diff --git a/BUILD b/BUILD
index a836f2f..915d368 100644
--- a/BUILD
+++ b/BUILD
@@ -24,9 +24,13 @@
 )
 
 java_test(
-    name = "ApkUtilsTest",
-    srcs = [
-        "src/test/java/com/android/apksig/apk/ApkUtilsTest.java",
-    ],
+    name = "all",
+    srcs = glob([
+        "src/test/java/com/android/apksig/**/*.java",
+    ]),
+    resources = glob([
+        "src/test/resources/**/*",
+    ]),
+    test_class = "com.android.apksig.AllTests",
     deps = [":apksig"],
 )
diff --git a/OWNERS b/OWNERS
new file mode 100644
index 0000000..0b8d398
--- /dev/null
+++ b/OWNERS
@@ -0,0 +1,2 @@
+cbrubaker@google.com
+klyubin@google.com
diff --git a/etc/apksigner.bat b/etc/apksigner.bat
index 024f4e1..360e142 100755
--- a/etc/apksigner.bat
+++ b/etc/apksigner.bat
@@ -59,19 +59,19 @@
 
 :firstArg
 if [%1]==[] goto endArgs
-set a=%~1
+set "a=%~1"
 
     if [%defaultXmx%]==[] goto notXmx
-    if %a:~0,5% NEQ -JXmx goto notXmx
+    if "%a:~0,5%" NEQ "-JXmx" goto notXmx
         set defaultXmx=
     :notXmx
 
     if [%defaultXss%]==[] goto notXss
-    if %a:~0,5% NEQ -JXss goto notXss
+    if "%a:~0,5%" NEQ "-JXss" goto notXss
         set defaultXss=
     :notXss
 
-    if %a:~0,2% NEQ -J goto notJ
+    if "%a:~0,2%" NEQ "-J" goto notJ
         set javaOpts=%javaOpts% -%a:~2%
         shift /1
         goto firstArg
diff --git a/src/apksigner/java/com/android/apksigner/ApkSignerTool.java b/src/apksigner/java/com/android/apksigner/ApkSignerTool.java
index 06b5603..9aed804 100644
--- a/src/apksigner/java/com/android/apksigner/ApkSignerTool.java
+++ b/src/apksigner/java/com/android/apksigner/ApkSignerTool.java
@@ -41,6 +41,7 @@
 import java.security.PrivateKey;
 import java.security.Provider;
 import java.security.PublicKey;
+import java.security.Security;
 import java.security.UnrecoverableKeyException;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateFactory;
@@ -67,7 +68,7 @@
  */
 public class ApkSignerTool {
 
-    private static final String VERSION = "0.5";
+    private static final String VERSION = "0.7";
     private static final String HELP_PAGE_GENERAL = "help.txt";
     private static final String HELP_PAGE_SIGN = "help_sign.txt";
     private static final String HELP_PAGE_VERIFY = "help_verify.txt";
@@ -122,6 +123,8 @@
         int maxSdkVersion = Integer.MAX_VALUE;
         List<SignerParams> signers = new ArrayList<>(1);
         SignerParams signerParams = new SignerParams();
+        List<ProviderInstallSpec> providers = new ArrayList<>();
+        ProviderInstallSpec providerParams = new ProviderInstallSpec();
         OptionsParser optionsParser = new OptionsParser(params);
         String optionName;
         String optionOriginalForm = null;
@@ -179,6 +182,20 @@
                 signerParams.certFile = optionsParser.getRequiredValue("Certificate file");
             } else if (("v".equals(optionName)) || ("verbose".equals(optionName))) {
                 verbose = optionsParser.getOptionalBooleanValue(true);
+            } else if ("next-provider".equals(optionName)) {
+                if (!providerParams.isEmpty()) {
+                    providers.add(providerParams);
+                    providerParams = new ProviderInstallSpec();
+                }
+            } else if ("provider-class".equals(optionName)) {
+                providerParams.className =
+                        optionsParser.getRequiredValue("JCA Provider class name");
+            } else if ("provider-arg".equals(optionName)) {
+                providerParams.constructorParam =
+                        optionsParser.getRequiredValue("JCA Provider constructor argument");
+            } else if ("provider-pos".equals(optionName)) {
+                providerParams.position =
+                        optionsParser.getRequiredIntValue("JCA Provider position");
             } else {
                 throw new ParameterException(
                         "Unsupported option: " + optionOriginalForm + ". See --help for supported"
@@ -189,6 +206,10 @@
             signers.add(signerParams);
         }
         signerParams = null;
+        if (!providerParams.isEmpty()) {
+            providers.add(providerParams);
+        }
+        providerParams = null;
 
         if (signers.isEmpty()) {
             throw new ParameterException("At least one signer must be specified");
@@ -219,6 +240,11 @@
                             + ")");
         }
 
+        // Install additional JCA Providers
+        for (ProviderInstallSpec providerInstallSpec : providers) {
+            providerInstallSpec.installProvider();
+        }
+
         List<ApkSigner.SignerConfig> signerConfigs = new ArrayList<>(signers.size());
         int signerNumber = 0;
         try (PasswordRetriever passwordRetriever = new PasswordRetriever()) {
@@ -531,6 +557,46 @@
         }
     }
 
+    private static class ProviderInstallSpec {
+        String className;
+        String constructorParam;
+        Integer position;
+
+        private boolean isEmpty() {
+            return (className == null) && (constructorParam == null) && (position == null);
+        }
+
+        private void installProvider() throws Exception {
+            if (className == null) {
+                throw new ParameterException(
+                        "JCA Provider class name (--provider-class) must be specified");
+            }
+
+            Class<?> providerClass = Class.forName(className);
+            if (!Provider.class.isAssignableFrom(providerClass)) {
+                throw new ParameterException(
+                        "JCA Provider class " + providerClass + " not subclass of "
+                                + Provider.class.getName());
+            }
+            Provider provider;
+            if (constructorParam != null) {
+                // Single-arg Provider constructor
+                provider =
+                        (Provider) providerClass.getConstructor(String.class)
+                                .newInstance(constructorParam);
+            } else {
+                // No-arg Provider constructor
+                provider = (Provider) providerClass.getConstructor().newInstance();
+            }
+
+            if (position == null) {
+                Security.addProvider(provider);
+            } else {
+                Security.insertProviderAt(provider, position);
+            }
+        }
+    }
+
     private static class SignerParams {
         String name;
 
@@ -623,17 +689,18 @@
             }
 
             // 2. Load the KeyStore
-            List<char[]> keystorePasswords = null;
-            if ("NONE".equals(keystoreFile)) {
-                ks.load(null);
-            } else {
+            List<char[]> keystorePasswords;
+            {
                 String keystorePasswordSpec =
                         (this.keystorePasswordSpec != null)
                                 ?  this.keystorePasswordSpec : PasswordRetriever.SPEC_STDIN;
                 keystorePasswords =
                         passwordRetriever.getPasswords(
                                 keystorePasswordSpec, "Keystore password for " + name);
-                loadKeyStoreFromFile(ks, keystoreFile, keystorePasswords);
+                loadKeyStoreFromFile(
+                        ks,
+                        "NONE".equals(keystoreFile) ? null : keystoreFile,
+                        keystorePasswords);
             }
 
             // 3. Load the PrivateKey and cert chain from KeyStore
@@ -725,13 +792,23 @@
             }
         }
 
+        /**
+         * Loads the password-protected keystore from storage.
+         *
+         * @param file file backing the keystore or {@code null} if the keystore is not file-backed,
+         *        for example, a PKCS #11 KeyStore.
+         */
         private static void loadKeyStoreFromFile(KeyStore ks, String file, List<char[]> passwords)
                 throws Exception {
             Exception lastFailure = null;
             for (char[] password : passwords) {
                 try {
-                    try (FileInputStream in = new FileInputStream(file)) {
-                        ks.load(in, password);
+                    if (file != null) {
+                        try (FileInputStream in = new FileInputStream(file)) {
+                            ks.load(in, password);
+                        }
+                    } else {
+                        ks.load(null, password);
                     }
                     return;
                 } catch (Exception e) {
diff --git a/src/apksigner/java/com/android/apksigner/help_sign.txt b/src/apksigner/java/com/android/apksigner/help_sign.txt
index ad865fe..11014e0 100644
--- a/src/apksigner/java/com/android/apksigner/help_sign.txt
+++ b/src/apksigner/java/com/android/apksigner/help_sign.txt
@@ -134,6 +134,25 @@
                       must be in X.509 PEM or DER format.
 
 
+        JCA PROVIDER INSTALLATION OPTIONS
+These options enable you to install additional Java Crypto Architecture (JCA)
+Providers, such PKCS #11 providers. Use --next-provider to delimit options of
+different providers. Providers are installed in the order in which they appear
+on the command-line.
+
+--provider-class      Fully-qualified class name of the JCA Provider.
+
+--provider-arg        Value to pass into the constructor of the JCA Provider
+                      class specified by --provider-class. The value is passed
+                      into the constructor as java.lang.String. By default, the
+                      no-arg provider's constructor is used.
+
+--provider-pos        Position / priority at which to install this provider in
+                      the JCA provider list. By default, the provider is
+                      installed as the lowest priority provider.
+                      See java.security.Security.insertProviderAt.
+
+
         EXAMPLES
 
 1. Sign an APK, in-place, using the one and only key in keystore release.jks:
@@ -148,3 +167,7 @@
 
 4. Sign an APK using two keys:
 $ apksigner sign --ks release.jks --next-signer --ks magic.jks app.apk
+
+5. Sign an APK using PKCS #11 JCA Provider:
+$ apksigner sign --provider-class sun.security.pkcs11.SunPKCS11 \
+    --provider-arg token.cfg --ks NONE --ks-type PKCS11 app.apk
diff --git a/src/main/java/com/android/apksig/ApkSigner.java b/src/main/java/com/android/apksig/ApkSigner.java
index 39f02db..2b7a7b6 100644
--- a/src/main/java/com/android/apksig/ApkSigner.java
+++ b/src/main/java/com/android/apksig/ApkSigner.java
@@ -690,12 +690,12 @@
     }
 
     /**
-     * Returns the minimum Android version (API Level) supported by the provided APK. This is based
-     * on the {@code android:minSdkVersion} attributes of the APK's {@code AndroidManifest.xml}.
+     * Returns the contents of the APK's {@code AndroidManifest.xml} or {@code null} if this entry
+     * is not present in the APK.
      */
-    static int getMinSdkVersionFromApk(
+    static ByteBuffer getAndroidManifestFromApk(
             List<CentralDirectoryRecord> cdRecords, DataSource lhfSection)
-                    throws IOException, MinSdkVersionException {
+                    throws IOException, ApkFormatException, ZipFormatException {
         CentralDirectoryRecord androidManifestCdRecord = null;
         for (CentralDirectoryRecord cdRecord : cdRecords) {
             if (ANDROID_MANIFEST_ZIP_ENTRY_NAME.equals(cdRecord.getName())) {
@@ -704,22 +704,30 @@
             }
         }
         if (androidManifestCdRecord == null) {
-            throw new MinSdkVersionException(
-                    "Unable to determine APK's minimum supported Android platform version"
-                            + ": APK is missing " + ANDROID_MANIFEST_ZIP_ENTRY_NAME);
+            throw new ApkFormatException("Missing " + ANDROID_MANIFEST_ZIP_ENTRY_NAME);
         }
-        byte[] androidManifest;
+
+        return ByteBuffer.wrap(
+                LocalFileRecord.getUncompressedData(
+                        lhfSection, androidManifestCdRecord, lhfSection.size()));
+    }
+
+    /**
+     * Returns the minimum Android version (API Level) supported by the provided APK. This is based
+     * on the {@code android:minSdkVersion} attributes of the APK's {@code AndroidManifest.xml}.
+     */
+    private static int getMinSdkVersionFromApk(
+            List<CentralDirectoryRecord> cdRecords, DataSource lhfSection)
+                    throws IOException, MinSdkVersionException {
+        ByteBuffer androidManifest;
         try {
-            androidManifest =
-                    LocalFileRecord.getUncompressedData(
-                            lhfSection, androidManifestCdRecord, lhfSection.size());
-        } catch (ZipFormatException e) {
+            androidManifest = getAndroidManifestFromApk(cdRecords, lhfSection);
+        } catch (ZipFormatException | ApkFormatException e) {
             throw new MinSdkVersionException(
-                    "Unable to determine APK's minimum supported Android platform version"
-                            + ": malformed ZIP entry: " + androidManifestCdRecord.getName(),
+                    "Failed to determine APK's minimum supported Android platform version",
                     e);
         }
-        return ApkUtils.getMinSdkVersionFromBinaryAndroidManifest(ByteBuffer.wrap(androidManifest));
+        return ApkUtils.getMinSdkVersionFromBinaryAndroidManifest(androidManifest);
     }
 
     /**
diff --git a/src/main/java/com/android/apksig/ApkVerifier.java b/src/main/java/com/android/apksig/ApkVerifier.java
index 8a0ffae..bf3997a 100644
--- a/src/main/java/com/android/apksig/ApkVerifier.java
+++ b/src/main/java/com/android/apksig/ApkVerifier.java
@@ -18,7 +18,7 @@
 
 import com.android.apksig.apk.ApkFormatException;
 import com.android.apksig.apk.ApkUtils;
-import com.android.apksig.apk.MinSdkVersionException;
+import com.android.apksig.internal.apk.AndroidBinXmlParser;
 import com.android.apksig.internal.apk.v1.V1SchemeVerifier;
 import com.android.apksig.internal.apk.v2.ContentDigestAlgorithm;
 import com.android.apksig.internal.apk.v2.SignatureAlgorithm;
@@ -32,6 +32,7 @@
 import java.io.File;
 import java.io.IOException;
 import java.io.RandomAccessFile;
+import java.nio.ByteBuffer;
 import java.security.NoSuchAlgorithmException;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
@@ -135,6 +136,8 @@
                                 + ")");
             }
         }
+        int maxSdkVersion = mMaxSdkVersion;
+
         ApkUtils.ZipSections zipSections;
         try {
             zipSections = ApkUtils.findZipSections(apk);
@@ -142,30 +145,6 @@
             throw new ApkFormatException("Malformed APK: not a ZIP archive", e);
         }
 
-        int minSdkVersion;
-        if (mMinSdkVersion != null) {
-            // No need to obtain minSdkVersion from the APK's AndroidManifest.xml
-            minSdkVersion = mMinSdkVersion;
-        } else {
-            // Need to obtain minSdkVersion from the APK's AndroidManifest.xml
-            List<CentralDirectoryRecord> cdRecords;
-            try {
-                cdRecords = V1SchemeVerifier.parseZipCentralDirectory(apk, zipSections);
-            } catch (ApkFormatException e) {
-                throw new MinSdkVersionException(
-                        "Unable to determine APK's minimum supported Android platform version", e);
-            }
-            minSdkVersion =
-                    ApkSigner.getMinSdkVersionFromApk(
-                            cdRecords, apk.slice(0, zipSections.getZipCentralDirectoryOffset()));
-            if (minSdkVersion > mMaxSdkVersion) {
-                throw new IllegalArgumentException(
-                        "minSdkVersion from APK (" + minSdkVersion + ") > maxSdkVersion ("
-                                + mMaxSdkVersion + ")");
-            }
-        }
-        int maxSdkVersion = mMaxSdkVersion;
-
         Result result = new Result();
 
         // Android N and newer attempts to verify APK Signature Scheme v2 signature of the APK.
@@ -186,6 +165,43 @@
             foundApkSigSchemeIds = Collections.emptySet();
         }
 
+        ByteBuffer androidManifest = null;
+
+        int minSdkVersion;
+        if (mMinSdkVersion != null) {
+            // No need to obtain minSdkVersion from the APK's AndroidManifest.xml
+            minSdkVersion = mMinSdkVersion;
+        } else {
+            // Need to obtain minSdkVersion from the APK's AndroidManifest.xml
+            if (androidManifest == null) {
+                androidManifest = getAndroidManifestFromApk(apk, zipSections);
+            }
+            minSdkVersion =
+                    ApkUtils.getMinSdkVersionFromBinaryAndroidManifest(androidManifest.slice());
+            if (minSdkVersion > mMaxSdkVersion) {
+                throw new IllegalArgumentException(
+                        "minSdkVersion from APK (" + minSdkVersion + ") > maxSdkVersion ("
+                                + mMaxSdkVersion + ")");
+            }
+        }
+
+        // Android O and newer requires that APKs targeting security sandbox version 2 and higher
+        // are signed using APK Signature Scheme v2 or newer.
+        if (maxSdkVersion >= AndroidSdkVersion.O) {
+            if (androidManifest == null) {
+                androidManifest = getAndroidManifestFromApk(apk, zipSections);
+            }
+            int targetSandboxVersion =
+                    getTargetSandboxVersionFromBinaryAndroidManifest(androidManifest.slice());
+            if (targetSandboxVersion > 1) {
+                if (foundApkSigSchemeIds.isEmpty()) {
+                    result.addError(
+                            Issue.NO_SIG_FOR_TARGET_SANDBOX_VERSION,
+                            targetSandboxVersion);
+                }
+            }
+        }
+
         // Attempt to verify the APK using JAR signing if necessary. Platforms prior to Android N
         // ignore APK Signature Scheme v2 signatures and always attempt to verify JAR signatures.
         // Android N onwards verifies JAR signatures only if no APK Signature Scheme v2 (or newer
@@ -272,6 +288,83 @@
         return result;
     }
 
+    private static ByteBuffer getAndroidManifestFromApk(
+            DataSource apk, ApkUtils.ZipSections zipSections)
+                    throws IOException, ApkFormatException {
+        List<CentralDirectoryRecord> cdRecords =
+                V1SchemeVerifier.parseZipCentralDirectory(apk, zipSections);
+        try {
+            return ApkSigner.getAndroidManifestFromApk(
+                    cdRecords,
+                    apk.slice(0, zipSections.getZipCentralDirectoryOffset()));
+        } catch (ZipFormatException e) {
+            throw new ApkFormatException("Failed to read AndroidManifest.xml", e);
+        }
+    }
+
+    /**
+     * Android resource ID of the {@code android:targetSandboxVersion} attribute in
+     * AndroidManifest.xml.
+     */
+    private static final int TARGET_SANDBOX_VERSION_ATTR_ID = 0x0101054c;
+
+    /**
+     * Returns the security sandbox version targeted by an APK with the provided
+     * {@code AndroidManifest.xml}.
+     *
+     * @param androidManifestContents contents of {@code AndroidManifest.xml} in binary Android
+     *        resource format
+     *
+     * @throws ApkFormatException if an error occurred while determining the version
+     */
+    private static int getTargetSandboxVersionFromBinaryAndroidManifest(
+            ByteBuffer androidManifestContents) throws ApkFormatException {
+        // Return the value of the android:targetSandboxVersion attribute of the top-level manifest
+        // element
+        try {
+            AndroidBinXmlParser parser = new AndroidBinXmlParser(androidManifestContents);
+            int eventType = parser.getEventType();
+            while (eventType != AndroidBinXmlParser.EVENT_END_DOCUMENT) {
+                if ((eventType == AndroidBinXmlParser.EVENT_START_ELEMENT)
+                        && (parser.getDepth() == 1)
+                        && ("manifest".equals(parser.getName()))
+                        && (parser.getNamespace().isEmpty())) {
+                    // In each manifest element, targetSandboxVersion defaults to 1
+                    int result = 1;
+                    for (int i = 0; i < parser.getAttributeCount(); i++) {
+                        if (parser.getAttributeNameResourceId(i)
+                                == TARGET_SANDBOX_VERSION_ATTR_ID) {
+                            int valueType = parser.getAttributeValueType(i);
+                            switch (valueType) {
+                                case AndroidBinXmlParser.VALUE_TYPE_INT:
+                                    result = parser.getAttributeIntValue(i);
+                                    break;
+                                default:
+                                    throw new ApkFormatException(
+                                            "Failed to determine APK's target sandbox version"
+                                                    + ": unsupported value type of"
+                                                    + " AndroidManifest.xml"
+                                                    + " android:targetSandboxVersion"
+                                                    + ". Only integer values supported.");
+                            }
+                            break;
+                        }
+                    }
+                    return result;
+                }
+                eventType = parser.next();
+            }
+            throw new ApkFormatException(
+                    "Failed to determine APK's target sandbox version"
+                            + " : no manifest element in AndroidManifest.xml");
+        } catch (AndroidBinXmlParser.XmlParserException e) {
+            throw new ApkFormatException(
+                    "Failed to determine APK's target sandbox version"
+                            + ": malformed AndroidManifest.xml",
+                    e);
+        }
+    }
+
     /**
      * Result of verifying an APKs signatures. The APK can be considered verified iff
      * {@link #isVerified()} returns {@code true}.
@@ -353,6 +446,10 @@
             return mV2SchemeSigners;
         }
 
+        void addError(Issue msg, Object... parameters) {
+            mErrors.add(new IssueWithParams(msg, parameters));
+        }
+
         /**
          * Returns errors encountered while verifying the APK's signatures.
          */
@@ -897,6 +994,18 @@
         JAR_SIG_MISSING("No JAR signature from this signer"),
 
         /**
+         * APK is targeting a sandbox version which requires APK Signature Scheme v2 signature but
+         * no such signature was found.
+         *
+         * <ul>
+         * <li>Parameter 1: target sandbox version ({@code Integer})</li>
+         * </ul>
+         */
+        NO_SIG_FOR_TARGET_SANDBOX_VERSION(
+                "Missing APK Signature Scheme v2 signature required for target sandbox version"
+                        + " %1$d"),
+
+        /**
          * APK which is both JAR-signed and signed using APK Signature Scheme v2 contains a JAR
          * signature from this signer, but does not contain an APK Signature Scheme v2 signature
          * from this signer.
diff --git a/src/main/java/com/android/apksig/apk/ApkUtils.java b/src/main/java/com/android/apksig/apk/ApkUtils.java
index a5b221e..c4ada25 100644
--- a/src/main/java/com/android/apksig/apk/ApkUtils.java
+++ b/src/main/java/com/android/apksig/apk/ApkUtils.java
@@ -16,6 +16,7 @@
 
 package com.android.apksig.apk;
 
+import com.android.apksig.internal.apk.AndroidBinXmlParser;
 import com.android.apksig.internal.util.Pair;
 import com.android.apksig.internal.zip.ZipUtils;
 import com.android.apksig.util.DataSource;
diff --git a/src/main/java/com/android/apksig/apk/AndroidBinXmlParser.java b/src/main/java/com/android/apksig/internal/apk/AndroidBinXmlParser.java
similarity index 99%
rename from src/main/java/com/android/apksig/apk/AndroidBinXmlParser.java
rename to src/main/java/com/android/apksig/internal/apk/AndroidBinXmlParser.java
index 5c70ef1..447632c 100644
--- a/src/main/java/com/android/apksig/apk/AndroidBinXmlParser.java
+++ b/src/main/java/com/android/apksig/internal/apk/AndroidBinXmlParser.java
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-package com.android.apksig.apk;
+package com.android.apksig.internal.apk;
 
 import java.io.UnsupportedEncodingException;
 import java.nio.ByteBuffer;
@@ -32,7 +32,7 @@
  * event can be obtained via an assortment of getters, for example, {@link #getName()} or
  * {@link #getAttributeNameResourceId(int)}.
  */
-class AndroidBinXmlParser {
+public class AndroidBinXmlParser {
 
     /** Event: start of document. */
     public static final int EVENT_START_DOCUMENT = 1;
@@ -817,7 +817,7 @@
     /**
      * Indicates that an error occurred while parsing a document.
      */
-    static class XmlParserException extends Exception {
+    public static class XmlParserException extends Exception {
         private static final long serialVersionUID = 1L;
 
         public XmlParserException(String message) {
diff --git a/src/main/java/com/android/apksig/internal/apk/v1/V1SchemeSigner.java b/src/main/java/com/android/apksig/internal/apk/v1/V1SchemeSigner.java
index af98007..0509d73 100644
--- a/src/main/java/com/android/apksig/internal/apk/v1/V1SchemeSigner.java
+++ b/src/main/java/com/android/apksig/internal/apk/v1/V1SchemeSigner.java
@@ -362,6 +362,7 @@
         SortedMap<String, byte[]> invidualSectionsContents = new TreeMap<>();
         String entryDigestAttributeName = getEntryDigestAttributeName(jarEntryDigestAlgorithm);
         for (String entryName : sortedEntryNames) {
+            checkEntryNameValid(entryName);
             byte[] entryDigest = jarEntryDigests.get(entryName);
             Attributes entryAttrs = new Attributes();
             entryAttrs.putValue(
@@ -386,6 +387,22 @@
         return result;
     }
 
+    private static void checkEntryNameValid(String name) throws ApkFormatException {
+        // JAR signing spec says CR, LF, and NUL are not permitted in entry names
+        // CR or LF in entry names will result in malformed MANIFEST.MF and .SF files because there
+        // is no way to escape characters in MANIFEST.MF and .SF files. NUL can, presumably, cause
+        // issues when parsing using C and C++ like languages.
+        for (char c : name.toCharArray()) {
+            if ((c == '\r') || (c == '\n') || (c == 0)) {
+                throw new ApkFormatException(
+                        String.format(
+                                "Unsupported character 0x%1$02x in ZIP entry name \"%2$s\"",
+                                (int) c,
+                                name));
+            }
+        }
+    }
+
     public static class OutputManifestFile {
         public byte[] contents;
         public SortedMap<String, byte[]> individualSectionsContents;
diff --git a/src/main/java/com/android/apksig/internal/apk/v1/V1SchemeVerifier.java b/src/main/java/com/android/apksig/internal/apk/v1/V1SchemeVerifier.java
index d7a4eb0..fdf459a 100644
--- a/src/main/java/com/android/apksig/internal/apk/v1/V1SchemeVerifier.java
+++ b/src/main/java/com/android/apksig/internal/apk/v1/V1SchemeVerifier.java
@@ -1425,18 +1425,18 @@
                 continue;
             }
 
-            Collection<NamedDigest> expectedDigests =
-                    getDigestsToVerify(manifestSection, "-Digest", minSdkVersion, maxSdkVersion);
+            List<NamedDigest> expectedDigests =
+                    new ArrayList<>(
+                            getDigestsToVerify(
+                                    manifestSection, "-Digest", minSdkVersion, maxSdkVersion));
             if (expectedDigests.isEmpty()) {
                 result.addError(Issue.JAR_SIG_NO_ZIP_ENTRY_DIGEST_IN_MANIFEST, entryName);
                 continue;
             }
 
             MessageDigest[] mds = new MessageDigest[expectedDigests.size()];
-            int mdIndex = 0;
-            for (NamedDigest expectedDigest : expectedDigests) {
-                mds[mdIndex] = getMessageDigest(expectedDigest.jcaDigestAlgorithm);
-                mdIndex++;
+            for (int i = 0; i < expectedDigests.size(); i++) {
+                mds[i] = getMessageDigest(expectedDigests.get(i).jcaDigestAlgorithm);
             }
 
             try {
@@ -1451,9 +1451,9 @@
                 throw new IOException("Failed to read entry: " + entryName, e);
             }
 
