tree bf94d74e160ea0a3b5cc5c2354a81ba62c09e54e
parent b03b5c31c123365e8d2c34c3b7fd578ef7829a2d
author Michael Groover <mpgroover@google.com> 1626314807 -0700
committer Michael Groover <mpgroover@google.com> 1626314807 -0700

Add support for Conscrypt APK sig verify with negative modulus

It is possible for an APK's signing certificate to be improperly
encoded such that the RSA modulus is negative (the modulus has a
leading 1 in the encoding without a preceding zero byte to encode
the integer as positive). While many Providers can handle this and
will reencode the public key with the positive value of the modulus,
the conscrypt provider will use the OID value for the public key's
algorithm (as opposed to the expected "RSA"), and can fail when
parsing the public key during a call to Signature#initVerify. This
commit adds checks for the RSA OID value when checking the
PublicKey's algorithm, and will also attempt to reencode the public
key during the V1 signature verification if Signature#initVerify
fails with an InvalidKeyException.

Bug: 181120429
Test: gradlew test
Change-Id: Ib34abfd67f0637a45a79dd981c669b5096c1570c