diff options
| -rw-r--r-- | core/java/android/content/pm/flags.aconfig | 9 | ||||
| -rw-r--r-- | core/java/android/util/apk/ApkSignatureVerifier.java | 8 |
2 files changed, 14 insertions, 3 deletions
diff --git a/core/java/android/content/pm/flags.aconfig b/core/java/android/content/pm/flags.aconfig index e4b8c90d381d..255a08cf170f 100644 --- a/core/java/android/content/pm/flags.aconfig +++ b/core/java/android/content/pm/flags.aconfig @@ -391,3 +391,12 @@ flag { bug: "319137634" is_fixed_read_only: true } + +flag { + name: "always_load_past_certs_v4" + is_exported: true + namespace: "package_manager_service" + description: "Always read the corresponding v3/3.1 signature block for the current v4 to get the past rotated certificates, even when not verifying integrity." + bug: "378539511" + is_fixed_read_only: true +} diff --git a/core/java/android/util/apk/ApkSignatureVerifier.java b/core/java/android/util/apk/ApkSignatureVerifier.java index a4c3ed96f2ce..5910434dc692 100644 --- a/core/java/android/util/apk/ApkSignatureVerifier.java +++ b/core/java/android/util/apk/ApkSignatureVerifier.java @@ -260,9 +260,11 @@ public class ApkSignatureVerifier { Certificate[][] nonstreamingCerts = null; int v3BlockId = APK_SIGNATURE_SCHEME_DEFAULT; - // If V4 contains additional signing blocks then we need to always run v2/v3 verifier - // to figure out which block they use. - if (verifyFull || signingInfos.signingInfoBlocks.length > 0) { + // We need to always run v2/v3 verifier to figure out which block they use so we can + // return the past signers as well as the current one - the rotation chain is important + // for many callers who verify the signature origin as well as the apk integrity. + if (android.content.pm.Flags.alwaysLoadPastCertsV4() + || verifyFull || signingInfos.signingInfoBlocks.length > 0) { try { // v4 is an add-on and requires v2 or v3 signature to validate against its // certificate and digest |