tree cceebdf7885d8b9bd4724ccae1b51c70ecf369c2
parent 4592c6e980d355a793e3bcb5f8b6e87cb17ca44d
author Michael Groover <mpgroover@google.com> 1621909835 -0700
committer Michael Groover <mpgroover@google.com> 1623282179 -0700

Add initial support for appending signatures to an APK

The V1 and V2 signature schemes support multiple signers, but
currently apksig does not support appending a V1 or V2 signature
to an already signed APK. This commit adds the initial support to
append a V1 / V2 signature to an already signed APK through one of
the following options:
- The --append-signature option when signing via apksigner
- ApkSigner.Builder#setOtherSignersSignaturePreserved(true) when
  using the apksig Java API
These options can also be used when an APK has additional key / value
attribute blocks within the APK signing block; using the same signing
config will overwrite the existing signatures while preserving these
additional blocks.

Note, when an APK has multiple V1 and V2 signatures one signer must
sign the APK multiple times since another signer appending their
V1 signature will invalidate an existing V2 signature. The following
process will allow two signers, A and B, to sign an APK with V1 and
V2 signatures:
1. A signs the APK with a V1 and V2 signature; this will add the
   stripping protection attribute to A's V1 signature.
2. B uses one of the append options listed above to sign the APK
   with a V1 and V2 signature. This will invalidate A's V2
   signature since V2 is a whole APK signature scheme and B's V1
   signature will modify the APK, but A's V1 signature will still
   be valid.
3. A uses one of the append options listed above to sign the APK
   with a V2 signature. This will overwrite A's previous V2
   signature using the updated contents of the APK and append
   this signature to B's existing signature in the V2 signature
   block.

Bug: 186395570
Test: gradlew build
Change-Id: I8ad2f21e111dcdc5e2c41695439794afba9cc1de
Merged-In: I8ad2f21e111dcdc5e2c41695439794afba9cc1de