-            mdIndex = 0;
-            for (NamedDigest expectedDigest : expectedDigests) {
-                byte[] actualDigest = mds[mdIndex].digest();
+            for (int i = 0; i < expectedDigests.size(); i++) {
+                NamedDigest expectedDigest = expectedDigests.get(i);
+                byte[] actualDigest = mds[i].digest();
                 if (!Arrays.equals(expectedDigest.digest, actualDigest)) {
                     result.addError(
                             Issue.JAR_SIG_ZIP_ENTRY_DIGEST_DID_NOT_VERIFY,
diff --git a/src/main/java/com/android/apksig/internal/asn1/ber/BerDataValue.java b/src/main/java/com/android/apksig/internal/asn1/ber/BerDataValue.java
new file mode 100644
index 0000000..f5604ff
--- /dev/null
+++ b/src/main/java/com/android/apksig/internal/asn1/ber/BerDataValue.java
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.asn1.ber;
+
+import java.nio.ByteBuffer;
+
+/**
+ * ASN.1 Basic Encoding Rules (BER) data value -- see {@code X.690}.
+ */
+public class BerDataValue {
+    private final ByteBuffer mEncoded;
+    private final ByteBuffer mEncodedContents;
+    private final int mTagClass;
+    private final boolean mConstructed;
+    private final int mTagNumber;
+
+    BerDataValue(
+            ByteBuffer encoded,
+            ByteBuffer encodedContents,
+            int tagClass,
+            boolean constructed,
+            int tagNumber) {
+        mEncoded = encoded;
+        mEncodedContents = encodedContents;
+        mTagClass = tagClass;
+        mConstructed = constructed;
+        mTagNumber = tagNumber;
+    }
+
+    /**
+     * Returns the tag class of this data value. See {@link BerEncoding} {@code TAG_CLASS}
+     * constants.
+     */
+    public int getTagClass() {
+        return mTagClass;
+    }
+
+    /**
+     * Returns {@code true} if the content octets of this data value are the complete BER encoding
+     * of one or more data values, {@code false} if the content octets of this data value directly
+     * represent the value.
+     */
+    public boolean isConstructed() {
+        return mConstructed;
+    }
+
+    /**
+     * Returns the tag number of this data value. See {@link BerEncoding} {@code TAG_NUMBER}
+     * constants.
+     */
+    public int getTagNumber() {
+        return mTagNumber;
+    }
+
+    /**
+     * Returns the encoded form of this data value.
+     */
+    public ByteBuffer getEncoded() {
+        return mEncoded.slice();
+    }
+
+    /**
+     * Returns the encoded contents of this data value.
+     */
+    public ByteBuffer getEncodedContents() {
+        return mEncodedContents.slice();
+    }
+
+    /**
+     * Returns a new reader of the contents of this data value.
+     */
+    public BerDataValueReader contentsReader() {
+        return new ByteBufferBerDataValueReader(getEncodedContents());
+    }
+
+    /**
+     * Returns a new reader which returns just this data value. This may be useful for re-reading
+     * this value in different contexts.
+     */
+    public BerDataValueReader dataValueReader() {
+        return new ParsedValueReader(this);
+    }
+
+    private static final class ParsedValueReader implements BerDataValueReader {
+        private final BerDataValue mValue;
+        private boolean mValueOutput;
+
+        public ParsedValueReader(BerDataValue value) {
+            mValue = value;
+        }
+
+        @Override
+        public BerDataValue readDataValue() throws BerDataValueFormatException {
+            if (mValueOutput) {
+                return null;
+            }
+            mValueOutput = true;
+            return mValue;
+        }
+    }
+}
diff --git a/src/main/java/com/android/apksig/internal/asn1/ber/BerDataValueFormatException.java b/src/main/java/com/android/apksig/internal/asn1/ber/BerDataValueFormatException.java
new file mode 100644
index 0000000..11ef6c3
--- /dev/null
+++ b/src/main/java/com/android/apksig/internal/asn1/ber/BerDataValueFormatException.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.asn1.ber;
+
+/**
+ * Indicates that an ASN.1 data value being read could not be decoded using
+ * Basic Encoding Rules (BER).
+ */
+public class BerDataValueFormatException extends Exception {
+
+    private static final long serialVersionUID = 1L;
+
+    public BerDataValueFormatException(String message) {
+        super(message);
+    }
+
+    public BerDataValueFormatException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}
diff --git a/src/main/java/com/android/apksig/internal/asn1/ber/BerDataValueReader.java b/src/main/java/com/android/apksig/internal/asn1/ber/BerDataValueReader.java
new file mode 100644
index 0000000..eb2f383
--- /dev/null
+++ b/src/main/java/com/android/apksig/internal/asn1/ber/BerDataValueReader.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.asn1.ber;
+
+/**
+ * Reader of ASN.1 Basic Encoding Rules (BER) data values.
+ *
+ * <p>BER data value reader returns data values, one by one, from a source. The interpretation of
+ * data values (e.g., how to obtain a numeric value from an INTEGER data value, or how to extract
+ * the elements of a SEQUENCE value) is left to clients of the reader.
+ */
+public interface BerDataValueReader {
+
+    /**
+     * Returns the next data value or {@code null} if end of input has been reached.
+     *
+     * @throws BerDataValueFormatExcepton if the value being read is malformed.
+     */
+    BerDataValue readDataValue() throws BerDataValueFormatException;
+}
diff --git a/src/main/java/com/android/apksig/internal/asn1/ber/BerEncoding.java b/src/main/java/com/android/apksig/internal/asn1/ber/BerEncoding.java
new file mode 100644
index 0000000..f893a65
--- /dev/null
+++ b/src/main/java/com/android/apksig/internal/asn1/ber/BerEncoding.java
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.asn1.ber;
+
+/**
+ * ASN.1 Basic Encoding Rules (BER) constants and helper methods. See {@code X.690}.
+ */
+public abstract class BerEncoding {
+    private BerEncoding() {}
+
+    /**
+     * Constructed vs primitive flag in the first identifier byte.
+     */
+    public static final int ID_FLAG_CONSTRUCTED_ENCODING = 1 << 5;
+
+    /**
+     * Tag class: UNIVERSAL
+     */
+    public static final int TAG_CLASS_UNIVERSAL = 0;
+
+    /**
+     * Tag class: APPLICATION
+     */
+    public static final int TAG_CLASS_APPLICATION = 1;
+
+    /**
+     * Tag class: CONTEXT SPECIFIC
+     */
+    public static final int TAG_CLASS_CONTEXT_SPECIFIC = 2;
+
+    /**
+     * Tag class: PRIVATE
+     */
+    public static final int TAG_CLASS_PRIVATE = 3;
+
+    /**
+     * Tag number: INTEGER
+     */
+    public static final int TAG_NUMBER_INTEGER = 0x2;
+
+    /**
+     * Tag number: OCTET STRING
+     */
+    public static final int TAG_NUMBER_OCTET_STRING = 0x4;
+
+    /**
+     * Tag number: NULL
+     */
+    public static final int TAG_NUMBER_NULL = 0x05;
+
+    /**
+     * Tag number: OBJECT IDENTIFIER
+     */
+    public static final int TAG_NUMBER_OBJECT_IDENTIFIER = 0x6;
+
+    /**
+     * Tag number: SEQUENCE
+     */
+    public static final int TAG_NUMBER_SEQUENCE = 0x10;
+
+    /**
+     * Tag number: SET
+     */
+    public static final int TAG_NUMBER_SET = 0x11;
+
+    public static String tagNumberToString(int tagNumber) {
+        switch (tagNumber) {
+            case TAG_NUMBER_INTEGER:
+                return "INTEGER";
+            case TAG_NUMBER_OCTET_STRING:
+                return "OCTET STRING";
+            case TAG_NUMBER_NULL:
+                return "NULL";
+            case TAG_NUMBER_OBJECT_IDENTIFIER:
+                return "OBJECT IDENTIFIER";
+            case TAG_NUMBER_SEQUENCE:
+                return "SEQUENCE";
+            case TAG_NUMBER_SET:
+                return "SET";
+            default:
+                return "0x" + Integer.toHexString(tagNumber);
+        }
+    }
+
+    /**
+     * Returns {@code true} if the provided first identifier byte indicates that the data value uses
+     * constructed encoding for its contents, or {@code false} if the data value uses primitive
+     * encoding for its contents.
+     */
+    public static boolean isConstructed(byte firstIdentifierByte) {
+        return (firstIdentifierByte & ID_FLAG_CONSTRUCTED_ENCODING) != 0;
+    }
+
+    /**
+     * Returns the tag class encoded in the provided first identifier byte. See {@code TAG_CLASS}
+     * constants.
+     */
+    public static int getTagClass(byte firstIdentifierByte) {
+        return (firstIdentifierByte & 0xff) >> 6;
+    }
+
+    /**
+     * Returns the tag number encoded in the provided first identifier byte. See {@code TAG_NUMBER}
+     * constants.
+     */
+    public static int getTagNumber(byte firstIdentifierByte) {
+        return firstIdentifierByte & 0x1f;
+    }
+}
+
diff --git a/src/main/java/com/android/apksig/internal/asn1/ber/ByteBufferBerDataValueReader.java b/src/main/java/com/android/apksig/internal/asn1/ber/ByteBufferBerDataValueReader.java
new file mode 100644
index 0000000..adf2a25
--- /dev/null
+++ b/src/main/java/com/android/apksig/internal/asn1/ber/ByteBufferBerDataValueReader.java
@@ -0,0 +1,182 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.asn1.ber;
+
+import java.nio.ByteBuffer;
+
+/**
+ * {@link BerDataValueReader} which reads from a {@link ByteBuffer} containing BER-encoded data
+ * values. See {@code X.690} for the encoding.
+ */
+public class ByteBufferBerDataValueReader implements BerDataValueReader {
+    private final ByteBuffer mBuf;
+
+    public ByteBufferBerDataValueReader(ByteBuffer buf) {
+        if (buf == null) {
+            throw new NullPointerException("buf == null");
+        }
+        mBuf = buf;
+    }
+
+    @Override
+    public BerDataValue readDataValue() throws BerDataValueFormatException {
+        int startPosition = mBuf.position();
+        if (!mBuf.hasRemaining()) {
+            return null;
+        }
+        byte firstIdentifierByte = mBuf.get();
+        int tagNumber = readTagNumber(firstIdentifierByte);
+
+        if (!mBuf.hasRemaining()) {
+            throw new BerDataValueFormatException("Missing length");
+        }
+        int firstLengthByte = mBuf.get() & 0xff;
+        int contentsLength;
+        int contentsOffsetInTag;
+        if ((firstLengthByte & 0x80) == 0) {
+            // short form length
+            contentsLength = readShortFormLength(firstLengthByte);
+            contentsOffsetInTag = mBuf.position() - startPosition;
+            skipDefiniteLengthContents(contentsLength);
+        } else if (firstLengthByte != 0x80) {
+            // long form length
+            contentsLength = readLongFormLength(firstLengthByte);
+            contentsOffsetInTag = mBuf.position() - startPosition;
+            skipDefiniteLengthContents(contentsLength);
+        } else {
+            // indefinite length -- value ends with 0x00 0x00
+            contentsOffsetInTag = mBuf.position() - startPosition;
+            contentsLength = skipIndefiniteLengthContents();
+        }
+
+        // Create the encoded data value ByteBuffer
+        int endPosition = mBuf.position();
+        mBuf.position(startPosition);
+        int bufOriginalLimit = mBuf.limit();
+        mBuf.limit(endPosition);
+        ByteBuffer encoded = mBuf.slice();
+        mBuf.position(mBuf.limit());
+        mBuf.limit(bufOriginalLimit);
+
+        // Create the encoded contents ByteBuffer
+        encoded.position(contentsOffsetInTag);
+        encoded.limit(contentsOffsetInTag + contentsLength);
+        ByteBuffer encodedContents = encoded.slice();
+        encoded.clear();
+
+        return new BerDataValue(
+                encoded,
+                encodedContents,
+                BerEncoding.getTagClass(firstIdentifierByte),
+                BerEncoding.isConstructed(firstIdentifierByte),
+                tagNumber);
+    }
+
+    private int readTagNumber(byte firstIdentifierByte) throws BerDataValueFormatException {
+        int tagNumber = BerEncoding.getTagNumber(firstIdentifierByte);
+        if (tagNumber == 0x1f) {
+            // high-tag-number form, where the tag number follows this byte in base-128
+            // big-endian form, where each byte has the highest bit set, except for the last
+            // byte
+            return readHighTagNumber();
+        } else {
+            // low-tag-number form
+            return tagNumber;
+        }
+    }
+
+    private int readHighTagNumber() throws BerDataValueFormatException {
+        // Base-128 big-endian form, where each byte has the highest bit set, except for the last
+        // byte
+        int b;
+        int result = 0;
+        do {
+            if (!mBuf.hasRemaining()) {
+                throw new BerDataValueFormatException("Truncated tag number");
+            }
+            b = mBuf.get();
+            if (result > Integer.MAX_VALUE >>> 7) {
+                throw new BerDataValueFormatException("Tag number too large");
+            }
+            result <<= 7;
+            result |= b & 0x7f;
+        } while ((b & 0x80) != 0);
+        return result;
+    }
+
+    private int readShortFormLength(int firstLengthByte) throws BerDataValueFormatException {
+        return firstLengthByte & 0x7f;
+    }
+
+    private int readLongFormLength(int firstLengthByte) throws BerDataValueFormatException {
+        // The low 7 bits of the first byte represent the number of bytes (following the first
+        // byte) in which the length is in big-endian base-256 form
+        int byteCount = firstLengthByte & 0x7f;
+        if (byteCount > 4) {
+            throw new BerDataValueFormatException("Length too large: " + byteCount + " bytes");
+        }
+        int result = 0;
+        for (int i = 0; i < byteCount; i++) {
+            if (!mBuf.hasRemaining()) {
+                throw new BerDataValueFormatException("Truncated length");
+            }
+            int b = mBuf.get();
+            if (result > Integer.MAX_VALUE >>> 8) {
+                throw new BerDataValueFormatException("Length too large");
+            }
+            result <<= 8;
+            result |= b & 0xff;
+        }
+        return result;
+    }
+
+    private void skipDefiniteLengthContents(int contentsLength) throws BerDataValueFormatException {
+        if (mBuf.remaining() < contentsLength) {
+            throw new BerDataValueFormatException(
+                    "Truncated contents. Need: " + contentsLength + " bytes, available: "
+                            + mBuf.remaining());
+        }
+        mBuf.position(mBuf.position() + contentsLength);
+    }
+
+    private int skipIndefiniteLengthContents() throws BerDataValueFormatException {
+        // Contents are terminated by 0x00 0x00
+        boolean prevZeroByte = false;
+        int bytesRead = 0;
+        while (true) {
+            if (!mBuf.hasRemaining()) {
+                throw new BerDataValueFormatException(
+                        "Truncated indefinite-length contents: " + bytesRead + " bytes read");
+
+            }
+            int b = mBuf.get();
+            bytesRead++;
+            if (bytesRead < 0) {
+                throw new BerDataValueFormatException("Indefinite-length contents too long");
+            }
+            if (b == 0) {
+                if (prevZeroByte) {
+                    // End of contents reached -- we've read the value and its terminator 0x00 0x00
+                    return bytesRead - 2;
+                }
+                prevZeroByte = true;
+            } else {
+                prevZeroByte = false;
+            }
+        }
+    }
+}
diff --git a/src/main/java/com/android/apksig/internal/asn1/ber/InputStreamBerDataValueReader.java b/src/main/java/com/android/apksig/internal/asn1/ber/InputStreamBerDataValueReader.java
new file mode 100644
index 0000000..9dfec15
--- /dev/null
+++ b/src/main/java/com/android/apksig/internal/asn1/ber/InputStreamBerDataValueReader.java
@@ -0,0 +1,271 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.asn1.ber;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.ByteBuffer;
+
+/**
+ * {@link BerDataValueReader} which reads from an {@link InputStream} returning BER-encoded data
+ * values. See {@code X.690} for the encoding.
+ */
+public class InputStreamBerDataValueReader implements BerDataValueReader {
+    private final InputStream mIn;
+
+    public InputStreamBerDataValueReader(InputStream in) {
+        if (in == null) {
+            throw new NullPointerException("in == null");
+        }
+        mIn = in;
+    }
+
+    @SuppressWarnings("resource")
+    @Override
+    public BerDataValue readDataValue() throws BerDataValueFormatException {
+        RecordingInputStream in = new RecordingInputStream(mIn);
+
+        try {
+            int firstIdentifierByte = in.read();
+            if (firstIdentifierByte == -1) {
+                // End of input
+                return null;
+            }
+            int tagNumber = readTagNumber(in, firstIdentifierByte);
+
+            int firstLengthByte = in.read();
+            if (firstLengthByte == -1) {
+                throw new BerDataValueFormatException("Missing length");
+            }
+
+            int contentsLength;
+            int contentsOffsetInDataValue;
+            if ((firstLengthByte & 0x80) == 0) {
+                // short form length
+                contentsLength = readShortFormLength(firstLengthByte);
+                contentsOffsetInDataValue = in.getReadByteCount();
+                skipDefiniteLengthContents(in, contentsLength);
+            } else if ((firstLengthByte & 0xff) != 0x80) {
+                // long form length
+                contentsLength = readLongFormLength(in, firstLengthByte);
+                contentsOffsetInDataValue = in.getReadByteCount();
+                skipDefiniteLengthContents(in, contentsLength);
+            } else {
+                // indefinite length
+                contentsOffsetInDataValue = in.getReadByteCount();
+                contentsLength = skipIndefiniteLengthContents(in);
+            }
+
+            byte[] encoded = in.getReadBytes();
+            ByteBuffer encodedContents =
+                    ByteBuffer.wrap(encoded, contentsOffsetInDataValue, contentsLength);
+            return new BerDataValue(
+                    ByteBuffer.wrap(encoded),
+                    encodedContents,
+                    BerEncoding.getTagClass((byte) firstIdentifierByte),
+                    BerEncoding.isConstructed((byte) firstIdentifierByte),
+                    tagNumber);
+        } catch (IOException e) {
+            throw new BerDataValueFormatException("Failed to read data value", e);
+        }
+    }
+
+    private static int readTagNumber(InputStream in, int firstIdentifierByte)
+            throws IOException, BerDataValueFormatException {
+        int tagNumber = BerEncoding.getTagNumber((byte) firstIdentifierByte);
+        if (tagNumber == 0x1f) {
+            // high-tag-number form
+            return readHighTagNumber(in);
+        } else {
+            // low-tag-number form
+            return tagNumber;
+        }
+    }
+
+    private static int readHighTagNumber(InputStream in)
+            throws IOException, BerDataValueFormatException {
+        // Base-128 big-endian form, where each byte has the highest bit set, except for the last
+        // byte where the highest bit is not set
+        int b;
+        int result = 0;
+        do {
+            b = in.read();
+            if (b == -1) {
+                throw new BerDataValueFormatException("Truncated tag number");
+            }
+            if (result > Integer.MAX_VALUE >>> 7) {
+                throw new BerDataValueFormatException("Tag number too large");
+            }
+            result <<= 7;
+            result |= b & 0x7f;
+        } while ((b & 0x80) != 0);
+        return result;
+    }
+
+    private static int readShortFormLength(int firstLengthByte) throws BerDataValueFormatException {
+        return firstLengthByte & 0x7f;
+    }
+
+    private static int readLongFormLength(InputStream in, int firstLengthByte)
+            throws IOException, BerDataValueFormatException {
+        // The low 7 bits of the first byte represent the number of bytes (following the first
+        // byte) in which the length is in big-endian base-256 form
+        int byteCount = firstLengthByte & 0x7f;
+        if (byteCount > 4) {
+            throw new BerDataValueFormatException("Length too large: " + byteCount + " bytes");
+        }
+        int result = 0;
+        for (int i = 0; i < byteCount; i++) {
+            int b = in.read();
+            if (b == -1) {
+                throw new BerDataValueFormatException("Truncated length");
+            }
+            if (result > Integer.MAX_VALUE >>> 8) {
+                throw new BerDataValueFormatException("Length too large");
+            }
+            result <<= 8;
+            result |= b & 0xff;
+        }
+        return result;
+    }
+
+    private static void skipDefiniteLengthContents(InputStream in, int len)
+            throws IOException, BerDataValueFormatException {
+        long bytesRead = 0;
+        while (len > 0) {
+            int skipped = (int) in.skip(len);
+            if (skipped <= 0) {
+                throw new BerDataValueFormatException(
+                        "Truncated definite-length contents: " + bytesRead + " bytes read"
+                                + ", " + len + " missing");
+            }
+            len -= skipped;
+            bytesRead += skipped;
+        }
+    }
+
+    private static int skipIndefiniteLengthContents(InputStream in)
+            throws IOException, BerDataValueFormatException {
+        // Contents are terminated by 0x00 0x00
+        boolean prevZeroByte = false;
+        int bytesRead = 0;
+        while (true) {
+            int b = in.read();
+            if (b == -1) {
+                throw new BerDataValueFormatException(
+                        "Truncated indefinite-length contents: " + bytesRead + " bytes read");
+            }
+            bytesRead++;
+            if (bytesRead < 0) {
+                throw new BerDataValueFormatException("Indefinite-length contents too long");
+            }
+            if (b == 0) {
+                if (prevZeroByte) {
+                    // End of contents reached -- we've read the value and its terminator 0x00 0x00
+                    return bytesRead - 2;
+                }
+                prevZeroByte = true;
+                continue;
+            } else {
+                prevZeroByte = false;
+            }
+        }
+    }
+
+    private static class RecordingInputStream extends InputStream {
+        private final InputStream mIn;
+        private final ByteArrayOutputStream mBuf;
+
+        private RecordingInputStream(InputStream in) {
+            mIn = in;
+            mBuf = new ByteArrayOutputStream();
+        }
+
+        public byte[] getReadBytes() {
+            return mBuf.toByteArray();
+        }
+
+        public int getReadByteCount() {
+            return mBuf.size();
+        }
+
+        @Override
+        public int read() throws IOException {
+            int b = mIn.read();
+            if (b != -1) {
+                mBuf.write(b);
+            }
+            return b;
+        }
+
+        @Override
+        public int read(byte[] b) throws IOException {
+            int len = mIn.read(b);
+            if (len > 0) {
+                mBuf.write(b, 0, len);
+            }
+            return len;
+        }
+
+        @Override
+        public int read(byte[] b, int off, int len) throws IOException {
+            len = mIn.read(b, off, len);
+            if (len > 0) {
+                mBuf.write(b, off, len);
+            }
+            return len;
+        }
+
+        @Override
+        public long skip(long n) throws IOException {
+            if (n <= 0) {
+                return mIn.skip(n);
+            }
+
+            byte[] buf = new byte[4096];
+            int len = mIn.read(buf, 0, (int) Math.min(buf.length, n));
+            if (len > 0) {
+                mBuf.write(buf, 0, len);
+            }
+            return (len < 0) ? 0 : len;
+        }
+
+        @Override
+        public int available() throws IOException {
+            return super.available();
+        }
+
+        @Override
+        public void close() throws IOException {
+            super.close();
+        }
+
+        @Override
+        public synchronized void mark(int readlimit) {}
+
+        @Override
+        public synchronized void reset() throws IOException {
+            throw new IOException("mark/reset not supported");
+        }
+
+        @Override
+        public boolean markSupported() {
+            return false;
+        }
+    }
+}
diff --git a/src/main/java/com/android/apksig/internal/util/AndroidSdkVersion.java b/src/main/java/com/android/apksig/internal/util/AndroidSdkVersion.java
index f874f88..83d1334 100644
--- a/src/main/java/com/android/apksig/internal/util/AndroidSdkVersion.java
+++ b/src/main/java/com/android/apksig/internal/util/AndroidSdkVersion.java
@@ -35,4 +35,7 @@
 
     /** Android 7.0. N is for Nougat. */
     public static final int N = 24;
+
+    /** Android O. */
+    public static final int O = 26;
 }
diff --git a/src/main/java/com/android/apksig/internal/util/ByteArrayDataSink.java b/src/main/java/com/android/apksig/internal/util/ByteArrayDataSink.java
index f804fa2..e5741a5 100644
--- a/src/main/java/com/android/apksig/internal/util/ByteArrayDataSink.java
+++ b/src/main/java/com/android/apksig/internal/util/ByteArrayDataSink.java
@@ -47,6 +47,17 @@
 
     @Override
     public void consume(byte[] buf, int offset, int length) throws IOException {
+        if (offset < 0) {
+            // Must perform this check because System.arraycopy below doesn't perform it when
+            // length == 0
+            throw new IndexOutOfBoundsException("offset: " + offset);
+        }
+        if (offset > buf.length) {
+            // Must perform this check because System.arraycopy below doesn't perform it when
+            // length == 0
+            throw new IndexOutOfBoundsException(
+                    "offset: " + offset + ", buf.length: " + buf.length);
+        }
         if (length == 0) {
             return;
         }
@@ -106,7 +117,7 @@
         checkChunkValid(offset, size);
 
         // checkChunkValid ensures that it's OK to cast offset to int.
-        return ByteBuffer.wrap(mArray, (int) offset, size);
+        return ByteBuffer.wrap(mArray, (int) offset, size).slice();
     }
 
     @Override
@@ -127,22 +138,22 @@
 
     private void checkChunkValid(long offset, long size) {
         if (offset < 0) {
-            throw new IllegalArgumentException("offset: " + offset);
+            throw new IndexOutOfBoundsException("offset: " + offset);
         }
         if (size < 0) {
-            throw new IllegalArgumentException("size: " + size);
+            throw new IndexOutOfBoundsException("size: " + size);
         }
         if (offset > mSize) {
-            throw new IllegalArgumentException(
+            throw new IndexOutOfBoundsException(
                     "offset (" + offset + ") > source size (" + mSize + ")");
         }
         long endOffset = offset + size;
         if (endOffset < offset) {
-            throw new IllegalArgumentException(
+            throw new IndexOutOfBoundsException(
                     "offset (" + offset + ") + size (" + size + ") overflow");
         }
         if (endOffset > mSize) {
-            throw new IllegalArgumentException(
+            throw new IndexOutOfBoundsException(
                     "offset (" + offset + ") + size (" + size + ") > source size (" + mSize + ")");
         }
     }
@@ -184,7 +195,7 @@
             checkChunkValid(offset, size);
             // checkChunkValid combined with the way instances of this class are constructed ensures
             // that mSliceOffset + offset does not overflow.
-            return ByteBuffer.wrap(mArray, (int) (mSliceOffset + offset), size);
+            return ByteBuffer.wrap(mArray, (int) (mSliceOffset + offset), size).slice();
         }
 
         @Override
@@ -205,22 +216,22 @@
 
         private void checkChunkValid(long offset, long size) {
             if (offset < 0) {
-                throw new IllegalArgumentException("offset: " + offset);
+                throw new IndexOutOfBoundsException("offset: " + offset);
             }
             if (size < 0) {
-                throw new IllegalArgumentException("size: " + size);
+                throw new IndexOutOfBoundsException("size: " + size);
             }
             if (offset > mSliceSize) {
-                throw new IllegalArgumentException(
+                throw new IndexOutOfBoundsException(
                         "offset (" + offset + ") > source size (" + mSliceSize + ")");
             }
             long endOffset = offset + size;
             if (endOffset < offset) {
-                throw new IllegalArgumentException(
+                throw new IndexOutOfBoundsException(
                         "offset (" + offset + ") + size (" + size + ") overflow");
             }
             if (endOffset > mSliceSize) {
-                throw new IllegalArgumentException(
+                throw new IndexOutOfBoundsException(
                         "offset (" + offset + ") + size (" + size + ") > source size (" + mSliceSize
                                 + ")");
             }
diff --git a/src/main/java/com/android/apksig/internal/util/ByteBufferDataSource.java b/src/main/java/com/android/apksig/internal/util/ByteBufferDataSource.java
index 258a379..656c20e 100644
--- a/src/main/java/com/android/apksig/internal/util/ByteBufferDataSource.java
+++ b/src/main/java/com/android/apksig/internal/util/ByteBufferDataSource.java
@@ -82,7 +82,7 @@
     @Override
     public void feed(long offset, long size, DataSink sink) throws IOException {
         if ((size < 0) || (size > mSize)) {
-            throw new IllegalArgumentException("size: " + size + ", source size: " + mSize);
+            throw new IndexOutOfBoundsException("size: " + size + ", source size: " + mSize);
         }
         sink.consume(getByteBuffer(offset, (int) size));
     }
@@ -93,7 +93,7 @@
             return this;
         }
         if ((size < 0) || (size > mSize)) {
-            throw new IllegalArgumentException("size: " + size + ", source size: " + mSize);
+            throw new IndexOutOfBoundsException("size: " + size + ", source size: " + mSize);
         }
         return new ByteBufferDataSource(
                 getByteBuffer(offset, (int) size),
@@ -103,22 +103,22 @@
 
     private void checkChunkValid(long offset, long size) {
         if (offset < 0) {
-            throw new IllegalArgumentException("offset: " + offset);
+            throw new IndexOutOfBoundsException("offset: " + offset);
         }
         if (size < 0) {
-            throw new IllegalArgumentException("size: " + size);
+            throw new IndexOutOfBoundsException("size: " + size);
         }
         if (offset > mSize) {
-            throw new IllegalArgumentException(
+            throw new IndexOutOfBoundsException(
                     "offset (" + offset + ") > source size (" + mSize + ")");
         }
         long endOffset = offset + size;
         if (endOffset < offset) {
-            throw new IllegalArgumentException(
+            throw new IndexOutOfBoundsException(
                     "offset (" + offset + ") + size (" + size + ") overflow");
         }
         if (endOffset > mSize) {
-            throw new IllegalArgumentException(
+            throw new IndexOutOfBoundsException(
                     "offset (" + offset + ") + size (" + size + ") > source size (" + mSize  +")");
         }
     }
diff --git a/src/main/java/com/android/apksig/internal/util/ByteBufferSink.java b/src/main/java/com/android/apksig/internal/util/ByteBufferSink.java
index c81a38a..d7cbe03 100644
--- a/src/main/java/com/android/apksig/internal/util/ByteBufferSink.java
+++ b/src/main/java/com/android/apksig/internal/util/ByteBufferSink.java
@@ -32,6 +32,10 @@
         mBuffer = buffer;
     }
 
+    public ByteBuffer getBuffer() {
+        return mBuffer;
+    }
+
     @Override
     public void consume(byte[] buf, int offset, int length) throws IOException {
         try {
diff --git a/src/main/java/com/android/apksig/internal/util/RandomAccessFileDataSink.java b/src/main/java/com/android/apksig/internal/util/RandomAccessFileDataSink.java
index 0e075d7..bbd2d14 100644
--- a/src/main/java/com/android/apksig/internal/util/RandomAccessFileDataSink.java
+++ b/src/main/java/com/android/apksig/internal/util/RandomAccessFileDataSink.java
@@ -55,8 +55,26 @@
         mPosition = startPosition;
     }
 
+    /**
+     * Returns the underlying {@link RandomAccessFile}.
+     */
+    public RandomAccessFile getFile() {
+        return mFile;
+    }
+
     @Override
     public void consume(byte[] buf, int offset, int length) throws IOException {
+        if (offset < 0) {
+            // Must perform this check here because RandomAccessFile.write doesn't throw when offset
+            // is negative but length is 0
+            throw new IndexOutOfBoundsException("offset: " + offset);
+        }
+        if (offset > buf.length) {
+            // Must perform this check here because RandomAccessFile.write doesn't throw when offset
+            // is too large but length is 0
+            throw new IndexOutOfBoundsException(
+                    "offset: " + offset + ", buf.length: " + buf.length);
+        }
         if (length == 0) {
             return;
         }
diff --git a/src/main/java/com/android/apksig/internal/util/RandomAccessFileDataSource.java b/src/main/java/com/android/apksig/internal/util/RandomAccessFileDataSource.java
index 4104fb0..3492399 100644
--- a/src/main/java/com/android/apksig/internal/util/RandomAccessFileDataSource.java
+++ b/src/main/java/com/android/apksig/internal/util/RandomAccessFileDataSource.java
@@ -20,6 +20,7 @@
 import com.android.apksig.util.DataSource;
 import java.io.IOException;
 import java.io.RandomAccessFile;
+import java.nio.BufferOverflowException;
 import java.nio.ByteBuffer;
 import java.nio.channels.FileChannel;
 
@@ -49,13 +50,15 @@
      * Constructs a new {@code RandomAccessFileDataSource} based on the data contained in the
      * specified region of the provided file. Changes to the contents of the file will be visible in
      * this data source.
+     *
+     * @throws IndexOutOfBoundsException if {@code offset} or {@code size} is negative.
      */
     public RandomAccessFileDataSource(RandomAccessFile file, long offset, long size) {
         if (offset < 0) {
-            throw new IllegalArgumentException("offset: " + size);
+            throw new IndexOutOfBoundsException("offset: " + size);
         }
         if (size < 0) {
-            throw new IllegalArgumentException("size: " + size);
+            throw new IndexOutOfBoundsException("size: " + size);
         }
         mFile = file;
         mOffset = offset;
@@ -116,11 +119,16 @@
         if (size == 0) {
             return;
         }
+        if (size > dest.remaining()) {
+            throw new BufferOverflowException();
+        }
 
         long offsetInFile = mOffset + offset;
         int remaining = size;
         int prevLimit = dest.limit();
         try {
+            // FileChannel.read(ByteBuffer) reads up to dest.remaining(). Thus, we need to adjust
+            // the buffer's limit to avoid reading more than size bytes.
             dest.limit(dest.position() + size);
             FileChannel fileChannel = mFile.getChannel();
             while (remaining > 0) {
@@ -139,6 +147,9 @@
 
     @Override
     public ByteBuffer getByteBuffer(long offset, int size) throws IOException {
+        if (size < 0) {
+            throw new IndexOutOfBoundsException("size: " + size);
+        }
         ByteBuffer result = ByteBuffer.allocate(size);
         copyTo(offset, size, result);
         result.flip();
@@ -147,22 +158,22 @@
 
     private static void checkChunkValid(long offset, long size, long sourceSize) {
         if (offset < 0) {
-            throw new IllegalArgumentException("offset: " + offset);
+            throw new IndexOutOfBoundsException("offset: " + offset);
         }
         if (size < 0) {
-            throw new IllegalArgumentException("size: " + size);
+            throw new IndexOutOfBoundsException("size: " + size);
         }
         if (offset > sourceSize) {
-            throw new IllegalArgumentException(
+            throw new IndexOutOfBoundsException(
                     "offset (" + offset + ") > source size (" + sourceSize + ")");
         }
         long endOffset = offset + size;
         if (endOffset < offset) {
-            throw new IllegalArgumentException(
+            throw new IndexOutOfBoundsException(
                     "offset (" + offset + ") + size (" + size + ") overflow");
         }
         if (endOffset > sourceSize) {
-            throw new IllegalArgumentException(
+            throw new IndexOutOfBoundsException(
                     "offset (" + offset + ") + size (" + size
                             + ") > source size (" + sourceSize  +")");
         }
diff --git a/src/main/java/com/android/apksig/internal/zip/CentralDirectoryRecord.java b/src/main/java/com/android/apksig/internal/zip/CentralDirectoryRecord.java
index 9e6e119..d2f444d 100644
--- a/src/main/java/com/android/apksig/internal/zip/CentralDirectoryRecord.java
+++ b/src/main/java/com/android/apksig/internal/zip/CentralDirectoryRecord.java
@@ -38,11 +38,13 @@
     private static final int RECORD_SIGNATURE = 0x02014b50;
     private static final int HEADER_SIZE_BYTES = 46;
 
-    private static final int LAST_MODIFICATION_TIME_OFFSET =  12;
+    private static final int GP_FLAGS_OFFSET = 8;
     private static final int LOCAL_FILE_HEADER_OFFSET_OFFSET = 42;
     private static final int NAME_OFFSET = HEADER_SIZE_BYTES;
 
     private final ByteBuffer mData;
+    private final short mGpFlags;
+    private final short mCompressionMethod;
     private final int mLastModificationTime;
     private final int mLastModificationDate;
     private final long mCrc32;
@@ -54,6 +56,8 @@
 
     private CentralDirectoryRecord(
             ByteBuffer data,
+            short gpFlags,
+            short compressionMethod,
             int lastModificationTime,
             int lastModificationDate,
             long crc32,
@@ -63,6 +67,8 @@
             String name,
             int nameSizeBytes) {
         mData = data;
+        mGpFlags = gpFlags;
+        mCompressionMethod = compressionMethod;
         mLastModificationDate = lastModificationDate;
         mLastModificationTime = lastModificationTime;
         mCrc32 = crc32;
@@ -85,6 +91,14 @@
         return mNameSizeBytes;
     }
 
+    public short getGpFlags() {
+        return mGpFlags;
+    }
+
+    public short getCompressionMethod() {
+        return mCompressionMethod;
+    }
+
     public int getLastModificationTime() {
         return mLastModificationTime;
     }
@@ -128,7 +142,9 @@
                     "Not a Central Directory record. Signature: 0x"
                             + Long.toHexString(recordSignature & 0xffffffffL));
         }
-        buf.position(originalPosition + LAST_MODIFICATION_TIME_OFFSET);
+        buf.position(originalPosition + GP_FLAGS_OFFSET);
+        short gpFlags = buf.getShort();
+        short compressionMethod = buf.getShort();
         int lastModificationTime = ZipUtils.getUnsignedInt16(buf);
         int lastModificationDate = ZipUtils.getUnsignedInt16(buf);
         long crc32 = ZipUtils.getUnsignedInt32(buf);
@@ -162,6 +178,8 @@
         buf.position(recordEndInBuf);
         return new CentralDirectoryRecord(
                 recordBuf,
+                gpFlags,
+                compressionMethod,
                 lastModificationTime,
                 lastModificationDate,
                 crc32,
@@ -185,6 +203,8 @@
         ZipUtils.setUnsignedInt32(result, LOCAL_FILE_HEADER_OFFSET_OFFSET, localFileHeaderOffset);
         return new CentralDirectoryRecord(
                 result,
+                mGpFlags,
+                mCompressionMethod,
                 mLastModificationTime,
                 mLastModificationDate,
                 mCrc32,
@@ -204,14 +224,16 @@
             long uncompressedSize,
             long localFileHeaderOffset) {
         byte[] nameBytes = name.getBytes(StandardCharsets.UTF_8);
+        short gpFlags = ZipUtils.GP_FLAG_EFS; // UTF-8 character encoding used for entry name
+        short compressionMethod = ZipUtils.COMPRESSION_METHOD_DEFLATED;
         int recordSize = HEADER_SIZE_BYTES + nameBytes.length;
         ByteBuffer result = ByteBuffer.allocate(recordSize);
         result.order(ByteOrder.LITTLE_ENDIAN);
         result.putInt(RECORD_SIGNATURE);
         ZipUtils.putUnsignedInt16(result, 0x14); // Version made by
         ZipUtils.putUnsignedInt16(result, 0x14); // Minimum version needed to extract
-        result.putShort(ZipUtils.GP_FLAG_EFS); // UTF-8 character encoding used for entry name
-        result.putShort(ZipUtils.COMPRESSION_METHOD_DEFLATED);
+        result.putShort(gpFlags);
+        result.putShort(compressionMethod);
         ZipUtils.putUnsignedInt16(result, lastModifiedTime);
         ZipUtils.putUnsignedInt16(result, lastModifiedDate);
         ZipUtils.putUnsignedInt32(result, crc32);
@@ -232,6 +254,8 @@
         result.flip();
         return new CentralDirectoryRecord(
                 result,
+                gpFlags,
+                compressionMethod,
                 lastModifiedTime,
                 lastModifiedDate,
                 crc32,
diff --git a/src/main/java/com/android/apksig/internal/zip/LocalFileRecord.java b/src/main/java/com/android/apksig/internal/zip/LocalFileRecord.java
index f2f4d0b..0a55b1a 100644
--- a/src/main/java/com/android/apksig/internal/zip/LocalFileRecord.java
+++ b/src/main/java/com/android/apksig/internal/zip/LocalFileRecord.java
@@ -38,7 +38,6 @@
     private static final int HEADER_SIZE_BYTES = 30;
 
     private static final int GP_FLAGS_OFFSET = 6;
-    private static final int COMPRESSION_METHOD_OFFSET = 8;
     private static final int CRC32_OFFSET = 14;
     private static final int COMPRESSED_SIZE_OFFSET = 18;
     private static final int UNCOMPRESSED_SIZE_OFFSET = 22;
@@ -175,6 +174,14 @@
         }
         short gpFlags = header.getShort(GP_FLAGS_OFFSET);
         boolean dataDescriptorUsed = (gpFlags & ZipUtils.GP_FLAG_DATA_DESCRIPTOR_USED) != 0;
+        boolean cdDataDescriptorUsed =
+                (cdRecord.getGpFlags() & ZipUtils.GP_FLAG_DATA_DESCRIPTOR_USED) != 0;
+        if (dataDescriptorUsed != cdDataDescriptorUsed) {
+            throw new ZipFormatException(
+                    "Data Descriptor presence mismatch between Local File Header and Central"
+                            + " Directory for entry " + entryName
+                            + ". LFH: " + dataDescriptorUsed + ", CD: " + cdDataDescriptorUsed);
+        }
         long uncompressedDataCrc32FromCdRecord = cdRecord.getCrc32();
         long compressedDataSizeFromCdRecord = cdRecord.getCompressedSize();
         long uncompressedDataSizeFromCdRecord = cdRecord.getUncompressedSize();
@@ -215,24 +222,10 @@
                             + name + "\", CD: \"" + entryName + "\"");
         }
         int extraLength = ZipUtils.getUnsignedInt16(header, EXTRA_LENGTH_OFFSET);
-
-        short compressionMethod = header.getShort(COMPRESSION_METHOD_OFFSET);
-        boolean compressed;
-        switch (compressionMethod) {
-            case ZipUtils.COMPRESSION_METHOD_STORED:
-                compressed = false;
-                break;
-            case ZipUtils.COMPRESSION_METHOD_DEFLATED:
-                compressed = true;
-                break;
-            default:
-                throw new ZipFormatException(
-                        "Unsupported compression method of entry " + entryName
-                                + ": " + (compressionMethod & 0xffff));
-        }
-
         long dataStartOffset = headerStartOffset + HEADER_SIZE_BYTES + nameLength + extraLength;
         long dataSize;
+        boolean compressed =
+                (cdRecord.getCompressionMethod() != ZipUtils.COMPRESSION_METHOD_STORED);
         if (compressed) {
             dataSize = compressedDataSizeFromCdRecord;
         } else {
diff --git a/src/main/java/com/android/apksig/util/DataSink.java b/src/main/java/com/android/apksig/util/DataSink.java
index e2d06ee..5042933 100644
--- a/src/main/java/com/android/apksig/util/DataSink.java
+++ b/src/main/java/com/android/apksig/util/DataSink.java
@@ -29,6 +29,9 @@
      *
      * <p>This data sink guarantees to not hold references to the provided buffer after this method
      * terminates.
+     *
+     * @throws IndexOutOfBoundsException if {@code offset} or {@code length} are negative, or if
+     *         {@code offset + length} is greater than {@code buf.length}.
      */
     void consume(byte[] buf, int offset, int length) throws IOException;
 
diff --git a/src/main/java/com/android/apksig/util/DataSource.java b/src/main/java/com/android/apksig/util/DataSource.java
index 86014ca..a89a87c 100644
--- a/src/main/java/com/android/apksig/util/DataSource.java
+++ b/src/main/java/com/android/apksig/util/DataSource.java
@@ -62,6 +62,9 @@
      *
      * @param offset index (in bytes) at which the chunk starts inside data source
      * @param size size (in bytes) of the chunk
+     *
+     * @throws IndexOutOfBoundsException if {@code offset} or {@code size} is negative, or if
+     *         {@code offset + size} is greater than {@link #size()}.
      */
     void feed(long offset, long size, DataSink sink) throws IOException;
 
