QtIKYbyME-TOSrNM`!9k)A2^`P&s)oXsBuF1e0g(^H}6IYIsCn&%_L>)z3JD=Oh zF+hxZ)Tosn-wQ-q)tf2Yx2pw6?cJ=SC3>$_w3VsBV6#=>8D_=MsuSHF9#geL!@uV|*jlr_ z=x*dZPR~TR>=e!0JgwMyO13Ux>Fs8&`Z{4zd%#%arnGa4VmoWXG{4KF{@PZ6c{&kc zpR?BbL)<-6z9R;%*QPM5swoj->e@Cx6fQMrHm9ejh%2}NAOmuoca}8hivSAHJh0DZ zFK4rt|LwCE&=vqHkblfn&}r~L2DoSUj6??9Ub+BAL;m@en5*6NH9EQS`U z=C#Jux-!#w1iX|~uzJ>N>GTB4eulvB`>yr3D{HErb~pwyTzJ7HfbPdT>2PTY;A zl^^2nJGXw7c!PXYmQt}xaI|o6a*YEpAeE|(L_`MZv#g{Q!ULrxJ}yWzCpt2Wxm|PA z@e;_7A?cQ%EGNCA#{R*{dJ{+KB_kAzbn0o$NIuXsK^KoFHlM7`ENnh?x0%HlE16I0 zJ`_I7fQ_Hv;g)C(Wkf->#tZv<8sGVRj)Jw*4WUoP&>mfU*y`)^k#x-(GzcSryotey+!vNw%_NW7(nOu;p)ku?6GJZ zJA*v~_fBefiSJUFWO(%?-L-g9B(;ITT9H*?o7C|0F|0 zg`m`(F5icWp`vq4GhvK!noaEug`7~Oj&X`J!;O=qGA+Jm%}!OH3X+KaTMsv9b6)UG zfeq0g#uVTPQ~1-a&cqo4X9%1jaE8Dc0%r)EA#jGk83JbroFQGzbGoKrwPFz2cxlmegWXu&~)?{0REZ&#rFVySMqDTGTA?AxCy>A`J0$_ zv;qR)UxzjSrK22t5&6$S&c7f0*Z4DZ=;vS50Y;?#5(xUU;m`Po-^0`XYG?(X+1~}L z{jTBnsI0#<6o6;)pEZCnTEDCKJqY736)2KlRQwW>p{I!rUKjX^7TlWA3mI3?x&Hvn CdHn(a literal 0 HcmV?d00001 diff --git a/core/tests/coretests/src/android/content/pm/PackageManagerTests.java b/core/tests/coretests/src/android/content/pm/PackageManagerTests.java index ed2436a269d90..79cb1f9f85f9d 100644 --- a/core/tests/coretests/src/android/content/pm/PackageManagerTests.java +++ b/core/tests/coretests/src/android/content/pm/PackageManagerTests.java @@ -1830,27 +1830,35 @@ public class PackageManagerTests extends AndroidTestCase { * The following series of tests are related to upgrading apps with * different certificates. */ - private int APP1_UNSIGNED = R.raw.install_app1_unsigned; + private static final int APP1_UNSIGNED = R.raw.install_app1_unsigned; - private int APP1_CERT1 = R.raw.install_app1_cert1; + private static final int APP1_CERT1 = R.raw.install_app1_cert1; - private int APP1_CERT2 = R.raw.install_app1_cert2; + private static final int APP1_CERT2 = R.raw.install_app1_cert2; - private int APP1_CERT1_CERT2 = R.raw.install_app1_cert1_cert2; + private static final int APP1_CERT1_CERT2 = R.raw.install_app1_cert1_cert2; - private int APP1_CERT3_CERT4 = R.raw.install_app1_cert3_cert4; + private static final int APP1_CERT3_CERT4 = R.raw.install_app1_cert3_cert4; - private int APP1_CERT3 = R.raw.install_app1_cert3; + private static final int APP1_CERT3 = R.raw.install_app1_cert3; - private int APP2_UNSIGNED = R.raw.install_app2_unsigned; + private static final int APP1_CERT5 = R.raw.install_app1_cert5; - private int APP2_CERT1 = R.raw.install_app2_cert1; + private static final int APP1_CERT5_ROTATED_CERT6 = R.raw.install_app1_cert5_rotated_cert6; - private int APP2_CERT2 = R.raw.install_app2_cert2; + private static final int APP1_CERT6 = R.raw.install_app1_cert6; - private int APP2_CERT1_CERT2 = R.raw.install_app2_cert1_cert2; + private static final int APP2_UNSIGNED = R.raw.install_app2_unsigned; - private int APP2_CERT3 = R.raw.install_app2_cert3; + private static final int APP2_CERT1 = R.raw.install_app2_cert1; + + private