From e568e0f5dfa47fc57a32de0dcfc9857c91b1c6ec Mon Sep 17 00:00:00 2001
From: Nikita Ioffe <ioffe@google.com>
Date: Fri, 1 May 2020 23:24:12 +0100
Subject: [PATCH] Collect certificates when parsing APEX packages

This is a smallest possible change to fix the breakage.

This change will introduce a boot time regression, but unfortunately
there is no easy way around it. Will try to address the regression in a
follow-up CL.

Test: atest PackageManagerTest
Test: atest android.security.cts.PackageSignatureTest#testPackageSignatures
Bug: 155396683
Change-Id: If92b8ce6236a0ef38d228d0705ae4f5345066e64
---
 .../com/android/server/pm/ApexManager.java     | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/services/core/java/com/android/server/pm/ApexManager.java b/services/core/java/com/android/server/pm/ApexManager.java
index 4872b66ff1b40..acce6992ea79d 100644
--- a/services/core/java/com/android/server/pm/ApexManager.java
+++ b/services/core/java/com/android/server/pm/ApexManager.java
@@ -32,6 +32,7 @@ import android.content.pm.PackageInstaller;
 import android.content.pm.PackageManager;
 import android.content.pm.PackageParser.PackageParserException;
 import android.content.pm.parsing.PackageInfoWithoutStateUtils;
+import android.content.pm.parsing.ParsingPackageUtils;
 import android.os.Binder;
 import android.os.Environment;
 import android.os.RemoteException;
@@ -49,6 +50,7 @@ import com.android.internal.util.IndentingPrintWriter;
 import com.android.internal.util.Preconditions;
 import com.android.server.pm.parsing.PackageParser2;
 import com.android.server.pm.parsing.pkg.AndroidPackage;
+import com.android.server.pm.parsing.pkg.ParsedPackage;
 import com.android.server.utils.TimingsTraceAndSlog;
 
 import com.google.android.collect.Lists;
@@ -480,7 +482,7 @@ public abstract class ApexManager {
             if (allPkgs.length == 0) {
                 return;
             }
-            int flags = PackageManager.GET_META_DATA
+            final int flags = PackageManager.GET_META_DATA
                     | PackageManager.GET_SIGNING_CERTIFICATES
                     | PackageManager.GET_SIGNATURES;
             ArrayMap<File, ApexInfo> parsingApexInfo = new ArrayMap<>();
@@ -489,7 +491,7 @@ public abstract class ApexManager {
 
             for (ApexInfo ai : allPkgs) {
                 File apexFile = new File(ai.modulePath);
-                parallelPackageParser.submit(apexFile, flags);
+                parallelPackageParser.submit(apexFile, 0);
                 parsingApexInfo.put(apexFile, ai);
             }
 
@@ -502,8 +504,18 @@ public abstract class ApexManager {
                 ApexInfo ai = parsingApexInfo.get(parseResult.scanFile);
 
                 if (throwable == null) {
+                    // Unfortunately, ParallelPackageParser won't collect certificates for us. We
+                    // need to manually collect them here.
+                    ParsedPackage pp = parseResult.parsedPackage;
+                    try {
+                        pp.setSigningDetails(
+                                ParsingPackageUtils.collectCertificates(pp, false));
+                    } catch (PackageParserException e) {
+                        throw new IllegalStateException(
+                                "Unable to collect certificates for " + ai.modulePath, e);
+                    }
                     final PackageInfo packageInfo = PackageInfoWithoutStateUtils.generate(
-                            parseResult.parsedPackage, ai, flags);
+                            pp, ai, flags);
                     if (packageInfo == null) {
                         throw new IllegalStateException("Unable to generate package info: "
                                 + ai.modulePath);