Fixed
Status Update
No update yet.
Comments
kl...@google.com
ap...@google.com
Project: platform/tools/apksig
Branch: master
commit 483b4735ef3b9fdf5877f282eeb85b66ca2155f0
Author: Alex Klyubin <klyubin@google.com>
Date: Mon May 22 12:23:55 2017
Fix JAR sig verification with multiple digests
This fixes a bug in ApkVerifier (and thus also in "apksigner verify")
where it would incorrectly reject APKs whose MANIFEST.MF contains
multiple digests for the same entry. Verification would fail with
ERROR: SHA-256 digest of AndroidManifest.xml does not match the digest
specified in META-INF/MANIFEST.MF. Expected:
<m5RN5FDhPTSIGRMQ0uVUXeEI+J0i51uoGsXVFFZGbnQ=>, actual:
<2jlj7l5rSw0yVb/vlWAYkK/YBwk=>
demonstrating that due to this bug ApkVerifier was comparing a SHA-1
digest to a SHA-256 digest.
This commit also adds unit tests for this issue and related issued.
Test: bazel test ...
Test: gradlew test
Bug: 38497270
Change-Id: Ifb7d44ffd59e6c2239d1d73b02e04e99a20dc09a
M src/main/java/com/android/apksig/internal/apk/v1/V1SchemeVerifier.java
M src/test/java/com/android/apksig/ApkVerifierTest.java
A src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-manifest.apk
A src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-sf.apk
A src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-manifest.apk
A src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-sf.apk
A src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf.apk
A src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sha1-sf.apk
https://android-review.googlesource.com/401294
https://goto.google.com/android-sha1/483b4735ef3b9fdf5877f282eeb85b66ca2155f0
Branch: master
commit 483b4735ef3b9fdf5877f282eeb85b66ca2155f0
Author: Alex Klyubin <klyubin@google.com>
Date: Mon May 22 12:23:55 2017
Fix JAR sig verification with multiple digests
This fixes a bug in ApkVerifier (and thus also in "apksigner verify")
where it would incorrectly reject APKs whose MANIFEST.MF contains
multiple digests for the same entry. Verification would fail with
ERROR: SHA-256 digest of AndroidManifest.xml does not match the digest
specified in META-INF/MANIFEST.MF. Expected:
<m5RN5FDhPTSIGRMQ0uVUXeEI+J0i51uoGsXVFFZGbnQ=>, actual:
<2jlj7l5rSw0yVb/vlWAYkK/YBwk=>
demonstrating that due to this bug ApkVerifier was comparing a SHA-1
digest to a SHA-256 digest.
This commit also adds unit tests for this issue and related issued.
Test: bazel test ...
Test: gradlew test
Bug: 38497270
Change-Id: Ifb7d44ffd59e6c2239d1d73b02e04e99a20dc09a
M src/main/java/com/android/apksig/internal/apk/v1/V1SchemeVerifier.java
M src/test/java/com/android/apksig/ApkVerifierTest.java
A src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-manifest.apk
A src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-sf.apk
A src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-manifest.apk
A src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-sf.apk
A src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf.apk
A src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sha1-sf.apk
ap...@google.com
Project: platform/tools/apksig
Branch: master
commit 0f88b97634034673f062a8ac6c3dab7d3d9befe3
Author: Alex Klyubin <klyubin@google.com>
Date: Thu Jun 22 09:43:22 2017
Bump apksigner version to 0.7
Changes since 0.6:
* Fixed a bug in whitespace handling in command-line parameters in
apksigner.bat.https://issuetracker.google.com/issues/38132450
* Fixed a bug in JAR signature verification when multiple digests
are present for the same named entry in MANIFEST.MF.
https://issuetracker.google.com/issues/38497270
* Honor android:targetSandboxVersion (introduced in Android O) when
verifying APKs. When android:targetSandboxVersion is set to 2 or
higher, the APK is required to be signed with APK Signature Scheme
v2.
* When signing, reject APKs with CR, LF or NUL in ZIP entry names.
Such names are not permitted by the JAR siging spec and are also
rejected by Android Package Manager.
Test: apksigner version
Bug: 38132450
Bug: 38497270
Bug: 36426653
Bug: 62211230
Change-Id: Ifa120b0e43b458c99c3da6fde1136e0cbb92caee
M src/apksigner/java/com/android/apksigner/ApkSignerTool.java
https://android-review.googlesource.com/420784
https://goto.google.com/android-sha1/0f88b97634034673f062a8ac6c3dab7d3d9befe3
Branch: master
commit 0f88b97634034673f062a8ac6c3dab7d3d9befe3
Author: Alex Klyubin <klyubin@google.com>
Date: Thu Jun 22 09:43:22 2017
Bump apksigner version to 0.7
Changes since 0.6:
* Fixed a bug in whitespace handling in command-line parameters in
apksigner.bat.
* Fixed a bug in JAR signature verification when multiple digests
are present for the same named entry in MANIFEST.MF.
* Honor android:targetSandboxVersion (introduced in Android O) when
verifying APKs. When android:targetSandboxVersion is set to 2 or
higher, the APK is required to be signed with APK Signature Scheme
v2.
* When signing, reject APKs with CR, LF or NUL in ZIP entry names.
Such names are not permitted by the JAR siging spec and are also
rejected by Android Package Manager.
Test: apksigner version
Bug: 38132450
Bug: 38497270
Bug: 36426653
Bug: 62211230
Change-Id: Ifa120b0e43b458c99c3da6fde1136e0cbb92caee
M src/apksigner/java/com/android/apksigner/ApkSignerTool.java
kl...@google.com
The fix has been released in apksigner 0.7, released as part of Android SDK Build Tools 26.0.1.
Description
ERROR: SHA-256 digest of AndroidManifest.xml does not match the digest specified in META-INF/MANIFEST.MF. Expected: <m5RN5FDhPTSIGRMQ0uVUXeEI+J0i51uoGsXVFFZGbnQ=>, actual: <2jlj7l5rSw0yVb/vlWAYkK/YBwk=>
An easy way to spot the issue is that "expected" and "actual" digests in the above error message are of different lengths.
The issue occurs only when verifying APKs for API Level / minSdkVersion 17 and lower.
I'm attaching a sample APK which exhibits this issue.