@@ -75,6 +78,9 @@
      *
      * @param offset index (in bytes) at which the chunk starts inside data source
      * @param size size (in bytes) of the chunk
+     *
+     * @throws IndexOutOfBoundsException if {@code offset} or {@code size} is negative, or if
+     *         {@code offset + size} is greater than {@link #size()}.
      */
     ByteBuffer getByteBuffer(long offset, int size) throws IOException;
 
@@ -84,6 +90,9 @@
      *
      * @param offset index (in bytes) at which the chunk starts inside data source
      * @param size size (in bytes) of the chunk
+     *
+     * @throws IndexOutOfBoundsException if {@code offset} or {@code size} is negative, or if
+     *         {@code offset + size} is greater than {@link #size()}.
      */
     void copyTo(long offset, int size, ByteBuffer dest) throws IOException;
 
@@ -93,6 +102,9 @@
      *
      * @param offset index (in bytes) at which the region starts inside data source
      * @param size size (in bytes) of the region
+     *
+     * @throws IndexOutOfBoundsException if {@code offset} or {@code size} is negative, or if
+     *         {@code offset + size} is greater than {@link #size()}.
      */
     DataSource slice(long offset, long size);
 }
diff --git a/src/test/java/com/android/apksig/AllTests.java b/src/test/java/com/android/apksig/AllTests.java
new file mode 100644
index 0000000..cd5c909
--- /dev/null
+++ b/src/test/java/com/android/apksig/AllTests.java
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig;
+
+import org.junit.runner.RunWith;
+import org.junit.runners.Suite;
+
+@RunWith(Suite.class)
+@Suite.SuiteClasses({
+    ApkSignerTest.class,
+    ApkVerifierTest.class,
+    com.android.apksig.apk.AllTests.class,
+    com.android.apksig.internal.AllTests.class,
+    com.android.apksig.util.AllTests.class,
+})
+public class AllTests {}
diff --git a/src/test/java/com/android/apksig/ApkSignerTest.java b/src/test/java/com/android/apksig/ApkSignerTest.java
new file mode 100644
index 0000000..513023e
--- /dev/null
+++ b/src/test/java/com/android/apksig/ApkSignerTest.java
@@ -0,0 +1,459 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig;
+
+import static org.junit.Assert.fail;
+
+import com.android.apksig.ApkVerifier.Issue;
+import com.android.apksig.apk.ApkFormatException;
+import com.android.apksig.internal.util.Resources;
+import com.android.apksig.util.DataSinks;
+import com.android.apksig.util.DataSource;
+import com.android.apksig.util.DataSources;
+import com.android.apksig.util.ReadableDataSink;
+import java.io.File;
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.nio.channels.ByteChannel;
+import java.nio.file.Files;
+import java.nio.file.StandardOpenOption;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.cert.X509Certificate;
+import java.util.Collections;
+import java.util.List;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public class ApkSignerTest {
+
+    /**
+     * Whether to preserve, as files, outputs of failed tests. This is useful for investigating test
+     * failures.
+     */
+    private static final boolean KEEP_FAILING_OUTPUT_AS_FILES = false;
+
+    public static void main(String[] params) throws Exception {
+        File outDir = (params.length > 0) ? new File(params[0]) : new File(".");
+        generateGoldenFiles(outDir);
+    }
+
+    private static void generateGoldenFiles(File outDir) throws Exception {
+        System.out.println(
+                "Generating golden files " + ApkSignerTest.class.getSimpleName()
+                    + " into " + outDir);
+        if (!outDir.mkdirs()) {
+            throw new IOException("Failed to create directory: " + outDir);
+        }
+        List<ApkSigner.SignerConfig> rsa2048SignerConfig =
+                Collections.singletonList(getDefaultSignerConfigFromResources("rsa-2048"));
+
+        signGolden(
+                "golden-unaligned-in.apk",
+                new File(outDir, "golden-unaligned-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig));
+        signGolden(
+                "golden-legacy-aligned-in.apk",
+                new File(outDir, "golden-legacy-aligned-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig));
+        signGolden(
+                "golden-aligned-in.apk",
+                new File(outDir, "golden-aligned-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig));
+
+        signGolden(
+                "golden-unaligned-in.apk",
+                new File(outDir, "golden-unaligned-v1-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(true)
+                        .setV2SigningEnabled(false));
+        signGolden(
+                "golden-legacy-aligned-in.apk",
+                new File(outDir, "golden-legacy-aligned-v1-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(true)
+                        .setV2SigningEnabled(false));
+        signGolden(
+                "golden-aligned-in.apk",
+                new File(outDir, "golden-aligned-v1-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(true)
+                        .setV2SigningEnabled(false));
+
+        signGolden(
+                "golden-unaligned-in.apk",
+                new File(outDir, "golden-unaligned-v2-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(false)
+                        .setV2SigningEnabled(true));
+        signGolden(
+                "golden-legacy-aligned-in.apk",
+                new File(outDir, "golden-legacy-aligned-v2-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(false)
+                        .setV2SigningEnabled(true));
+        signGolden(
+                "golden-aligned-in.apk",
+                new File(outDir, "golden-aligned-v2-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(false)
+                        .setV2SigningEnabled(true));
+
+        signGolden(
+                "golden-unaligned-in.apk",
+                new File(outDir, "golden-unaligned-v1v2-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(true)
+                        .setV2SigningEnabled(true));
+        signGolden(
+                "golden-legacy-aligned-in.apk",
+                new File(outDir, "golden-legacy-aligned-v1v2-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(true)
+                        .setV2SigningEnabled(true));
+        signGolden(
+                "golden-aligned-in.apk",
+                new File(outDir, "golden-aligned-v1v2-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(true)
+                        .setV2SigningEnabled(true));
+
+
+        signGolden(
+                "original.apk", new File(outDir, "golden-rsa-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig));
+        signGolden(
+                "original.apk", new File(outDir, "golden-rsa-minSdkVersion-1-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig).setMinSdkVersion(1));
+        signGolden(
+                "original.apk", new File(outDir, "golden-rsa-minSdkVersion-18-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig).setMinSdkVersion(18));
+        signGolden(
+                "original.apk", new File(outDir, "golden-rsa-minSdkVersion-24-out.apk"),
+                new ApkSigner.Builder(rsa2048SignerConfig).setMinSdkVersion(24));
+    }
+
+    private static void signGolden(
+            String inResourceName, File outFile, ApkSigner.Builder apkSignerBuilder)
+                    throws Exception {
+        DataSource in =
+                DataSources.asDataSource(
+                        ByteBuffer.wrap(Resources.toByteArray(ApkSigner.class, inResourceName)));
+        apkSignerBuilder
+                .setInputApk(in)
+                .setOutputApk(outFile)
+                .build()
+                .sign();
+    }
+
+    @Test
+    public void testAlignmentPreserved_Golden() throws Exception {
+        // Regression tests for preserving (mis)alignment of ZIP Local File Header data
+        // NOTE: Expected output files can be re-generated by running the "main" method.
+
+        List<ApkSigner.SignerConfig> rsa2048SignerConfig =
+                Collections.singletonList(getDefaultSignerConfigFromResources("rsa-2048"));
+
+        // Uncompressed entries in this input file are not aligned -- the file was created using
+        // the jar utility. temp4.txt entry was then manually added into the archive. This entry's
+        // ZIP Local File Header "extra" field declares that the entry's data must be aligned to
+        // 4 kB boundary, but the data isn't actually aligned in the file.
+        assertGolden(
+                "golden-unaligned-in.apk", "golden-unaligned-out.apk",
+                new ApkSigner.Builder(rsa2048SignerConfig));
+        assertGolden(
+                "golden-unaligned-in.apk", "golden-unaligned-v1-out.apk",
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(true)
+                        .setV2SigningEnabled(false));
+        assertGolden(
+                "golden-unaligned-in.apk", "golden-unaligned-v2-out.apk",
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(false)
+                        .setV2SigningEnabled(true));
+        assertGolden(
+                "golden-unaligned-in.apk", "golden-unaligned-v1v2-out.apk",
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(true)
+                        .setV2SigningEnabled(true));
+
+        // Uncompressed entries in this input file are aligned by zero-padding the "extra" field, as
+        // performed by zipalign at the time of writing. This padding technique produces ZIP
+        // archives whose "extra" field are not compliant with APPNOTE.TXT. Hence, this technique
+        // was deprecated.
+        assertGolden(
+                "golden-legacy-aligned-in.apk", "golden-legacy-aligned-out.apk",
+                new ApkSigner.Builder(rsa2048SignerConfig));
+        assertGolden(
+                "golden-legacy-aligned-in.apk", "golden-legacy-aligned-v1-out.apk",
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(true)
+                        .setV2SigningEnabled(false));
+        assertGolden(
+                "golden-legacy-aligned-in.apk", "golden-legacy-aligned-v2-out.apk",
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(false)
+                        .setV2SigningEnabled(true));
+        assertGolden(
+                "golden-legacy-aligned-in.apk", "golden-legacy-aligned-v1v2-out.apk",
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(true)
+                        .setV2SigningEnabled(true));
+
+        // Uncompressed entries in this input file are aligned by padding the "extra" field, as
+        // generated by signapk and apksigner. This padding technique produces "extra" fields which
+        // are compliant with APPNOTE.TXT.
+        assertGolden(
+                "golden-aligned-in.apk", "golden-aligned-out.apk",
+                new ApkSigner.Builder(rsa2048SignerConfig));
+        assertGolden(
+                "golden-aligned-in.apk", "golden-aligned-v1-out.apk",
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(true)
+                        .setV2SigningEnabled(false));
+        assertGolden(
+                "golden-aligned-in.apk", "golden-aligned-v2-out.apk",
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(false)
+                        .setV2SigningEnabled(true));
+        assertGolden(
+                "golden-aligned-in.apk", "golden-aligned-v1v2-out.apk",
+                new ApkSigner.Builder(rsa2048SignerConfig)
+                        .setV1SigningEnabled(true)
+                        .setV2SigningEnabled(true));
+    }
+
+    @Test
+    public void testMinSdkVersion_Golden() throws Exception {
+        // Regression tests for minSdkVersion-based signature/digest algorithm selection
+        // NOTE: Expected output files can be re-generated by running the "main" method.
+
+        List<ApkSigner.SignerConfig> rsaSignerConfig =
+                Collections.singletonList(getDefaultSignerConfigFromResources("rsa-2048"));
+        assertGolden("original.apk", "golden-rsa-out.apk", new ApkSigner.Builder(rsaSignerConfig));
+        assertGolden(
+                "original.apk", "golden-rsa-minSdkVersion-1-out.apk",
+                new ApkSigner.Builder(rsaSignerConfig).setMinSdkVersion(1));
+        assertGolden(
+                "original.apk", "golden-rsa-minSdkVersion-18-out.apk",
+                new ApkSigner.Builder(rsaSignerConfig).setMinSdkVersion(18));
+        assertGolden(
+                "original.apk", "golden-rsa-minSdkVersion-24-out.apk",
+                new ApkSigner.Builder(rsaSignerConfig).setMinSdkVersion(24));
+
+        // TODO: Add tests for DSA and ECDSA. This is non-trivial because the default
+        // implementations of these signature algorithms are non-deterministic which means output
+        // files always differ from golden files.
+    }
+
+    @Test
+    public void testRsaSignedVerifies() throws Exception {
+        List<ApkSigner.SignerConfig> signers =
+                Collections.singletonList(getDefaultSignerConfigFromResources("rsa-2048"));
+        String in = "original.apk";
+
+        // Sign so that the APK is guaranteed to verify on API Level 1+
+        DataSource out = sign(in, new ApkSigner.Builder(signers).setMinSdkVersion(1));
+        assertVerified(verifyForMinSdkVersion(out, 1));
+
+        // Sign so that the APK is guaranteed to verify on API Level 18+
+        out = sign(in, new ApkSigner.Builder(signers).setMinSdkVersion(18));
+        assertVerified(verifyForMinSdkVersion(out, 18));
+        // Does not verify on API Level 17 because RSA with SHA-256 not supported
+        assertVerificationFailure(
+                verifyForMinSdkVersion(out, 17), Issue.JAR_SIG_UNSUPPORTED_SIG_ALG);
+    }
+
+    @Test
+    public void testDsaSignedVerifies() throws Exception {
+        List<ApkSigner.SignerConfig> signers =
+                Collections.singletonList(getDefaultSignerConfigFromResources("dsa-1024"));
+        String in = "original.apk";
+
+        // Sign so that the APK is guaranteed to verify on API Level 1+
+        DataSource out = sign(in, new ApkSigner.Builder(signers).setMinSdkVersion(1));
+        assertVerified(verifyForMinSdkVersion(out, 1));
+
+        // Sign so that the APK is guaranteed to verify on API Level 21+
+        out = sign(in, new ApkSigner.Builder(signers).setMinSdkVersion(21));
+        assertVerified(verifyForMinSdkVersion(out, 21));
+        // Does not verify on API Level 20 because DSA with SHA-256 not supported
+        assertVerificationFailure(
+                verifyForMinSdkVersion(out, 20), Issue.JAR_SIG_UNSUPPORTED_SIG_ALG);
+    }
+
+    @Test
+    public void testEcSignedVerifies() throws Exception {
+        List<ApkSigner.SignerConfig> signers =
+                Collections.singletonList(getDefaultSignerConfigFromResources("ec-p256"));
+        String in = "original.apk";
+
+        // NOTE: EC APK signatures are not supported prior to API Level 18
+        // Sign so that the APK is guaranteed to verify on API Level 18+
+        DataSource out = sign(in, new ApkSigner.Builder(signers).setMinSdkVersion(18));
+        assertVerified(verifyForMinSdkVersion(out, 18));
+        // Does not verify on API Level 17 because EC not supported
+        assertVerificationFailure(
+                verifyForMinSdkVersion(out, 17), Issue.JAR_SIG_UNSUPPORTED_SIG_ALG);
+    }
+
+    @Test
+    public void testV1SigningRejectsInvalidZipEntryNames() throws Exception {
+        // ZIP/JAR entry name cannot contain CR, LF, or NUL characters when the APK is being
+        // JAR-signed.
+        List<ApkSigner.SignerConfig> signers =
+                Collections.singletonList(getDefaultSignerConfigFromResources("rsa-2048"));
+        try {
+            sign("v1-only-with-cr-in-entry-name.apk",
+                    new ApkSigner.Builder(signers).setV1SigningEnabled(true));
+            fail();
+        } catch (ApkFormatException expected) {}
+
+        try {
+            sign("v1-only-with-lf-in-entry-name.apk",
+                    new ApkSigner.Builder(signers).setV1SigningEnabled(true));
+            fail();
+        } catch (ApkFormatException expected) {}
+
+        try {
+            sign("v1-only-with-nul-in-entry-name.apk",
+                    new ApkSigner.Builder(signers).setV1SigningEnabled(true));
+            fail();
+        } catch (ApkFormatException expected) {}
+    }
+
+    @Test
+    public void testWeirdZipCompressionMethod() throws Exception {
+        // Any ZIP compression method other than STORED is treated as DEFLATED by Android.
+        // This APK declares compression method 21 (neither STORED nor DEFLATED) for CERT.RSA entry,
+        // but the entry is actually Deflate-compressed.
+        List<ApkSigner.SignerConfig> signers =
+                Collections.singletonList(getDefaultSignerConfigFromResources("rsa-2048"));
+        sign("weird-compression-method.apk", new ApkSigner.Builder(signers));
+    }
+
+    @Test
+    public void testZipCompressionMethodMismatchBetweenLfhAndCd() throws Exception {
+        // Android Package Manager ignores compressionMethod field in Local File Header and always
+        // uses the compressionMethod from Central Directory instead.
+        // In this APK, compression method of CERT.RSA is declared as STORED in Local File Header
+        // and as DEFLATED in Central Directory. The entry is actually Deflate-compressed.
+        List<ApkSigner.SignerConfig> signers =
+                Collections.singletonList(getDefaultSignerConfigFromResources("rsa-2048"));
+        sign("mismatched-compression-method.apk", new ApkSigner.Builder(signers));
+    }
+
+    /**
+     * Asserts that signing the specified golden input file using the provided signing
+     * configuration produces output identical to the specified golden output file.
+     */
+    private void assertGolden(
+            String inResourceName, String expectedOutResourceName,
+            ApkSigner.Builder apkSignerBuilder) throws Exception {
+        // Sign the provided golden input
+        DataSource out = sign(inResourceName, apkSignerBuilder);
+
+        // Assert that the output is identical to the provided golden output
+        if (out.size() > Integer.MAX_VALUE) {
+            throw new RuntimeException("Output too large: " + out.size() + " bytes");
+        }
+        ByteBuffer actualOutBuf = out.getByteBuffer(0, (int) out.size());
+
+        ByteBuffer expectedOutBuf =
+                ByteBuffer.wrap(Resources.toByteArray(getClass(), expectedOutResourceName));
+
+        int actualStartPos = actualOutBuf.position();
+        boolean identical = false;
+        if (actualOutBuf.remaining() == expectedOutBuf.remaining()) {
+            while (actualOutBuf.hasRemaining()) {
+                if (actualOutBuf.get() != expectedOutBuf.get()) {
+                    break;
+                }
+            }
+            identical = !actualOutBuf.hasRemaining();
+        }
+
+        if (identical) {
+            return;
+        }
+        actualOutBuf.position(actualStartPos);
+
+        if (KEEP_FAILING_OUTPUT_AS_FILES) {
+            File tmp = File.createTempFile(getClass().getSimpleName(), ".apk");
+            try (ByteChannel outChannel =
+                    Files.newByteChannel(
+                            tmp.toPath(),
+                            StandardOpenOption.WRITE,
+                            StandardOpenOption.CREATE,
+                            StandardOpenOption.TRUNCATE_EXISTING)) {
+                while (actualOutBuf.hasRemaining()) {
+                    outChannel.write(actualOutBuf);
+                }
+            }
+            fail(tmp + " differs from " + expectedOutResourceName);
+        } else {
+            fail("Output differs from " + expectedOutResourceName);
+        }
+    }
+
+    private DataSource sign(
+            String inResourceName, ApkSigner.Builder apkSignerBuilder) throws Exception {
+        DataSource in =
+                DataSources.asDataSource(
+                        ByteBuffer.wrap(Resources.toByteArray(getClass(), inResourceName)));
+        ReadableDataSink out = DataSinks.newInMemoryDataSink();
+        apkSignerBuilder
+                .setInputApk(in)
+                .setOutputApk(out)
+                .build()
+                .sign();
+        return out;
+    }
+
+    private static ApkVerifier.Result verifyForMinSdkVersion(DataSource apk, int minSdkVersion)
+            throws IOException, ApkFormatException, NoSuchAlgorithmException {
+        return verify(apk, minSdkVersion);
+    }
+
+    private static ApkVerifier.Result verify(DataSource apk, Integer minSdkVersionOverride)
+            throws IOException, ApkFormatException, NoSuchAlgorithmException {
+        ApkVerifier.Builder builder = new ApkVerifier.Builder(apk);
+        if (minSdkVersionOverride != null) {
+            builder.setMinCheckedPlatformVersion(minSdkVersionOverride);
+        }
+        return builder.build().verify();
+    }
+
+    private static void assertVerified(ApkVerifier.Result result) {
+        ApkVerifierTest.assertVerified(result);
+    }
+
+    private static void assertVerificationFailure(ApkVerifier.Result result, Issue expectedIssue) {
+        ApkVerifierTest.assertVerificationFailure(result, expectedIssue);
+    }
+
+    private static ApkSigner.SignerConfig getDefaultSignerConfigFromResources(
+            String keyNameInResources) throws Exception {
+        PrivateKey privateKey =
+                Resources.toPrivateKey(ApkSignerTest.class, keyNameInResources + ".pk8");
+        List<X509Certificate> certs =
+                Resources.toCertificateChain(ApkSignerTest.class, keyNameInResources + ".x509.pem");
+        return new ApkSigner.SignerConfig.Builder(keyNameInResources, privateKey, certs).build();
+    }
+}
diff --git a/src/test/java/com/android/apksig/ApkVerifierTest.java b/src/test/java/com/android/apksig/ApkVerifierTest.java
new file mode 100644
index 0000000..2bb3487
--- /dev/null
+++ b/src/test/java/com/android/apksig/ApkVerifierTest.java
@@ -0,0 +1,890 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeNoException;
+
+import com.android.apksig.ApkVerifier.Issue;
+import com.android.apksig.ApkVerifier.IssueWithParams;
+import com.android.apksig.apk.ApkFormatException;
+import com.android.apksig.internal.util.AndroidSdkVersion;
+import com.android.apksig.internal.util.HexEncoding;
+import com.android.apksig.internal.util.Resources;
+import com.android.apksig.util.DataSources;
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.PublicKey;
+import java.security.Security;
+import java.security.Signature;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.util.List;
+import java.util.Locale;
+import org.junit.Assume;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public class ApkVerifierTest {
+
+    private static final String[] DSA_KEY_NAMES = {"1024", "2048", "3072"};
+    private static final String[] DSA_KEY_NAMES_1024_AND_SMALLER = {"1024"};
+    private static final String[] DSA_KEY_NAMES_2048_AND_LARGER = {"2048", "3072"};
+    private static final String[] EC_KEY_NAMES = {"p256", "p384", "p521"};
+    private static final String[] RSA_KEY_NAMES = {"1024", "2048", "3072", "4096", "8192", "16384"};
+    private static final String[] RSA_KEY_NAMES_2048_AND_LARGER =
+            {"2048", "3072", "4096", "8192", "16384"};
+
+    @Test
+    public void testOriginalAccepted() throws Exception {
+        // APK signed with v1 and v2 schemes. Obtained by building
+        // cts/hostsidetests/appsecurity/test-apps/tinyapp.
+        // This APK is used as a basis for many of the other tests here. Hence, we check that this
+        // APK verifies.
+        assertVerified(verify("original.apk"));
+    }
+
+    @Test
+    public void testV1OneSignerMD5withRSAAccepted() throws Exception {
+        assumeThatMd5AcceptedInPkcs7Signature();
+
+        // APK signed with v1 scheme only, one signer
+        assertVerifiedForEach(
+                "v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-%s.apk", RSA_KEY_NAMES);
+        assertVerifiedForEach(
+                "v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-%s.apk", RSA_KEY_NAMES);
+    }
+
+    @Test
+    public void testV1OneSignerSHA1withRSAAccepted() throws Exception {
+        // APK signed with v1 scheme only, one signer
+        assertVerifiedForEach(
+                "v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-%s.apk", RSA_KEY_NAMES);
+        assertVerifiedForEach(
+                "v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-%s.apk", RSA_KEY_NAMES);
+    }
+
+    @Test
+    public void testV1OneSignerSHA224withRSAAccepted() throws Exception {
+        // APK signed with v1 scheme only, one signer
+        assertVerifiedForEach(
+                "v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-%s.apk", RSA_KEY_NAMES);
+        assertVerifiedForEach(
+                "v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-%s.apk", RSA_KEY_NAMES);
+    }
+
+    @Test
+    public void testV1OneSignerSHA256withRSAAccepted() throws Exception {
+        // APK signed with v1 scheme only, one signer
+        assertVerifiedForEach(
+                "v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-%s.apk", RSA_KEY_NAMES);
+        assertVerifiedForEach(
+                "v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-%s.apk", RSA_KEY_NAMES);
+    }
+
+    @Test
+    public void testV1OneSignerSHA384withRSAAccepted() throws Exception {
+        // APK signed with v1 scheme only, one signer
+        assertVerifiedForEach(
+                "v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-%s.apk", RSA_KEY_NAMES);
+        assertVerifiedForEach(
+                "v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-%s.apk", RSA_KEY_NAMES);
+    }
+
+    @Test
+    public void testV1OneSignerSHA512withRSAVerifies() throws Exception {
+        // APK signed with v1 scheme only, one signer
+        assertVerifiedForEach(
+                "v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-%s.apk", RSA_KEY_NAMES);
+        assertVerifiedForEach(
+                "v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-%s.apk", RSA_KEY_NAMES);
+    }
+
+    @Test
+    public void testV1OneSignerSHA1withECDSAAccepted() throws Exception {
+        // APK signed with v1 scheme only, one signer
+        assertVerifiedForEach(
+                "v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-%s.apk", EC_KEY_NAMES);
+        assertVerifiedForEach(
+                "v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-%s.apk", EC_KEY_NAMES);
+    }
+
+    @Test
+    public void testV1OneSignerSHA224withECDSAAccepted() throws Exception {
+        // APK signed with v1 scheme only, one signer
+        assertVerifiedForEach(
+                "v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-%s.apk", EC_KEY_NAMES);
+        assertVerifiedForEach(
+                "v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-%s.apk", EC_KEY_NAMES);
+    }
+
+    @Test
+    public void testV1OneSignerSHA256withECDSAAccepted() throws Exception {
+        // APK signed with v1 scheme only, one signer
+        assertVerifiedForEach(
+                "v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-%s.apk", EC_KEY_NAMES);
+        assertVerifiedForEach(
+                "v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-%s.apk", EC_KEY_NAMES);
+    }
+
+    @Test
+    public void testV1OneSignerSHA384withECDSAAccepted() throws Exception {
+        // APK signed with v1 scheme only, one signer
+        assertVerifiedForEach(
+                "v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-%s.apk", EC_KEY_NAMES);
+        assertVerifiedForEach(
+                "v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-%s.apk", EC_KEY_NAMES);
+    }
+
+    @Test
+    public void testV1OneSignerSHA512withECDSAAccepted() throws Exception {
+        // APK signed with v1 scheme only, one signer
+        assertVerifiedForEach(
+                "v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-%s.apk", EC_KEY_NAMES);
+        assertVerifiedForEach(
+                "v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-%s.apk", EC_KEY_NAMES);
+    }
+
+    @Test
+    public void testV1OneSignerSHA1withDSAAccepted() throws Exception {
+        // APK signed with v1 scheme only, one signer
+        // NOTE: This test is split into two because JCA Providers shipping with OpenJDK refuse to
+        // verify DSA signatures with keys too long for the SHA-1 digest.
+        assertVerifiedForEach(
+                "v1-only-with-dsa-sha1-1.2.840.10040.4.1-%s.apk", DSA_KEY_NAMES_1024_AND_SMALLER);
+        assertVerifiedForEach(
+                "v1-only-with-dsa-sha1-1.2.840.10040.4.3-%s.apk", DSA_KEY_NAMES_1024_AND_SMALLER);
+    }
+
+    @Test
+    public void testV1OneSignerSHA1withDSAAcceptedWithKeysTooLongForDigest() throws Exception {
+        // APK signed with v1 scheme only, one signer
+
+        // OpenJDK's default implementation of Signature.SHA1withDSA refuses to verify signatures
+        // created with keys too long for the digest used. Android Package Manager does not reject
+        // such signatures. We thus skip this test if Signature.SHA1withDSA exhibits this issue.
+        PublicKey publicKey =
+                Resources.toCertificate(getClass(), "dsa-2048.x509.pem").getPublicKey();
+        Signature s = Signature.getInstance("SHA1withDSA");
+        try {
+            s.initVerify(publicKey);
+        } catch (InvalidKeyException e) {
+            assumeNoException(e);
+        }
+
+        assertVerifiedForEach(
+                "v1-only-with-dsa-sha1-1.2.840.10040.4.1-%s.apk", DSA_KEY_NAMES_2048_AND_LARGER);
+        assertVerifiedForEach(
+                "v1-only-with-dsa-sha1-1.2.840.10040.4.3-%s.apk", DSA_KEY_NAMES_2048_AND_LARGER);
+    }
+
+    @Test
+    public void testV1OneSignerSHA224withDSAAccepted() throws Exception {
+        // APK signed with v1 scheme only, one signer
+        // NOTE: This test is split into two because JCA Providers shipping with OpenJDK refuse to
+        // verify DSA signatures with keys too long for the SHA-224 digest.
+        assertVerifiedForEach(
+                "v1-only-with-dsa-sha224-1.2.840.10040.4.1-%s.apk", DSA_KEY_NAMES_1024_AND_SMALLER);
+        assertVerifiedForEach(
+                "v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-%s.apk",
+                DSA_KEY_NAMES_1024_AND_SMALLER);
+    }
+
+    @Test
+    public void testV1OneSignerSHA224withDSAAcceptedWithKeysTooLongForDigest() throws Exception {
+        // APK signed with v1 scheme only, one signer
+
+        // OpenJDK's default implementation of Signature.SHA224withDSA refuses to verify signatures
+        // created with keys too long for the digest used. Android Package Manager does not reject
+        // such signatures. We thus skip this test if Signature.SHA224withDSA exhibits this issue.
+        PublicKey publicKey =
+                Resources.toCertificate(getClass(), "dsa-2048.x509.pem").getPublicKey();
+        Signature s = Signature.getInstance("SHA224withDSA");
+        try {
+            s.initVerify(publicKey);
+        } catch (InvalidKeyException e) {
+            assumeNoException(e);
+        }
+        assertVerifiedForEach(
+                "v1-only-with-dsa-sha224-1.2.840.10040.4.1-%s.apk", DSA_KEY_NAMES_2048_AND_LARGER);
+        assertVerifiedForEach(
+                "v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-%s.apk",
+                DSA_KEY_NAMES_2048_AND_LARGER);
+    }
+
+    @Test
+    public void testV1OneSignerSHA256withDSAAccepted() throws Exception {
+        // APK signed with v1 scheme only, one signer
+        assertVerifiedForEach(
+                "v1-only-with-dsa-sha256-1.2.840.10040.4.1-%s.apk", DSA_KEY_NAMES);
+        assertVerifiedForEach(
+                "v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-%s.apk", DSA_KEY_NAMES);
+    }
+
+    @Test
+    public void testV2StrippedRejected() throws Exception {
+        // APK signed with v1 and v2 schemes, but v2 signature was stripped from the file (by using
+        // zipalign).
+        // This should fail because the v1 signature indicates that the APK was supposed to be
+        // signed with v2 scheme as well, making the platform's anti-stripping protections reject
+        // the APK.
+        assertVerificationFailure(
+                "v2-stripped.apk", Issue.JAR_SIG_MISSING_APK_SIG_REFERENCED);
+
+        // Similar to above, but the X-Android-APK-Signed anti-stripping header in v1 signature
+        // lists unknown signature schemes in addition to APK Signature Scheme v2. Unknown schemes
+        // should be ignored.
+        assertVerificationFailure(
+                "v2-stripped-with-ignorable-signing-schemes.apk",
+                Issue.JAR_SIG_MISSING_APK_SIG_REFERENCED);
+    }
+
+    @Test
+    public void testV2OneSignerOneSignatureAccepted() throws Exception {
+        // APK signed with v2 scheme only, one signer, one signature
+        assertVerifiedForEachForMinSdkVersion(
+                "v2-only-with-dsa-sha256-%s.apk", DSA_KEY_NAMES, AndroidSdkVersion.N);
+        assertVerifiedForEachForMinSdkVersion(
+                "v2-only-with-ecdsa-sha256-%s.apk", EC_KEY_NAMES, AndroidSdkVersion.N);
+        assertVerifiedForEachForMinSdkVersion(
+                "v2-only-with-rsa-pkcs1-sha256-%s.apk", RSA_KEY_NAMES, AndroidSdkVersion.N);
+        // RSA-PSS signatures tested in a separate test below
+
+        // DSA with SHA-512 is not supported by Android platform and thus APK Signature Scheme v2
+        // does not support that either
