From 7a1de6fe81eb6d1ef0eb06f0b99b4aceeec0fe97 Mon Sep 17 00:00:00 2001
From: Alex Buynytskyy <alexbuy@google.com>
Date: Mon, 12 Jul 2021 16:53:27 -0700
Subject: [PATCH] Key rotation support when updating an app on IncFS.

Bug: 190569284
Fixes: 190569284
Test: have two apks with .idsig; adb install <original apk>; adb install <apk with rotated keys>
Change-Id: I6ff854786aea31c6e9f3f1e33be0a33b4ba67ccb
Merged-In: I6ff854786aea31c6e9f3f1e33be0a33b4ba67ccb
---
 .../java/android/util/apk/ApkSignatureVerifier.java | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/core/java/android/util/apk/ApkSignatureVerifier.java b/core/java/android/util/apk/ApkSignatureVerifier.java
index 696271c697179..73f7543ba8191 100644
--- a/core/java/android/util/apk/ApkSignatureVerifier.java
+++ b/core/java/android/util/apk/ApkSignatureVerifier.java
@@ -198,6 +198,7 @@ public class ApkSignatureVerifier {
                     ApkSignatureSchemeV4Verifier.extractCertificates(apkPath);
             Certificate[][] signerCerts = new Certificate[][]{vSigner.certs};
             Signature[] signerSigs = convertToSignatures(signerCerts);
+            Signature[] pastSignerSigs = null;
 
             if (verifyFull) {
                 Map<Integer, byte[]> nonstreamingDigests;
@@ -210,6 +211,15 @@ public class ApkSignatureVerifier {
                             ApkSignatureSchemeV3Verifier.unsafeGetCertsWithoutVerification(apkPath);
                     nonstreamingDigests = v3Signer.contentDigests;
                     nonstreamingCerts = new Certificate[][]{v3Signer.certs};
+                    if (v3Signer.por != null) {
+                        // populate proof-of-rotation information
+                        pastSignerSigs = new Signature[v3Signer.por.certs.size()];
+                        for (int i = 0; i < pastSignerSigs.length; i++) {
+                            pastSignerSigs[i] = new Signature(
+                                    v3Signer.por.certs.get(i).getEncoded());
+                            pastSignerSigs[i].setFlags(v3Signer.por.flagsList.get(i));
+                        }
+                    }
                 } catch (SignatureNotFoundException e) {
                     try {
                         ApkSignatureSchemeV2Verifier.VerifiedSigner v2Signer =
@@ -250,7 +260,8 @@ public class ApkSignatureVerifier {
             }
 
             return new SigningDetailsWithDigests(new PackageParser.SigningDetails(signerSigs,
-                    SignatureSchemeVersion.SIGNING_BLOCK_V4), vSigner.contentDigests);
+                    SignatureSchemeVersion.SIGNING_BLOCK_V4, pastSignerSigs),
+                    vSigner.contentDigests);
         } catch (SignatureNotFoundException e) {
             throw e;
         } catch (Exception e) {