diff options
| author | Michael Groover <mpgroover@google.com> | 2020-06-16 13:17:34 -0700 |
|---|---|---|
| committer | Michael Groover <mpgroover@google.com> | 2020-06-17 11:02:18 -0700 |
| commit | b71e39893596a7aa6a8733b9add83452c57b7df9 (patch) | |
| tree | 5747f7fabea08534a1f562b2d29f528cc5443245 /core/java | |
| parent | a27465258acbc7e4f0007cf2ab3d0cbfd1294893 (diff) | |
Relax minimum signature scheme version for apps on system partition
Android 11 requires a minimum V2 APK signature for apps targeting SDK
version 30+; however some apps on a system partition can only be signed
with the V1 signature scheme. This commit relaxes the minimum signature
scheme version to allow for these apps on a system partition.
Bug: 158728035
Test: atest PackageManagerTest
Test: atest PackageManagerTests
Test: atest PkgInstallSignatureVerificationTest
Change-Id: I1a95fd6894cc937e00ad1ac54d1846b51b48e9cd
Diffstat (limited to 'core/java')
| -rw-r--r-- | core/java/android/content/pm/PackageParser.java | 6 | ||||
| -rw-r--r-- | core/java/android/content/pm/parsing/ParsingPackageUtils.java | 6 |
2 files changed, 8 insertions, 4 deletions
diff --git a/core/java/android/content/pm/PackageParser.java b/core/java/android/content/pm/PackageParser.java index c8dd4d9d9d51..6dc74976a0c1 100644 --- a/core/java/android/content/pm/PackageParser.java +++ b/core/java/android/content/pm/PackageParser.java @@ -1374,9 +1374,11 @@ public class PackageParser { } SigningDetails verified; if (skipVerify) { - // systemDir APKs are already trusted, save time by not verifying + // systemDir APKs are already trusted, save time by not verifying; since the signature + // is not verified and some system apps can have their V2+ signatures stripped allow + // pulling the certs from the jar signature. verified = ApkSignatureVerifier.unsafeGetCertsWithoutVerification( - apkPath, minSignatureScheme); + apkPath, SigningDetails.SignatureSchemeVersion.JAR); } else { verified = ApkSignatureVerifier.verify(apkPath, minSignatureScheme); } diff --git a/core/java/android/content/pm/parsing/ParsingPackageUtils.java b/core/java/android/content/pm/parsing/ParsingPackageUtils.java index 317107829623..bc9c71e7a68e 100644 --- a/core/java/android/content/pm/parsing/ParsingPackageUtils.java +++ b/core/java/android/content/pm/parsing/ParsingPackageUtils.java @@ -2748,9 +2748,11 @@ public class ParsingPackageUtils { SigningDetails verified; try { if (skipVerify) { - // systemDir APKs are already trusted, save time by not verifying + // systemDir APKs are already trusted, save time by not verifying; since the + // signature is not verified and some system apps can have their V2+ signatures + // stripped allow pulling the certs from the jar signature. verified = ApkSignatureVerifier.unsafeGetCertsWithoutVerification( - baseCodePath, minSignatureScheme); + baseCodePath, SigningDetails.SignatureSchemeVersion.JAR); } else { verified = ApkSignatureVerifier.verify(baseCodePath, minSignatureScheme); } |