apksigner cannot decrypt some keystores with non-ASCII passwords which were created using keytool and which work fine with jarsigner [37135737]

Fixed

Bug

[AOSP] assigned

Status Update

No update yet.

Description

kl...@google.com

created issue #1

Feb 14, 2017 02:30AM

apksigner uses standard Java JCA KeyStore API for loading password-encrypted key material from keystores. The API operates on passwords provided as Unicode characters (Java type: char[]). Weirdly enough, it appears that when Sun/Oracle keytool is provided with password via console/stdin keytool uses the console's/stdin's native encoding of the password, where each input byte is upcast into char. When the password is passed in as a command-line parameter, the password's Unicode representation is used as expected.

For example, on Windows 10 with English US as the UI language, the console/stdin uses IMB437 as the character encoding. Assuming the six character password "ab¡äю1" (0x0061 0x0062 0x00a1 0x00e4 0x044e 0x0031 in big-endian hexadecimal representation):
$ keytool -genkey -v -keystore native.jks -keyalg RSA -keysize 2048 -validity 10000 -alias test
generates a keystore and key protected with 0x0061 0x0062 0x00ad 0x0084 0x003f 0x0031
whereas
$ keytool -genkey -v -keystore native.jks -keyalg RSA -keysize 2048 -validity 10000 -alias test -storepass ab¡äю1
generates a keystore and key protected with 0x0061 0x0062 0x00a1 0x00e4 0x003f 0x0031

The same command-lines on modern Linux/OSX which these days use UTF-8 by default for console produces keystores encrypted using:
0x0061 0x0062 0x00c2 0x00a1 0x00c3 0x00a4 0x00d1 0x008e 0x0031
and
0x0061 0x0062 0x00a1 0x00e4 0x044e 0x0031
respectively.

This weird behavior might be a remnant of the early days of Java where there was no Console (which automatically provides Unicode characters as input and thus has a concept of character encoding of standard input) nor a standard concept of character encoding for standard input. jarsigner appears to follow the same behavior, potentially to remain compatible with old keystores from those days and with current versions of keytool.

To complicate matters, keytool is not the only means of creating keystores which are used for signing APKs. For example, Android Studio offers this functionality as well. Thus, apksigner needs to try both the password represented as Unicode characters as well as the password represented as the form encoded according to the console's character encoding.

Comments

kl...@google.com <kl...@google.com> #2Feb 15, 2017 08:35PM

A workaround is to use Java 8.

kl...@google.com <kl...@google.com> #3Mar 7, 2017 05:29AM

Project: platform/tools/apksig
Branch: master

commit 3222d6c8a40307c4912ab80d666dcb6846840dea
Author: Alex Klyubin <klyubin@google.com>
Date: Tue May 02 14:39:54 2017

Add first batch of tests for ApkVerifier

These tests are based on Android Package Manager CTS tests. See
cts/hostsidetests/appsecurity/src/android/appsecurity/cts/PkgInstallSignatureVerificationTest.java

Test: bazel test ...
Test: gradlew test
Bug: 37137869
Change-Id: I9a077283600271a0efa0ef3e5d271918711df66c