+        // assertInstallSucceedsForEach("v2-only-with-dsa-sha512-%s.apk", DSA_KEY_NAMES);
+        assertVerifiedForEachForMinSdkVersion(
+                "v2-only-with-ecdsa-sha512-%s.apk", EC_KEY_NAMES, AndroidSdkVersion.N);
+        assertVerifiedForEachForMinSdkVersion(
+                "v2-only-with-rsa-pkcs1-sha512-%s.apk", RSA_KEY_NAMES, AndroidSdkVersion.N);
+    }
+
+    @Test
+    public void testV2OneSignerOneRsaPssSignatureAccepted() throws Exception {
+        assumeThatRsaPssAvailable();
+        // APK signed with v2 scheme only, one signer, one signature
+        assertVerifiedForEachForMinSdkVersion(
+                "v2-only-with-rsa-pss-sha256-%s.apk", RSA_KEY_NAMES, AndroidSdkVersion.N);
+        assertVerifiedForEachForMinSdkVersion(
+                "v2-only-with-rsa-pss-sha512-%s.apk",
+                RSA_KEY_NAMES_2048_AND_LARGER, // 1024-bit key is too short for PSS with SHA-512
+                AndroidSdkVersion.N);
+    }
+
+    @Test
+    public void testV2SignatureDoesNotMatchSignedDataRejected() throws Exception {
+        // APK signed with v2 scheme only, but the signature over signed-data does not verify
+
+        // Bitflip in certificate field inside signed-data. Based on
+        // v2-only-with-dsa-sha256-1024.apk.
+        assertVerificationFailure(
+                "v2-only-with-dsa-sha256-1024-sig-does-not-verify.apk",
+                Issue.V2_SIG_DID_NOT_VERIFY);
+
+        // Signature claims to be RSA PKCS#1 v1.5 with SHA-256, but is actually using SHA-512.
+        // Based on v2-only-with-rsa-pkcs1-sha256-2048.apk.
+        assertVerificationFailure(
+                "v2-only-with-rsa-pkcs1-sha256-2048-sig-does-not-verify.apk",
+                Issue.V2_SIG_VERIFY_EXCEPTION);
+
+        // Bitflip in the ECDSA signature. Based on v2-only-with-ecdsa-sha256-p256.apk.
+        assertVerificationFailure(
+                "v2-only-with-ecdsa-sha256-p256-sig-does-not-verify.apk",
+                Issue.V2_SIG_DID_NOT_VERIFY);
+    }
+
+    @Test
+    public void testV2RsaPssSignatureDoesNotMatchSignedDataRejected() throws Exception {
+        assumeThatRsaPssAvailable();
+
+        // APK signed with v2 scheme only, but the signature over signed-data does not verify.
+
+        // Signature claims to be RSA PSS with SHA-256 and 32 bytes of salt, but is actually using 0
+        // bytes of salt. Based on v2-only-with-rsa-pkcs1-sha256-2048.apk. Obtained by modifying APK
+        // signer to use the wrong amount of salt.
+        assertVerificationFailure(
+                "v2-only-with-rsa-pss-sha256-2048-sig-does-not-verify.apk",
+                Issue.V2_SIG_DID_NOT_VERIFY);
+    }
+
+    @Test
+    public void testV2ContentDigestMismatchRejected() throws Exception {
+        // APK signed with v2 scheme only, but the digest of contents does not match the digest
+        // stored in signed-data
+        ApkVerifier.Issue error = Issue.V2_SIG_APK_DIGEST_DID_NOT_VERIFY;
+
+        // Based on v2-only-with-rsa-pkcs1-sha512-4096.apk. Obtained by modifying APK signer to
+        // flip the leftmost bit in content digest before signing signed-data.
+        assertVerificationFailure(
+                "v2-only-with-rsa-pkcs1-sha512-4096-digest-mismatch.apk", error);
+
+        // Based on v2-only-with-ecdsa-sha256-p256.apk. Obtained by modifying APK signer to flip the
+        // leftmost bit in content digest before signing signed-data.
+        assertVerificationFailure(
+                "v2-only-with-ecdsa-sha256-p256-digest-mismatch.apk", error);
+    }
+
+    @Test
+    public void testNoApkSignatureSchemeBlockRejected() throws Exception {
+        // APK signed with v2 scheme only, but the rules for verifying APK Signature Scheme v2
+        // signatures say that this APK must not be verified using APK Signature Scheme v2.
+
+        // Obtained from v2-only-with-rsa-pkcs1-sha512-4096.apk by flipping a bit in the magic
+        // field in the footer of APK Signing Block. This makes the APK Signing Block disappear.
+        assertVerificationFailure(
+                "v2-only-wrong-apk-sig-block-magic.apk",
+                Issue.JAR_SIG_NO_MANIFEST);
+
+        // Obtained by modifying APK signer to insert "GARBAGE" between ZIP Central Directory and
+        // End of Central Directory. The APK is otherwise fine and is signed with APK Signature
+        // Scheme v2. Based on v2-only-with-rsa-pkcs1-sha256.apk.
+        assertVerificationFailure(
+                "v2-only-garbage-between-cd-and-eocd.apk",
+                Issue.JAR_SIG_NO_MANIFEST);
+
+        // Obtained by modifying the size in APK Signature Block header. Based on
+        // v2-only-with-ecdsa-sha512-p521.apk.
+        assertVerificationFailure(
+                "v2-only-apk-sig-block-size-mismatch.apk",
+                Issue.JAR_SIG_NO_MANIFEST);
+
+        // Obtained by modifying the ID under which APK Signature Scheme v2 Block is stored in
+        // APK Signing Block and by modifying the APK signer to not insert anti-stripping
+        // protections into JAR Signature. The APK should appear as having no APK Signature Scheme
+        // v2 Block and should thus successfully verify using JAR Signature Scheme.
+        assertVerified(verify("v1-with-apk-sig-block-but-without-apk-sig-scheme-v2-block.apk"));
+    }
+
+    @Test(expected = ApkFormatException.class)
+    public void testTruncatedZipCentralDirectoryRejected() throws Exception {
+        // Obtained by modifying APK signer to truncate the ZIP Central Directory by one byte. The
+        // APK is otherwise fine and is signed with APK Signature Scheme v2. Based on
+        // v2-only-with-rsa-pkcs1-sha256.apk
+        verify("v2-only-truncated-cd.apk");
+    }
+
+    @Test
+    public void testV2UnknownPairIgnoredInApkSigningBlock() throws Exception {
+        // Obtained by modifying APK signer to emit an unknown ID-value pair into APK Signing Block
+        // before the ID-value pair containing the APK Signature Scheme v2 Block. The unknown
+        // ID-value should be ignored.
+        assertVerified(
+                verifyForMinSdkVersion(
+                        "v2-only-unknown-pair-in-apk-sig-block.apk", AndroidSdkVersion.N));
+    }
+
+    @Test
+    public void testV2UnknownSignatureAlgorithmsIgnored() throws Exception {
+        // APK is signed with a known signature algorithm and with a couple of unknown ones.
+        // Obtained by modifying APK signer to use "unknown" signature algorithms in addition to
+        // known ones.
+        assertVerified(
+                verifyForMinSdkVersion(
+                        "v2-only-with-ignorable-unsupported-sig-algs.apk", AndroidSdkVersion.N));
+    }
+
+    @Test
+    public void testV2MismatchBetweenSignaturesAndDigestsBlockRejected() throws Exception {
+        // APK is signed with a single signature algorithm, but the digests block claims that it is
+        // signed with two different signature algorithms. Obtained by modifying APK Signer to
+        // emit an additional digest record with signature algorithm 0x12345678.
+        assertVerificationFailure(
+                "v2-only-signatures-and-digests-block-mismatch.apk",
+                Issue.V2_SIG_SIG_ALG_MISMATCH_BETWEEN_SIGNATURES_AND_DIGESTS_RECORDS);
+    }
+
+    @Test
+    public void testV2MismatchBetweenPublicKeyAndCertificateRejected() throws Exception {
+        // APK is signed with v2 only. The public key field does not match the public key in the
+        // leaf certificate. Obtained by modifying APK signer to write out a modified leaf
+        // certificate where the RSA modulus has a bitflip.
+        assertVerificationFailure(
+                "v2-only-cert-and-public-key-mismatch.apk",
+                Issue.V2_SIG_PUBLIC_KEY_MISMATCH_BETWEEN_CERTIFICATE_AND_SIGNATURES_RECORD);
+    }
+
+    @Test
+    public void testV2SignerBlockWithNoCertificatesRejected() throws Exception {
+        // APK is signed with v2 only. There are no certificates listed in the signer block.
+        // Obtained by modifying APK signer to output no certificates.
+        assertVerificationFailure(
+                "v2-only-no-certs-in-sig.apk", Issue.V2_SIG_NO_CERTIFICATES);
+    }
+
+    @Test
+    public void testTwoSignersAccepted() throws Exception {
+        // APK signed by two different signers
+        assertVerified(verify("two-signers.apk"));
+        assertVerified(verify("v1-only-two-signers.apk"));
+        assertVerified(verifyForMinSdkVersion("v2-only-two-signers.apk", AndroidSdkVersion.N));
+    }
+
+    @Test
+    public void testV2TwoSignersRejectedWhenOneBroken() throws Exception {
+        // Bitflip in the ECDSA signature of second signer. Based on two-signers.apk.
+        // This asserts that breakage in any signer leads to rejection of the APK.
+        assertVerificationFailure(
+                "two-signers-second-signer-v2-broken.apk", Issue.V2_SIG_DID_NOT_VERIFY);
+    }
+
+    @Test
+    public void testV2TwoSignersRejectedWhenOneWithoutSignatures() throws Exception {
+        // APK v2-signed by two different signers. However, there are no signatures for the second
+        // signer.
+        assertVerificationFailure(
+                "v2-only-two-signers-second-signer-no-sig.apk", Issue.V2_SIG_NO_SIGNATURES);
+    }
+
+    @Test
+    public void testV2TwoSignersRejectedWhenOneWithoutSupportedSignatures() throws Exception {
+        // APK v2-signed by two different signers. However, there are no supported signatures for
+        // the second signer.
+        assertVerificationFailure(
+                "v2-only-two-signers-second-signer-no-supported-sig.apk",
+                Issue.V2_SIG_NO_SUPPORTED_SIGNATURES);
+    }
+
+    @Test
+    public void testCorrectCertUsedFromPkcs7SignedDataCertsSet() throws Exception {
+        // Obtained by prepending the rsa-1024 certificate to the PKCS#7 SignedData certificates set
+        // of v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-2048.apk META-INF/CERT.RSA. The certs
+        // (in the order of appearance in the file) are thus: rsa-1024, rsa-2048. The package's
+        // signing cert is rsa-2048.
+        ApkVerifier.Result result = verify("v1-only-pkcs7-cert-bag-first-cert-not-used.apk");
+        assertVerified(result);
+        List<X509Certificate> signingCerts = result.getSignerCertificates();
+        assertEquals(1, signingCerts.size());
+        assertEquals(
+                "fb5dbd3c669af9fc236c6991e6387b7f11ff0590997f22d0f5c74ff40e04fca8",
+                HexEncoding.encode(sha256(signingCerts.get(0).getEncoded())));
+    }
+
+    @Test
+    public void testV1SchemeSignatureCertNotReencoded() throws Exception {
+        // Regression test for b/30148997 and b/18228011. When PackageManager does not preserve the
+        // original encoded form of signing certificates, bad things happen, such as rejection of
+        // completely valid updates to apps. The issue in b/30148997 and b/18228011 was that
+        // PackageManager started re-encoding signing certs into DER. This normally produces exactly
+        // the original form because X.509 certificates are supposed to be DER-encoded. However, a
+        // small fraction of Android apps uses X.509 certificates which are not DER-encoded. For
+        // such apps, re-encoding into DER changes the serialized form of the certificate, creating
+        // a mismatch with the serialized form stored in the PackageManager database, leading to the
+        // rejection of updates for the app.
+        //
+        // v1-only-with-rsa-1024-cert-not-der.apk cert's signature is not DER-encoded. It is
+        // BER-encoded, with length encoded as two bytes instead of just one.
+        // v1-only-with-rsa-1024-cert-not-der.apk META-INF/CERT.RSA was obtained from
+        // v1-only-with-rsa-1024.apk META-INF/CERT.RSA by manually modifying the ASN.1 structure.
+        ApkVerifier.Result result = verify("v1-only-with-rsa-1024-cert-not-der.apk");
+
+        // On JDK 8u131 and newer, when the default (SUN) X.509 CertificateFactory implementation is
+        // used, PKCS #7 signature verification fails because the certificate is not DER-encoded.
+        // This contrived block of code disables this test in this scenario.
+        if (!result.isVerified()) {
+            List<ApkVerifier.Result.V1SchemeSignerInfo> signers = result.getV1SchemeSigners();
+            if (signers.size() > 0) {
+                ApkVerifier.Result.V1SchemeSignerInfo signer = signers.get(0);
+                for (IssueWithParams issue : signer.getErrors()) {
+                    if (issue.getIssue() == Issue.JAR_SIG_PARSE_EXCEPTION) {
+                        CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
+                        if ("SUN".equals(certFactory.getProvider().getName())) {
+                            Throwable exception = (Throwable) issue.getParams()[1];
+                            Throwable e = exception;
+                            while (e != null) {
+                                String msg = e.getMessage();
+                                e = e.getCause();
+                                if ((msg != null)
+                                        && (msg.contains("Redundant length bytes found"))) {
+                                    Assume.assumeNoException(exception);
+                                }
+                            }
+                        }
+                        break;
+                    }
+                }
+            }
+        }
+
+        assertVerified(result);
+        List<X509Certificate> signingCerts = result.getSignerCertificates();
+        assertEquals(1, signingCerts.size());
+        assertEquals(
+                "c5d4535a7e1c8111687a8374b2198da6f5ff8d811a7a25aa99ef060669342fa9",
+                HexEncoding.encode(sha256(signingCerts.get(0).getEncoded())));
+    }
+
+    @Test
+    public void testV1SchemeSignatureCertNotReencoded2() throws Exception {
+        // Regression test for b/30148997 and b/18228011. When PackageManager does not preserve the
+        // original encoded form of signing certificates, bad things happen, such as rejection of
+        // completely valid updates to apps. The issue in b/30148997 and b/18228011 was that
+        // PackageManager started re-encoding signing certs into DER. This normally produces exactly
+        // the original form because X.509 certificates are supposed to be DER-encoded. However, a
+        // small fraction of Android apps uses X.509 certificates which are not DER-encoded. For
+        // such apps, re-encoding into DER changes the serialized form of the certificate, creating
+        // a mismatch with the serialized form stored in the PackageManager database, leading to the
+        // rejection of updates for the app.
+        //
+        // v1-only-with-rsa-1024-cert-not-der2.apk cert's signature is not DER-encoded. It is
+        // BER-encoded, with the BIT STRING value containing an extraneous leading 0x00 byte.
+        // v1-only-with-rsa-1024-cert-not-der2.apk META-INF/CERT.RSA was obtained from
+        // v1-only-with-rsa-1024.apk META-INF/CERT.RSA by manually modifying the ASN.1 structure.
+        ApkVerifier.Result result = verify("v1-only-with-rsa-1024-cert-not-der2.apk");
+        assertVerified(result);
+        List<X509Certificate> signingCerts = result.getSignerCertificates();
+        assertEquals(1, signingCerts.size());
+        assertEquals(
+                "da3da398de674541313deed77218ce94798531ea5131bb9b1bb4063ba4548cfb",
+                HexEncoding.encode(sha256(signingCerts.get(0).getEncoded())));
+    }
+
+    @Test
+    public void testMaxSizedZipEocdCommentAccepted() throws Exception {
+        // Obtained by modifying apksigner to produce a max-sized (0xffff bytes long) ZIP End of
+        // Central Directory comment, and signing the original.apk using the modified apksigner.
+        assertVerified(verify("v1-only-max-sized-eocd-comment.apk"));
+        assertVerified(
+                verifyForMinSdkVersion("v2-only-max-sized-eocd-comment.apk", AndroidSdkVersion.N));
+    }
+
+    @Test
+    public void testEmptyApk() throws Exception {
+        // Unsigned empty ZIP archive
+        try {
+            verifyForMinSdkVersion("empty-unsigned.apk", 1);
+            fail("ApkFormatException should've been thrown");
+        } catch (ApkFormatException expected) {}
+
+        // JAR-signed empty ZIP archive
+        try {
+            verifyForMinSdkVersion("v1-only-empty.apk", 18);
+            fail("ApkFormatException should've been thrown");
+        } catch (ApkFormatException expected) {}
+
+        // APK Signature Scheme v2 signed empty ZIP archive
+        try {
+            verifyForMinSdkVersion("v2-only-empty.apk", AndroidSdkVersion.N);
+            fail("ApkFormatException should've been thrown");
+        } catch (ApkFormatException expected) {}
+    }
+
+    @Test
+    public void testTargetSandboxVersion2AndHigher() throws Exception {
+        // This APK (and its variants below) use minSdkVersion 18, meaning it needs to be signed
+        // with v1 and v2 schemes
+
+        // This APK is signed with v1 and v2 schemes and thus should verify
+        assertVerified(verify("targetSandboxVersion-2.apk"));
+
+        // v1 signature is needed only if minSdkVersion is lower than 24
+        assertVerificationFailure(
+                verify("v2-only-targetSandboxVersion-2.apk"), Issue.JAR_SIG_NO_MANIFEST);
+        assertVerified(verifyForMinSdkVersion("v2-only-targetSandboxVersion-2.apk", 24));
+
+        // v2 signature is required
+        assertVerificationFailure(
+                verify("v1-only-targetSandboxVersion-2.apk"),
+                Issue.NO_SIG_FOR_TARGET_SANDBOX_VERSION);
+        assertVerificationFailure(
+                verify("unsigned-targetSandboxVersion-2.apk"),
+                Issue.NO_SIG_FOR_TARGET_SANDBOX_VERSION);
+
+        // minSdkVersion 28, meaning v1 signature not needed
+        assertVerified(verify("v2-only-targetSandboxVersion-3.apk"));
+    }
+
+    @Test
+    public void testV1MultipleDigestAlgsInManifestAndSignatureFile() throws Exception {
+        // MANIFEST.MF contains SHA-1 and SHA-256 digests for each entry, .SF contains only SHA-1
+        // digests. This file was obtained by:
+        //   jarsigner -sigalg SHA256withRSA -digestalg SHA-256 ... <file> ...
+        //   jarsigner -sigalg SHA1withRSA -digestalg SHA1 ... <same file> ...
+        assertVerified(verify("v1-sha1-sha256-manifest-and-sha1-sf.apk"));
+
+        // MANIFEST.MF and .SF contain SHA-1 and SHA-256 digests for each entry. This file was
+        // obtained by modifying apksigner to output multiple digests.
+        assertVerified(verify("v1-sha1-sha256-manifest-and-sf.apk"));
+
+        // One of the digests is wrong in either MANIFEST.MF or .SF. These files were obtained by
+        // modifying apksigner to output multiple digests and to flip a bit to create a wrong
+        // digest.
+
+        // SHA-1 digests in MANIFEST.MF are wrong, but SHA-256 digests are OK.
+        // The APK will fail to verify on API Level 17 and lower, but will verify on API Level 18
+        // and higher.
+        assertVerificationFailure(
+                verify("v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-manifest.apk"),
+                Issue.JAR_SIG_ZIP_ENTRY_DIGEST_DID_NOT_VERIFY);
+        assertVerificationFailure(
+                verifyForMaxSdkVersion(
+                        "v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-manifest.apk", 17),
+                Issue.JAR_SIG_ZIP_ENTRY_DIGEST_DID_NOT_VERIFY);
+        assertVerified(
+                verifyForMinSdkVersion(
+                        "v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-manifest.apk", 18));
+
+        // SHA-1 digests in .SF are wrong, but SHA-256 digests are OK.
+        // The APK will fail to verify on API Level 17 and lower, but will verify on API Level 18
+        // and higher.
+        assertVerificationFailure(
+                verify("v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-sf.apk"),
+                Issue.JAR_SIG_MANIFEST_SECTION_DIGEST_DID_NOT_VERIFY);
+        assertVerificationFailure(
+                verifyForMaxSdkVersion(
+                        "v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-sf.apk", 17),
+                Issue.JAR_SIG_MANIFEST_SECTION_DIGEST_DID_NOT_VERIFY);
+        assertVerified(
+                verifyForMinSdkVersion(
+                        "v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-sf.apk", 18));
+
+        // SHA-256 digests in MANIFEST.MF are wrong, but SHA-1 digests are OK.
+        // The APK will fail to verify on API Level 18 and higher, but will verify on API Level 17
+        // and lower.
+        assertVerificationFailure(
+                verify("v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-manifest.apk"),
+                Issue.JAR_SIG_ZIP_ENTRY_DIGEST_DID_NOT_VERIFY);
+        assertVerificationFailure(
+                verifyForMinSdkVersion(
+                        "v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-manifest.apk", 18),
+                Issue.JAR_SIG_ZIP_ENTRY_DIGEST_DID_NOT_VERIFY);
+        assertVerified(
+                verifyForMaxSdkVersion(
+                        "v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-manifest.apk", 17));
+
+        // SHA-256 digests in .SF are wrong, but SHA-1 digests are OK.
+        // The APK will fail to verify on API Level 18 and higher, but will verify on API Level 17
+        // and lower.
+        assertVerificationFailure(
+                verify("v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-sf.apk"),
+                Issue.JAR_SIG_MANIFEST_SECTION_DIGEST_DID_NOT_VERIFY);
+        assertVerificationFailure(
+                verifyForMinSdkVersion(
+                        "v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-sf.apk", 18),
+                Issue.JAR_SIG_MANIFEST_SECTION_DIGEST_DID_NOT_VERIFY);
+        assertVerified(
+                verifyForMaxSdkVersion(
+                        "v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-sf.apk", 17));
+    }
+
+    @Test
+    public void testV1WithUnsupportedCharacterInZipEntryName() throws Exception {
+        // Android Package Manager does not support ZIP entry names containing CR or LF
+        assertVerificationFailure(
+                verify("v1-only-with-cr-in-entry-name.apk"),
+                Issue.JAR_SIG_UNNNAMED_MANIFEST_SECTION);
+        assertVerificationFailure(
+                verify("v1-only-with-lf-in-entry-name.apk"),
+                Issue.JAR_SIG_UNNNAMED_MANIFEST_SECTION);
+    }
+
+    @Test
+    public void testWeirdZipCompressionMethod() throws Exception {
+        // Any ZIP compression method other than STORED is treated as DEFLATED by Android.
+        // This APK declares compression method 21 (neither STORED nor DEFLATED) for CERT.RSA entry,
+        // but the entry is actually Deflate-compressed.
+        assertVerified(verify("weird-compression-method.apk"));
+    }
+
+    @Test
+    public void testZipCompressionMethodMismatchBetweenLfhAndCd() throws Exception {
+        // Android Package Manager ignores compressionMethod field in Local File Header and always
+        // uses the compressionMethod from Central Directory instead.
+        // In this APK, compression method of CERT.RSA is declared as STORED in Local File Header
+        // and as DEFLATED in Central Directory. The entry is actually Deflate-compressed.
+        assertVerified(verify("mismatched-compression-method.apk"));
+    }
+
+    private ApkVerifier.Result verify(String apkFilenameInResources)
+            throws IOException, ApkFormatException, NoSuchAlgorithmException {
+        return verify(apkFilenameInResources, null, null);
+    }
+
+    private ApkVerifier.Result verifyForMinSdkVersion(
+            String apkFilenameInResources, int minSdkVersion)
+                    throws IOException, ApkFormatException, NoSuchAlgorithmException {
+        return verify(apkFilenameInResources, minSdkVersion, null);
+    }
+
+    private ApkVerifier.Result verifyForMaxSdkVersion(
+            String apkFilenameInResources, int maxSdkVersion)
+                    throws IOException, ApkFormatException, NoSuchAlgorithmException {
+        return verify(apkFilenameInResources, null, maxSdkVersion);
+    }
+
+    private ApkVerifier.Result verify(
+            String apkFilenameInResources,
+            Integer minSdkVersionOverride,
+            Integer maxSdkVersionOverride)
+                    throws IOException, ApkFormatException, NoSuchAlgorithmException {
+        byte[] apkBytes = Resources.toByteArray(getClass(), apkFilenameInResources);
+
+        ApkVerifier.Builder builder =
+                new ApkVerifier.Builder(DataSources.asDataSource(ByteBuffer.wrap(apkBytes)));
+        if (minSdkVersionOverride != null) {
+            builder.setMinCheckedPlatformVersion(minSdkVersionOverride);
+        }
+        if (maxSdkVersionOverride != null) {
+            builder.setMaxCheckedPlatformVersion(maxSdkVersionOverride);
+        }
+        return builder.build().verify();
+    }
+
+    static void assertVerified(ApkVerifier.Result result) {
+        if (result.isVerified()) {
+            return;
+        }
+
+        StringBuilder msg = new StringBuilder();
+        for (IssueWithParams issue : result.getErrors()) {
+            if (msg.length() > 0) {
+                msg.append('\n');
+            }
+            msg.append(issue);
+        }
+        for (ApkVerifier.Result.V1SchemeSignerInfo signer : result.getV1SchemeSigners()) {
+            String signerName = signer.getName();
+            for (IssueWithParams issue : signer.getErrors()) {
+                if (msg.length() > 0) {
+                    msg.append('\n');
+                }
+                msg.append("JAR signer ").append(signerName).append(": ").append(issue);
+            }
+        }
+        for (ApkVerifier.Result.V2SchemeSignerInfo signer : result.getV2SchemeSigners()) {
+            String signerName = "signer #" + (signer.getIndex() + 1);
+            for (IssueWithParams issue : signer.getErrors()) {
+                if (msg.length() > 0) {
+                    msg.append('\n');
+                }
+                msg.append("APK Signature Scheme v2 signer ")
+                        .append(signerName).append(": ").append(issue);
+            }
+        }
+
+        fail("APK did not verify: " + msg);
+    }
+
+    private void assertVerified(
+            String apkFilenameInResources,
+            Integer minSdkVersionOverride,
+            Integer maxSdkVersionOverride) throws Exception {
+        assertVerified(
+                verify(apkFilenameInResources, minSdkVersionOverride, maxSdkVersionOverride));
+    }
+
+    static void assertVerificationFailure(ApkVerifier.Result result, Issue expectedIssue) {
+        if (result.isVerified()) {
+            fail("APK verification succeeded instead of failing with " + expectedIssue);
+            return;
+        }
+
+        StringBuilder msg = new StringBuilder();
+        for (IssueWithParams issue : result.getErrors()) {
+            if (expectedIssue.equals(issue.getIssue())) {
+                return;
+            }
+            if (msg.length() > 0) {
+                msg.append('\n');
+            }
+            msg.append(issue);
+        }
+        for (ApkVerifier.Result.V1SchemeSignerInfo signer : result.getV1SchemeSigners()) {
+            String signerName = signer.getName();
+            for (ApkVerifier.IssueWithParams issue : signer.getErrors()) {
+                if (expectedIssue.equals(issue.getIssue())) {
+                    return;
+                }
+                if (msg.length() > 0) {
+                    msg.append('\n');
+                }
+                msg.append("JAR signer ").append(signerName).append(": ").append(issue);
+            }
+        }
+        for (ApkVerifier.Result.V2SchemeSignerInfo signer : result.getV2SchemeSigners()) {
+            String signerName = "signer #" + (signer.getIndex() + 1);
+            for (IssueWithParams issue : signer.getErrors()) {
+                if (expectedIssue.equals(issue.getIssue())) {
+                    return;
+                }
+                if (msg.length() > 0) {
+                    msg.append('\n');
+                }
+                msg.append("APK Signature Scheme v2 signer ")
+                        .append(signerName).append(": ").append(issue);
+            }
+        }
+
+        fail("APK failed verification for the wrong reason"
+                + " . Expected: " + expectedIssue + ", actual: " + msg);
+    }
+
+    private void assertVerificationFailure(
+            String apkFilenameInResources, ApkVerifier.Issue expectedIssue)
+                    throws Exception {
+        assertVerificationFailure(verify(apkFilenameInResources), expectedIssue);
+    }
+
+    private void assertVerifiedForEach(
+            String apkFilenamePatternInResources, String[] args) throws Exception {
+        assertVerifiedForEach(apkFilenamePatternInResources, args, null, null);
+    }
+
+    private void assertVerifiedForEach(
+            String apkFilenamePatternInResources,
+            String[] args,
+            Integer minSdkVersionOverride,
+            Integer maxSdkVersionOverride) throws Exception {
+        for (String arg : args) {
+            String apkFilenameInResources =
+                    String.format(Locale.US, apkFilenamePatternInResources, arg);
+            assertVerified(apkFilenameInResources, minSdkVersionOverride, maxSdkVersionOverride);
+        }
+    }
+
+    private void assertVerifiedForEachForMinSdkVersion(
+            String apkFilenameInResources, String[] args, int minSdkVersion)
+                    throws Exception {
+        assertVerifiedForEach(apkFilenameInResources, args, minSdkVersion, null);
+    }
+
+    private static byte[] sha256(byte[] msg) throws Exception {
+        try {
+            return MessageDigest.getInstance("SHA-256").digest(msg);
+        } catch (NoSuchAlgorithmException e) {
+            throw new RuntimeException("Failed to create SHA-256 MessageDigest", e);
+        }
+    }
+
+    private static void assumeThatRsaPssAvailable() throws Exception {
+        Assume.assumeTrue(Security.getProviders("Signature.SHA256withRSA/PSS") != null);
+    }
+
+    private static void assumeThatMd5AcceptedInPkcs7Signature() throws Exception {
+        String algs = Security.getProperty("jdk.jar.disabledAlgorithms");
+        if ((algs != null) && (algs.toLowerCase(Locale.US).contains("md5"))) {
+            Assume.assumeNoException(
+                    new RuntimeException("MD5 not accepted in PKCS #7 signatures"
+                            + " . jdk.jar.disabledAlgorithms: \"" + algs + "\""));
+        }
+    }
+}
diff --git a/src/test/java/com/android/apksig/apk/AllTests.java b/src/test/java/com/android/apksig/apk/AllTests.java
new file mode 100644
index 0000000..64895ab
--- /dev/null
+++ b/src/test/java/com/android/apksig/apk/AllTests.java
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.apk;
+
+import org.junit.runner.RunWith;
+import org.junit.runners.Suite;
+
+@RunWith(Suite.class)
+@Suite.SuiteClasses({
+    ApkUtilsTest.class,
+})
+public class AllTests {}
diff --git a/src/test/java/com/android/apksig/internal/AllTests.java b/src/test/java/com/android/apksig/internal/AllTests.java
new file mode 100644
index 0000000..77d760e
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/AllTests.java
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal;
+
+import org.junit.runner.RunWith;
+import org.junit.runners.Suite;
+
+@RunWith(Suite.class)
+@Suite.SuiteClasses({
+    com.android.apksig.internal.asn1.AllTests.class,
+    com.android.apksig.internal.util.AllTests.class,
+})
+public class AllTests {}
diff --git a/src/test/java/com/android/apksig/internal/asn1/AllTests.java b/src/test/java/com/android/apksig/internal/asn1/AllTests.java
new file mode 100644
index 0000000..9f7265a
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/asn1/AllTests.java
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.asn1;
+
+import org.junit.runner.RunWith;
+import org.junit.runners.Suite;
+
+@RunWith(Suite.class)
+@Suite.SuiteClasses({
+    com.android.apksig.internal.asn1.ber.AllTests.class
+})
+public class AllTests {}
diff --git a/src/test/java/com/android/apksig/internal/asn1/ber/AllTests.java b/src/test/java/com/android/apksig/internal/asn1/ber/AllTests.java
new file mode 100644
index 0000000..6916164
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/asn1/ber/AllTests.java
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.asn1.ber;
+
+import org.junit.runner.RunWith;
+import org.junit.runners.Suite;
+
+@RunWith(Suite.class)
+@Suite.SuiteClasses({
+    BerDataValueTest.class,
+    ByteBufferBerDataValueReaderTest.class,
+    InputStreamBerDataValueReaderTest.class,
+})
+public class AllTests {}
diff --git a/src/test/java/com/android/apksig/internal/asn1/ber/BerDataValueReaderTestBase.java b/src/test/java/com/android/apksig/internal/asn1/ber/BerDataValueReaderTestBase.java
new file mode 100644
index 0000000..34d236b
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/asn1/ber/BerDataValueReaderTestBase.java
@@ -0,0 +1,255 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.asn1.ber;
+
+import static com.android.apksig.internal.test.MoreAsserts.assertByteBufferEquals;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import com.android.apksig.internal.util.HexEncoding;
+import org.junit.Test;
+
+/**
