Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c9464144 authored by Jeongik Cha's avatar Jeongik Cha
Browse files

Check system certificate violation for product apks 

Only if enforcement option is enable, it makes build error when there is apk located at system partition but signed with system certificate.

Bug: 74699609

Test: m -j

Change-Id: I23c41f2665dd97abac3e77d1c82d81ff91b894eb
parent 10ed054a

android/config.go

+8 −0
Original line number Diff line number Diff line
@@ -950,6 +950,14 @@ func (c *config) FlattenApex() bool { 
	return Bool(c.productVariables.FlattenApex)

}



func (c *config) EnforceSystemCertificate() bool {

	return Bool(c.productVariables.EnforceSystemCertificate)

}



func (c *config) EnforceSystemCertificateWhitelist() []string {

	return c.productVariables.EnforceSystemCertificateWhitelist

}



func stringSlice(s *[]string) []string {

	if s != nil {

		return *s

android/variable.go

+3 −0
Original line number Diff line number Diff line
@@ -263,6 +263,9 @@ type productVariables struct { 
	DexpreoptGlobalConfig *string `json:",omitempty"`



	ManifestPackageNameOverrides []string `json:",omitempty"`



	EnforceSystemCertificate          *bool    `json:",omitempty"`

	EnforceSystemCertificateWhitelist []string `json:",omitempty"`

}



func boolPtr(v bool) *bool {

java/app.go

+14 −0
Original line number Diff line number Diff line
@@ -263,6 +263,20 @@ func (a *AndroidApp) generateAndroidBuildActions(ctx android.ModuleContext) { 


	packageFile := android.PathForModuleOut(ctx, "package.apk")

	CreateAppPackage(ctx, packageFile, a.exportPackage, jniJarFile, dexJarFile, certificates)



	if !a.Module.Platform() {

		certPath := a.certificate.Pem.String()

		systemCertPath := ctx.Config().DefaultAppCertificateDir(ctx).String()

		if strings.HasPrefix(certPath, systemCertPath) {

			enforceSystemCert := ctx.Config().EnforceSystemCertificate()

			whitelist := ctx.Config().EnforceSystemCertificateWhitelist()



			if enforceSystemCert && !inList(a.Module.Name(), whitelist) {

				ctx.PropertyErrorf("certificate", "The module in product partition cannot be signed with certificate in system.")

			}

		}

	}



	a.outputFile = packageFile



	bundleFile := android.PathForModuleOut(ctx, "base.zip")