From 1e4cbfaf5c23c8a3be92b747725d18bc31d2d1d6 Mon Sep 17 00:00:00 2001 From: Tao Bao Date: Fri, 22 Mar 2019 13:15:39 -0700 Subject: [PATCH 1/2] releasetools: Fix an issue in handling PRESIGNED APEX keys. For PRESIGNED APEXes, we should keep carrying the matching public keys at /system/etc/security/apex. Bug: 129148142 Test: Run sign_target_files_apks.py on a target_files.zip with presigned APEXes. Check the output zip. Change-Id: I2e941fd9b10e99d2db9df1e5308cbbe8c760177b (cherry picked from commit bf3fb024cd8ccbf74c0a7fdc8168792f2805089d) --- tools/releasetools/sign_target_files_apks.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py index 75a98fd5dc..2a5cd4abfe 100755 --- a/tools/releasetools/sign_target_files_apks.py +++ b/tools/releasetools/sign_target_files_apks.py @@ -600,7 +600,7 @@ def ProcessTargetFiles(input_tf_zip, output_tf_zip, misc_info, else: common.ZipWriteStr(output_tf_zip, out_info, data) - # Update APEX payload public keys. + # Copy or update APEX payload public keys. for info in input_tf_zip.infolist(): filename = info.filename if (os.path.dirname(filename) != 'SYSTEM/etc/security/apex' or @@ -609,8 +609,10 @@ def ProcessTargetFiles(input_tf_zip, output_tf_zip, misc_info, name = os.path.basename(filename) - # Skip PRESIGNED APEXes. + # Copy the keys for PRESIGNED APEXes. if name not in updated_apex_payload_keys: + data = input_tf_zip.read(filename) + common.ZipWriteStr(output_tf_zip, info, data) continue key_path = updated_apex_payload_keys[name] From ffc9a3094605b186dbd0f065b9743eb4eda29824 Mon Sep 17 00:00:00 2001 From: Tao Bao Date: Fri, 22 Mar 2019 23:16:58 -0700 Subject: [PATCH 2/2] releasetools: Fix alignment issue when signing APEXes. Previously it was following a wrong order by doing `zipalign` after calling SignApk, which effectively compromised the signature. This CL corrects the logic, and follows the same flow as in build system: - Pack APEX file; - `zipalign -f 4096`; - Call SignApk to sign the container with `-a 4096` flag. Bug: 129148142 Test: Run sign_target_files_apks.py on taimen target_files.zip. Boot the image after signing. Change-Id: I91bd3dce4f45c1891c5e122212a699f4808618fa (cherry picked from commit 0e06cb0a8b86374a259fd27811e50c0bbb28fbf8) --- tools/releasetools/common.py | 10 ++++++-- tools/releasetools/sign_target_files_apks.py | 26 ++++++++++++-------- 2 files changed, 24 insertions(+), 12 deletions(-) diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py index 34c13596c7..632c1e2c25 100644 --- a/tools/releasetools/common.py +++ b/tools/releasetools/common.py @@ -1008,7 +1008,8 @@ def GetMinSdkVersionInt(apk_name, codename_to_api_level_map): def SignFile(input_name, output_name, key, password, min_api_level=None, - codename_to_api_level_map=None, whole_file=False): + codename_to_api_level_map=None, whole_file=False, + extra_signapk_args=None): """Sign the input_name zip/jar/apk, producing output_name. Use the given key and password (the latter may be None if the key does not have a password. @@ -1023,9 +1024,14 @@ def SignFile(input_name, output_name, key, password, min_api_level=None, codename_to_api_level_map is needed to translate the codename which may be encountered as the APK's minSdkVersion. + + Caller may optionally specify extra args to be passed to SignApk, which + defaults to OPTIONS.extra_signapk_args if omitted. """ if codename_to_api_level_map is None: codename_to_api_level_map = {} + if extra_signapk_args is None: + extra_signapk_args = OPTIONS.extra_signapk_args java_library_path = os.path.join( OPTIONS.search_path, OPTIONS.signapk_shared_library_path) @@ -1033,7 +1039,7 @@ def SignFile(input_name, output_name, key, password, min_api_level=None, cmd = ([OPTIONS.java_path] + OPTIONS.java_args + ["-Djava.library.path=" + java_library_path, "-jar", os.path.join(OPTIONS.search_path, OPTIONS.signapk_path)] + - OPTIONS.extra_signapk_args) + extra_signapk_args) if whole_file: cmd.append("-w") diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py index 2a5cd4abfe..16c1840185 100755 --- a/tools/releasetools/sign_target_files_apks.py +++ b/tools/releasetools/sign_target_files_apks.py @@ -400,7 +400,6 @@ def SignApex(apex_data, payload_key, container_key, container_pw, APEX_PAYLOAD_IMAGE = 'apex_payload.img' - # Signing an APEX is a two step process. # 1. Extract and sign the APEX_PAYLOAD_IMAGE entry with the given payload_key. payload_dir = common.MakeTempDir(prefix='apex-payload-') with zipfile.ZipFile(apex_file) as apex_fd: @@ -420,21 +419,28 @@ def SignApex(apex_data, payload_key, container_key, container_pw, common.ZipWrite(apex_zip, payload_file, arcname=APEX_PAYLOAD_IMAGE) common.ZipClose(apex_zip) - # 2. Sign the overall APEX container with container_key. + # 2. Align the files at page boundary (same as in apexer). + aligned_apex = common.MakeTempFile( + prefix='apex-container-', suffix='.apex') + common.RunAndCheckOutput( + ['zipalign', '-f', '4096', apex_file, aligned_apex]) + + # 3. Sign the APEX container with container_key. signed_apex = common.MakeTempFile(prefix='apex-container-', suffix='.apex') + + # Specify the 4K alignment when calling SignApk. + extra_signapk_args = OPTIONS.extra_signapk_args[:] + extra_signapk_args.extend(['-a', '4096']) + common.SignFile( - apex_file, + aligned_apex, signed_apex, container_key, container_pw, - codename_to_api_level_map=codename_to_api_level_map) + codename_to_api_level_map=codename_to_api_level_map, + extra_signapk_args=extra_signapk_args) - signed_and_aligned_apex = common.MakeTempFile( - prefix='apex-container-', suffix='.apex') - common.RunAndCheckOutput( - ['zipalign', '-f', '4096', signed_apex, signed_and_aligned_apex]) - - return (signed_and_aligned_apex, payload_info['apex.key']) + return (signed_apex, payload_info['apex.key']) def ProcessTargetFiles(input_tf_zip, output_tf_zip, misc_info,