+ * Base class for unit tests of ASN.1 BER (see {@code X.690}) data value reader implementations.
+ *
+ * <p>Subclasses need to provide only an implementation of {@link #createReader(byte[])} and
+ * subclass-specific tests.
+ */
+public abstract class BerDataValueReaderTestBase {
+
+    /**
+     * Returns a new reader initialized with the provided input.
+     */
+    protected abstract BerDataValueReader createReader(byte[] input);
+
+    @Test
+    public void testEmptyInput() throws Exception {
+        assertNull(readDataValue(""));
+    }
+
+    @Test
+    public void testEndOfInput() throws Exception {
+        BerDataValueReader reader = createReader("3000"); // SEQUENCE with empty contents
+        assertNotNull(reader.readDataValue());
+        // End of input has been reached
+        assertNull(reader.readDataValue());
+        // Null should also be returned on consecutive invocations
+        assertNull(reader.readDataValue());
+    }
+
+    @Test
+    public void testSingleByteTagId() throws Exception {
+        BerDataValue dataValue = readDataValue("1000");
+        assertEquals(BerEncoding.TAG_CLASS_UNIVERSAL, dataValue.getTagClass());
+        assertFalse(dataValue.isConstructed());
+        assertEquals(0x10, dataValue.getTagNumber());
+
+        dataValue = readDataValue("3900");
+        assertEquals(BerEncoding.TAG_CLASS_UNIVERSAL, dataValue.getTagClass());
+        assertTrue(dataValue.isConstructed());
+        assertEquals(0x19, dataValue.getTagNumber());
+
+        dataValue = readDataValue("6700");
+        assertEquals(BerEncoding.TAG_CLASS_APPLICATION, dataValue.getTagClass());
+        assertTrue(dataValue.isConstructed());
+        assertEquals(7, dataValue.getTagNumber());
+
+        dataValue = readDataValue("8600");
+        assertEquals(BerEncoding.TAG_CLASS_CONTEXT_SPECIFIC, dataValue.getTagClass());
+        assertFalse(dataValue.isConstructed());
+        assertEquals(6, dataValue.getTagNumber());
+
+        dataValue = readDataValue("fe00");
+        assertEquals(BerEncoding.TAG_CLASS_PRIVATE, dataValue.getTagClass());
+        assertTrue(dataValue.isConstructed());
+        assertEquals(0x1e, dataValue.getTagNumber());
+    }
+
+    @Test
+    public void testHighTagNumber() throws Exception {
+        assertEquals(7, readDataValue("3f0700").getTagNumber());
+        assertEquals(7, readDataValue("3f800700").getTagNumber());
+        assertEquals(7, readDataValue("3f80800700").getTagNumber());
+        assertEquals(7, readDataValue("3f8080800700").getTagNumber());
+        assertEquals(7, readDataValue("3f808080808080808080808080808080800700").getTagNumber());
+        assertEquals(375, readDataValue("3f827700").getTagNumber());
+        assertEquals(268435455, readDataValue("3fffffff7f00").getTagNumber());
+        assertEquals(Integer.MAX_VALUE, readDataValue("3f87ffffff7f00").getTagNumber());
+    }
+
+    @Test(expected = BerDataValueFormatException.class)
+    public void testHighTagNumberTooLarge() throws Exception {
+        readDataValue("3f888080800000"); // Integer.MAX_VALUE + 1
+    }
+
+    // @Test(expected = BerDataValueFormatException.class)
+    public void testTruncatedHighTagNumberLastOctetMissing() throws Exception {
+        readDataValue("9f80"); // terminating octet must not have the highest bit set
+    }
+
+    @Test(expected = BerDataValueFormatException.class)
+    public void testTruncatedBeforeFirstLengthOctet() throws Exception {
+        readDataValue("30");
+    }
+
+    @Test
+    public void testShortFormLength() throws Exception {
+        assertByteBufferEquals(new byte[0], readDataValue("3000").getEncodedContents());
+        assertByteBufferEquals(
+                HexEncoding.decode("010203"), readDataValue("3003010203").getEncodedContents());
+    }
+
+    @Test
+    public void testLongFormLength() throws Exception {
+        assertByteBufferEquals(new byte[0], readDataValue("308100").getEncodedContents());
+        assertByteBufferEquals(
+                HexEncoding.decode("010203"), readDataValue("30820003010203").getEncodedContents());
+        assertEquals(
+                255,
+                readDataValue(concat(HexEncoding.decode("3081ff"), new byte[255]))
+                        .getEncodedContents().remaining());
+        assertEquals(
+                0x110,
+                readDataValue(concat(HexEncoding.decode("30820110"), new byte[0x110]))
+                        .getEncodedContents().remaining());
+    }
+
+    @Test(expected = BerDataValueFormatException.class)
+    public void testTruncatedLongFormLengthBeforeFirstLengthByte() throws Exception {
+        readDataValue("3081");
+    }
+
+    @Test(expected = BerDataValueFormatException.class)
+    public void testTruncatedLongFormLengthLastLengthByteMissing() throws Exception {
+        readDataValue("308200");
+    }
+
+    @Test(expected = BerDataValueFormatException.class)
+    public void testLongFormLengthTooLarge() throws Exception {
+        readDataValue("3084ffffffff");
+    }
+
+    @Test
+    public void testIndefiniteFormLength() throws Exception {
+        assertByteBufferEquals(new byte[0], readDataValue("30800000").getEncodedContents());
+        assertByteBufferEquals(
+                HexEncoding.decode("010203"), readDataValue("30800102030000").getEncodedContents());
+        assertByteBufferEquals(
+                HexEncoding.decode(
+                        "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"
+                            + "000102030405060708090a0b0c0d0e0f"),
+                readDataValue(
+                        "3080"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "000102030405060708090a0b0c0d0e0f"
+                                + "0000"
+                        ).getEncodedContents());
+    }
+
+    @Test(expected = BerDataValueFormatException.class)
+    public void testDefiniteLengthContentsTruncatedBeforeFirstContentOctet() throws Exception {
+        readDataValue("3001");
+    }
+
+    @Test(expected = BerDataValueFormatException.class)
+    public void testIndefiniteLengthContentsTruncatedBeforeFirstContentOctet() throws Exception {
+        readDataValue("3080");
+    }
+
+    @Test(expected = BerDataValueFormatException.class)
+    public void testTruncatedDefiniteLengthContents() throws Exception {
+        readDataValue("30030102");
+    }
+
+    @Test(expected = BerDataValueFormatException.class)
+    public void testTruncatedIndefiniteLengthContents() throws Exception {
+        readDataValue("308001020300");
+    }
+
+    @Test
+    public void testEmptyDefiniteLengthContents() throws Exception {
+        assertByteBufferEquals(new byte[0], readDataValue("3000").getEncodedContents());
+    }
+
+    @Test
+    public void testEmptyIndefiniteLengthContents() throws Exception {
+        assertByteBufferEquals(new byte[0], readDataValue("30800000").getEncodedContents());
+    }
+
+    @Test
+    public void testReadAdvancesPosition() throws Exception {
+        BerDataValueReader reader = createReader("37018f050001020304");
+        assertByteBufferEquals(HexEncoding.decode("37018f"), reader.readDataValue().getEncoded());
+        assertByteBufferEquals(HexEncoding.decode("0500"), reader.readDataValue().getEncoded());
+        assertByteBufferEquals(HexEncoding.decode("01020304"), reader.readDataValue().getEncoded());
+        assertNull(reader.readDataValue());
+    }
+
+    private BerDataValueReader createReader(String hexEncodedInput) {
+        return createReader(HexEncoding.decode(hexEncodedInput));
+    }
+
+    private BerDataValue readDataValue(byte[] input)
+            throws BerDataValueFormatException {
+        return createReader(input).readDataValue();
+    }
+
+    private BerDataValue readDataValue(String hexEncodedInput)
+            throws BerDataValueFormatException {
+        return createReader(hexEncodedInput).readDataValue();
+    }
+
+    private static byte[] concat(byte[] arr1, byte[] arr2) {
+        byte[] result = new byte[arr1.length + arr2.length];
+        System.arraycopy(arr1,  0, result, 0, arr1.length);
+        System.arraycopy(arr2,  0, result, arr1.length, arr2.length);
+        return result;
+    }
+}
diff --git a/src/test/java/com/android/apksig/internal/asn1/ber/BerDataValueTest.java b/src/test/java/com/android/apksig/internal/asn1/ber/BerDataValueTest.java
new file mode 100644
index 0000000..5fd0ac3
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/asn1/ber/BerDataValueTest.java
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.asn1.ber;
+
+import static com.android.apksig.internal.test.MoreAsserts.assertByteBufferEquals;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertSame;
+import static org.junit.Assert.assertTrue;
+
+import com.android.apksig.internal.util.HexEncoding;
+import java.nio.ByteBuffer;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public class BerDataValueTest {
+    private static final BerDataValue TEST_VALUE1 =
+            new BerDataValue(
+                    ByteBuffer.wrap(HexEncoding.decode("aa")),
+                    ByteBuffer.wrap(HexEncoding.decode("bb")),
+                    BerEncoding.TAG_CLASS_UNIVERSAL,
+                    true,
+                    BerEncoding.TAG_NUMBER_SEQUENCE);
+
+    private static final BerDataValue TEST_VALUE2 =
+            new BerDataValue(
+                    ByteBuffer.wrap(HexEncoding.decode("cc")),
+                    ByteBuffer.wrap(HexEncoding.decode("dd")),
+                    BerEncoding.TAG_CLASS_CONTEXT_SPECIFIC,
+                    false,
+                    BerEncoding.TAG_NUMBER_OCTET_STRING);
+
+    @Test
+    public void testGetTagClass() {
+        assertEquals(BerEncoding.TAG_CLASS_UNIVERSAL, TEST_VALUE1.getTagClass());
+        assertEquals(BerEncoding.TAG_CLASS_CONTEXT_SPECIFIC, TEST_VALUE2.getTagClass());
+    }
+
+    @Test
+    public void testIsConstructed() {
+        assertTrue(TEST_VALUE1.isConstructed());
+        assertFalse(TEST_VALUE2.isConstructed());
+    }
+
+    @Test
+    public void testGetTagNumber() {
+        assertEquals(BerEncoding.TAG_NUMBER_SEQUENCE, TEST_VALUE1.getTagNumber());
+        assertEquals(BerEncoding.TAG_NUMBER_OCTET_STRING, TEST_VALUE2.getTagNumber());
+    }
+
+    @Test
+    public void testGetEncoded() {
+        assertByteBufferEquals(HexEncoding.decode("aa"), TEST_VALUE1.getEncoded());
+        assertByteBufferEquals(HexEncoding.decode("cc"), TEST_VALUE2.getEncoded());
+    }
+
+    @Test
+    public void testGetEncodedReturnsSlice() {
+        // Assert that changing the position of returned ByteBuffer does not affect ByteBuffers
+        // returned in the future
+        ByteBuffer encoded = TEST_VALUE1.getEncoded();
+        assertByteBufferEquals(HexEncoding.decode("aa"), encoded);
+        encoded.position(encoded.limit());
+        assertByteBufferEquals(HexEncoding.decode("aa"), TEST_VALUE1.getEncoded());
+    }
+
+    @Test
+    public void testGetEncodedContents() {
+        assertByteBufferEquals(HexEncoding.decode("bb"), TEST_VALUE1.getEncodedContents());
+        assertByteBufferEquals(HexEncoding.decode("dd"), TEST_VALUE2.getEncodedContents());
+    }
+
+    @Test
+    public void testGetEncodedContentsReturnsSlice() {
+        // Assert that changing the position of returned ByteBuffer does not affect ByteBuffers
+        // returned in the future
+        ByteBuffer encoded = TEST_VALUE1.getEncodedContents();
+        assertByteBufferEquals(HexEncoding.decode("bb"), encoded);
+        encoded.position(encoded.limit());
+        assertByteBufferEquals(HexEncoding.decode("bb"), TEST_VALUE1.getEncodedContents());
+    }
+
+    @Test
+    public void testDataValueReader() throws BerDataValueFormatException {
+        BerDataValueReader reader = TEST_VALUE1.dataValueReader();
+        assertSame(TEST_VALUE1, reader.readDataValue());
+        assertNull(reader.readDataValue());
+        assertNull(reader.readDataValue());
+    }
+
+    @Test
+    public void testContentsReader() throws BerDataValueFormatException {
+        BerDataValue dataValue =
+                new BerDataValue(
+                        ByteBuffer.allocate(0),
+                        ByteBuffer.wrap(HexEncoding.decode("300203040500")),
+                        BerEncoding.TAG_CLASS_UNIVERSAL,
+                        true,
+                        BerEncoding.TAG_NUMBER_SEQUENCE);
+        BerDataValueReader reader = dataValue.contentsReader();
+        assertEquals(ByteBufferBerDataValueReader.class, reader.getClass());
+        assertByteBufferEquals(HexEncoding.decode("30020304"), reader.readDataValue().getEncoded());
+        assertByteBufferEquals(HexEncoding.decode("0500"), reader.readDataValue().getEncoded());
+        assertNull(reader.readDataValue());
+    }
+}
diff --git a/src/test/java/com/android/apksig/internal/asn1/ber/ByteBufferBerDataValueReaderTest.java b/src/test/java/com/android/apksig/internal/asn1/ber/ByteBufferBerDataValueReaderTest.java
new file mode 100644
index 0000000..8875e5c
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/asn1/ber/ByteBufferBerDataValueReaderTest.java
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.asn1.ber;
+
+import java.nio.ByteBuffer;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public class ByteBufferBerDataValueReaderTest extends BerDataValueReaderTestBase {
+
+    @Override
+    protected ByteBufferBerDataValueReader createReader(byte[] input) {
+        return new ByteBufferBerDataValueReader(ByteBuffer.wrap(input));
+    }
+
+    @Test(expected = NullPointerException.class)
+    public void testConstructWithNullByteBuffer() throws Exception {
+        new ByteBufferBerDataValueReader(null);
+    }
+}
diff --git a/src/test/java/com/android/apksig/internal/asn1/ber/InputStreamBerDataValueReaderTest.java b/src/test/java/com/android/apksig/internal/asn1/ber/InputStreamBerDataValueReaderTest.java
new file mode 100644
index 0000000..97fcddf
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/asn1/ber/InputStreamBerDataValueReaderTest.java
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.asn1.ber;
+
+import java.io.ByteArrayInputStream;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public class InputStreamBerDataValueReaderTest extends BerDataValueReaderTestBase {
+
+    @Override
+    protected InputStreamBerDataValueReader createReader(byte[] input) {
+        return new InputStreamBerDataValueReader(new ByteArrayInputStream(input));
+    }
+
+    @Test(expected = NullPointerException.class)
+    public void testConstructWithNullByteBuffer() throws Exception {
+        new InputStreamBerDataValueReader(null);
+    }
+}
diff --git a/src/test/java/com/android/apksig/internal/test/MoreAsserts.java b/src/test/java/com/android/apksig/internal/test/MoreAsserts.java
new file mode 100644
index 0000000..409e95e
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/test/MoreAsserts.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.test;
+
+import static org.junit.Assert.assertArrayEquals;
+
+import java.nio.ByteBuffer;
+
+public abstract class MoreAsserts {
+    private MoreAsserts() {}
+
+    /**
+     * Asserts that the contents of the provided {@code ByteBuffer} are as expected. This method
+     * does not change the position or the limit of the provided buffer.
+     */
+    public static void assertByteBufferEquals(byte[] expected, ByteBuffer actual) {
+        assertByteBufferEquals(null, expected, actual);
+    }
+
+    /**
+     * Asserts that the contents of the provided {@code ByteBuffer} are as expected. This method
+     * does not change the position or the limit of the provided buffer.
+     */
+    public static void assertByteBufferEquals(String message, byte[] expected, ByteBuffer actual) {
+        byte[] actualArr;
+        if ((actual.hasArray())
+                && (actual.arrayOffset() == 0) && (actual.array().length == actual.remaining())) {
+            actualArr = actual.array();
+        } else {
+            actualArr = new byte[actual.remaining()];
+            int actualOriginalPos = actual.position();
+            actual.get(actualArr);
+            actual.position(actualOriginalPos);
+        }
+        assertArrayEquals(message, expected, actualArr);
+    }
+}
diff --git a/src/test/java/com/android/apksig/internal/util/AllTests.java b/src/test/java/com/android/apksig/internal/util/AllTests.java
new file mode 100644
index 0000000..3043538
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/util/AllTests.java
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.util;
+
+import org.junit.runner.RunWith;
+import org.junit.runners.Suite;
+
+@RunWith(Suite.class)
+@Suite.SuiteClasses({
+    ArrayBackedByteBufferSinkTest.class,
+    DirectByteBufferSinkTest.class,
+})
+public class AllTests {}
diff --git a/src/test/java/com/android/apksig/internal/util/ArrayBackedByteBufferSinkTest.java b/src/test/java/com/android/apksig/internal/util/ArrayBackedByteBufferSinkTest.java
new file mode 100644
index 0000000..e554e19
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/util/ArrayBackedByteBufferSinkTest.java
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.util;
+
+import java.nio.ByteBuffer;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public class ArrayBackedByteBufferSinkTest extends ByteBufferSinkTestBase {
+    @Override
+    protected ByteBuffer createBuffer(int size) {
+        return ByteBuffer.allocate(size);
+    }
+}
diff --git a/src/test/java/com/android/apksig/internal/util/ByteBufferSinkTestBase.java b/src/test/java/com/android/apksig/internal/util/ByteBufferSinkTestBase.java
new file mode 100644
index 0000000..1258e81
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/util/ByteBufferSinkTestBase.java
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.util;
+
+import com.android.apksig.util.DataSinkTestBase;
+import java.io.IOException;
+import java.nio.ByteBuffer;
+
+public abstract class ByteBufferSinkTestBase extends DataSinkTestBase<ByteBufferSink> {
+
+    private static final int START_POS = 100;
+
+    protected abstract ByteBuffer createBuffer(int size);
+
+    @Override
+    protected CloseableWithDataSink<ByteBufferSink> createDataSink() {
+        ByteBuffer buf = createBuffer(1024);
+        // Use non-zero position and limit which isn't set to capacity to catch the implementation
+        // under test ignoring the initial position.
+        buf.position(START_POS);
+        buf.limit(buf.capacity() - 300);
+        return CloseableWithDataSink.of(new ByteBufferSink(buf));
+    }
+
+    @Override
+    protected ByteBuffer getContents(ByteBufferSink dataSink) throws IOException {
+        ByteBuffer buf = dataSink.getBuffer();
+        int oldPos = buf.position();
+        int oldLimit = buf.limit();
+        try {
+            buf.position(START_POS);
+            buf.limit(oldPos);
+            return buf.slice();
+        } finally {
+            buf.limit(oldLimit);
+            buf.position(oldPos);
+        }
+    }
+}
diff --git a/src/test/java/com/android/apksig/internal/util/ByteStreams.java b/src/test/java/com/android/apksig/internal/util/ByteStreams.java
new file mode 100644
index 0000000..bca3b08
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/util/ByteStreams.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.util;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+
+/**
+ * Utilities for byte arrays and I/O streams.
+ */
+public final class ByteStreams {
+    private ByteStreams() {}
+
+    /**
+     * Returns the data remaining in the provided input stream as a byte array
+     */
+    public static byte[] toByteArray(InputStream in) throws IOException {
+        ByteArrayOutputStream result = new ByteArrayOutputStream();
+        byte[] buf = new byte[16384];
+        int chunkSize;
+        while ((chunkSize = in.read(buf)) != -1) {
+            result.write(buf, 0, chunkSize);
+        }
+        return result.toByteArray();
+    }
+}
diff --git a/src/test/java/com/android/apksig/internal/util/DirectByteBufferSinkTest.java b/src/test/java/com/android/apksig/internal/util/DirectByteBufferSinkTest.java
new file mode 100644
index 0000000..0b8e975
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/util/DirectByteBufferSinkTest.java
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.util;
+
+import java.nio.ByteBuffer;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public class DirectByteBufferSinkTest extends ByteBufferSinkTestBase {
+    @Override
+    protected ByteBuffer createBuffer(int size) {
+        return ByteBuffer.allocateDirect(size);
+    }
+}
diff --git a/src/test/java/com/android/apksig/internal/util/HexEncoding.java b/src/test/java/com/android/apksig/internal/util/HexEncoding.java
new file mode 100644
index 0000000..5d75138
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/util/HexEncoding.java
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.util;
+
+import java.nio.ByteBuffer;
+
+/**
+ * Hexadecimal encoding where each byte is represented by two hexadecimal digits.
+ */
+public class HexEncoding {
+
+    /** Hidden constructor to prevent instantiation. */
+    private HexEncoding() {}
+
+    private static final char[] HEX_DIGITS = "0123456789abcdef".toCharArray();
+
+    /**
+     * Encodes the provided data as a hexadecimal string.
+     */
+    public static String encode(byte[] data) {
+        return encode(data, 0, data.length);
+    }
+
+    /**
+     * Encodes the provided data as a hexadecimal string.
+     */
+    public static String encode(byte[] data, int offset, int len) {
+      StringBuilder result = new StringBuilder(len * 2);
+      for (int i = 0; i < len; i++) {
+          byte b = data[offset + i];
+          result.append(HEX_DIGITS[(b >>> 4) & 0x0f]);
+          result.append(HEX_DIGITS[b & 0x0f]);
+      }
+      return result.toString();
+    }
+
+    /**
+     * Encodes the provided data as a hexadecimal string.
+     */
+    public static String encode(ByteBuffer buf) {
+        return encode(buf.array(), buf.arrayOffset() + buf.position(), buf.remaining());
+    }
+
+    /**
+     * Decodes the provided hexadecimal string into an array of bytes.
+     */
+    public static byte[] decode(String encoded) {
+        // IMPLEMENTATION NOTE: Special care is taken to permit odd number of hexadecimal digits.
+        int resultLengthBytes = (encoded.length() + 1) / 2;
+        byte[] result = new byte[resultLengthBytes];
+        int resultOffset = 0;
+        int encodedCharOffset = 0;
+        if ((encoded.length() % 2) != 0) {
+            // Odd number of digits -- the first digit is the lower 4 bits of the first result byte.
+            result[resultOffset++] =
+                    (byte) getHexadecimalDigitValue(encoded.charAt(encodedCharOffset));
+            encodedCharOffset++;
+        }
+        for (int len = encoded.length(); encodedCharOffset < len; encodedCharOffset += 2) {
+          result[resultOffset++] = (byte)
+                  ((getHexadecimalDigitValue(encoded.charAt(encodedCharOffset)) << 4)
+                          | getHexadecimalDigitValue(encoded.charAt(encodedCharOffset + 1)));
+        }
+        return result;
+    }
+
+    private static int getHexadecimalDigitValue(char c) {
+        if ((c >= 'a') && (c <= 'f')) {
+            return (c - 'a') + 0x0a;
+        } else if ((c >= 'A') && (c <= 'F')) {
+            return (c - 'A') + 0x0a;
+        } else if ((c >= '0') && (c <= '9')) {
+            return c - '0';
+        } else {
+            throw new IllegalArgumentException(
+                    "Invalid hexadecimal digit at position : '"
+                            + c + "' (0x" + Integer.toHexString(c) + ")");
+        }
+    }
+}
diff --git a/src/test/java/com/android/apksig/internal/util/Resources.java b/src/test/java/com/android/apksig/internal/util/Resources.java
new file mode 100644
index 0000000..8a761ff
--- /dev/null
+++ b/src/test/java/com/android/apksig/internal/util/Resources.java
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.internal.util;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.KeyFactory;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+import java.util.Locale;
+
+/**
+ * Assorted methods to obtaining test input from resources.
+ */
+public final class Resources {
+    private Resources() {}
+
+    public static byte[] toByteArray(Class<?> cls, String resourceName) throws IOException {
+        try (InputStream in = cls.getResourceAsStream(resourceName)) {
+            if (in == null) {
+                throw new IllegalArgumentException("Resource not found: " + resourceName);
+            }
+            return ByteStreams.toByteArray(in);
+        }
+    }
+
+    public static X509Certificate toCertificate(
+            Class <?> cls, String resourceName) throws IOException, CertificateException {
+        try (InputStream in = cls.getResourceAsStream(resourceName)) {
+            if (in == null) {
+                throw new IllegalArgumentException("Resource not found: " + resourceName);
+            }
+            return (X509Certificate)
+                    CertificateFactory.getInstance("X.509").generateCertificate(in);
+        }
+    }
+
+    public static List<X509Certificate> toCertificateChain(
+            Class <?> cls, String resourceName) throws IOException, CertificateException {
+        Collection<? extends Certificate> certs;
+        try (InputStream in = cls.getResourceAsStream(resourceName)) {
+            if (in == null) {
+                throw new IllegalArgumentException("Resource not found: " + resourceName);
+            }
+            certs = CertificateFactory.getInstance("X.509").generateCertificates(in);
+        }
+        List<X509Certificate> result = new ArrayList<>(certs.size());
+        for (Certificate cert : certs) {
+            result.add((X509Certificate) cert);
+        }
+        return result;
+    }
+
+    public static PrivateKey toPrivateKey(Class <?> cls, String resourceName)
+                    throws IOException, InvalidKeySpecException, NoSuchAlgorithmException {
+        int delimiterIndex = resourceName.indexOf('-');
+        if (delimiterIndex == -1) {
+            throw new IllegalArgumentException(
+                    "Failed to autodetect key algorithm from resource name: " + resourceName);
+        }
+        String keyAlgorithm = resourceName.substring(0, delimiterIndex).toUpperCase(Locale.US);
+        return toPrivateKey(cls, resourceName, keyAlgorithm);
+    }
+
+    public static PrivateKey toPrivateKey(
+            Class <?> cls, String resourceName, String keyAlgorithm)
+                    throws IOException, InvalidKeySpecException, NoSuchAlgorithmException {
+        byte[] encoded = toByteArray(cls, resourceName);
+
+        // Keep overly strictly linter happy by limiting what JCA KeyFactory algorithms are used
+        // here
+        KeyFactory keyFactory;
+        switch (keyAlgorithm.toUpperCase(Locale.US)) {
+            case "RSA":
+                keyFactory = KeyFactory.getInstance("rsa");
+                break;
+            case "DSA":
+                keyFactory = KeyFactory.getInstance("dsa");
+                break;
+            case "EC":
+                keyFactory = KeyFactory.getInstance("ec");
+                break;
+            default:
+                throw new InvalidKeySpecException("Unsupported key algorithm: " + keyAlgorithm);
+        }
+
+        return keyFactory.generatePrivate(new PKCS8EncodedKeySpec(encoded));
+    }
+}
diff --git a/src/test/java/com/android/apksig/util/AllTests.java b/src/test/java/com/android/apksig/util/AllTests.java
new file mode 100644
index 0000000..0af9b5a
--- /dev/null
+++ b/src/test/java/com/android/apksig/util/AllTests.java
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.util;
+
+import org.junit.runner.RunWith;
+import org.junit.runners.Suite;
+
+@RunWith(Suite.class)
+@Suite.SuiteClasses({
+    DataSinkFromOutputStreamTest.class,
+    DataSinkFromRAFTest.class,
+    DataSourceFromByteBufferTest.class,
+    DataSourceFromRAFChunkTest.class,
+    DataSourceFromRAFTest.class,
+    InMemoryDataSinkDataSourceTest.class,
+    InMemoryDataSinkTest.class,
+})
+public class AllTests {}
diff --git a/src/test/java/com/android/apksig/util/DataSinkFromOutputStreamTest.java b/src/test/java/com/android/apksig/util/DataSinkFromOutputStreamTest.java
new file mode 100644
index 0000000..ecb9a70
--- /dev/null
+++ b/src/test/java/com/android/apksig/util/DataSinkFromOutputStreamTest.java
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.util;
+
+import com.android.apksig.internal.util.OutputStreamDataSink;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Tests for the {@link DataSink} returned by {@link DataSinks#asDataSink(java.io.OutputStream)}.
+ */
+@RunWith(JUnit4.class)
+public class DataSinkFromOutputStreamTest extends DataSinkTestBase<OutputStreamDataSink> {
+
+    @Override
+    protected CloseableWithDataSink<OutputStreamDataSink> createDataSink() {
+        return CloseableWithDataSink.of(
+                (OutputStreamDataSink) DataSinks.asDataSink(new ByteArrayOutputStream()));
+    }
+
+    @Override
+    protected ByteBuffer getContents(OutputStreamDataSink dataSink) throws IOException {
+        return ByteBuffer.wrap(((ByteArrayOutputStream) dataSink.getOutputStream()).toByteArray());
+    }
+}
diff --git a/src/test/java/com/android/apksig/util/DataSinkFromRAFTest.java b/src/test/java/com/android/apksig/util/DataSinkFromRAFTest.java
new file mode 100644
index 0000000..e4441df
--- /dev/null
+++ b/src/test/java/com/android/apksig/util/DataSinkFromRAFTest.java
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.util;
+
+import com.android.apksig.internal.util.RandomAccessFileDataSink;
+import java.io.File;
+import java.io.IOException;
+import java.io.RandomAccessFile;
+import java.nio.ByteBuffer;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Tests for the {@link DataSink} returned by
+ * {@link DataSinks#asDataSink(java.io.RandomAccessFile)}.
+ */
+@RunWith(JUnit4.class)
+public class DataSinkFromRAFTest extends DataSinkTestBase<RandomAccessFileDataSink> {
+
+    @Override
+    protected CloseableWithDataSink<RandomAccessFileDataSink> createDataSink() throws IOException {
+        File tmp = File.createTempFile(DataSourceFromRAFTest.class.getSimpleName(), ".bin");
+        RandomAccessFile f = null;
+        try {
+            f = new RandomAccessFile(tmp, "rw");
+        } finally {
+            if (f == null) {
+                tmp.delete();
+            }
+        }
+        return CloseableWithDataSink.of(
+                (RandomAccessFileDataSink) DataSinks.asDataSink(f),
+                new DataSourceFromRAFTest.TmpFileCloseable(tmp, f));
+    }
+
+    @Override
+    protected ByteBuffer getContents(RandomAccessFileDataSink dataSink) throws IOException {
+        RandomAccessFile f = dataSink.getFile();
+        if (f.length() > Integer.MAX_VALUE) {
+            throw new IOException("File too large: " + f.length());
+        }
+        byte[] contents = new byte[(int) f.length()];
+        f.seek(0);
+        f.readFully(contents);
+        return ByteBuffer.wrap(contents);
+    }
+}
diff --git a/src/test/java/com/android/apksig/util/DataSinkTestBase.java b/src/test/java/com/android/apksig/util/DataSinkTestBase.java
new file mode 100644
index 0000000..4329f1e
--- /dev/null
+++ b/src/test/java/com/android/apksig/util/DataSinkTestBase.java
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.util;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
+
+import java.io.Closeable;
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.nio.charset.StandardCharsets;
+import org.junit.Test;
+
+/**
+ * Base class for testing implementations of {@link DataSink}. This class tests the contract of
+ * {@code DataSink}.
+ *
+ * <p>To subclass, provide an implementation of {@link #createDataSink()} which returns the
+ * implementation of {@code DataSink} you want to test.
+ */
+public abstract class DataSinkTestBase<T extends DataSink> {
+    /**
+     * Returns a new {@link DataSink}.
+     */
+    protected abstract CloseableWithDataSink<T> createDataSink() throws IOException;
+
+    /**
+     * Returns the contents of the data sink.
+     */
+    protected abstract ByteBuffer getContents(T dataSink) throws IOException;
+
+    @Test
+    public void testConsumeFromArray() throws Exception {
+        try (CloseableWithDataSink<T> c = createDataSink()) {
+            T sink = c.getDataSink();
+            byte[] input = "abcdefg".getBytes(StandardCharsets.UTF_8);
+            sink.consume(input, 2, 3); // "cde"
+            sink.consume(input, 0, 1); // "a"
+            assertContentsEquals("cdea", sink);
+
+            // Zero-length chunks
+            sink.consume(input, 0, 0);
+            sink.consume(input, 1, 0);
+            sink.consume(input, input.length - 2, 0);
+            sink.consume(input, input.length - 1, 0);
+            sink.consume(input, input.length, 0);
+
+            // Invalid chunks
+            assertConsumeArrayThrowsIOOB(sink, input, -1, 0);
+            assertConsumeArrayThrowsIOOB(sink, input, -1, 3);
+            assertConsumeArrayThrowsIOOB(sink, input, 0, input.length + 1);
+            assertConsumeArrayThrowsIOOB(sink, input, input.length - 2, 4);
+            assertConsumeArrayThrowsIOOB(sink, input, input.length + 1, 0);
+            assertConsumeArrayThrowsIOOB(sink, input, input.length + 1, 1);
+
+            assertContentsEquals("cdea", sink);
+        }
+    }
+
+    @Test
+    public void testConsumeFromByteBuffer() throws Exception {
+        try (CloseableWithDataSink<T> c = createDataSink()) {
+            T sink = c.getDataSink();
+            ByteBuffer input = ByteBuffer.wrap("abcdefg".getBytes(StandardCharsets.UTF_8));