M BUILD
M src/test/java/com/android/apksig/AllTests.java
A src/test/java/com/android/apksig/ApkVerifierTest.java
A src/test/resources/com/android/apksig/dsa-1024.pk8
A src/test/resources/com/android/apksig/dsa-1024.x509.pem
A src/test/resources/com/android/apksig/dsa-2048.pk8
A src/test/resources/com/android/apksig/dsa-2048.x509.pem
A src/test/resources/com/android/apksig/dsa-3072.pk8
A src/test/resources/com/android/apksig/dsa-3072.x509.pem
A src/test/resources/com/android/apksig/ec-p256.pk8
A src/test/resources/com/android/apksig/ec-p256.x509.pem
A src/test/resources/com/android/apksig/ec-p384.pk8
A src/test/resources/com/android/apksig/ec-p384.x509.pem
A src/test/resources/com/android/apksig/ec-p521.pk8
A src/test/resources/com/android/apksig/ec-p521.x509.pem
A src/test/resources/com/android/apksig/empty-unsigned.apk
A src/test/resources/com/android/apksig/original.apk
A src/test/resources/com/android/apksig/rsa-1024.pk8
A src/test/resources/com/android/apksig/rsa-1024.x509.pem
A src/test/resources/com/android/apksig/rsa-16384.pk8
A src/test/resources/com/android/apksig/rsa-16384.x509.pem
A src/test/resources/com/android/apksig/rsa-2048.pk8
A src/test/resources/com/android/apksig/rsa-2048.x509.pem
A src/test/resources/com/android/apksig/rsa-3072.pk8
A src/test/resources/com/android/apksig/rsa-3072.x509.pem
A src/test/resources/com/android/apksig/rsa-4096.pk8
A src/test/resources/com/android/apksig/rsa-4096.x509.pem
A src/test/resources/com/android/apksig/rsa-8192.pk8
A src/test/resources/com/android/apksig/rsa-8192.x509.pem
A src/test/resources/com/android/apksig/two-signers-second-signer-v2-broken.apk
A src/test/resources/com/android/apksig/two-signers.apk
A src/test/resources/com/android/apksig/unsigned-ephemeral.apk
A src/test/resources/com/android/apksig/v1-only-empty.apk
A src/test/resources/com/android/apksig/v1-only-ephemeral.apk
A src/test/resources/com/android/apksig/v1-only-max-sized-eocd-comment.apk
A src/test/resources/com/android/apksig/v1-only-pkcs7-cert-bag-first-cert-not-used.apk
A src/test/resources/com/android/apksig/v1-only-two-signers.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-1024-cert-not-der.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-8192.apk
A src/test/resources/com/android/apksig/v1-v2-ephemeral.apk
A src/test/resources/com/android/apksig/v1-with-apk-sig-block-but-without-apk-sig-scheme-v2-block.apk
A src/test/resources/com/android/apksig/v2-only-apk-sig-block-size-mismatch.apk
A src/test/resources/com/android/apksig/v2-only-cert-and-public-key-mismatch.apk
A src/test/resources/com/android/apksig/v2-only-empty.apk
A src/test/resources/com/android/apksig/v2-only-ephemeral.apk
A src/test/resources/com/android/apksig/v2-only-garbage-between-cd-and-eocd.apk
A src/test/resources/com/android/apksig/v2-only-max-sized-eocd-comment.apk
A src/test/resources/com/android/apksig/v2-only-missing-classes.dex.apk
A src/test/resources/com/android/apksig/v2-only-no-certs-in-sig.apk
A src/test/resources/com/android/apksig/v2-only-signatures-and-digests-block-mismatch.apk
A src/test/resources/com/android/apksig/v2-only-truncated-cd.apk
A src/test/resources/com/android/apksig/v2-only-two-signers-second-signer-no-sig.apk
A src/test/resources/com/android/apksig/v2-only-two-signers-second-signer-no-supported-sig.apk
A src/test/resources/com/android/apksig/v2-only-two-signers.apk
A src/test/resources/com/android/apksig/v2-only-unknown-pair-in-apk-sig-block.apk
A src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-1024-sig-does-not-verify.apk
A src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-1024.apk
A src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-2048.apk
A src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-3072.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256-digest-mismatch.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256-sig-does-not-verify.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p384.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p521.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p256.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p384.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p521.apk
A src/test/resources/com/android/apksig/v2-only-with-ignorable-unsupported-sig-algs.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-1024-cert-not-der.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-1024.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-16384.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-2048-sig-does-not-verify.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-2048.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-3072.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-4096.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-8192.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-1024.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-16384.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-2048.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-3072.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-4096-digest-mismatch.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-4096.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-8192.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-1024.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-16384.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-2048-sig-does-not-verify.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-2048.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-3072.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-4096.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-8192.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-16384.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-2048.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-3072.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-4096.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-8192.apk
A src/test/resources/com/android/apksig/v2-only-wrong-apk-sig-block-magic.apk
A src/test/resources/com/android/apksig/v2-stripped-with-ignorable-signing-schemes.apk
A src/test/resources/com/android/apksig/v2-stripped.apk

https://android-review.googlesource.com/387374

https://goto.google.com/android-sha1/3222d6c8a40307c4912ab80d666dcb6846840dea

kl...@google.com <kl...@google.com> #4Apr 24, 2017 06:17PM

FYI it seems to be possible to temporarily break open the encapsulation of internal modules via a javac 9 via command line flags:

--add-exports java.base/sun.security.pkcs=ALL-UNNAMED --add-exports java.base/sun.security.x509=ALL-UNNAMED

Yesterday when building without the flag, javac failed with:

Exception in thread "main" java.lang.IllegalAccessError: class com.android.apksig.internal.apk.v1.V1SchemeSigner (in unnamed module @0x64f6106c) cannot access class sun.security.x509.AlgorithmId (in module java.base) because module java.base does not export sun.security.x509 to unnamed module @0x64f6106c
at [...]

It seems like the option is not allowed when setting --target 1.8:

javac: option --add-exports not allowed with target 1.8

(I thought I had been running with --target 1.8 yesterday as well, but *shrug*).

So tools/apksig/Android.mk probably needs those flags when building for version 53 class files (OpenJDK 9).

cb...@google.com <cb...@google.com> Apr 24, 2017 06:18PM

Marked as fixed.

as...@gmail.com <as...@gmail.com> #5Jul 24, 2017 09:31AM

I just ran into the issue again but not for make apksig{,ner} so it must be some other build target that triggers the failure when building with -target 1.8.

Sadly, the order in which build targets are built doesn't seem to be deterministic and there are other issues, so I'l not sure what target was failing.

ap...@google.com <ap...@google.com> #6Aug 9, 2017 04:24PM

Silly me, the issue is not when *building* apksigner but when *running* it (as part of building some other targets). I think the bug had already realized this but I hadn't :)

Here's the exception I'm getting:
Exception in thread "main" java.lang.IllegalAccessError: class com.android.apksig.internal.apk.v1.V1SchemeSigner (in unnamed module @0x4e718207) cannot access class sun.security.x509.AlgorithmId (in module java.base) because module java.base does not export sun.security.x509 to unnamed module @0x4e718207
at com.android.apksig.internal.apk.v1.V1SchemeSigner.getSupportedAlgorithmId(V1SchemeSigner.java:623)
at com.android.apksig.internal.apk.v1.V1SchemeSigner.<clinit>(V1SchemeSigner.java:539)
at com.android.apksig.DefaultApkSignerEngine.<init>(DefaultApkSignerEngine.java:148)
at com.android.apksig.DefaultApkSignerEngine.<init>(DefaultApkSignerEngine.java:51)
at com.android.apksig.DefaultApkSignerEngine$Builder.build(DefaultApkSignerEngine.java:901)
at com.android.signapk.SignApk.main(SignApk.java:1060)

ap...@google.com <ap...@google.com> #7Aug 9, 2017 09:29PM

signapk, which is what's currently used by the build system to sign APKs, is using apksig library to sign APK. So, the above failure is expected on Java 9.