Merge "Merge "MODULE_HASH documentation" into main am: 20c23d9312 am: 72e779ee2d" into main

2 files changed, 6 insertions, 2 deletions

diff --git a/core/java/android/content/pm/PackageManager.java b/core/java/android/content/pm/PackageManager.java
index c16582f19c9b..8c7e93a834b7 100644
--- a/core/java/android/content/pm/PackageManager.java
+++ b/core/java/android/content/pm/PackageManager.java
@@ -4649,6 +4649,7 @@ public abstract class PackageManager {
      * the Android Keystore backed by an isolated execution environment. The version indicates
      * which features are implemented in the isolated execution environment:
      * <ul>
+     * <li>400: Inclusion of module information (via tag MODULE_HASH) in the attestation record.
      * <li>300: Ability to include a second IMEI in the ID attestation record, see
      * {@link android.app.admin.DevicePolicyManager#ID_TYPE_IMEI}.
      * <li>200: Hardware support for Curve 25519 (including both Ed25519 signature generation and
@@ -4682,6 +4683,7 @@ public abstract class PackageManager {
      * StrongBox</a>. If this feature has a version, the version number indicates which features are
      * implemented in StrongBox:
      * <ul>
+     * <li>400: Inclusion of module information (via tag MODULE_HASH) in the attestation record.
      * <li>300: Ability to include a second IMEI in the ID attestation record, see
      * {@link android.app.admin.DevicePolicyManager#ID_TYPE_IMEI}.
      * <li>200: No new features for StrongBox (the Android Keystore environment backed by an
diff --git a/keystore/java/android/security/keystore/KeyStoreManager.java b/keystore/java/android/security/keystore/KeyStoreManager.java
index 740ccb53a691..13f1a72469c2 100644
--- a/keystore/java/android/security/keystore/KeyStoreManager.java
+++ b/keystore/java/android/security/keystore/KeyStoreManager.java
@@ -312,9 +312,11 @@ public final class KeyStoreManager {
      * When passed into getSupplementaryAttestationInfo, getSupplementaryAttestationInfo returns the
      * DER-encoded structure corresponding to the `Modules` schema described in the KeyMint HAL's
      * KeyCreationResult.aidl. The SHA-256 hash of this encoded structure is what's included with
-     * the tag in attestations.
+     * the tag in attestations. To ensure the returned encoded structure is the one attested to,
+     * clients should verify its SHA-256 hash matches the one in the attestation. Note that the
+     * returned structure can vary between boots.
      */
-    // TODO(b/369375199): Replace with Tag.MODULE_HASH when flagging is removed.
+    // TODO(b/380020528): Replace with Tag.MODULE_HASH when KeyMint V4 is frozen.
     public static final int MODULE_HASH = TagType.BYTES | 724;
 
     /**