apksigner produce an Exception with PKCS#11 KeyStore on Windows [37140484]

Fixed

Bug

[AOSP] win

[AOSP] assigned

Status Update

No update yet.

Description

lo...@gmail.com

created issue #1

Mar 24, 2017 08:10AM

*****************************************************************
***** *****
***** !!!! THIS BUG TRACKER IS FOR GERRIT CODE REVIEW !!!! *****
***** *****
***** DO NOT SUBMIT BUGS FOR CHROME, ANDROID, CYANOGENMOD, *****
***** INTERNAL ISSUES WITH YOUR COMPANY'S GERRIT SETUP, ETC.*****
***** *****
***** THOSE ISSUES BELONG IN DIFFERENT ISSUE TRACKERS *****
***** *****
*****************************************************************

Affected Version:

What steps will reproduce the problem?
1.Use the native KeyStore from Windows
2.User a certificate witch need an USE-eToken
3.callapksigner with those parameters:
@("sign",
"--ks", "$easyTokenSignCrtPath",
"--ks-type", "PKCS11",
"--ks-pass", "file:$apkSignerPwPath",
"--ks-provider-class", "sun.security.pkcs11.SunPKCS11",
"--ks-provider-arg", "C:\PROGRA~1\Java\jdk1.8.0_121\bin\eToken.cfg",
"--ks-key-alias", "my alias",
"$scrDir\$toSign")

What is the expected output?
apk file should be sign, all those parameters are working with jarsigner, on the same computer

What do you see instead?

Please provide any additional information below.
- Windows Server 2016
- JDK 1.8.0_121
- eToken works with jarsigner on the same Computer, parameters are:
$jarSignerParams=@(
"-keystore","NONE",
"-storepass", "$STOREPASS",
"-storetype", "PKCS11",
"-tsa", "

http://timestamp.globalsign.com/scripts/timestamp.dll",
"-providerclass", "sun.security.pkcs11.SunPKCS11",
"-providerArg", "$JDK_PATH\bin\eToken.cfg"
"$scrDir\$toSignJarsigner",
"my alias")

As far as I could analyse, {KeyStore}.engineLoad() should not be called will 'null' as parameter, which is done in apksigner

https://android.googlesource.com/platform/tools/apksig/+/master/src/apksigner/java/com/android/apksigner/ApkSignerTool.java#628

https://github.com/frohoff/jdk8u-jdk/blob/master/src/share/classes/sun/security/pkcs11/P11KeyStore.java#L790

Regards, Éric

Comments

kl...@google.com <kl...@google.com> #2Mar 25, 2017 07:28PM

Assigned to kl...@google.com.

A workaround is to use Java 8.

kl...@google.com <kl...@google.com> #3Mar 25, 2017 07:56PM

Project: platform/tools/apksig
Branch: master

commit 3222d6c8a40307c4912ab80d666dcb6846840dea
Author: Alex Klyubin <klyubin@google.com>
Date: Tue May 02 14:39:54 2017

Add first batch of tests for ApkVerifier

These tests are based on Android Package Manager CTS tests. See
cts/hostsidetests/appsecurity/src/android/appsecurity/cts/PkgInstallSignatureVerificationTest.java

Test: bazel test ...
Test: gradlew test
Bug: 37137869
Change-Id: I9a077283600271a0efa0ef3e5d271918711df66c

