Add signingInfo/signatures support in androidx.core.content.pm.PackageInfoCompat [159831205]

Fixed

Bug

Status Update

No update yet.

Description

yo...@gmail.com

created issue #1

Jun 24, 2020 11:10PM

In API 28+, PackageInfo has signingInfo and signatures is deprecated.

Add methods to PackageInfoCompat to access commonly available signature info in an API independant way.

https://developer.android.com/reference/androidx/core/content/pm/PackageInfoCompat https://developer.android.com/reference/android/content/pm/PackageInfo.html

Comments

ki...@google.com <ki...@google.com> Jun 25, 2020 04:18AM

Reassigned to sv...@google.com.

pk...@google.com <pk...@google.com> #2Jul 2, 2020 03:55PM

In particular, consider supporting an API to check if a given app has a given signature, likely using some combination of:

al...@google.com <al...@google.com> #3Jul 14, 2020 03:28PM

Reassigned to to...@google.com.

Todd, would someone from the Package Manager team be interested in contributing this feature to the core Jetpack library? We can help onboard to the Jetpack development workflow and review the code with a focus on libraries.

to...@google.com <to...@google.com> #4Jul 14, 2020 06:55PM

Reassigned to ch...@google.com.

Yeah. That sounds good. Winson should be able to look into this.

ch...@google.com <ch...@google.com> Sep 23, 2020 12:59AM

Accepted by ch...@google.com.

ap...@google.com <ap...@google.com> #5Dec 11, 2020 05:56PM

Project: platform/prebuilts/androidx/external
Branch: androidx-master-dev

commit 4899d733d629672ccf72ec2cdb41dbf26a3697a6
Author: Winson <chiuwinson@google.com>
Date: Mon Sep 28 11:35:42 2020

Add dexmaker-mockito-inline

Used for mocking final classes when there is no available alternative
to test platform APIs.

Bug: 159831205

Change-Id: Ib52e3f3c5dee75b059cc32e9924ce312f88881a2

A com/linkedin/dexmaker/dexmaker-mockito-inline/2.25.0/LICENSE
A com/linkedin/dexmaker/dexmaker-mockito-inline/2.25.0/dexmaker-mockito-inline-2.25.0-sources.jar
A com/linkedin/dexmaker/dexmaker-mockito-inline/2.25.0/dexmaker-mockito-inline-2.25.0-sources.jar.md5
A com/linkedin/dexmaker/dexmaker-mockito-inline/2.25.0/dexmaker-mockito-inline-2.25.0-sources.jar.sha1
A com/linkedin/dexmaker/dexmaker-mockito-inline/2.25.0/dexmaker-mockito-inline-2.25.0.aar
A com/linkedin/dexmaker/dexmaker-mockito-inline/2.25.0/dexmaker-mockito-inline-2.25.0.aar.md5
A com/linkedin/dexmaker/dexmaker-mockito-inline/2.25.0/dexmaker-mockito-inline-2.25.0.aar.sha1
A com/linkedin/dexmaker/dexmaker-mockito-inline/2.25.0/dexmaker-mockito-inline-2.25.0.pom
A com/linkedin/dexmaker/dexmaker-mockito-inline/2.25.0/dexmaker-mockito-inline-2.25.0.pom.md5
A com/linkedin/dexmaker/dexmaker-mockito-inline/2.25.0/dexmaker-mockito-inline-2.25.0.pom.sha1
M com/linkedin/dexmaker/dexmaker/2.25.0/LICENSE
M org/mockito/mockito-core/2.25.0/LICENSE

https://android-review.googlesource.com/1441255

ap...@google.com <ap...@google.com> #6Dec 11, 2020 05:56PM

Project: platform/frameworks/support
Branch: androidx-master-dev

commit b309cdeb976c33a91306dbc6ff7851398b4f71c6
Author: Winson <chiuwinson@google.com>
Date: Wed Sep 23 10:52:42 2020

Add PackageInfoCompat signature verification APIs

Create methods for retrieving the Signature[] for a package on device,
as well as verifying that a package has a set of certificates.

Checking by app UID is not supported. Callers must use package name.
This is done to ensure the system doesn't arbitrarily choose a package
to check against.

A matchExact parameter is provided to address compatibility for
un-patched devices that are affected by the certificate reference fake
ID vulnerability. For such devices, all certificates of the package
being checked must be verified.

Bug: 159831205

Test: androidx.core.content.pm.PackageInfoCompatSignaturesTest
Test: androidx.core.content.pm.PackageInfoCompatTest

Relnote: "Added PackageInfoCompat#getSignatures for retrieving the
certificate array for a package"
Relnote: "Added PackageInfoCompat#hasSignatures for verifying package
ceritificates"

Change-Id: I8e9a3ece2d45416abbcbaaa0cf2a0485180997d3

M buildSrc/src/main/kotlin/androidx/build/dependencies/Dependencies.kt
M core/core/api/current.txt
M core/core/api/public_plus_experimental_current.txt
M core/core/api/restricted_current.txt
M core/core/build.gradle
A core/core/src/androidTest/java/androidx/core/content/pm/PackageInfoCompatHasSignaturesTest.kt
M core/core/src/androidTest/java/androidx/core/content/pm/PackageInfoCompatTest.java
A core/core/src/androidTest/java/androidx/core/util/mockito/CustomMockMaker.kt
A core/core/src/androidTest/java/androidx/core/util/mockito/CustomStackTraceCleaner.kt
A core/core/src/androidTest/resources/mockito-extensions/org.mockito.plugins.MockMaker
A core/core/src/androidTest/resources/mockito-extensions/org.mockito.plugins.StackTraceCleaner
M core/core/src/main/java/androidx/core/content/pm/PackageInfoCompat.java
M settings.gradle
A testutils/testutils-mockito/build.gradle
A testutils/testutils-mockito/src/main/AndroidManifest.xml
A testutils/testutils-mockito/src/main/java/androidx/testutils/mockito/MockitoUtils.kt

https://android-review.googlesource.com/1439137

ch...@google.com <ch...@google.com> Dec 14, 2020 10:55PM

Marked as fixed.