+            input.position(2);
+            input.limit(5);
+            sink.consume(input); // "cde"
+            assertEquals(5, input.position());
+            assertEquals(5, input.limit());
+
+            input.position(0);
+            input.limit(1);
+            sink.consume(input); // "a"
+            assertContentsEquals("cdea", sink);
+
+            // Empty input
+            sink.consume(input);
+            assertContentsEquals("cdea", sink);
+
+            // ByteBuffer which isn't backed by a byte[]
+            input = ByteBuffer.allocateDirect(2);
+            input.put((byte) 'X');
+            input.put((byte) 'Z');
+            input.flip();
+            sink.consume(input);
+
+            assertContentsEquals("cdeaXZ", sink);
+            assertEquals(2, input.position());
+            assertEquals(2, input.limit());
+
+            // Empty input
+            sink.consume(input);
+            assertContentsEquals("cdeaXZ", sink);
+        }
+    }
+
+    /**
+     * Returns the contents of the provided buffer as a string. The buffer's position and limit
+     * remain unchanged.
+     */
+    private static String toString(ByteBuffer buf) {
+        return DataSourceTestBase.toString(buf);
+    }
+
+    private void assertContentsEquals(String expectedContents, T sink) throws IOException {
+        ByteBuffer actual = getContents(sink);
+        assertEquals(expectedContents, toString(actual));
+    }
+
+    private static void assertConsumeArrayThrowsIOOB(
+            DataSink sink, byte[] arr, int offset, int length) throws IOException {
+        try {
+            sink.consume(arr, offset, length);
+            fail();
+        } catch (IndexOutOfBoundsException expected) {}
+    }
+
+    public static class CloseableWithDataSink<T extends DataSink> implements Closeable {
+        private final T mDataSink;
+        private final Closeable mCloseable;
+
+        private CloseableWithDataSink(T dataSink, Closeable closeable) {
+            mDataSink = dataSink;
+            mCloseable = closeable;
+        }
+
+        public static <T extends DataSink> CloseableWithDataSink<T> of(T dataSink) {
+            return new CloseableWithDataSink<>(dataSink, null);
+        }
+
+        public static <T extends DataSink> CloseableWithDataSink<T> of(
+                T dataSink, Closeable closeable) {
+            return new CloseableWithDataSink<>(dataSink, closeable);
+        }
+
+        public T getDataSink() {
+            return mDataSink;
+        }
+
+        public Closeable getCloseable() {
+            return mCloseable;
+        }
+
+        @Override
+        public void close() throws IOException {
+            if (mCloseable != null) {
+                mCloseable.close();
+            }
+        }
+    }
+}
diff --git a/src/test/java/com/android/apksig/util/DataSourceFromByteBufferTest.java b/src/test/java/com/android/apksig/util/DataSourceFromByteBufferTest.java
new file mode 100644
index 0000000..83af814
--- /dev/null
+++ b/src/test/java/com/android/apksig/util/DataSourceFromByteBufferTest.java
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.util;
+
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import java.nio.charset.StandardCharsets;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Tests for the {@link DataSource} returned by {@link DataSources#asDataSource(ByteBuffer)}.
+ */
+@RunWith(JUnit4.class)
+public class DataSourceFromByteBufferTest extends DataSourceTestBase {
+
+    @Test
+    public void testChangesToBufferPosAndLimitNotVisible() throws Exception {
+        ByteBuffer buf = ByteBuffer.wrap("abcdefgh".getBytes(StandardCharsets.UTF_8));
+        buf.position(1);
+        buf.limit(4);
+        DataSource ds = DataSources.asDataSource(buf);
+        buf.position(2);
+        buf.limit(buf.capacity());
+        assertGetByteBufferEquals("bcd", ds, 0, (int) ds.size());
+        assertFeedEquals("bcd", ds, 0, (int) ds.size());
+        assertSliceEquals("bcd", ds, 0, (int) ds.size());
+        assertCopyToEquals("bcd", ds, 0, (int) ds.size());
+    }
+
+    @Override
+    protected CloseableWithDataSource createDataSource(byte[] contents) throws IOException {
+        return CloseableWithDataSource.of(DataSources.asDataSource(ByteBuffer.wrap(contents)));
+    }
+}
diff --git a/src/test/java/com/android/apksig/util/DataSourceFromRAFChunkTest.java b/src/test/java/com/android/apksig/util/DataSourceFromRAFChunkTest.java
new file mode 100644
index 0000000..8116012
--- /dev/null
+++ b/src/test/java/com/android/apksig/util/DataSourceFromRAFChunkTest.java
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.util;
+
+import com.android.apksig.util.DataSourceFromRAFTest.TmpFileCloseable;
+import java.io.File;
+import java.io.IOException;
+import java.io.RandomAccessFile;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Tests for the {@link DataSource} returned by
+ * {@link DataSources#asDataSource(RandomAccessFile, long, long)}.
+ */
+@RunWith(JUnit4.class)
+public class DataSourceFromRAFChunkTest extends DataSourceTestBase {
+
+    @Test
+    public void testFileSizeChangesNotVisible() throws Exception {
+        try (CloseableWithDataSource c = createDataSource("abcdefg")) {
+            DataSource ds = c.getDataSource();
+            DataSource slice = ds.slice(3, 2);
+            File f = ((TmpFileCloseable) c.getCloseable()).getFile();
+            assertGetByteBufferEquals("abcdefg", ds, 0, (int) ds.size());
+            assertGetByteBufferEquals("de", slice, 0, (int) slice.size());
+            assertFeedEquals("cdefg", ds, 2, 5);
+            assertFeedEquals("e", slice, 1, 1);
+            assertCopyToEquals("cdefg", ds, 2, 5);
+            assertCopyToEquals("e", slice, 1, 1);
+            assertSliceEquals("cdefg", ds, 2, 5);
+            assertSliceEquals("e", slice, 1, 1);
+            try (RandomAccessFile raf = new RandomAccessFile(f, "rw")) {
+                raf.seek(raf.length());
+                raf.write("hijkl".getBytes(StandardCharsets.UTF_8));
+            }
+
+            assertGetByteBufferEquals("abcdefg", ds, 0, (int) ds.size());
+            assertGetByteBufferEquals("de", slice, 0, (int) slice.size());
+            assertGetByteBufferThrowsIOOB(ds, 0, (int) ds.size() + 3);
+            assertFeedThrowsIOOB(ds, 0, (int) ds.size() + 3);
+            assertSliceThrowsIOOB(ds, 0, (int) ds.size() + 3);
+            assertCopyToThrowsIOOB(ds, 0, (int) ds.size() + 3);
+        }
+    }
+
+    @Override
+    protected CloseableWithDataSource createDataSource(byte[] contents) throws IOException {
+        // "01" | contents | "9"
+        byte[] fullContents = new byte[2 + contents.length + 1];
+        fullContents[0] = '0';
+        fullContents[1] = '1';
+        System.arraycopy(contents, 0, fullContents, 2, contents.length);
+        fullContents[fullContents.length - 1] = '9';
+
+        File tmp = File.createTempFile(DataSourceFromRAFChunkTest.class.getSimpleName(), ".bin");
+        RandomAccessFile f = null;
+        try {
+            Files.write(tmp.toPath(), fullContents);
+            f = new RandomAccessFile(tmp, "r");
+        } finally {
+            if (f == null) {
+                tmp.delete();
+            }
+        }
+
+        return CloseableWithDataSource.of(
+                DataSources.asDataSource(f, 2, contents.length),
+                new DataSourceFromRAFTest.TmpFileCloseable(tmp, f));
+    }
+}
diff --git a/src/test/java/com/android/apksig/util/DataSourceFromRAFTest.java b/src/test/java/com/android/apksig/util/DataSourceFromRAFTest.java
new file mode 100644
index 0000000..36ef760
--- /dev/null
+++ b/src/test/java/com/android/apksig/util/DataSourceFromRAFTest.java
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.util;
+
+import static org.junit.Assert.assertEquals;
+
+import java.io.Closeable;
+import java.io.File;
+import java.io.IOException;
+import java.io.RandomAccessFile;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Tests for the {@link DataSource} returned by
+ * {@link DataSources#asDataSource(java.io.RandomAccessFile)}.
+ */
+@RunWith(JUnit4.class)
+public class DataSourceFromRAFTest extends DataSourceTestBase {
+
+    @Test
+    public void testFileSizeChangesVisible() throws Exception {
+        try (CloseableWithDataSource c = createDataSource("abcdefg")) {
+            DataSource ds = c.getDataSource();
+            DataSource slice = ds.slice(3, 2);
+            File f = ((TmpFileCloseable) c.getCloseable()).getFile();
+            assertGetByteBufferEquals("abcdefg", ds, 0, (int) ds.size());
+            assertGetByteBufferEquals("de", slice, 0, (int) slice.size());
+            assertFeedEquals("cdefg", ds, 2, 5);
+            assertFeedEquals("e", slice, 1, 1);
+            assertCopyToEquals("cdefg", ds, 2, 5);
+            assertCopyToEquals("e", slice, 1, 1);
+            assertSliceEquals("cdefg", ds, 2, 5);
+            assertSliceEquals("e", slice, 1, 1);
+            try (RandomAccessFile raf = new RandomAccessFile(f, "rw")) {
+                raf.seek(7);
+                raf.write("hijkl".getBytes(StandardCharsets.UTF_8));
+            }
+
+            assertEquals(12, ds.size());
+            assertGetByteBufferEquals("abcdefghijkl", ds, 0, (int) ds.size());
+            assertGetByteBufferEquals("de", slice, 0, (int) slice.size());
+            assertFeedEquals("cdefg", ds, 2, 5);
+            assertFeedEquals("fgh", ds, 5, 3);
+            assertCopyToEquals("fgh", ds, 5, 3);
+            assertSliceEquals("fgh", ds, 5, 3);
+        }
+    }
+
+    @Override
+    protected CloseableWithDataSource createDataSource(byte[] contents) throws IOException {
+        File tmp = File.createTempFile(DataSourceFromRAFTest.class.getSimpleName(), ".bin");
+        RandomAccessFile f = null;
+        try {
+            Files.write(tmp.toPath(), contents);
+            f = new RandomAccessFile(tmp, "r");
+        } finally {
+            if (f == null) {
+                tmp.delete();
+            }
+        }
+
+        return CloseableWithDataSource.of(
+                DataSources.asDataSource(f),
+                new TmpFileCloseable(tmp, f));
+    }
+
+    /**
+     * {@link Closeable} which closes the delegate {@code Closeable} and deletes the provided file.
+     */
+    static class TmpFileCloseable implements Closeable {
+        private final File mFile;
+        private final Closeable mDelegate;
+
+        TmpFileCloseable(File file, Closeable closeable) {
+            mFile = file;
+            mDelegate = closeable;
+        }
+
+        File getFile() {
+            return mFile;
+        }
+
+        @Override
+        public void close() throws IOException {
+            try {
+                if (mDelegate != null) {
+                    mDelegate.close();
+                }
+            } finally {
+                if (mFile != null) {
+                    mFile.delete();
+                }
+            }
+        }
+    }
+}
diff --git a/src/test/java/com/android/apksig/util/DataSourceTestBase.java b/src/test/java/com/android/apksig/util/DataSourceTestBase.java
new file mode 100644
index 0000000..a21f1e5
--- /dev/null
+++ b/src/test/java/com/android/apksig/util/DataSourceTestBase.java
@@ -0,0 +1,377 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.util;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
+
+import java.io.Closeable;
+import java.io.IOException;
+import java.nio.BufferOverflowException;
+import java.nio.ByteBuffer;
+import java.nio.charset.StandardCharsets;
+import org.junit.Test;
+
+/**
+ * Base class for testing implementations of {@link DataSource}. This class tests the contract of
+ * {@code DataSource}.
+ *
+ * <p>To subclass, provide an implementation of {@link #createDataSource(byte[])} which returns
+ * the implementation of {@code DataSource} you want to test.
+ */
+public abstract class DataSourceTestBase {
+
+    /**
+     * Returns a new {@link DataSource} containing the provided contents.
+     */
+    protected abstract CloseableWithDataSource createDataSource(byte[] contents) throws IOException;
+
+    protected CloseableWithDataSource createDataSource(String contents) throws IOException {
+        return createDataSource(contents.getBytes(StandardCharsets.UTF_8));
+    }
+
+    @Test
+    public void testSize() throws Exception {
+        try (CloseableWithDataSource c = createDataSource("Hello12345")) {
+            DataSource ds = c.getDataSource();
+            assertEquals(10, ds.size());
+        }
+    }
+
+    @Test
+    public void testSlice() throws Exception {
+        try (CloseableWithDataSource c = createDataSource("Hello12345")) {
+            DataSource ds = c.getDataSource();
+            assertSliceEquals("123", ds, 5, 3);
+            DataSource slice = ds.slice(3, 5);
+            assertGetByteBufferEquals("lo123", slice, 0, 5);
+
+            // Zero-length slices
+            assertSliceEquals("", ds, 0, 0);
+            assertSliceEquals("", ds, 1, 0);
+            assertSliceEquals("", ds, ds.size() - 2, 0);
+            assertSliceEquals("", ds, ds.size() - 1, 0);
+            assertSliceEquals("", ds, ds.size(), 0);
+            assertSliceEquals("", slice, 0, 0);
+            assertSliceEquals("", slice, 1, 0);
+            assertSliceEquals("", slice, slice.size() - 2, 0);
+            assertSliceEquals("", slice, slice.size() - 1, 0);
+            assertSliceEquals("", slice, slice.size(), 0);
+
+            // Invalid slices
+            assertSliceThrowsIOOB(ds, -1, 0);
+            assertSliceThrowsIOOB(slice, -1, 0);
+            assertSliceThrowsIOOB(ds, -1, 2);
+            assertSliceThrowsIOOB(slice, -1, 2);
+            assertSliceThrowsIOOB(ds, -1, 20);
+            assertSliceThrowsIOOB(slice, -1, 20);
+            assertSliceThrowsIOOB(ds, 1, 20);
+            assertSliceThrowsIOOB(slice, 1, 20);
+            assertSliceThrowsIOOB(ds, ds.size() + 1, 0);
+            assertSliceThrowsIOOB(slice, slice.size() + 1, 0);
+            assertSliceThrowsIOOB(ds, ds.size(), 1);
+            assertSliceThrowsIOOB(slice, slice.size(), 1);
+            assertSliceThrowsIOOB(ds, ds.size() - 1, -1);
+            assertSliceThrowsIOOB(ds, slice.size() - 1, -1);
+        }
+    }
+
+    @Test
+    public void testGetByteBuffer() throws Exception {
+        try (CloseableWithDataSource c = createDataSource("test1234")) {
+            DataSource ds = c.getDataSource();
+            assertGetByteBufferEquals("s", ds, 2, 1);
+            DataSource slice = ds.slice(3, 4); // "t123"
+            assertGetByteBufferEquals("2", slice, 2, 1);
+
+            // Zero-length chunks
+            assertEquals(0, ds.getByteBuffer(0, 0).capacity());
+            assertEquals(0, ds.getByteBuffer(ds.size(), 0).capacity());
+            assertEquals(0, ds.getByteBuffer(ds.size() - 1, 0).capacity());
+            assertEquals(0, ds.getByteBuffer(ds.size() - 2, 0).capacity());
+            assertEquals(0, slice.getByteBuffer(0, 0).capacity());
+            assertEquals(0, slice.getByteBuffer(slice.size(), 0).capacity());
+            assertEquals(0, slice.getByteBuffer(slice.size() - 1, 0).capacity());
+            assertEquals(0, slice.getByteBuffer(slice.size() - 2, 0).capacity());
+
+            // Invalid chunks
+            assertGetByteBufferThrowsIOOB(ds, -1, 0);
+            assertGetByteBufferThrowsIOOB(slice, -1, 0);
+            assertGetByteBufferThrowsIOOB(ds, -1, 2);
+            assertGetByteBufferThrowsIOOB(slice, -1, 2);
+            assertGetByteBufferThrowsIOOB(ds, -1, 20);
+            assertGetByteBufferThrowsIOOB(slice, -1, 20);
+            assertGetByteBufferThrowsIOOB(ds, 1, 20);
+            assertGetByteBufferThrowsIOOB(slice, 1, 20);
+            assertGetByteBufferThrowsIOOB(ds, ds.size() + 1, 0);
+            assertGetByteBufferThrowsIOOB(slice, slice.size() + 1, 0);
+            assertGetByteBufferThrowsIOOB(ds, ds.size(), 1);
+            assertGetByteBufferThrowsIOOB(slice, slice.size(), 1);
+            assertGetByteBufferThrowsIOOB(ds, ds.size() - 1, -1);
+            assertGetByteBufferThrowsIOOB(ds, slice.size() - 1, -1);
+        }
+    }
+
+    @Test
+    public void testFeed() throws Exception {
+        try (CloseableWithDataSource c = createDataSource("test1234")) {
+            DataSource ds = c.getDataSource();
+            assertFeedEquals("23", ds, 5, 2);
+            DataSource slice = ds.slice(1, 5); // "est12"
+            assertFeedEquals("t", slice, 2, 1);
+
+            // Zero-length chunks
+            assertFeedEquals("", ds, 0, 0);
+            assertFeedEquals("", ds, 1, 0);
+            assertFeedEquals("", ds, ds.size() - 2, 0);
+            assertFeedEquals("", ds, ds.size() - 1, 0);
+            assertFeedEquals("", ds, ds.size(), 0);
+            assertFeedEquals("", slice, 0, 0);
+            assertFeedEquals("", slice, 2, 0);
+            assertFeedEquals("", slice, slice.size() - 2, 0);
+            assertFeedEquals("", slice, slice.size() - 1, 0);
+            assertFeedEquals("", slice, slice.size(), 0);
+
+            // Invalid chunks
+            assertFeedThrowsIOOB(ds, -1, 0);
+            assertFeedThrowsIOOB(slice, -1, 0);
+            assertFeedThrowsIOOB(ds, -1, 2);
+            assertFeedThrowsIOOB(slice, -1, 2);
+            assertFeedThrowsIOOB(ds, -1, 10);
+            assertFeedThrowsIOOB(slice, -1, 10);
+            assertFeedThrowsIOOB(ds, 1, 10);
+            assertFeedThrowsIOOB(slice, 1, 10);
+            assertFeedThrowsIOOB(ds, ds.size() + 1, 0);
+            assertFeedThrowsIOOB(slice, slice.size() + 1, 0);
+            assertFeedThrowsIOOB(ds, ds.size(), 1);
+            assertFeedThrowsIOOB(slice, slice.size(), 1);
+            assertFeedThrowsIOOB(ds, ds.size() - 1, -1);
+            assertFeedThrowsIOOB(ds, slice.size() - 1, -1);
+        }
+    }
+
+    @Test
+    public void testCopyTo() throws Exception {
+        try (CloseableWithDataSource c = createDataSource("abcdefghijklmnop")) {
+            DataSource ds = c.getDataSource();
+            assertCopyToEquals("fgh", ds, 5, 3);
+            DataSource slice = ds.slice(2, 7); // "cdefghi"
+            assertCopyToEquals("efgh", slice, 2, 4);
+
+            // Zero-length chunks
+            assertCopyToEquals("", ds, 0, 0);
+            assertCopyToEquals("", ds, 1, 0);
+            assertCopyToEquals("", ds, ds.size() - 2, 0);
+            assertCopyToEquals("", ds, ds.size() - 1, 0);
+            assertCopyToEquals("", ds, ds.size(), 0);
+            assertCopyToEquals("", slice, 0, 0);
+            assertCopyToEquals("", slice, 2, 0);
+            assertCopyToEquals("", slice, slice.size() - 2, 0);
+            assertCopyToEquals("", slice, slice.size() - 1, 0);
+            assertCopyToEquals("", slice, slice.size(), 0);
+
+            // Invalid chunks
+            assertCopyToThrowsIOOB(ds, -1, 0);
+            assertCopyToThrowsIOOB(slice, -1, 0);
+            assertCopyToThrowsIOOB(ds, -1, 2);
+            assertCopyToThrowsIOOB(slice, -1, 2);
+            assertCopyToThrowsIOOB(ds, -1, 20);
+            assertCopyToThrowsIOOB(slice, -1, 20);
+            assertCopyToThrowsIOOB(ds, 1, 20);
+            assertCopyToThrowsIOOB(slice, 1, 20);
+            assertCopyToThrowsIOOB(ds, ds.size() + 1, 0);
+            assertCopyToThrowsIOOB(slice, slice.size() + 1, 0);
+            assertCopyToThrowsIOOB(ds, ds.size(), 1);
+            assertCopyToThrowsIOOB(slice, slice.size(), 1);
+            assertCopyToThrowsIOOB(ds, ds.size() - 1, -1);
+            assertCopyToThrowsIOOB(ds, slice.size() - 1, -1);
+
+            // Destination buffer too small
+            ByteBuffer buf = ByteBuffer.allocate(5);
+            buf.position(2);
+            buf.limit(3);
+            assertCopyToThrowsBufferOverflow(ds, 0, 2, buf);
+            buf.position(2);
+            buf.limit(3);
+            assertCopyToThrowsBufferOverflow(slice, 1, 2, buf);
+
+            // Destination buffer larger than chunk copied using copyTo
+            buf = ByteBuffer.allocate(10);
+            buf.position(2);
+            assertCopyToEquals("bcd", ds, 1, 3, buf);
+            buf = ByteBuffer.allocate(10);
+            buf.position(2);
+            assertCopyToEquals("fg", slice, 3, 2, buf);
+        }
+    }
+
+    protected static void assertSliceEquals(
+            String expectedContents, DataSource ds, long offset, int size) throws IOException {
+        DataSource slice = ds.slice(offset, size);
+        assertEquals(size, slice.size());
+        assertGetByteBufferEquals(expectedContents, slice, 0, size);
+    }
+
+    protected static void assertSliceThrowsIOOB(DataSource ds, long offset, int size) {
+        try {
+            ds.slice(offset, size);
+            fail();
+        } catch (IndexOutOfBoundsException expected) {}
+    }
+
+    protected static void assertGetByteBufferEquals(
+            String expectedContents, DataSource ds, long offset, int size) throws IOException {
+        ByteBuffer buf = ds.getByteBuffer(offset, size);
+        assertEquals(0, buf.position());
+        assertEquals(size, buf.limit());
+        assertEquals(size, buf.capacity());
+        assertEquals(expectedContents, toString(buf));
+    }
+
+    protected static void assertGetByteBufferThrowsIOOB(DataSource ds, long offset, int size)
+            throws IOException {
+        try {
+            ds.getByteBuffer(offset, size);
+            fail();
+        } catch (IndexOutOfBoundsException expected) {}
+    }
+
+    protected static void assertFeedEquals(
+            String expectedFedContents, DataSource ds, long offset, int size) throws IOException {
+        ReadableDataSink out = DataSinks.newInMemoryDataSink(size);
+        ds.feed(offset, size, out);
+        assertEquals(size, out.size());
+        assertEquals(expectedFedContents, toString(out.getByteBuffer(0, size)));
+    }
+
+    protected static void assertFeedThrowsIOOB(DataSource ds, long offset, long size)
+            throws IOException {
+        try {
+            ds.feed(offset, size, NullDataSink.INSTANCE);
+            fail();
+        } catch (IndexOutOfBoundsException expected) {}
+    }
+
+    protected static void assertCopyToEquals(
+            String expectedContents, DataSource ds, long offset, int size) throws IOException {
+        // Create a ByteBuffer backed by a section of a byte array. The ByteBuffer is on purpose not
+        // starting at offset 0 to catch issues to do with not checking ByteBuffer.arrayOffset().
+        byte[] arr = new byte[size + 10];
+        ByteBuffer buf = ByteBuffer.wrap(arr, 1, size + 5);
+        // Use non-zero position to catch issues with not checking buf.position()
+        buf.position(2);
+        // Buffer contains sufficient space for the requested copyTo operation
+        assertEquals(size + 4, buf.remaining());
+        assertCopyToEquals(expectedContents, ds, offset, size, buf);
+    }
+
+    private static void assertCopyToEquals(
+            String expectedContents, DataSource ds, long offset, int size, ByteBuffer buf)
+                    throws IOException {
+        int oldPosition = buf.position();
+        int oldLimit = buf.limit();
+        ds.copyTo(offset, size, buf);
+        // Position should've advanced by size whereas limit should've remained unchanged
+        assertEquals(oldPosition + size, buf.position());
+        assertEquals(oldLimit, buf.limit());
+
+        buf.limit(buf.position());
+        buf.position(oldPosition);
+        assertEquals(expectedContents, toString(buf));
+    }
+
+    protected static void assertCopyToThrowsIOOB(DataSource ds, long offset, int size)
+            throws IOException {
+        ByteBuffer buf = ByteBuffer.allocate((size < 0) ? 0 : size);
+        try {
+            ds.copyTo(offset, size, buf);
+            fail();
+        } catch (IndexOutOfBoundsException expected) {}
+    }
+
+    private static void assertCopyToThrowsBufferOverflow(
+            DataSource ds, long offset, int size, ByteBuffer buf) throws IOException {
+        try {
+            ds.copyTo(offset, size, buf);
+            fail();
+        } catch (BufferOverflowException expected) {}
+    }
+
+    /**
+     * Returns the contents of the provided buffer as a string. The buffer's position and limit
+     * remain unchanged.
+     */
+    static String toString(ByteBuffer buf) {
+        byte[] arr;
+        int offset;
+        int size = buf.remaining();
+        if (buf.hasArray()) {
+            arr = buf.array();
+            offset = buf.arrayOffset() + buf.position();
+        } else {
+            arr = new byte[buf.remaining()];
+            offset = 0;
+            int oldPos = buf.position();
+            buf.get(arr);
+            buf.position(oldPos);
+        }
+        return new String(arr, offset, size, StandardCharsets.UTF_8);
+    }
+
+    public static class CloseableWithDataSource implements Closeable {
+        private final DataSource mDataSource;
+        private final Closeable mCloseable;
+
+        private CloseableWithDataSource(DataSource dataSource, Closeable closeable) {
+            mDataSource = dataSource;
+            mCloseable = closeable;
+        }
+
+        public static CloseableWithDataSource of(DataSource dataSource) {
+            return new CloseableWithDataSource(dataSource, null);
+        }
+
+        public static CloseableWithDataSource of(DataSource dataSource, Closeable closeable) {
+            return new CloseableWithDataSource(dataSource, closeable);
+        }
+
+        public DataSource getDataSource() {
+            return mDataSource;
+        }
+
+        public Closeable getCloseable() {
+            return mCloseable;
+        }
+
+        @Override
+        public void close() throws IOException {
+            if (mCloseable != null) {
+                mCloseable.close();
+            }
+        }
+    }
+
+    private static final class NullDataSink implements DataSink {
+        private static final NullDataSink INSTANCE = new NullDataSink();
+
+        @Override
+        public void consume(byte[] buf, int offset, int length) {}
+
+        @Override
+        public void consume(ByteBuffer buf) {}
+    }
+}
diff --git a/src/test/java/com/android/apksig/util/InMemoryDataSinkDataSourceTest.java b/src/test/java/com/android/apksig/util/InMemoryDataSinkDataSourceTest.java
new file mode 100644
index 0000000..33243e9
--- /dev/null
+++ b/src/test/java/com/android/apksig/util/InMemoryDataSinkDataSourceTest.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.util;
+
+import java.io.IOException;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Tests for the {@link DataSource} returned by {@link DataSinks#newInMemoryDataSink()}.
+ */
+@RunWith(JUnit4.class)
+public class InMemoryDataSinkDataSourceTest extends DataSourceTestBase {
+    @Override
+    protected CloseableWithDataSource createDataSource(byte[] contents) throws IOException {
+        ReadableDataSink sink = DataSinks.newInMemoryDataSink();
+        sink.consume(contents, 0, contents.length);
+        return CloseableWithDataSource.of(sink);
+    }
+}
diff --git a/src/test/java/com/android/apksig/util/InMemoryDataSinkTest.java b/src/test/java/com/android/apksig/util/InMemoryDataSinkTest.java
new file mode 100644
index 0000000..f48510a
--- /dev/null
+++ b/src/test/java/com/android/apksig/util/InMemoryDataSinkTest.java
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.apksig.util;
+
+import java.io.IOException;
+import java.nio.ByteBuffer;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Tests for the {@link DataSink} returned by {@link DataSinks#newInMemoryDataSink()}.
+ */
+@RunWith(JUnit4.class)
+public class InMemoryDataSinkTest extends DataSinkTestBase<ReadableDataSink> {
+
+    @Override
+    protected CloseableWithDataSink<ReadableDataSink> createDataSink() {
+        return CloseableWithDataSink.of(DataSinks.newInMemoryDataSink());
+    }
+
+    @Override
+    protected ByteBuffer getContents(ReadableDataSink dataSink) throws IOException {
+        if (dataSink.size() > Integer.MAX_VALUE) {
+            throw new IOException("Too much data: " + dataSink.size());
+        }
+        return dataSink.getByteBuffer(0, (int) dataSink.size());
+    }
+
+}
diff --git a/src/test/resources/com/android/apksig/dsa-1024.pk8 b/src/test/resources/com/android/apksig/dsa-1024.pk8
new file mode 100644
index 0000000..d500d70
--- /dev/null
+++ b/src/test/resources/com/android/apksig/dsa-1024.pk8
Binary files differ
diff --git a/src/test/resources/com/android/apksig/dsa-1024.x509.pem b/src/test/resources/com/android/apksig/dsa-1024.x509.pem
new file mode 100644
index 0000000..e230eb0
--- /dev/null
+++ b/src/test/resources/com/android/apksig/dsa-1024.x509.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICsTCCAnGgAwIBAgIJAP6EmkoBF8UoMAkGByqGSM44BAMwEzERMA8GA1UEAwwI
+ZHNhLTEwMjQwHhcNMTYwMzMxMTUyNzEwWhcNNDMwODE3MTUyNzEwWjATMREwDwYD
+VQQDDAhkc2EtMTAyNDCCAbYwggErBgcqhkjOOAQBMIIBHgKBgQCTDpv8gS5Y+Ehl
+oln6WT/MYBnywrc3tWDfnlY+9MpVDdB2+kcB7WrhobW1L+6ayKmlkrTaAFjiMPDf
+bdyA6hy3fDu1teLCb89R0uodfZa3MDXXlmqvBk4Fdw8fYijWI/q175e4Y5sNYO9+
+QZg8bBIZnxxCdbKASJ6NAHc50ts3vwIVAIebRw3HnYOZbo6rPoBmcBOxcZTLAoGA
+ch+0D7JrbqmR1w5S3VBtTnONLiBYnaz1Ri3Pfiw5FHKfJcfFcQopIOLJwfdBmY4b
+FLGV5u7DXeJNp16Nvl4MrsmVjkWs9MZVAp5RqzrN9JhVi4ShpdelyFjdWOXHPbc7
+NNqQpTjdkK23r/tCE6XkvkCiWm7Rt22LMpZA4ePALIoDgYQAAoGAc8SkppDzSUPH
+SpKrhrldRyh5m4wSH14ZE96mlSze9tRoSDo8hsA9/vGLgoN7F+3jYSvj8m42tmNt
+jZJWk7vPkJHC/9qoEGbVBY+aTNYwVJyKDJ07vZB9bLxpjD/yyQlsn7/vZTOS657c
+W2S817RgGGyGcCNRoKNig6i0k9fzE8ajUDBOMB0GA1UdDgQWBBSPwzoIjftVH2ke
+EJXtLq+bB50lzDAfBgNVHSMEGDAWgBSPwzoIjftVH2keEJXtLq+bB50lzDAMBgNV
+HRMEBTADAQH/MAkGByqGSM44BAMDLwAwLAIUH1GQcpqx8/9p9QfhCRMvcxrECM4C
+FH8ZULK91BMaHodbRMUtdxB9kIbL
+-----END CERTIFICATE-----
diff --git a/src/test/resources/com/android/apksig/dsa-2048.pk8 b/src/test/resources/com/android/apksig/dsa-2048.pk8
new file mode 100644
index 0000000..cf63594
--- /dev/null
+++ b/src/test/resources/com/android/apksig/dsa-2048.pk8
Binary files differ
diff --git a/src/test/resources/com/android/apksig/dsa-2048.x509.pem b/src/test/resources/com/android/apksig/dsa-2048.x509.pem
new file mode 100644
index 0000000..705db39
--- /dev/null
+++ b/src/test/resources/com/android/apksig/dsa-2048.x509.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEWzCCBAKgAwIBAgIJAK4uYtTAat4+MAkGByqGSM44BAMwEzERMA8GA1UEAwwI
+ZHNhLTIwNDgwHhcNMTYwMzMxMTgzMDAxWhcNNDMwODE3MTgzMDAxWjATMREwDwYD
+VQQDDAhkc2EtMjA0ODCCA0cwggI5BgcqhkjOOAQBMIICLAKCAQEAv2/yUkci8fnZ
+ppepy1kcOTIrbPJTW46Z2jKOWjHCTd1aqRFunz3gllpx/YDgjboNIYZf2jKhk2gi
+MgF+8OT0hEHQGXSofnqRoVljexA2nC3tPhVyjN14pQ7ZJXp/raHh1uCT5K7Lfafc
+8y5Cs180CdfisspANfCp10jFu1D2hKOLfggUA9efN05c0f2yOx/Pm9uEiz6ftLUJ
+UWgcJenx1WUk4Nb1qMOWgg9nKQyDiBxZKoVCH5/XJO0K225w6F4scol2hMdTRlA+
+9TGb5tvHKT+Y+lE7fBbcBSKzLT3pwD/T08ErpsIoHqRPamLGHeuamGzvXLHwI1UN
+cJNGg2nnCwIhAJz9K+Qpgg7sbqRMeRvIf2cuWRWbi4XnYR+IAGqgfYUZAoIBADks
+N3taHUnIvkcxTuEUiCSb+d1KMlvbZiH5zLVIyzi5kZNQW8L/gR23z8T6qngXXnFw
+tcTRcb0TDqR7iYPxsX3/x+jBjiApIgebqpnPdpiEAUfORZX7w6CpCNsp9Kqxb98z
+4PtKE9z/20Q3zKhqlwDm8uSjjT7E5xw/YpV8bg7YuQ5eQ8mkonipNXllf3qmDV48
+see/+QwIeBiL7jTjgeBv5ziL8BY2AYmfOwGKwmK9ERxJpIoxgS+5fFuA2oAQ8CwJ
+UDwwv5Wbz7NVkvljHK1Fh5u26ZHdeLT4qp4F0GamJcikq4MqFco6ToCvp8NoDNMZ
+MOno2k1IvsIwrIbrQJgDggEGAAKCAQEAuxbFbx2H4n4BqfbkC9tjn/Mg3zr4LZgG
+7v3FWpzpkbAcEcFCVIqTmJiRlsuf4ml/t9hflOvarfD6TesSc7gyGCJ/2QiqJcI+
+Vif5AKqZskQFlZ5BUMIMjPFMy1WtTVpEotmdbIOaQif4wQrz6SNFUOAXPBKRTY33
+HOLMoo8FRiZ1+uMu9PlUWYqMhSJg+rm2AQPt06D+JToXREaNkYjN0K97T2MTcUNh
+OWiliH/zFuF8N2s6IlNaCv1Yc4FoYEIRoS07dUxcjrV9KRd0TyU0q++rRPluytJP
+yAoyTIrfwa2SM5JR9RtdBZsPdR9Ckpy4ZKSJqDzTbCIU70zsGgHA4aNQME4wHQYD
+VR0OBBYEFL3koBjVHAySf8Xr196yqDT6VhwSMB8GA1UdIwQYMBaAFL3koBjVHAyS
+f8Xr196yqDT6VhwSMAwGA1UdEwQFMAMBAf8wCQYHKoZIzjgEAwNIADBFAiEAjowh
+laeXA/CUrHt6iH4u6edWGeZzyFGlpWsxssKTMBECIG2tZs/xnZVAtXioiIcH1CXT
+LN5AAzZ8wlNUKSvTc12j
+-----END CERTIFICATE-----
diff --git a/src/test/resources/com/android/apksig/dsa-3072.pk8 b/src/test/resources/com/android/apksig/dsa-3072.pk8
new file mode 100644
index 0000000..f0f8983
--- /dev/null
+++ b/src/test/resources/com/android/apksig/dsa-3072.pk8
Binary files differ
diff --git a/src/test/resources/com/android/apksig/dsa-3072.x509.pem b/src/test/resources/com/android/apksig/dsa-3072.x509.pem
new file mode 100644
index 0000000..0284b13
--- /dev/null
+++ b/src/test/resources/com/android/apksig/dsa-3072.x509.pem
@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF3DCCBYKgAwIBAgIJAKmpH5wXPDbGMAkGByqGSM44BAMwEzERMA8GA1UEAwwI
+ZHNhLTMwNzIwHhcNMTYwMzMxMTgzMjU2WhcNNDMwODE3MTgzMjU2WjATMREwDwYD
+VQQDDAhkc2EtMzA3MjCCBMcwggM5BgcqhkjOOAQBMIIDLAKCAYEAscwotTL9jjwZ
+CpGRqXVezU9P0zY/wHFYMQB09JjgoCJRm0D9FZzmTnySJa4suwlwoduzgv+pkIkk
+nn0w+hL6LsblRTEuFj11o/fLLAZE4KmdIAPkCcH74HOnws4BwazJLWFtVEv+bdyj
+CmrI2urYWT5uRJwWZmkG4iUnoL/5FUv2pvpSOzu6EO+qFcFcWf3/VrQDaaP3jRRh
+iVCThxvX5xOrO24krrOFlHQufY0A6fHYQqII6EYac6tKTI+ltz121DYH914SHMe8
+0JJYpDVOatjTJADyg1AzHAKsyfTKHHpHbqkgU/CRtALEC1DUyLqQhHvBGpodmqPH
+r9Mbd7pXudw2h6O8uapAsmaFt/YdrSbd37UvhLJyyW0fodTjBTA0WiNs0CLTJL9o
+422Nt1cUDQS1JpsghAzmMWaavq7+QIRhpnMHL47p1jCZvcwMboMlcJwOCjyyZS0F
+fmaD+pEi56Lx+9XDblESM78crb8/lbvuohyrwIJciQmL0hQoKIg1AiEApYT1sROj
+BMB4FIQaS86VKdJ4h9OR13AraES3ba9WV1cCggGAI9LskZ7wcUna6nZyGT4f3bH1
+KSeD3602Yd86NKuB8QGr/QT5L+wFwCuvvI4V8P2lM4wb+q1LrR688f53WS4c0Kin
+/MeN4YtkQBzV4l04Bxrce//EcfQzUPDAr41Fwu2tA0BHE67trxGjNS7SzoFZUiDo
+d/aOZCVilFIay5oF2X8yeNcpTynsxTbGxjxhhgG2tS0fvxhbGF6rl4D0Ddskx6L/
+xjstzu0ADE8FNpDehuKqxzOisNLIJgc1INPQ06AmaUF1Pge74T2AJYPYwqfzArG3
+pj+l2iND0PM7lDeQCgivPAqhYrveoIqJe0NAEu/PiCnOW50hQ4F6dl9lzn9sGXTP
+5KxdR5OyG+Ki+nWTN8h3yOy9ZK7Gh8gUeqE3QVow4+1LhcO19C+X+NM588KbKsq9
+KRP5H4v238g6oF2wgbmPrYvqiwoa1qjHvUX7ZjQuIfrN9+lICflsHKtAtchuUIiO
+b1AWPeaJwAynTn2EeDsVd0e8bm+h+g7ZSDAwUOKuA4IBhgACggGBAJfW6T1BxtZo