static final int APP2_CERT2 = R.raw.install_app2_cert2; + + private static final int APP2_CERT1_CERT2 = R.raw.install_app2_cert1_cert2; + + private static final int APP2_CERT3 = R.raw.install_app2_cert3; + + private static final int APP2_CERT5_ROTATED_CERT6 = R.raw.install_app2_cert5_rotated_cert6; private InstallParams replaceCerts(int apk1, int apk2, boolean cleanUp, boolean fail, int retCode) throws Exception { @@ -2472,6 +2480,26 @@ public class PackageManagerTests extends AndroidTestCase { } } + @LargeTest + public void testCheckSignaturesRotatedAgainstOriginal() throws Exception { + // checkSignatures should be backwards compatible with pre-rotation behavior; this test + // verifies that an app signed with a rotated key results in a signature match with an app + // signed with the original key in the lineage. + int apk1 = APP1_CERT5; + int apk2 = APP2_CERT5_ROTATED_CERT6; + checkSignatures(apk1, apk2, PackageManager.SIGNATURE_MATCH); + } + + @LargeTest + public void testCheckSignaturesRotatedAgainstRotated() throws Exception { + // checkSignatures should be successful when both apps have been signed with the same + // rotated key since the initial signature comparison between the two apps should + // return a match. + int apk1 = APP1_CERT5_ROTATED_CERT6; + int apk2 = APP2_CERT5_ROTATED_CERT6; + checkSignatures(apk1, apk2, PackageManager.SIGNATURE_MATCH); + } + @LargeTest public void testInstallNoCertificates() throws Exception { int apk1 = APP1_UNSIGNED; diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index f693555d97619..c51cbe73e9e57 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -5934,8 +5934,25 @@ public class PackageManagerService extends IPackageManager.Stub || shouldFilterApplicationLocked(ps2, callingUid, callingUserId)) { return PackageManager.SIGNATURE_UNKNOWN_PACKAGE; } - return compareSignatures(p1.getSigningDetails().signatures, - p2.getSigningDetails().signatures); + SigningDetails p1SigningDetails = p1.getSigningDetails(); + SigningDetails p2SigningDetails = p2.getSigningDetails(); + int result = compareSignatures(p1SigningDetails.signatures, + p2SigningDetails.signatures); + // To support backwards compatibility with clients of this API expecting pre-key + // rotation results if either of the packages has a signing lineage the oldest signer + // in the lineage is used for signature verification. + if (result != PackageManager.SIGNATURE_MATCH && ( + p1SigningDetails.hasPastSigningCertificates() + || p2SigningDetails.hasPastSigningCertificates())) { + Signature[] p1Signatures = p1SigningDetails.hasPastSigningCertificates() + ? new Signature[]{p1SigningDetails.pastSigningCertificates[0]} + : p1SigningDetails.signatures; + Signature[] p2Signatures = p2SigningDetails.hasPastSigningCertificates() + ? new Signature[]{p2SigningDetails.pastSigningCertificates[0]} + : p2SigningDetails.signatures; + result = compareSignatures(p1Signatures, p2Signatures); + } + return result; } }