Merge "Verify best signature algorithms of all signers" into pi-dev (a81b3fec) · Commits · e / os / android_frameworks_base

core/java/android/util/apk/ApkSigningBlockUtils.java

+13 −6

Original line number	Diff line number	Diff line
		@@ -92,6 +92,8 @@ final class ApkSigningBlockUtils {
		throw new SecurityException("No digests provided");
		}

		boolean neverVerified = true;

		Map<Integer, byte[]> expected1MbChunkDigests = new ArrayMap<>();
		if (expectedDigests.containsKey(CONTENT_DIGEST_CHUNKED_SHA256)) {
		expected1MbChunkDigests.put(CONTENT_DIGEST_CHUNKED_SHA256,
		@@ -101,18 +103,23 @@ final class ApkSigningBlockUtils {
		expected1MbChunkDigests.put(CONTENT_DIGEST_CHUNKED_SHA512,
		expectedDigests.get(CONTENT_DIGEST_CHUNKED_SHA512));
		}

		if (expectedDigests.containsKey(CONTENT_DIGEST_VERITY_CHUNKED_SHA256)) {
		verifyIntegrityForVerityBasedAlgorithm(
		expectedDigests.get(CONTENT_DIGEST_VERITY_CHUNKED_SHA256), apk, signatureInfo);
		} else if (!expected1MbChunkDigests.isEmpty()) {
		if (!expected1MbChunkDigests.isEmpty()) {
		try {
		verifyIntegrityFor1MbChunkBasedAlgorithm(expected1MbChunkDigests, apk.getFD(),
		signatureInfo);
		neverVerified = false;
		} catch (IOException e) {
		throw new SecurityException("Cannot get FD", e);
		}
		} else {
		}

		if (expectedDigests.containsKey(CONTENT_DIGEST_VERITY_CHUNKED_SHA256)) {
		verifyIntegrityForVerityBasedAlgorithm(
		expectedDigests.get(CONTENT_DIGEST_VERITY_CHUNKED_SHA256), apk, signatureInfo);
		neverVerified = false;
		}

		if (neverVerified) {
		throw new SecurityException("No known digest exists for integrity check");
		}
		}