+EacqR2TwTi9B3O93Zcj0OzDOn9UMahepcfaF1B3wq9UdJ4PPIC1U27CaEXEJNxgJ
+cIURfFPDXA6pLVEqrGgRX2u0FR1pmHVIxjBpvPJvO954+Hawp+ClU6PKLmxuVZpA
+VeJBx7C8/DU/58J//iuG9B6/mwzPuEoPmnGYMsfVCcEX8yQ2PZXyNGp+KnUygyql
+mMxpE8UXtH6mHYontjiw4Afxqwop3v/bG8eT5FHhpXoQDSN/oeGghDaq9DyIjCqr
+GXZDBvEufLYRgOvnpV6T0oMa9U2W2Trz3HYD6eX09FOhGnMWl9euYrSVRihAKBh1
+72ystvPy2R4wdAA5EQf7EsDdgt/QOMf/AvkaKHMP7DNK5BZxwPQ0KwRkLB+0vaDI
+Mnpu29L6TiixMxI1ihnZbR/U0v8H+/SlSjZaPNRQeuoV9d8t81miUqVSMLcpqNui
+ZljSCtoGfktPAbPyFwGenBkGK5oo0I381KTECMynC0R2P9CQUHegeaNQME4wHQYD
+VR0OBBYEFPRqMyQLPdq0guTx3YKiVxtWN+bPMB8GA1UdIwQYMBaAFPRqMyQLPdq0
+guTx3YKiVxtWN+bPMAwGA1UdEwQFMAMBAf8wCQYHKoZIzjgEAwNJADBGAiEAjcit
+8dFR02elWKoeRAounP9TE2aqDqd5cJXqXn0ssMYCIQCIINjXEYRovfVjDotKelRg
+5k0lmzMmx6Xfz8EgZDLovw==
+-----END CERTIFICATE-----
diff --git a/src/test/resources/com/android/apksig/ec-p256.pk8 b/src/test/resources/com/android/apksig/ec-p256.pk8
new file mode 100644
index 0000000..f781c30
--- /dev/null
+++ b/src/test/resources/com/android/apksig/ec-p256.pk8
Binary files differ
diff --git a/src/test/resources/com/android/apksig/ec-p256.x509.pem b/src/test/resources/com/android/apksig/ec-p256.x509.pem
new file mode 100644
index 0000000..06adcfe
--- /dev/null
+++ b/src/test/resources/com/android/apksig/ec-p256.x509.pem
@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBbDCCARGgAwIBAgIJAMoPtk37ZudyMAoGCCqGSM49BAMCMBIxEDAOBgNVBAMM
+B2VjLXAyNTYwHhcNMTYwMzMxMTQ1ODA2WhcNNDMwODE3MTQ1ODA2WjASMRAwDgYD
+VQQDDAdlYy1wMjU2MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpl8RPSLLSROQ
+gwesMe4roOkTi3hfrGU20U6izpDStL/hlLUM3I4Wn1SnOpke8Pp2MpglvgeMx4J0
+BwPaRLTX66NQME4wHQYDVR0OBBYEFNQTNWi5WzAVizIgceqMQ/9bBczIMB8GA1Ud
+IwQYMBaAFNQTNWi5WzAVizIgceqMQ/9bBczIMAwGA1UdEwQFMAMBAf8wCgYIKoZI
+zj0EAwIDSQAwRgIhAPUEoIZsrvAp9BcULFy3E1THn/zR1kBhjfyk8Z4W23jWAiEA
++O6kgpeZwGytCMbT0tLsBeBXQVTnR+oP27gELLZVqt0=
+-----END CERTIFICATE-----
diff --git a/src/test/resources/com/android/apksig/ec-p384.pk8 b/src/test/resources/com/android/apksig/ec-p384.pk8
new file mode 100644
index 0000000..f22507d
--- /dev/null
+++ b/src/test/resources/com/android/apksig/ec-p384.pk8
Binary files differ
diff --git a/src/test/resources/com/android/apksig/ec-p384.x509.pem b/src/test/resources/com/android/apksig/ec-p384.x509.pem
new file mode 100644
index 0000000..9d1403b
--- /dev/null
+++ b/src/test/resources/com/android/apksig/ec-p384.x509.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBqTCCAS6gAwIBAgIJAMRWS+CLIsxqMAoGCCqGSM49BAMDMBIxEDAOBgNVBAMM
+B2VjLXAzODQwHhcNMTYwMzMxMTUzMDU3WhcNNDMwODE3MTUzMDU3WjASMRAwDgYD
+VQQDDAdlYy1wMzg0MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE18hjdbk/HXGQNIuF
+xKPMAZO3PQnROO6izB/mHM1BKPpih2/51iMTFKn6KCU9NZt/Q4Z+PpZVLuawEWP/
+uoWwWIj+60vk25z47/Sr0icelSDGt9T9ujiNP6aTA5hc9gypo1AwTjAdBgNVHQ4E
+FgQU981MoejFjh0rbaGXODywOYvB32kwHwYDVR0jBBgwFoAU981MoejFjh0rbaGX
+ODywOYvB32kwDAYDVR0TBAUwAwEB/zAKBggqhkjOPQQDAwNpADBmAjEA/58rXa+F
+mB6JwB89/IAucpNlktjSPrH2tD63BSROvpUpXNy+p+OlJu4sCvY7HnwEAjEA0VWw
+QqUBFLQHFJx1JjMYYfT78V8ylY+Ns1lxrdvs29NNg45MA9uw/ZVMMHgTFNph
+-----END CERTIFICATE-----
diff --git a/src/test/resources/com/android/apksig/ec-p521.pk8 b/src/test/resources/com/android/apksig/ec-p521.pk8
new file mode 100644
index 0000000..9c75e4c
--- /dev/null
+++ b/src/test/resources/com/android/apksig/ec-p521.pk8
Binary files differ
diff --git a/src/test/resources/com/android/apksig/ec-p521.x509.pem b/src/test/resources/com/android/apksig/ec-p521.x509.pem
new file mode 100644
index 0000000..a9b8194
--- /dev/null
+++ b/src/test/resources/com/android/apksig/ec-p521.x509.pem
@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB8zCCAVSgAwIBAgIJAOxXdFsvm3YiMAoGCCqGSM49BAMEMBIxEDAOBgNVBAMM
+B2VjLXA1MjEwHhcNMTYwMzMxMTUzMTIyWhcNNDMwODE3MTUzMTIyWjASMRAwDgYD
+VQQDDAdlYy1wNTIxMIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAYX95sSjPEQqg
+yLD04tNUyq9y/w8seblOpfqa/Amx6H4GFdrjGXX0YTfXKr9GhAyIyQSnNrIg0zDl
+WQUbBPRW4CYBLFOg1pUn1NBhKFD4NtO1KWvYtNOYDegFjRCPB0p+fEXDbq8QFDYv
+lh+NZUJ16+ih8XNIf1C29xuLEqN6oKOnAvajUDBOMB0GA1UdDgQWBBT/Ra3kz60g
+Q7tYk3byZckcLabt8TAfBgNVHSMEGDAWgBT/Ra3kz60gQ7tYk3byZckcLabt8TAM
+BgNVHRMEBTADAQH/MAoGCCqGSM49BAMEA4GMADCBiAJCAP39hYLsWk2H84oEw+HJ
+qGGjexhqeD3vSO1mWhopripE/81oy3yV10puYoJe11xDSfcDj2VfNCHazuXO3kSx
+GA/1AkIBLUJxp/WYbYzhBGKr6lcxczKI/wuMfkZ6vL+0EMJVA/2uEoeqvnl7Bsdk
+icyaOBNEADijuVdaPPIWzKClt9OaVxE=
+-----END CERTIFICATE-----
diff --git a/src/test/resources/com/android/apksig/empty-unsigned.apk b/src/test/resources/com/android/apksig/empty-unsigned.apk
new file mode 100644
index 0000000..15cb0ec
--- /dev/null
+++ b/src/test/resources/com/android/apksig/empty-unsigned.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-aligned-in.apk b/src/test/resources/com/android/apksig/golden-aligned-in.apk
new file mode 100644
index 0000000..97f7881
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-aligned-in.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-aligned-out.apk b/src/test/resources/com/android/apksig/golden-aligned-out.apk
new file mode 100644
index 0000000..a888228
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-aligned-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-aligned-v1-out.apk b/src/test/resources/com/android/apksig/golden-aligned-v1-out.apk
new file mode 100644
index 0000000..8939a9f
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-aligned-v1-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-aligned-v1v2-out.apk b/src/test/resources/com/android/apksig/golden-aligned-v1v2-out.apk
new file mode 100644
index 0000000..a888228
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-aligned-v1v2-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-aligned-v2-out.apk b/src/test/resources/com/android/apksig/golden-aligned-v2-out.apk
new file mode 100644
index 0000000..3794463
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-aligned-v2-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-legacy-aligned-in.apk b/src/test/resources/com/android/apksig/golden-legacy-aligned-in.apk
new file mode 100644
index 0000000..df0e6c1
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-legacy-aligned-in.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-legacy-aligned-out.apk b/src/test/resources/com/android/apksig/golden-legacy-aligned-out.apk
new file mode 100644
index 0000000..a8520e6
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-legacy-aligned-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-legacy-aligned-v1-out.apk b/src/test/resources/com/android/apksig/golden-legacy-aligned-v1-out.apk
new file mode 100644
index 0000000..20fe0fa
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-legacy-aligned-v1-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-legacy-aligned-v1v2-out.apk b/src/test/resources/com/android/apksig/golden-legacy-aligned-v1v2-out.apk
new file mode 100644
index 0000000..a8520e6
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-legacy-aligned-v1v2-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-legacy-aligned-v2-out.apk b/src/test/resources/com/android/apksig/golden-legacy-aligned-v2-out.apk
new file mode 100644
index 0000000..87c344d
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-legacy-aligned-v2-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-rsa-minSdkVersion-1-out.apk b/src/test/resources/com/android/apksig/golden-rsa-minSdkVersion-1-out.apk
new file mode 100644
index 0000000..0ac5356
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-rsa-minSdkVersion-1-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-rsa-minSdkVersion-18-out.apk b/src/test/resources/com/android/apksig/golden-rsa-minSdkVersion-18-out.apk
new file mode 100644
index 0000000..bfe89a2
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-rsa-minSdkVersion-18-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-rsa-minSdkVersion-24-out.apk b/src/test/resources/com/android/apksig/golden-rsa-minSdkVersion-24-out.apk
new file mode 100644
index 0000000..bfe89a2
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-rsa-minSdkVersion-24-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-rsa-out.apk b/src/test/resources/com/android/apksig/golden-rsa-out.apk
new file mode 100644
index 0000000..bfe89a2
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-rsa-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-unaligned-in.apk b/src/test/resources/com/android/apksig/golden-unaligned-in.apk
new file mode 100644
index 0000000..a52e30b
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-unaligned-in.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-unaligned-out.apk b/src/test/resources/com/android/apksig/golden-unaligned-out.apk
new file mode 100644
index 0000000..44584f1
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-unaligned-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-unaligned-v1-out.apk b/src/test/resources/com/android/apksig/golden-unaligned-v1-out.apk
new file mode 100644
index 0000000..8fe9740
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-unaligned-v1-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-unaligned-v1v2-out.apk b/src/test/resources/com/android/apksig/golden-unaligned-v1v2-out.apk
new file mode 100644
index 0000000..44584f1
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-unaligned-v1v2-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/golden-unaligned-v2-out.apk b/src/test/resources/com/android/apksig/golden-unaligned-v2-out.apk
new file mode 100644
index 0000000..199d3ed
--- /dev/null
+++ b/src/test/resources/com/android/apksig/golden-unaligned-v2-out.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/mismatched-compression-method.apk b/src/test/resources/com/android/apksig/mismatched-compression-method.apk
new file mode 100644
index 0000000..9fe9ff9
--- /dev/null
+++ b/src/test/resources/com/android/apksig/mismatched-compression-method.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/original.apk b/src/test/resources/com/android/apksig/original.apk
new file mode 100644
index 0000000..05f89aa
--- /dev/null
+++ b/src/test/resources/com/android/apksig/original.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/rsa-1024.pk8 b/src/test/resources/com/android/apksig/rsa-1024.pk8
new file mode 100644
index 0000000..7b4beee
--- /dev/null
+++ b/src/test/resources/com/android/apksig/rsa-1024.pk8
Binary files differ
diff --git a/src/test/resources/com/android/apksig/rsa-1024.x509.pem b/src/test/resources/com/android/apksig/rsa-1024.x509.pem
new file mode 100644
index 0000000..9498ec5
--- /dev/null
+++ b/src/test/resources/com/android/apksig/rsa-1024.x509.pem
@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB9DCCAV2gAwIBAgIJAP0KtYjhFu3IMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNV
+BAMMCHJzYS0xMDI0MB4XDTE2MDMzMTE2MTQ0M1oXDTQzMDgxNzE2MTQ0M1owEzER
+MA8GA1UEAwwIcnNhLTEwMjQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOOP
+r4Y+uCAihcVjey8JmdjyfhZXplVf3HnOQfvWcY97nKnJ7L977QiWajIn7iZRAdVX
+PamVrEbaU6uklgcJFG/qirtscOf6fMBf6GaP2PAhQG89MQnUt9rAjxUAakzWOBTz
+bH0gHRDEGQ30LCA1oSlbLldHz+zBKSC7nsSKYp+9AgMBAAGjUDBOMB0GA1UdDgQW
+BBT1x0TcWRB4i9JnU5pvRtrEv+95OTAfBgNVHSMEGDAWgBT1x0TcWRB4i9JnU5pv
+RtrEv+95OTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GBAKs024CvDYFv
+rj3GTXM8A9Jslg/86WukzEl/+PXDjbPljNV24RSsFVW5gO0ps6Q/EBkbllJP7xNO
+XmOUDyqUcvcwC1zzySqs8kJcF5GCuRXajy4KiEiA5VRmVUSShhnkYX7g1yXkhWrP
+Ps1fQArqHx84+naFSh9kVqu54QIykS7z
+-----END CERTIFICATE-----
diff --git a/src/test/resources/com/android/apksig/rsa-16384.pk8 b/src/test/resources/com/android/apksig/rsa-16384.pk8
new file mode 100644
index 0000000..c8d2793
--- /dev/null
+++ b/src/test/resources/com/android/apksig/rsa-16384.pk8
Binary files differ
diff --git a/src/test/resources/com/android/apksig/rsa-16384.x509.pem b/src/test/resources/com/android/apksig/rsa-16384.x509.pem
new file mode 100644
index 0000000..22b6148
--- /dev/null
+++ b/src/test/resources/com/android/apksig/rsa-16384.x509.pem
@@ -0,0 +1,93 @@
+-----BEGIN CERTIFICATE-----
+MIIQ+zCCCOOgAwIBAgIJAOd3bpikuRKvMA0GCSqGSIb3DQEBDQUAMBQxEjAQBgNV
+BAMMCXJzYS0xNjM4NDAeFw0xNjA0MDQxOTM0MzFaFw00MzA4MjExOTM0MzFaMBQx
+EjAQBgNVBAMMCXJzYS0xNjM4NDCCCCIwDQYJKoZIhvcNAQEBBQADgggPADCCCAoC
+gggBALDYs7aIK08pNr9fdrpLmUVfSc+3n/RNU2e7o3fzwQf2IMExk/ZmxF/ORgAd
+pXPEkn7uOLYSp+fJHUgqsca+8HsxTN1ypKov0X3OeFbnBLXmsoXgjRzaMEgluupd
+B81xnAKE/Vb+HYaEJ4YP+3UgBLIItnwLtL6vdh+e4qQGF9KEAv+T+PdrNQF0EGWK
+weCaOuMKRKfSnNXMkgIgWgoEefsBXNOR/jRJVFxsnJlwsB2iw0FbKjrxnlmwBL+f
+A8YxdMoCLxjL0TuUEmRyd0jO7Td49kUIkW6ux/b4qOvcUPQiODXeayesJ1lmFepS
+ATjhgCz2+C3pcAJOPvOvC4v0+5OQ3YrU2kKsnj8G2ic3SdPUq4UUvQWqY+rCZVDH
+IqsEs/+XO++wMELkN3uiQcRIEO8aCug+VxMSRiyRSSNtxmcmedUZevbZ6+2leBtn
+AbLP33E5hC80A7WKuddQgOiA1yTUVxatZEaxHFVZlg2nzSYHipvwMVC2+zQ4yrKA
+mbNp5wiVUV5WLsUkYEuSwl+MG9vEjr2gTX+qLrvpIYS2AF/16SOEw5zQBPUcfVIz
+eJU+W//wwXdlNmA6qRCDXqLDBX1MQrChpaI2eRbv64k5C09LtEA5nt/lJt5dm8IF
+XpurOZqHTVG3CCS15SM8PyoApYKN0oM9+6Z+FDUOB+VbTW/hAqKYLNBJmNf8mRkK
++c1peoOAYw5iG8iaSD8f8bcIi3oFPMdt0Gs5vDoLjbWmK2s9P2wknA4hmVe7hvSy
+DMvyxj8j4BLadc3HafcXYPfoNPhfgoiZVLm6ijEj74iKeLSkef8F3x0Agulnitz3
+CWt7X6EXHbqR/0++VTqgnFDe+enf9oFzMsDDbOs59dpyGFSP159dTqJILimF5xUG
+Fw95hsTbdEblZ7Q2MiibB38ifz8WT+Pix72SnHrlcnKonv8Tkeoie0AP+dYkYXpC
+Dy0oIzl7Vhy1e99RjX8kKjZAfCuiQ7wnOGNu6V32UyKMvWD5E6mNLpsvyBRTxDhs
+ePpH5dZWbhg6WxhD68QG/Wi/8FRmc8/TPpPXilOG3HHtX6Q3yfGYHJB6/dJhWQQy
+iZawyEpcyZKjEyWoJayRsKSLb6gW6Idfc1Uf/yb6IHDRlYZEPF7JuznjLCaz2QC9
+8GCBGfUE9OGH+LtdMnsmn2IYEd1FtWrRGduG0HNKubmx8bJmc1HkYDQg3cksPb2o
+jwCND2ALGtTcR30yllmSmEJKpXBYB00iRvxvkBqCkL4THOXhN2V5uEMrS0r8GRZN
+QCvCoFKulPjITmlQ/ciVonN9y9qVeRbFE4ZxiiBxF41K/Mw45ugIqfg4ndJqbub6
+5p15nhYJIC2CbsVL5+1THmd+kompQhUo1ttwof0aHh3KLwe1uq2OEU7Tz71Ct5+G
+b5JjIAlQDuGcfsx3utJY3AE5ailtvaRNAz3FyTsZGkIOeqX4uswWltxGnuSMSbPi
+CPv7ngFXkytkK+3Oqs92XM8mhO1yqPzmm73+qZYDGFdy32C/Rr0enETmgkUFPToH
+28hMcOsEt+7L0GM6A5N708BaF9Csy7XTFz47Hk2CjaKTvP08Tl3bFPULrgJ5KCr6
+4hc/bVIDkU7c1lhDISJ1yuw4KHizmjuf4UeRBBDoB3MpPwZSeEkggGXuX1wkFApu
+RGhjCXQgFU9bNtUHM6Kj0tPQZrgsvx2wwBUFVOfPoej6afrJqpvep+EN1+OJCE4c
+AzuZ1CdE96vEleVbrq3BQaJbsm8JqHs7lAn1aiCK0semqAoXD4cT4L2H4E37IDlm
+PHsxIeTmgD7/TP3InuFB6sYvVM8moG1TLmtUJkpc8kkPBPNbTRHwuRvMGD1pSsP1
+aNbgKkEfGqL1iOrfoTCRGKDeDDxWGsxDOgW1hRs9wGzJuMQjl1Rlb11lnnX7UYyT
+UnD/yw7YaplScWwpsqntQewI59A4ad1wOJlabDUFwkD4i4ERTcjyea1ydE03qaOy
+0ItJbc8kjsEMWFAv1+y7/cxD7kALcytvBHhD8OVJ40qJrtwRsXnv2T74cTPh87qh
+3j2tjdJKVSLxwqg5ZdvIemnWmmFAPuRERResp5j5WLJcOFcXhbp4CAQLViRoktLf
+AKtgKSVa9FQLvombOq8GqWxqeGJEsq+8/X6UOj/RDPu8gUCdodmlxgC5BpJlMTfg
+9ElvHb4oRewPfc5MBV5i++8xagxS1+5NM6z+1qZfT+XJcJ/wFYyeSvGGdEgaDIVd
+XGqOFDmA20bUl0xWSM5j4At2CmymAn32i8FR5lNfB/f8tIGBlXQyrYzpAKoj6FrV
+3u43zKgYBzDTqNs61e+A8MScV5666gvpcOltFiaucc455JGiN2v7N+SAygWaX3nb
+jidmRaIAftup6kXVXxy1ZwpKCtUTqo0M+S/jO9clHy1EYaSX12blCL1B6OFpMRV7
+1foffUHwaPrMqqbPphgN4QRY2Ao2sKSliiP1T8s1T2iteEGiazCdWSOVVi9Acbo5
+DfeBlWwhW6OQpv1nMTznGscc4+ledP5yG5C6boz2aNwK6H6cpDfEc7tWTWhZN5Jm
+Jlra4pseqf9Lsc/Y4QMD1312C3Hu8EtJ/qlxEDhLnCW8PHxdlRsIkmcV8w+as/hu
+6/MlOYcCp9ae6nooFL7ZuDkdDWm84UXdce2ZVVGVoDa+RdpICnp79y/9CLxWue4H
+09VFEFUH//E6lOCBymUjTSO/DQ6z+ceb2W5B3WVV8gqADTDhAgMBAAGjUDBOMB0G
+A1UdDgQWBBQkHp1wX0Sfr0xz7xcip9UwEIFTLDAfBgNVHSMEGDAWgBQkHp1wX0Sf
+r0xz7xcip9UwEIFTLDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBDQUAA4IIAQAd
+FhlHg4E7Yp8kIOfZRU5Cma6wbOSd2eHkV28WHGdwpKsvNhzgQEj+scYWSS8geozi
+vqSdJCoMmY8hWJh4SY0ED1DjPMoRvE8OotyGoCJovvYQia+gbVneT8JnfV3fkdwi
+hpUmAhokrsHkBj0jp2Ubff/D5yflA+QPCmhZZnkow+5QHXtmpy8CL9Fzfonz5uq7
+yCV5uWRicczFbQw3pDSXKn5OFqXuC8H/8R6Caq2TkJ1LusVtZJevcHBkEQ6e+XEX
+kZ+QCNtHw0a67LQEPtMXSyqZ/zR0roqwT6udUgHhdvZjbbb9GDpTW3u472IY18E+
+bf+npZl9kyuv2kyK1d2IjL45TxjBr7vLbjsP2UsmZvb3Wfb/kiMscvTBcxOL7/WA
+GNJ0XifmJWiDTDC+gUBC7LRN9lG8F7ykrMTtMUNlhow5LpIi0HA8TH58yq3/ulGq
+XWpculy33kcVAFTMGh57r8zq9DwkeW+RWggvHO2422S1bFGmKpizKASTvY6iqo4H
+yKvE9uZ41WaEbpp9WKPIaeup+ynxFpcgwMCKwvs7Yaj+mVexv7CoJ9nrEhMOHDxV
+GRyWDdBoIi08S02JHztZBXp5NZ+hqey5HrO4dhrnV1nVYJmH89KcAlXMfTZ2YHsv
+R2+dm6K8ToaX+Irqbz7Xbv8WG/aAdUqMSWkFEss7OT7VZBUiAdFaWqg0D0wtWSSE
+jZJJs9ISUTClq+97o9BEH2sAebchLFP56nY+Bj/zHBq2qPxTKdKE5BH13KcK1fwO
+eNn8a3SlSEHraa0oV6VjgSoMNdFz7b7b0r/Z8L4PEASJgH+VaGRm2TtuVWFHSqvX
+015UGITk6YgAQ25MTprJc/oAd0dut+aCPtOVElfukYvdrbw1YYQ9tc7kU+AVrzaf
+ytWj2GYR5Slfhle0inKlBvbpLTAHs82bp2Dgy9ZSQzW9/gIvLvCt+Hj0kiSYNcbX
+W7Ai5z2i6XKE7DdQO0Uzt+1bXGK3j2PI+81lCw2ejCFwjdYDWQw9f2nzQ5FgeYwG
+tc6fS4GbJM97n0yH9rj0Jb25AummZGnEL11ytPpC6Nv9cQdCuKDbaWQuQyRMCLEm
+hHaqV6k/fI4Etvuo15pyfJ9w7Xrhc6emgdg2HzJ99lDGkzZAF/3FR7N5pLPk5E0/
+PPlXUSiEx17IeWp3rNt0YSMixkGz+EbKyv9RIZzm/LV4zAzs2ZyUHHavUgZ602eg
+89ppqafaBrCwIWB1jUmnHJop9YlXQ3hE7pAV5qf9GxZLwUdzJcyLte1/vkn1yt94
+nLOZPPWUwUjIaBOZ7e/g8fHBjvAYwyoy3toKVpvkhR48NvcYD8pQ9cB6rIL0JkWV
+nQEYeISlJCUOO3K2eZ3ZH02ftha5gLshcGRXy9NS+4fNxDT3H+102RqSxmKPIxV0
+onV9RyOxUPKLRGjCZBZxs5aSxTYjFJ591azt3yAY4vwCnnHqdNGFbTat/Zc8LUOO
+J26n5cOYFGKPvZVvj8jMNYC1wo+R+A+1FeYXBV4MSVxCB7tjBlbU6OIyZSWLZ8Vw
+LMcPbuZ7ESj1LeTONwS1vspZM8Y/M8+RXv9VA8Z998tnNopdU3izVC2z6Zn9hNNI
+XBDbSe6ZRwsjXrm5TZCBgA4ZE18MwxPVhntSvl87Gc3wF4hz4BOiZXmffrXK4nQJ
+aVA8E2IsriCV+GQBN/ui+w3U9LbtsHrbauhjrru5EfYohpuInwvgPlAnTztdv9u7
+ee8RhwaCa+MInZanD6pRAAcfM6O64CPxHZtfVW6JM42N7wQXijvYzJPVR30F+6o1
+C+KwySuMBOGxOctmzLj938/OMrxuLBOmv3PJvSnHV0pWtbR7r7jH3v0uUm54zH56
+Qo/Rm/Aqf+m4Si3Xtsf9zvc89sqG5v2TT882Joja76zlJfaS31QgbnLTmKtAHtIC
+mqfQPvt1LNEJIiB6FZDHJIW5Ccm7imsixerxCBBoAt/J/dhW6N+cjZ0EWG5NiSoz
+9LmAZv8iWyqK/KvdPXUopQWqkYUvuIyNCYqzTRLKudUMohefNwghvl1gSGp4IMZ/
+4LyrJHi9eCcD9Z65PJsRTua+742N2sdhFfU/C4atOUGSK9x/Dl79Qkgsl6HqAoce
+HXiHAIvoOqC+jzEkjjxow30BzJeGsZoFwNvMUW7HcQ523DiIOx6MX8oQyKEo+W6C
+ayFvvvT3qHu2hL2ZxOXE+rGyUJnmwqctz4ChLvyYXa/eNrycs382x2U5XNXgXzNT
+3bwB9B+LnKSMJEB+UvHdbBcafYyevLptbF5xiiiUA0P3fq61AfmNiCzJWb+kaO11
+oHHQNWyG/fO49u3bZJkhvlsk8GXAp9uTqdW7YAqxjy8NohFewmtpTJPE62XKIqiq
++dqo4nUT761iaUBxgyj1v5jKcXT2JiEMnEe4AN7pZJ01pCNXQrXl+6ru4TVV3tpy
+OsDJ9UfZo8xZXEAJ/gvSyiih0xq6xhwGuUyExC3GldBz2frveWImxVEiqQIdHULH
+WwB6eAm9T1f+2hOGq7AB9Jb8CRyQniJWXtWu9uJBt+XwSt5lN6VUjeLt95SitvjO
+llqs0zhvTf52H8siwaO83Cui78iamqv7jVatB3JYW71S5cOyZ/x5Z5FYqKi8/wjO
+L4OyUs54kfcJllsxAmS014UgcTrJpbMNw7jSzLX6FxT4MEbyARK8wWQfEZQ2tCeo
+IOzfcYvlY05mG0KSzs6ZGBrWRZQDPcbJ0CKNSLTFbQ==
+-----END CERTIFICATE-----
diff --git a/src/test/resources/com/android/apksig/rsa-2048.pk8 b/src/test/resources/com/android/apksig/rsa-2048.pk8
new file mode 100644
index 0000000..105f7e7
--- /dev/null
+++ b/src/test/resources/com/android/apksig/rsa-2048.pk8
Binary files differ
diff --git a/src/test/resources/com/android/apksig/rsa-2048.x509.pem b/src/test/resources/com/android/apksig/rsa-2048.x509.pem
new file mode 100644
index 0000000..0e7b38e
--- /dev/null
+++ b/src/test/resources/com/android/apksig/rsa-2048.x509.pem
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC+TCCAeGgAwIBAgIJAI41MGzdARX3MA0GCSqGSIb3DQEBCwUAMBMxETAPBgNV
+BAMMCHJzYS0yMDQ4MB4XDTE2MDMzMTE0NTc0OVoXDTQzMDgxNzE0NTc0OVowEzER
+MA8GA1UEAwwIcnNhLTIwNDgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDQ4JI1EJ239V4wss0jpVlZMudh2/kARCVdoBgsRQuvc2RNnO23Eyynlt9UN+Dc
+NRdQIhbCpVTjdEl/bePECHlqg9NE3frAj5GebiUdWL6A/idKsZA1nAKyIgxxjcnu
++38OcrlO6XOm36euxGfd/ULrghZGXzMVFq4uLiIv3DqFkUcIlE0BvUiUoNwpopV4
+MKj1GQgoaEObJG5xkMBKO6vg36VfJ3s3V3r48uJxYGhhBZEB0EpoXLd4i0piAB8S
+MLb0Ek6wA/HZ8A2rdnStk1wl/83OM1jO0uB3hyfJpqIijlvNGnrloYyyOIqS0LGH
+nxSJD7goASH2Ef0h4yxbsOvHAgMBAAGjUDBOMB0GA1UdDgQWBBQXAi1zEH84mzkS
+62ohswGGWSwdbzAfBgNVHSMEGDAWgBQXAi1zEH84mzkS62ohswGGWSwdbzAMBgNV
+HRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAB92T5toLkF6dLl65/boH5Qvub
+5wfIk0AD12T3t3kYWQFOH0YDCHNL3SfmrjYM/CwNJAd1KuCL5AZcn0km/n0SFXt5
+8Ps/MBcb0eK1fYezeEehKUyt5IBgDTKeQOel6So8rGuQRrDf/WV8rt6fugkIODFx
+sB3oj4ESaGXbvmvWD6q4a3koq/nV26kALchnAr7/FTNq3HEIQ1BDr9pldVh1gEV/
+ohHKcQP4M22Es7lredzpIcb5K6Ko/UtwsSRtHnoOjwmb+L/FsgAJsekmcJG5TK1X
+ciIsrrNFDCYzf/d9O1PD/V95kB7460qMzrGWZpc3mLe+OnmVMq6c4omOtIKl
+-----END CERTIFICATE-----
diff --git a/src/test/resources/com/android/apksig/rsa-3072.pk8 b/src/test/resources/com/android/apksig/rsa-3072.pk8
new file mode 100644
index 0000000..163e06c
--- /dev/null
+++ b/src/test/resources/com/android/apksig/rsa-3072.pk8
Binary files differ
diff --git a/src/test/resources/com/android/apksig/rsa-3072.x509.pem b/src/test/resources/com/android/apksig/rsa-3072.x509.pem
new file mode 100644
index 0000000..0f3cd14
--- /dev/null
+++ b/src/test/resources/com/android/apksig/rsa-3072.x509.pem
@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIID+TCCAmGgAwIBAgIJAN8aZ+YVywdhMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNV
+BAMMCHJzYS0zMDcyMB4XDTE2MDMzMTE5MTQ1OFoXDTQzMDgxNzE5MTQ1OFowEzER
+MA8GA1UEAwwIcnNhLTMwNzIwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIB
+gQCcgu3kzCLVWeUzwO5vhwWFD4rCJVavnVJjA4hz3fg9wsh8wpK0D39a8iyKS714
+5fFF/EsPpoKo6b8l9GVHfrSzJSa0rMcQ7+GHLyfG+8Wt6cnGwb8m6FOMKM8YAlUO
+zVL/WDZXBGvHu/gmZXM0ZbCy1cFBy5/kcGF2zF/fa+a8n4fUiQlbGC6y5iXKewMF
+z5/tFN4BeShBSNxGJVNOut/bLOvpGoPQVsteFlUgiSOPuXeiMeXDDEMEHbY7u7lB
+Fmjs5yAdXaLtnsJD689NdfIDZYHsiBRf7sFNWWNg4gE0gEPhN0QkC2Bkak80t2Mw
+XNakB7gqJ7Vsy+ZPBmhzMzeZbrK9cZXgqNNlxmraHycGzPif4sqmpy1/xFxNqOQh
+n2cc0fd2RG0ql1T4qO0U2b2NQzNMcgrtBW2E1UUUVukVJLCa7RKyt7yq7uUqeCYd
+MxNfvWYBSCzpZMvTI7jq6HcCqQOfW8nkE/z2IBdWvBi3yIdgKSsW0uZsW2/1+KlJ
+fhkCAwEAAaNQME4wHQYDVR0OBBYEFLGsv+jET2b4cWyINayy3qf/U7izMB8GA1Ud
+IwQYMBaAFLGsv+jET2b4cWyINayy3qf/U7izMAwGA1UdEwQFMAMBAf8wDQYJKoZI
+hvcNAQELBQADggGBACLyVVZrgLXL0PUAS2WwZruWj9q7lVnzLMla3u9j/fSLnlPK
+/YcuQh/DqovNkPjFrItww4VfLxkQNsdOccAMHWA2rnWivOYnS1q3gM56e9KN/fEq
+yRc3ltZCPvEoFnFEVtVfmgZJGV0xBLZUFHnPjlWtUYXS8pR89x/Klwy5aaJ9OcGW
+SPaI0I3TyFHCb92Dtfdehtdu8YCDrwTyaYLHvYdNQFDrJ20I8WNsG8RwklfAWNwZ
+IJ5fQxwHiCKxvdaTt2NYUSm4R4kEQCgklrgnaEy2kzDVKp4GjQwVrsa1btK+Srrd
+gtIqB+azx3XziuLi129qJGeZsof8ylN5eYmw0r57d6OPB/xj3roBsB77t4d5jEhl
+Y0BZ93t2HWvXJmuolf1JcauDOcGhxxgdiWdcOWeSABH3cNUiilRfs8HRwSzZwB5E
+RyjvKBdGirUAbLgri+8t9165gaz3wVhP4xkcD4e6LoupWHarAMKunMVGVbCOj7mj
+AUPHJ3Z+HhUKiI/q9g==
+-----END CERTIFICATE-----
diff --git a/src/test/resources/com/android/apksig/rsa-4096.pk8 b/src/test/resources/com/android/apksig/rsa-4096.pk8
new file mode 100644
index 0000000..0f498e5
--- /dev/null
+++ b/src/test/resources/com/android/apksig/rsa-4096.pk8
Binary files differ
diff --git a/src/test/resources/com/android/apksig/rsa-4096.x509.pem b/src/test/resources/com/android/apksig/rsa-4096.x509.pem
new file mode 100644
index 0000000..704dcbd
--- /dev/null
+++ b/src/test/resources/com/android/apksig/rsa-4096.x509.pem
@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE+TCCAuGgAwIBAgIJAIhxrQmG+dcZMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNV
+BAMMCHJzYS00MDk2MB4XDTE2MDMzMTE1Mjg0NloXDTQzMDgxNzE1Mjg0NlowEzER
+MA8GA1UEAwwIcnNhLTQwOTYwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
+AQDTPhE7i4Bv3BQG1ifMPZfTGA1ZvE+mQWOgQ1q/3AQz23I8pIaoj1wFbYDvnTYG
+UCDnlJqKvwL4mrAnxvqTxm+0g/WFOoBKFoNY5OhgcDfomNEFQajY9bgXaNiwEYDU
+0X+q+2KAnr35MF7vdEaHcN8gFh15wObVXmlerMIOWejnwrM4MOXjGjNXtiB+Dg04
+Fb9eHufZ+s1dKNAojD08mUJkxTC1gjmBKPr8hOAPo9ay5NZk6mGaI1E0U5NbIpDe
+0EhYxRXkDjP7f6BzbhFEupCOzZNMC5CxD8fsmku1CaKBayGpsxktYFxsw1RFVTZj
+3pKYnM1fJBHj/hU+7zy60MZNpdU6i5HVa8FPldwAxv6P2dz0wIl9S3rrqDrd2/1p
+r3rKNrMbVo7wzZ8euVhmjttsRvN8NykCniX6oWxuX7EFQxT/ZM0xk055gMMW7xbr
+oLtPAJ1Lk7R6aTCS+ObrhBgS8+38sIT8rF/CCz2KQ68iUpMmMBz+dkYsDwHPq7vG
+wIy8J7fwzTLqUbyO971+4MD9/9HbqfjRAsjfnSz8HqfyHrSDKeAhgqlr8j8DtQ7X
+B2PIZIEmyN//A13xfZQ63c/KR/yf9nPig4KfHulODfWXBD+2T5kzakTSn4My37FF
+mzG0giMMJ3zGs4QpGZAKFGdwhUq6nAAqEKYo+dptlFhbzQIDAQABo1AwTjAdBgNV
+HQ4EFgQU+f3rdfojsysUqNHmjE4c+0I8YGUwHwYDVR0jBBgwFoAU+f3rdfojsysU
+qNHmjE4c+0I8YGUwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAbOd0
+bKbaeGNsinFSck4niiHDhkeD7GhsneReA73LDJVwAsr5SLAYlmZL/R+1Jw2FGa5m
+82q8412xoVxqAbsz/OrBjoW+5RjAUpHSv0vo3Ny9EpFDpRI1yO8EFU2PhpbcC8Av
+101/oBA8tgKDKgb9H9GrnuqKqxLvrOKDle0TEWAb4X+yyuLSneU6UZTn/g6hhKMw
+pRcsCkwwKa2266auq93NA30Xb1UME5med/5fBKzjL7TvA8BTbr8EdHxjbPmnyI1n
+iVQJnkvvk6rDRcWeOt+lP/pmvaCcVFp9FJHlWmxrus7x0PuH8WxecVl6PeV3MLyR
+HXwGLzlqJWFm753FP3sTV3xNqemo1IhtlHR3jgU8Y7Ixq2Ljjs5izucqM+u2Ioo/
+wbzlhjfRmxqGE3RWvq6Vv5C22Th3hEA7PDUKAh1/cvUwZxOh1Wa9Nedhy0SUXAR8
+nY2GHJEN6QmR1ZAoyABHuPqk1IjduDONo0usGk/iYIFMgfwitc5Tv4gdjjBLburF
+NRU3QkoT1twPueb4Xnvmb/yHmTmqm7MM4OlkmTSpYRci8C1JNChdqIjNSF36Flnm
+DEMqP6petbkZcORD7UtgoB+DCPyBWybtm/GDOW2v3CWo94Q5A1yRDpqyQOTIJChe
+sssLUtp3bfmTSFFMfmsovynUlFpsazeFKjQOkYQ=
+-----END CERTIFICATE-----
diff --git a/src/test/resources/com/android/apksig/rsa-8192.pk8 b/src/test/resources/com/android/apksig/rsa-8192.pk8
new file mode 100644
index 0000000..cc7a7ec
--- /dev/null
+++ b/src/test/resources/com/android/apksig/rsa-8192.pk8
Binary files differ
diff --git a/src/test/resources/com/android/apksig/rsa-8192.x509.pem b/src/test/resources/com/android/apksig/rsa-8192.x509.pem
new file mode 100644
index 0000000..42f1428
--- /dev/null
+++ b/src/test/resources/com/android/apksig/rsa-8192.x509.pem
@@ -0,0 +1,50 @@
+-----BEGIN CERTIFICATE-----
+MIII+TCCBOGgAwIBAgIJAMMCN6DTJaAOMA0GCSqGSIb3DQEBDQUAMBMxETAPBgNV
+BAMMCHJzYS04MTkyMB4XDTE2MDQwNDE5MzI0NloXDTQzMDgyMTE5MzI0NlowEzER
+MA8GA1UEAwwIcnNhLTgxOTIwggQiMA0GCSqGSIb3DQEBAQUAA4IEDwAwggQKAoIE
+AQCt2gaOPSTn1A/WkapaytoE2RGF5nBzlfLocagG+0Bgz0RH3QQq0xBEmQivmbj4
+egyKFQQ9dYrefXRnayLQvHpfeT31QXR3iKOfMnvtxK9UnkXo9S/T+czyj91Ox51w
+HFUyMlXjFs8btxi6Lpkrgl3jmL+e4/WI8khvTrdszrO8rBHBYlD8Y7SAvPcVczYq
+nn4m6Jd0/abR5slHiyGtkTREoHmW/u4r4PfTzanLyzcsWH9/td+sYHcu1Y0XTWTR
+x2qrUmpD+7X5cvXP9rsECU82dtnyPZPIHBqzfLJ8oGELsJxgVZ0u9gW0tlmJQdVo
+Q0QPJSWivnNxPl1czJYbXimbY3Zh5hCzdyNqQewVx6iNsNh008JsXJ5/yvJQgLgZ
+UR2gWZMGzLc4V2wiqxuLzELt5RoXPehAdAiOLQu/3Fw+u4J/d7NEwpKgpdDGyG/U
+9nV6mjvomcgOdWKblaRAeiXauYy/MgW68kIu4O4SoKWRRmOF2p+tch3aDKw9M89O
+88QhEzbzDsioAxeOAqL7th3bSPZ2fX05xtM2vFK71QFM41q+FOL+062Ev/VJyU4g
+kxK643V+Cxso9CZEVtFfkNnVIGOI2h8knkOiLtbMnCx/hcxuZLm/XvYQxOO/7ScL
+rkHLUuKu/dK2ksDn8yBgaHfVlHkMmVoSll6fKB+UXpPX7xClrGQAFpVUji5oZN0s
++EcMQdcMtsb6LxnwC9XS1ELQ5FQGuJFatwY9RSV3cbwI6kNKaZiB5sDDAaAHX9GU
+U3EA2fm0u+4UFOSSmYTfx/jl0V1NMQ1oOAY9QMqzckMo2y9cepLQ3temQ/k4bNqj
+rYB3POdqS9OoT74UKU8gg9rv01PaFlLHhPKwVc+MjY36aVefbfk1KZzBpm2twUUm
+F0kz4pU3BYj0aSrTeKWaTLjdn4ndGMSe3QMQQ5GUchWCcygTyID8Wx8+eDzPIs/U
+sc++7fQRuPawcd11oQ7wTjWIjr7VnsV8hiHSyMupEad8HuBt8CNtDf/m/hD1LsEf
+0dY8nDGSPvV/ih2YqTfhcac65D4JKKbV5x65aEwM7frYwi9QsB7CK2xLMHnatp2a
+TRcA24VEsaBP2+UNSLyxkOeeuzSCksHLPBWkVfcRbKUeD9x4Dtwf2WsUtYjGzOQ7
+ApLBB4XHe+GPr/i+PmJP4IDoU1Mifbjla8rz2ZuebZgPnyV7nSvkG/FUqUYpa3Ut
+LY0nF/2dDRF0NirbWuB4Mkk/KlxCQ3w8EZFY5u6L/ee23WxbnVOEQJBtKh7/I/UV
+2dGqoVJx2UqT0MpjUCFjx+KjWvaEt+FfmjfRRqQfHLkJlYly/YdeUrGPdGgJNr0C
+csnZkAZmKDo4OVv+wVduHxHfAgMBAAGjUDBOMB0GA1UdDgQWBBRdiMpGc1L++yQc
+MtftoeGuLwJ+PzAfBgNVHSMEGDAWgBRdiMpGc1L++yQcMtftoeGuLwJ+PzAMBgNV
+HRMEBTADAQH/MA0GCSqGSIb3DQEBDQUAA4IEAQBo9lUFyV8jI0IpcQLC7hC0ILxx
+6DsDw/YpMd9lRyujKa//OVJOEO3Z+SalfoLslMPCD1eeJBxgx9/xTMxZUrunOMJu
+Ddxc5RypVwdt6NOUQ3pNYU+Qkp73aZzakm6/i1LQDOxGf1PaZooPqXaKMfyb9CQ+
+M5wR9XsLDAyQPlylft3cWsp7DaPsrcp7Sn5u33TtvCDgfMwbKZrzzmCdAHS52p0A
+czMpDgYxhxCuHPwN6XSAxlrWnfpkOsdKneiVr4aDm1fp61PQg+sOKNCNJCMmUB50
+XFj14qLmvjLERNl2vUfDqoj6DxC9OceioZljzFM2d8/DEC1/YUT8AGYZQt0ISLlq
+QW4e4iIxXxVNKwXvJZMCd3z4XX8SvAOXL0+WrOffgkQQpSr2jBXKFe0BpCUnzVkN
+jw/bVJ89jrqfupExJ6kKTLzI+H2u/7LgZUn9/QlvhWR3IL1nEvCCOPHXTreuUp2U
+KauH7WQU+mzF/K+obzYiaPc53dz0C3JcvWgv5cBbhDUsGsziZLPkR3r5TvpTNF3t
+c3Ky84q7CfOKI+hGN/S+BNSv+TdA5uOG+h8GJ6SAwVpimzguhx2/iRg7OiHmhoy4
+UfsCF/QdoF3cEoSMMzorOIM+szZ+XggJMbtWzIv4NAL2TCKJcpB6t0Uxci6JN6lM
+tnbq78QxeOoJ3D3g6ZQoGvCdKwHcMQunS2MK75j9hckX5hR+0xnH++bI+D3qXaul
+zCOAcMoGpM7WgyzAc3mh9aAJFk1J9OYzpFY34nX2cDMc0xtI2s9p2/8X14ir5suK
+R0rqm3BZewDaQVNtrZCm/sch1I0cN4GomvxZ+2xD43vsZm8QEB2fyTvazg6kW2O9
+G0coUmszwI63f7fVx+wzZZxS24N17lIO36hjBq12SKDz9C3cIOZpPYdcaNxDyiwq
++RojbgUnosJji+xZtyK5Bf1kNB+jNoNT5OrWCXCR62Z5CQ+fAdlz4NPdibYnwscF
+SD8OA2I7UIT42KAuDBEMKVXe4SlhqLzOdqXwZ7h/ZxyUlY+zpwLO9vfLVpqZiavl
+bx+RO7lkvxPGEtM4mjXt5dNx2rgML/lXSE63qaqspYLJ806A3GE0918/b+ZDfvzG
+HLbeqIVtAlXwOGFLdifLvsgFybQ5yriR/yTlHXN/T8K+Q6wPo3uNkKNgUDq0FmzF
+N9UDQ+VFAdwaGPfBox3okGPoD6/HdiokuwZm4mlioHjZc513qhDapS3fJcXV6tu9
+OhIPBJ5NXVw3IVXwB+eskd2W5y8QlHZKBNTwzc/PBqL93QA2PxOFispDtevAuyTq
+OhRConYsMhoLf/9NqhEsyKVhwtYhYrUh0Q+hCiAg+YpjKuE2YJoUNMVyF3dY
+-----END CERTIFICATE-----
diff --git a/src/test/resources/com/android/apksig/targetSandboxVersion-2.apk b/src/test/resources/com/android/apksig/targetSandboxVersion-2.apk
new file mode 100644
index 0000000..2d7685a
--- /dev/null
+++ b/src/test/resources/com/android/apksig/targetSandboxVersion-2.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/two-signers-second-signer-v2-broken.apk b/src/test/resources/com/android/apksig/two-signers-second-signer-v2-broken.apk
new file mode 100644
index 0000000..fcf154e
--- /dev/null
+++ b/src/test/resources/com/android/apksig/two-signers-second-signer-v2-broken.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/two-signers.apk b/src/test/resources/com/android/apksig/two-signers.apk
new file mode 100644
index 0000000..f11760f
--- /dev/null
+++ b/src/test/resources/com/android/apksig/two-signers.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/unsigned-targetSandboxVersion-2.apk b/src/test/resources/com/android/apksig/unsigned-targetSandboxVersion-2.apk
new file mode 100644
index 0000000..2c92f1c
--- /dev/null
+++ b/src/test/resources/com/android/apksig/unsigned-targetSandboxVersion-2.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-empty.apk b/src/test/resources/com/android/apksig/v1-only-empty.apk
new file mode 100644
index 0000000..1967272
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-empty.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-max-sized-eocd-comment.apk b/src/test/resources/com/android/apksig/v1-only-max-sized-eocd-comment.apk
new file mode 100644
index 0000000..f7c8db3
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-max-sized-eocd-comment.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-pkcs7-cert-bag-first-cert-not-used.apk b/src/test/resources/com/android/apksig/v1-only-pkcs7-cert-bag-first-cert-not-used.apk
new file mode 100644
index 0000000..0ebd01f
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-pkcs7-cert-bag-first-cert-not-used.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-targetSandboxVersion-2.apk b/src/test/resources/com/android/apksig/v1-only-targetSandboxVersion-2.apk
new file mode 100644
index 0000000..4a00879
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-targetSandboxVersion-2.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-two-signers.apk b/src/test/resources/com/android/apksig/v1-only-two-signers.apk
new file mode 100644
index 0000000..f096a56
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-two-signers.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-cr-in-entry-name.apk b/src/test/resources/com/android/apksig/v1-only-with-cr-in-entry-name.apk
new file mode 100644
index 0000000..84828b0
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-cr-in-entry-name.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-1024.apk
new file mode 100644
index 0000000..02ce027
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-2048.apk
new file mode 100644
index 0000000..62f8e69
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-3072.apk
new file mode 100644
index 0000000..e8f1633
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.1-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-1024.apk
new file mode 100644
index 0000000..0f0f016
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-2048.apk
new file mode 100644
index 0000000..aa30612
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-3072.apk
new file mode 100644
index 0000000..68edee9
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha1-1.2.840.10040.4.3-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-1024.apk
new file mode 100644
index 0000000..11d3942
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-2048.apk
new file mode 100644
index 0000000..be8fd4b
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-3072.apk
new file mode 100644
index 0000000..2f4db65
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-1.2.840.10040.4.1-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-1024.apk
new file mode 100644
index 0000000..938ea7a
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-2048.apk
new file mode 100644
index 0000000..2f0002f
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-3072.apk
new file mode 100644
index 0000000..13b4bcb
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha224-2.16.840.1.101.3.4.3.1-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-1024.apk
new file mode 100644
index 0000000..5a7e4d3
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-2048.apk
new file mode 100644
index 0000000..edeb27d
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-3072.apk
new file mode 100644
index 0000000..ea5deea
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-1.2.840.10040.4.1-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-1024.apk
new file mode 100644
index 0000000..b1bf280
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-2048.apk
new file mode 100644
index 0000000..8e7415f
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-3072.apk
new file mode 100644
index 0000000..65f8238
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha256-2.16.840.1.101.3.4.3.2-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-1024.apk
new file mode 100644
index 0000000..f5db0e4
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-2048.apk
new file mode 100644
index 0000000..d18a9a9
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-3072.apk
new file mode 100644
index 0000000..641ba50
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha384-2.16.840.1.101.3.4.3.3-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-1024.apk
new file mode 100644
index 0000000..dd8ab61
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-2048.apk
new file mode 100644
index 0000000..129a335
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-3072.apk
new file mode 100644
index 0000000..41287d7
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-dsa-sha512-2.16.840.1.101.3.4.3.4-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p256.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p256.apk
new file mode 100644
index 0000000..bfa657a
