[go: nahoru, domu]

Add PackageInfoCompat signature verification APIs

Create methods for retrieving the Signature[] for a package on device,
as well as verifying that a package has a set of certificates.

Checking by app UID is not supported. Callers must use package name.
This is done to ensure the system doesn't arbitrarily choose a package
to check against.

A matchExact parameter is provided to address compatibility for
un-patched devices that are affected by the certificate reference fake
ID vulnerability. For such devices, all certificates of the package
being checked must be verified.

Bug: 159831205

Test: androidx.core.content.pm.PackageInfoCompatSignaturesTest
Test: androidx.core.content.pm.PackageInfoCompatTest

Relnote: "Added PackageInfoCompat#getSignatures for retrieving the
    certificate array for a package"
Relnote: "Added PackageInfoCompat#hasSignatures for verifying package
    ceritificates"

Change-Id: I8e9a3ece2d45416abbcbaaa0cf2a0485180997d3
diff --git a/settings.gradle b/settings.gradle
index b19943d..fe0f50a 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -560,6 +560,7 @@
 includeProject(":internal-testutils-navigation", "testutils/testutils-navigation", [BuildType.MAIN, BuildType.FLAN])
 includeProject(":internal-testutils-paging", "testutils/testutils-paging", [BuildType.MAIN])
 includeProject(":internal-testutils-gradle-plugin", "testutils/testutils-gradle-plugin", [BuildType.MAIN, BuildType.FLAN])
+includeProject(":internal-testutils-mockito", "testutils/testutils-mockito", [BuildType.MAIN])
 
 /////////////////////////////
 //