M BUILD
M src/test/java/com/android/apksig/AllTests.java
A src/test/java/com/android/apksig/ApkVerifierTest.java
A src/test/resources/com/android/apksig/dsa-1024.pk8
A src/test/resources/com/android/apksig/dsa-1024.x509.pem
A src/test/resources/com/android/apksig/dsa-2048.pk8
A src/test/resources/com/android/apksig/dsa-2048.x509.pem
A src/test/resources/com/android/apksig/dsa-3072.pk8
A src/test/resources/com/android/apksig/dsa-3072.x509.pem
A src/test/resources/com/android/apksig/ec-p256.pk8
A src/test/resources/com/android/apksig/ec-p256.x509.pem
A src/test/resources/com/android/apksig/ec-p384.pk8
A src/test/resources/com/android/apksig/ec-p384.x509.pem
A src/test/resources/com/android/apksig/ec-p521.pk8
A src/test/resources/com/android/apksig/ec-p521.x509.pem
A src/test/resources/com/android/apksig/empty-unsigned.apk
A src/test/resources/com/android/apksig/original.apk
A src/test/resources/com/android/apksig/rsa-1024.pk8
A src/test/resources/com/android/apksig/rsa-1024.x509.pem
A src/test/resources/com/android/apksig/rsa-16384.pk8
A src/test/resources/com/android/apksig/rsa-16384.x509.pem
A src/test/resources/com/android/apksig/rsa-2048.pk8
A src/test/resources/com/android/apksig/rsa-2048.x509.pem
A src/test/resources/com/android/apksig/rsa-3072.pk8
A src/test/resources/com/android/apksig/rsa-3072.x509.pem
A src/test/resources/com/android/apksig/rsa-4096.pk8
A src/test/resources/com/android/apksig/rsa-4096.x509.pem
A src/test/resources/com/android/apksig/rsa-8192.pk8
A src/test/resources/com/android/apksig/rsa-8192.x509.pem
A src/test/resources/com/android/apksig/two-signers-second-signer-v2-broken.apk
A src/test/resources/com/android/apksig/two-signers.apk
A src/test/resources/com/android/apksig/unsigned-ephemeral.apk
A src/test/resources/com/android/apksig/v1-only-empty.apk
A src/test/resources/com/android/apksig/v1-only-ephemeral.apk
A src/test/resources/com/android/apksig/v1-only-max-sized-eocd-comment.apk
A src/test/resources/com/android/apksig/v1-only-pkcs7-cert-bag-first-cert-not-used.apk
A src/test/resources/com/android/apksig/v1-only-two-signers.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p256.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p384.apk
A src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p521.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-1024-cert-not-der.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-8192.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-1024.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-16384.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-2048.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-3072.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-4096.apk
A src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-8192.apk
A src/test/resources/com/android/apksig/v1-v2-ephemeral.apk
A src/test/resources/com/android/apksig/v1-with-apk-sig-block-but-without-apk-sig-scheme-v2-block.apk
A src/test/resources/com/android/apksig/v2-only-apk-sig-block-size-mismatch.apk
A src/test/resources/com/android/apksig/v2-only-cert-and-public-key-mismatch.apk
A src/test/resources/com/android/apksig/v2-only-empty.apk
A src/test/resources/com/android/apksig/v2-only-ephemeral.apk
A src/test/resources/com/android/apksig/v2-only-garbage-between-cd-and-eocd.apk
A src/test/resources/com/android/apksig/v2-only-max-sized-eocd-comment.apk
A src/test/resources/com/android/apksig/v2-only-missing-classes.dex.apk
A src/test/resources/com/android/apksig/v2-only-no-certs-in-sig.apk
A src/test/resources/com/android/apksig/v2-only-signatures-and-digests-block-mismatch.apk
A src/test/resources/com/android/apksig/v2-only-truncated-cd.apk
A src/test/resources/com/android/apksig/v2-only-two-signers-second-signer-no-sig.apk
A src/test/resources/com/android/apksig/v2-only-two-signers-second-signer-no-supported-sig.apk
A src/test/resources/com/android/apksig/v2-only-two-signers.apk
A src/test/resources/com/android/apksig/v2-only-unknown-pair-in-apk-sig-block.apk
A src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-1024-sig-does-not-verify.apk
A src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-1024.apk
A src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-2048.apk
A src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-3072.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256-digest-mismatch.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256-sig-does-not-verify.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p384.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p521.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p256.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p384.apk
A src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p521.apk
A src/test/resources/com/android/apksig/v2-only-with-ignorable-unsupported-sig-algs.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-1024-cert-not-der.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-1024.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-16384.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-2048-sig-does-not-verify.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-2048.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-3072.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-4096.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-8192.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-1024.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-16384.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-2048.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-3072.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-4096-digest-mismatch.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-4096.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-8192.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-1024.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-16384.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-2048-sig-does-not-verify.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-2048.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-3072.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-4096.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-8192.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-16384.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-2048.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-3072.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-4096.apk
A src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-8192.apk
A src/test/resources/com/android/apksig/v2-only-wrong-apk-sig-block-magic.apk
A src/test/resources/com/android/apksig/v2-stripped-with-ignorable-signing-schemes.apk
A src/test/resources/com/android/apksig/v2-stripped.apk