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p256.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p384.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p384.apk
new file mode 100644
index 0000000..42ee240
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p521.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p521.apk
new file mode 100644
index 0000000..fe3efbf
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.2.1-p521.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p256.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p256.apk
new file mode 100644
index 0000000..e9a0d90
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p256.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p384.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p384.apk
new file mode 100644
index 0000000..848cda0
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p521.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p521.apk
new file mode 100644
index 0000000..397e6db
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha1-1.2.840.10045.4.1-p521.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p256.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p256.apk
new file mode 100644
index 0000000..fff1789
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p256.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p384.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p384.apk
new file mode 100644
index 0000000..0d83e41
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p521.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p521.apk
new file mode 100644
index 0000000..92f8548
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.2.1-p521.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p256.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p256.apk
new file mode 100644
index 0000000..5127d60
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p256.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p384.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p384.apk
new file mode 100644
index 0000000..b5d9d46
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p521.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p521.apk
new file mode 100644
index 0000000..f3aa1d6
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha224-1.2.840.10045.4.3.1-p521.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p256.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p256.apk
new file mode 100644
index 0000000..c289f6f
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p256.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p384.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p384.apk
new file mode 100644
index 0000000..b979702
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p521.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p521.apk
new file mode 100644
index 0000000..9ab8bd4
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.2.1-p521.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p256.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p256.apk
new file mode 100644
index 0000000..02b8a31
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p256.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p384.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p384.apk
new file mode 100644
index 0000000..5c4bf7b
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p521.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p521.apk
new file mode 100644
index 0000000..3a91ee5
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha256-1.2.840.10045.4.3.2-p521.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p256.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p256.apk
new file mode 100644
index 0000000..c24be65
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p256.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p384.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p384.apk
new file mode 100644
index 0000000..dc06637
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p521.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p521.apk
new file mode 100644
index 0000000..8194a87
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.2.1-p521.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p256.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p256.apk
new file mode 100644
index 0000000..ec4a42e
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p256.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p384.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p384.apk
new file mode 100644
index 0000000..c3c3e0a
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p521.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p521.apk
new file mode 100644
index 0000000..5be8ac5
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha384-1.2.840.10045.4.3.3-p521.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p256.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p256.apk
new file mode 100644
index 0000000..ecd9287
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p256.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p384.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p384.apk
new file mode 100644
index 0000000..c2afc5a
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p521.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p521.apk
new file mode 100644
index 0000000..62b86b2
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.2.1-p521.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p256.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p256.apk
new file mode 100644
index 0000000..60090a5
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p256.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p384.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p384.apk
new file mode 100644
index 0000000..63f6780
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p521.apk b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p521.apk
new file mode 100644
index 0000000..53ae508
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-ecdsa-sha512-1.2.840.10045.4.3.4-p521.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-lf-in-entry-name.apk b/src/test/resources/com/android/apksig/v1-only-with-lf-in-entry-name.apk
new file mode 100644
index 0000000..7d341da
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-lf-in-entry-name.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-nul-in-entry-name.apk b/src/test/resources/com/android/apksig/v1-only-with-nul-in-entry-name.apk
new file mode 100644
index 0000000..2bcdec1
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-nul-in-entry-name.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-1024-cert-not-der.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-1024-cert-not-der.apk
new file mode 100644
index 0000000..28c8e0c
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-1024-cert-not-der.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-1024-cert-not-der2.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-1024-cert-not-der2.apk
new file mode 100644
index 0000000..ff722aa
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-1024-cert-not-der2.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-1024.apk
new file mode 100644
index 0000000..c1dff8a
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-1024.apk
new file mode 100644
index 0000000..fe50da7
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-16384.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-16384.apk
new file mode 100644
index 0000000..3ce1737
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-2048.apk
new file mode 100644
index 0000000..5eb6dec
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-3072.apk
new file mode 100644
index 0000000..451f336
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-4096.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-4096.apk
new file mode 100644
index 0000000..a99a670
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-8192.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-8192.apk
new file mode 100644
index 0000000..10f4654
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.1-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-1024.apk
new file mode 100644
index 0000000..4f248bd
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-16384.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-16384.apk
new file mode 100644
index 0000000..ee14de4
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-2048.apk
new file mode 100644
index 0000000..d7c292f
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-3072.apk
new file mode 100644
index 0000000..5d0d11a
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-4096.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-4096.apk
new file mode 100644
index 0000000..32e28a9
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-8192.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-8192.apk
new file mode 100644
index 0000000..10163b6
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-md5-1.2.840.113549.1.1.4-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-1024.apk
new file mode 100644
index 0000000..f31e649
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-16384.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-16384.apk
new file mode 100644
index 0000000..784e569
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-2048.apk
new file mode 100644
index 0000000..a2801e5
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-3072.apk
new file mode 100644
index 0000000..8d9fccf
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-4096.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-4096.apk
new file mode 100644
index 0000000..3e36a40
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-8192.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-8192.apk
new file mode 100644
index 0000000..b8f979d
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.1-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-1024.apk
new file mode 100644
index 0000000..091cf6f
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-16384.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-16384.apk
new file mode 100644
index 0000000..4da371d
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-2048.apk
new file mode 100644
index 0000000..43bb698
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-3072.apk
new file mode 100644
index 0000000..a4c2b15
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-4096.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-4096.apk
new file mode 100644
index 0000000..806e0ea
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-8192.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-8192.apk
new file mode 100644
index 0000000..efb124b
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha1-1.2.840.113549.1.1.5-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-1024.apk
new file mode 100644
index 0000000..d86ac4d
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-16384.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-16384.apk
new file mode 100644
index 0000000..7656ece
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-2048.apk
new file mode 100644
index 0000000..4971db7
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-3072.apk
new file mode 100644
index 0000000..ed7f3f5
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-4096.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-4096.apk
new file mode 100644
index 0000000..7d47560
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-8192.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-8192.apk
new file mode 100644
index 0000000..99bcba2
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.1-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-1024.apk
new file mode 100644
index 0000000..37192c3
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-16384.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-16384.apk
new file mode 100644
index 0000000..357999a
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-2048.apk
new file mode 100644
index 0000000..a8a6b15
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-3072.apk
new file mode 100644
index 0000000..5c7c901
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-4096.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-4096.apk
new file mode 100644
index 0000000..2774259
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-8192.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-8192.apk
new file mode 100644
index 0000000..1df393a
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha224-1.2.840.113549.1.1.14-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-1024.apk
new file mode 100644
index 0000000..46d3e61
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-16384.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-16384.apk
new file mode 100644
index 0000000..21bf67f
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-2048.apk
new file mode 100644
index 0000000..a952f1b
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-3072.apk
new file mode 100644
index 0000000..db6941d
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-4096.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-4096.apk
new file mode 100644
index 0000000..5bd3d0d
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-8192.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-8192.apk
new file mode 100644
index 0000000..d8630b6
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.1-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-1024.apk
new file mode 100644
index 0000000..2aea3bd
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-16384.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-16384.apk
new file mode 100644
index 0000000..9fafe2c
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-2048.apk
new file mode 100644
index 0000000..348afda
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-3072.apk
new file mode 100644
index 0000000..db73a9b
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-4096.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-4096.apk
new file mode 100644
index 0000000..34be32d
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-8192.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-8192.apk
new file mode 100644
index 0000000..9af7d99
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha256-1.2.840.113549.1.1.11-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-1024.apk
new file mode 100644
index 0000000..9438016
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-16384.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-16384.apk
new file mode 100644
index 0000000..bb0caf0
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-2048.apk
new file mode 100644
index 0000000..81a0258
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-3072.apk
new file mode 100644
index 0000000..b76d7cf
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-4096.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-4096.apk
new file mode 100644
index 0000000..2583f6f
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-8192.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-8192.apk
new file mode 100644
index 0000000..f0b47f6
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.1-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-1024.apk
new file mode 100644
index 0000000..8e72556
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-16384.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-16384.apk
new file mode 100644
index 0000000..d4fc6fb
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-2048.apk
new file mode 100644
index 0000000..1e3be03
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-3072.apk
new file mode 100644
index 0000000..ac9e972
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-4096.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-4096.apk
new file mode 100644
index 0000000..d220048
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-8192.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-8192.apk
new file mode 100644
index 0000000..c70bce1
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha384-1.2.840.113549.1.1.12-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-1024.apk
new file mode 100644
index 0000000..7c6ff19
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-16384.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-16384.apk
new file mode 100644
index 0000000..8cf9eba
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-2048.apk
new file mode 100644
index 0000000..58676e8
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-3072.apk
new file mode 100644
index 0000000..2f4b23c
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-4096.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-4096.apk
new file mode 100644
index 0000000..b823de3
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-8192.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-8192.apk
new file mode 100644
index 0000000..ffa6be1
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.1-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-1024.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-1024.apk
new file mode 100644
index 0000000..480fcc5
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-16384.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-16384.apk
new file mode 100644
index 0000000..a6089e6
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-2048.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-2048.apk
new file mode 100644
index 0000000..9de481f
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-3072.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-3072.apk
new file mode 100644
index 0000000..895e2c5
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-4096.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-4096.apk
new file mode 100644
index 0000000..70b7592
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-8192.apk b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-8192.apk
new file mode 100644
index 0000000..475a4e6
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-only-with-rsa-pkcs1-sha512-1.2.840.113549.1.1.13-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-manifest.apk b/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-manifest.apk
new file mode 100644
index 0000000..1d90c7e
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-manifest.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-sf.apk b/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-sf.apk
new file mode 100644
index 0000000..a16e442
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha1-wrong-in-sf.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-manifest.apk b/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-manifest.apk
new file mode 100644
index 0000000..29a6030
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-manifest.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-sf.apk b/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-sf.apk
new file mode 100644
index 0000000..eb12bcc
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf-with-sha256-wrong-in-sf.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf.apk b/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf.apk
new file mode 100644
index 0000000..f347a1c
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sf.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sha1-sf.apk b/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sha1-sf.apk
new file mode 100644
index 0000000..f347a1c
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-sha1-sha256-manifest-and-sha1-sf.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v1-with-apk-sig-block-but-without-apk-sig-scheme-v2-block.apk b/src/test/resources/com/android/apksig/v1-with-apk-sig-block-but-without-apk-sig-scheme-v2-block.apk
new file mode 100644
index 0000000..a194a2c
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v1-with-apk-sig-block-but-without-apk-sig-scheme-v2-block.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-apk-sig-block-size-mismatch.apk b/src/test/resources/com/android/apksig/v2-only-apk-sig-block-size-mismatch.apk
new file mode 100644
index 0000000..e657a80
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-apk-sig-block-size-mismatch.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-cert-and-public-key-mismatch.apk b/src/test/resources/com/android/apksig/v2-only-cert-and-public-key-mismatch.apk
new file mode 100644
index 0000000..5fbe97e
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-cert-and-public-key-mismatch.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-empty.apk b/src/test/resources/com/android/apksig/v2-only-empty.apk
new file mode 100644
index 0000000..071ac7e
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-empty.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-garbage-between-cd-and-eocd.apk b/src/test/resources/com/android/apksig/v2-only-garbage-between-cd-and-eocd.apk
new file mode 100644
index 0000000..9360383
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-garbage-between-cd-and-eocd.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-max-sized-eocd-comment.apk b/src/test/resources/com/android/apksig/v2-only-max-sized-eocd-comment.apk
new file mode 100644
index 0000000..ef6cb43
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-max-sized-eocd-comment.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-missing-classes.dex.apk b/src/test/resources/com/android/apksig/v2-only-missing-classes.dex.apk
new file mode 100644
index 0000000..0f1350a
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-missing-classes.dex.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-no-certs-in-sig.apk b/src/test/resources/com/android/apksig/v2-only-no-certs-in-sig.apk
new file mode 100644
index 0000000..692c6b3
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-no-certs-in-sig.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-signatures-and-digests-block-mismatch.apk b/src/test/resources/com/android/apksig/v2-only-signatures-and-digests-block-mismatch.apk
new file mode 100644
index 0000000..fb397a4
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-signatures-and-digests-block-mismatch.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-targetSandboxVersion-2.apk b/src/test/resources/com/android/apksig/v2-only-targetSandboxVersion-2.apk
new file mode 100644
index 0000000..f3487c8
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-targetSandboxVersion-2.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-targetSandboxVersion-3.apk b/src/test/resources/com/android/apksig/v2-only-targetSandboxVersion-3.apk
new file mode 100644
index 0000000..56984c5
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-targetSandboxVersion-3.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-truncated-cd.apk b/src/test/resources/com/android/apksig/v2-only-truncated-cd.apk
new file mode 100644
index 0000000..d2e3e8d
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-truncated-cd.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-two-signers-second-signer-no-sig.apk b/src/test/resources/com/android/apksig/v2-only-two-signers-second-signer-no-sig.apk
new file mode 100644
index 0000000..1133085
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-two-signers-second-signer-no-sig.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-two-signers-second-signer-no-supported-sig.apk b/src/test/resources/com/android/apksig/v2-only-two-signers-second-signer-no-supported-sig.apk
new file mode 100644
index 0000000..2fab38a
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-two-signers-second-signer-no-supported-sig.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-two-signers.apk b/src/test/resources/com/android/apksig/v2-only-two-signers.apk
new file mode 100644
index 0000000..697b046
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-two-signers.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-unknown-pair-in-apk-sig-block.apk b/src/test/resources/com/android/apksig/v2-only-unknown-pair-in-apk-sig-block.apk
new file mode 100644
index 0000000..2904305
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-unknown-pair-in-apk-sig-block.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-1024-sig-does-not-verify.apk b/src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-1024-sig-does-not-verify.apk
new file mode 100644
index 0000000..18a4409
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-1024-sig-does-not-verify.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-1024.apk b/src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-1024.apk
new file mode 100644
index 0000000..9c8232f
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-2048.apk b/src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-2048.apk
new file mode 100644
index 0000000..1d679b1
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-3072.apk b/src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-3072.apk
new file mode 100644
index 0000000..6921479
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-dsa-sha256-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256-digest-mismatch.apk b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256-digest-mismatch.apk
new file mode 100644
index 0000000..4cfc49c
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256-digest-mismatch.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256-sig-does-not-verify.apk b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256-sig-does-not-verify.apk
new file mode 100644
index 0000000..0339d39
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256-sig-does-not-verify.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256.apk b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256.apk
new file mode 100644
index 0000000..657f1f9
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p256.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p384.apk b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p384.apk
new file mode 100644
index 0000000..326c681
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p521.apk b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p521.apk
new file mode 100644
index 0000000..7fcb887
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha256-p521.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p256.apk b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p256.apk
new file mode 100644
index 0000000..5942916
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p256.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p384.apk b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p384.apk
new file mode 100644
index 0000000..82aa6ad
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p521.apk b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p521.apk
new file mode 100644
index 0000000..fde4294
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-ecdsa-sha512-p521.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-ignorable-unsupported-sig-algs.apk b/src/test/resources/com/android/apksig/v2-only-with-ignorable-unsupported-sig-algs.apk
new file mode 100644
index 0000000..165b262
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-ignorable-unsupported-sig-algs.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-1024-cert-not-der.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-1024-cert-not-der.apk
new file mode 100644
index 0000000..ada1b00
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-1024-cert-not-der.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-1024.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-1024.apk
new file mode 100644
index 0000000..5751fbe
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-16384.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-16384.apk
new file mode 100644
index 0000000..a832366
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-2048-sig-does-not-verify.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-2048-sig-does-not-verify.apk
new file mode 100644
index 0000000..fe6be6f
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-2048-sig-does-not-verify.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-2048.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-2048.apk
new file mode 100644
index 0000000..51ed3ff
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-3072.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-3072.apk
new file mode 100644
index 0000000..a3569d6
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-4096.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-4096.apk
new file mode 100644
index 0000000..acf5cb6
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-8192.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-8192.apk
new file mode 100644
index 0000000..1c9f131
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha256-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-1024.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-1024.apk
new file mode 100644
index 0000000..e95e312
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-16384.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-16384.apk
new file mode 100644
index 0000000..2b332b1
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-2048.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-2048.apk
new file mode 100644
index 0000000..5e5863e
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-3072.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-3072.apk
new file mode 100644
index 0000000..d587865
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-4096-digest-mismatch.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-4096-digest-mismatch.apk
new file mode 100644
index 0000000..72f5dba
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-4096-digest-mismatch.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-4096.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-4096.apk
new file mode 100644
index 0000000..1189d8a
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-8192.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-8192.apk
new file mode 100644
index 0000000..146534e
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pkcs1-sha512-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-1024.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-1024.apk
new file mode 100644
index 0000000..1331d35
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-1024.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-16384.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-16384.apk
new file mode 100644
index 0000000..a205741
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-2048-sig-does-not-verify.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-2048-sig-does-not-verify.apk
new file mode 100644
index 0000000..f90d226
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-2048-sig-does-not-verify.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-2048.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-2048.apk
new file mode 100644
index 0000000..8bdfb45
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-3072.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-3072.apk
new file mode 100644
index 0000000..d36731c
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-4096.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-4096.apk
new file mode 100644
index 0000000..8e190b4
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-8192.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-8192.apk
new file mode 100644
index 0000000..c879ffe
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha256-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-16384.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-16384.apk
new file mode 100644
index 0000000..d398584
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-16384.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-2048.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-2048.apk
new file mode 100644
index 0000000..bf8150d
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-2048.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-3072.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-3072.apk
new file mode 100644
index 0000000..ca11ebb
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-3072.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-4096.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-4096.apk
new file mode 100644
index 0000000..dfa1206
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-4096.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-8192.apk b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-8192.apk
new file mode 100644
index 0000000..1bdd017
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-with-rsa-pss-sha512-8192.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-only-wrong-apk-sig-block-magic.apk b/src/test/resources/com/android/apksig/v2-only-wrong-apk-sig-block-magic.apk
new file mode 100644
index 0000000..85750d4
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-only-wrong-apk-sig-block-magic.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-stripped-with-ignorable-signing-schemes.apk b/src/test/resources/com/android/apksig/v2-stripped-with-ignorable-signing-schemes.apk
new file mode 100644
index 0000000..634255b
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-stripped-with-ignorable-signing-schemes.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/v2-stripped.apk b/src/test/resources/com/android/apksig/v2-stripped.apk
new file mode 100644
index 0000000..0d04d93
--- /dev/null
+++ b/src/test/resources/com/android/apksig/v2-stripped.apk
Binary files differ
diff --git a/src/test/resources/com/android/apksig/weird-compression-method.apk b/src/test/resources/com/android/apksig/weird-compression-method.apk
new file mode 100644
index 0000000..33f9af9
--- /dev/null
+++ b/src/test/resources/com/android/apksig/weird-compression-method.apk
Binary files differ