https://android-review.googlesource.com/387374

https://goto.google.com/android-sha1/3222d6c8a40307c4912ab80d666dcb6846840dea

src-files.txt

2.8 KB

View

Download

e....@gmail.com <e....@gmail.com> #4Mar 27, 2017 09:28AM

FYI it seems to be possible to temporarily break open the encapsulation of internal modules via a javac 9 via command line flags:

--add-exports java.base/sun.security.pkcs=ALL-UNNAMED --add-exports java.base/sun.security.x509=ALL-UNNAMED

Yesterday when building without the flag, javac failed with:

Exception in thread "main" java.lang.IllegalAccessError: class com.android.apksig.internal.apk.v1.V1SchemeSigner (in unnamed module @0x64f6106c) cannot access class sun.security.x509.AlgorithmId (in module java.base) because module java.base does not export sun.security.x509 to unnamed module @0x64f6106c
at [...]

It seems like the option is not allowed when setting --target 1.8:

javac: option --add-exports not allowed with target 1.8

(I thought I had been running with --target 1.8 yesterday as well, but *shrug*).

So tools/apksig/Android.mk probably needs those flags when building for version 53 class files (OpenJDK 9).

kl...@google.com <kl...@google.com> #5Mar 28, 2017 03:27AM

I just ran into the issue again but not for make apksig{,ner} so it must be some other build target that triggers the failure when building with -target 1.8.

Sadly, the order in which build targets are built doesn't seem to be deterministic and there are other issues, so I'l not sure what target was failing.

lo...@gmail.com <lo...@gmail.com> #6Mar 30, 2017 08:53AM

Silly me, the issue is not when *building* apksigner but when *running* it (as part of building some other targets). I think the bug had already realized this but I hadn't :)

Here's the exception I'm getting:
Exception in thread "main" java.lang.IllegalAccessError: class com.android.apksig.internal.apk.v1.V1SchemeSigner (in unnamed module @0x4e718207) cannot access class sun.security.x509.AlgorithmId (in module java.base) because module java.base does not export sun.security.x509 to unnamed module @0x4e718207
at com.android.apksig.internal.apk.v1.V1SchemeSigner.getSupportedAlgorithmId(V1SchemeSigner.java:623)
at com.android.apksig.internal.apk.v1.V1SchemeSigner.<clinit>(V1SchemeSigner.java:539)
at com.android.apksig.DefaultApkSignerEngine.<init>(DefaultApkSignerEngine.java:148)
at com.android.apksig.DefaultApkSignerEngine.<init>(DefaultApkSignerEngine.java:51)
at com.android.apksig.DefaultApkSignerEngine$Builder.build(DefaultApkSignerEngine.java:901)
at com.android.signapk.SignApk.main(SignApk.java:1060)

kl...@google.com <kl...@google.com> #7Mar 30, 2017 03:09PM

signapk, which is what's currently used by the build system to sign APKs, is using apksig library to sign APK. So, the above failure is expected on Java 9.

kl...@google.com <kl...@google.com> #8Apr 1, 2017 10:57PM

I have pending changes that fix this. Stealing the bug.

kl...@google.com <kl...@google.com> #9Apr 1, 2017 10:58PM

Actually, my changes only *work around* the bug by passing some javac command line parameters that let apksigner still access those internal APIs. These pending changes will be sufficient for unblocking

bug 38177295

.

Should we leave this bug to cover the work to move away from those private APIs? If so, I'll assign it back to klyubin.

kl...@google.com <kl...@google.com> #10Apr 1, 2017 10:59PM

Yes, I'd prefer this to remain assigned to me to stop using sun.** API in apksig library. The workarounds you mentioned would be good to know and/or mentioned here just in case we need them very soon.

kl...@google.com <kl...@google.com> #11Apr 2, 2017 01:52AM

I believe the right workaround is to add these command line options to the "java" invocation:

--add-exports java.base/sun.security.pkcs=ALL-UNNAMED --add-exports java.base/sun.security.x509=ALL-UNNAMED

Turns out apksig is not actually part of my pending changes. Huh. I must have mis-remembered something? Maybe the -target 1.8 with which I'm running OpenJDK 9's javac also stops OpenJDK 9's java complaining in this case. If so, that also seems like a fine workaround (until we want to run with OpenJDK 9's java, which I plan to start looking into, soon, but with no specific ETA).

kl...@google.com <kl...@google.com> #12Apr 7, 2017 11:06PM

Correction: Those changes *are* part of my pending changes. But the changes are in build/make/core/

definitions.mk around line 2700, rather than in tools/apksig

I'll export a CL shortly (probably today).

e....@gmail.com <e....@gmail.com> #13Apr 10, 2017 10:02AM

I exported my CL as

http://aosp/402735 and added klyubin@ as a reviewer.

e....@gmail.com <e....@gmail.com> #14Apr 10, 2017 10:03AM

Project: platform/build
Branch: master

commit 9cc3c76abd9c8fa159616883e06526d56b5136e5
Author: Tobias Thierer <tobiast@google.com>
Date: Tue May 09 22:04:25 2017

Let signapk access internal APIs under OpenJDK 9 toolchain

signapk relies on internal APIs sun.security.{pkcs,x509},
for example in com.android.apksig.internal.apk.v1.V1SchemeSigner.

This breaks at signapk runtime under OpenJDK 9 because those
packages are not exported by the java.base module.

This CL unbreaks signapk by allowing it to access these internal
packages. In the long term, signapk should migrate away from these
internal APIs (

bug 37137869

).

Test: make ANDROID_COMPILE_WITH_JACK=false checkbuild tests \
&& make checkbuild tests
(with OpenJDK 8u45 toolchain on the PATH)
Test: make EXPERIMENTAL_USE_OPENJDK9=true \
ANDROID_COMPILE_WITH_JACK=false checkbuild
(with jdk 9-ea+170 toolchain on the PATH)

Bug: 37137869
Bug: 38177295
Change-Id: I64cab83e6eb7b135cf2ad7b523736cb409aaae02

M core/

definitions.mk

https://android-review.googlesource.com/402735

https://goto.google.com/android-sha1/9cc3c76abd9c8fa159616883e06526d56b5136e5

e....@gmail.com <e....@gmail.com> #15Apr 10, 2017 12:26PM

The CL from

comment #14

unblocks

bug 38177295

, so I'm updating this bug correspondingly.

kl...@google.com <kl...@google.com> #16Apr 11, 2017 12:41AM

Thanks, Tobias! I'll revert your change once to the build system once apksig library no longer relies on sun.** APIs.

kl...@google.com <kl...@google.com> #17Jul 25, 2017 07:34PM

Marked as fixed.

Project: platform/tools/apksig
Branch: master

commit 2ded5eb392c26eb13b96bfcec7e3517bb06eb94c
Author: Alex Klyubin <klyubin@google.com>
Date: Thu Jun 22 14:20:04 2017

Add ASN.1 BER parser

This adds an ASN.1 BER parser to be used for parsing PKCS #7 signature
blocks of APK JAR signatures. The main reason for adding the parser
instead of using Sun's/Oracle's sun.** classes is that these classes
will no longer be accessible (by default) in Java 9 and will likely no
longer be accessible at all in a later release of Java.

The parser takes a BER-encoded input and parses it into the ASN.1
structure represented as a Java object. The main entry point of the
parser is Asn1BerParser.parse.

Test: bazel test ...
Test: gradlew test
Bug: 37137869
Change-Id: I56ecef77c3e32d609a9ea00b71467ed4c11b1757

A src/main/java/com/android/apksig/internal/asn1/Asn1BerParser.java
A src/main/java/com/android/apksig/internal/asn1/Asn1Class.java
A src/main/java/com/android/apksig/internal/asn1/Asn1DecodingException.java
A src/main/java/com/android/apksig/internal/asn1/Asn1Field.java
A src/main/java/com/android/apksig/internal/asn1/Asn1OpaqueObject.java
A src/main/java/com/android/apksig/internal/asn1/Asn1TagClass.java
A src/main/java/com/android/apksig/internal/asn1/Asn1Tagging.java
A src/main/java/com/android/apksig/internal/asn1/Asn1Type.java
M src/main/java/com/android/apksig/internal/asn1/ber/BerDataValueReader.java
M src/main/java/com/android/apksig/internal/asn1/ber/BerEncoding.java
M src/main/java/com/android/apksig/internal/asn1/ber/ByteBufferBerDataValueReader.java
M src/main/java/com/android/apksig/internal/asn1/ber/InputStreamBerDataValueReader.java
A src/main/java/com/android/apksig/internal/util/ByteBufferUtils.java
M src/test/java/com/android/apksig/internal/asn1/AllTests.java
A src/test/java/com/android/apksig/internal/asn1/Asn1BerParserTest.java

https://android-review.googlesource.com/420792

https://goto.google.com/android-sha1/2ded5eb392c26eb13b96bfcec7e3517bb06eb94c

ge...@gmail.com <ge...@gmail.com> #18Dec 9, 2017 10:51PM

Project: platform/tools/apksig
Branch: master

commit 48793cefc913817a2e3aab8cd329a343c1bec636
Author: Alex Klyubin <klyubin@google.com>
Date: Mon Jun 26 09:43:01 2017

Add ASN.1 DER encoder

This adds an ASN.1 DER encoder to be used for encoding PKCS #7
signature blocks of APK JAR signatures. The main reason for adding
the encoder instead of using Sun's/Oracle's sun.** classes is that
these classes will no longer be accessible (by default) in Java 9 and
will likely no longer be accessible at all in a later release of Java.

The parser takes an annotated Java object representing an ASN.1
structure and produces the DER encoding of the object. The main entry
point of the encoder is Asn1DerEncoder.encode.

Test: bazel test ...
Test: gradlew test
Bug: 37137869
Change-Id: I2225431a1a351298ae2e47a244373aa21b16dfd4

A src/main/java/com/android/apksig/internal/asn1/Asn1DerEncoder.java
A src/main/java/com/android/apksig/internal/asn1/Asn1EncodingException.java
M src/main/java/com/android/apksig/internal/asn1/Asn1Field.java
M src/main/java/com/android/apksig/internal/asn1/ber/BerEncoding.java
M src/test/java/com/android/apksig/internal/asn1/AllTests.java
A src/test/java/com/android/apksig/internal/asn1/Asn1DerEncoderTest.java

https://android-review.googlesource.com/422919

https://goto.google.com/android-sha1/48793cefc913817a2e3aab8cd329a343c1bec636

kl...@google.com <kl...@google.com> #19Dec 9, 2017 11:19PM

Project: platform/tools/apksig
Branch: master

commit ca1bcedcf8aaa783aac3762e0e0a36c4f7f03298
Author: Alex Klyubin <klyubin@google.com>
Date: Wed Jun 28 10:24:23 2017

Handle nested indefinite length BER encoding

This fixes the ASN.1 BER parser to correctly handle nested indefinite
length encoded data values. Indefinite length encoding provides no
length estimate upfront and instead terminates the value using 0x00
0x00. As a result, contructed data values (i.e., those that contain
nested data values) must be BER-parsed to establish the correct 0x00
0x00 terminator because nested data values might be indefinite length
encoded and their 0x00 0x00 terminator could be mistaken for the outer
value's terminator. Primitive values (i.e., those that are not
constructed) cannot contain nested data values and thus must not be
BER-parsed to locate 0x00 0x00.

Test: bazel test ...
Test: gradlew test
Bug: 37137869
Change-Id: I9991dcf766d43c2b8a5560639521ff9ad9043d61

M src/main/java/com/android/apksig/internal/asn1/ber/ByteBufferBerDataValueReader.java
M src/main/java/com/android/apksig/internal/asn1/ber/InputStreamBerDataValueReader.java
M src/test/java/com/android/apksig/internal/asn1/Asn1BerParserTest.java
M src/test/java/com/android/apksig/internal/asn1/ber/BerDataValueReaderTestBase.java

https://android-review.googlesource.com/425308

https://goto.google.com/android-sha1/ca1bcedcf8aaa783aac3762e0e0a36c4f7f03298