| /* |
| * Copyright (C) 2014 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| package com.android.build.gradle.integration.application; |
| |
| import static com.android.build.gradle.integration.common.truth.TruthHelper.assertThat; |
| import static com.android.builder.core.BuilderConstants.RELEASE; |
| import static com.android.builder.internal.packaging.ApkCreatorType.APK_FLINGER; |
| import static com.android.builder.internal.packaging.ApkCreatorType.APK_Z_FILE_CREATOR; |
| import static com.android.testutils.truth.PathSubject.assertThat; |
| import static com.android.tools.build.apkzlib.sign.SignatureAlgorithm.DSA; |
| import static com.android.tools.build.apkzlib.sign.SignatureAlgorithm.ECDSA; |
| import static com.android.tools.build.apkzlib.sign.SignatureAlgorithm.RSA; |
| import static org.junit.Assert.assertFalse; |
| import static org.junit.Assert.assertTrue; |
| import static org.junit.Assert.fail; |
| |
| import com.android.annotations.NonNull; |
| import com.android.apksig.ApkVerifier; |
| import com.android.apksig.ApkVerifier.IssueWithParams; |
| import com.android.build.gradle.integration.common.fixture.BaseGradleExecutor; |
| import com.android.build.gradle.integration.common.fixture.GradleBuildResult; |
| import com.android.build.gradle.integration.common.fixture.GradleTestProject; |
| import com.android.build.gradle.integration.common.fixture.ModelBuilder; |
| import com.android.build.gradle.integration.common.fixture.app.HelloWorldApp; |
| import com.android.build.gradle.integration.common.runner.FilterableParameterized; |
| import com.android.build.gradle.integration.common.utils.AndroidProjectUtils; |
| import com.android.build.gradle.integration.common.utils.GradleTestProjectUtils; |
| import com.android.build.gradle.integration.common.utils.SigningConfigHelper; |
| import com.android.build.gradle.integration.common.utils.TestFileUtils; |
| import com.android.build.gradle.integration.common.utils.VariantUtils; |
| import com.android.build.gradle.options.BooleanOption; |
| import com.android.build.gradle.options.OptionalBooleanOption; |
| import com.android.build.gradle.options.StringOption; |
| import com.android.builder.core.BuilderConstants; |
| import com.android.builder.internal.packaging.ApkCreatorType; |
| import com.android.builder.model.AndroidArtifact; |
| import com.android.builder.model.AndroidProject; |
| import com.android.builder.model.SigningConfig; |
| import com.android.builder.model.SyncIssue; |
| import com.android.builder.model.Variant; |
| import com.android.testutils.TestUtils; |
| import com.android.testutils.apk.Apk; |
| import com.android.tools.build.apkzlib.sign.DigestAlgorithm; |
| import com.google.common.io.Resources; |
| import java.io.File; |
| import java.nio.file.Files; |
| import java.util.ArrayList; |
| import java.util.Arrays; |
| import java.util.Collection; |
| import java.util.List; |
| import java.util.stream.Collectors; |
| import org.junit.Assume; |
| import org.junit.Before; |
| import org.junit.Rule; |
| import org.junit.Test; |
| import org.junit.runner.RunWith; |
| import org.junit.runners.Parameterized; |
| |
| /** Integration test for all signing-related features. */ |
| @RunWith(FilterableParameterized.class) |
| public class SigningTest { |
| |
| public static final String STORE_PASSWORD = "store_password"; |
| |
| public static final String ALIAS_NAME = "alias_name"; |
| |
| public static final String KEY_PASSWORD = "key_password"; |
| |
| @Parameterized.Parameter() public String keystoreName; |
| |
| @Parameterized.Parameter(1) |
| public String certEntryName; |
| |
| @Parameterized.Parameter(2) |
| public int minSdkVersion; |
| |
| @Parameterized.Parameter(3) |
| public ApkCreatorType apkCreatorType; |
| |
| @Rule |
| public GradleTestProject project = |
| GradleTestProject.builder().fromTestApp(HelloWorldApp.noBuildFile()).create(); |
| |
| private File keystore; |
| |
| @Parameterized.Parameters(name = "{0}, {3}") |
| public static Collection<Object[]> data() { |
| return Arrays.asList( |
| new Object[] {"rsa_keystore.jks", "CERT.RSA", RSA.minSdkVersion, APK_FLINGER}, |
| new Object[] { |
| "rsa_keystore.jks", "CERT.RSA", RSA.minSdkVersion, APK_Z_FILE_CREATOR |
| }, |
| new Object[] {"dsa_keystore.jks", "CERT.DSA", DSA.minSdkVersion, APK_FLINGER}, |
| new Object[] { |
| "dsa_keystore.jks", "CERT.DSA", DSA.minSdkVersion, APK_Z_FILE_CREATOR |
| }, |
| new Object[] {"ec_keystore.jks", "CERT.EC", ECDSA.minSdkVersion, APK_FLINGER}, |
| new Object[] { |
| "ec_keystore.jks", "CERT.EC", ECDSA.minSdkVersion, APK_Z_FILE_CREATOR |
| }); |
| } |
| |
| private static void createKeystoreFile(@NonNull String resourceName, @NonNull File keystore) |
| throws Exception { |
| byte[] keystoreBytes = |
| Resources.toByteArray( |
| Resources.getResource(SigningTest.class, "SigningTest/" + resourceName)); |
| Files.write(keystore.toPath(), keystoreBytes); |
| } |
| |
| @NonNull |
| public static ApkVerifier.Result assertApkSignaturesVerify(@NonNull Apk apk, int minSdkVersion) |
| throws Exception { |
| ApkVerifier.Builder builder = |
| new ApkVerifier.Builder(apk.getFile().toFile()) |
| .setMinCheckedPlatformVersion(minSdkVersion); |
| File v4SignatureFile = new File(apk.getFile().toFile().getAbsolutePath() + ".idsig"); |
| if (v4SignatureFile.exists()) { |
| builder.setV4SignatureFile(v4SignatureFile); |
| } |
| ApkVerifier.Result result = builder.build().verify(); |
| if (result.isVerified()) { |
| return result; |
| } |
| |
| List<IssueWithParams> errors = new ArrayList<>(result.getErrors()); |
| for (ApkVerifier.Result.V1SchemeSignerInfo signer : result.getV1SchemeSigners()) { |
| errors.addAll(signer.getErrors()); |
| } |
| for (ApkVerifier.Result.V2SchemeSignerInfo signer : result.getV2SchemeSigners()) { |
| errors.addAll(signer.getErrors()); |
| } |
| throw new AssertionError( |
| "APK signatures failed to verify. " + errors.size() + " error(s): " + errors); |
| } |
| |
| private static void assertApkSignaturesDoNotVerify(Apk apk, int minSdkVersion) |
| throws Exception { |
| ApkVerifier.Result result = |
| new ApkVerifier.Builder(apk.getFile().toFile()) |
| .setMinCheckedPlatformVersion(minSdkVersion) |
| .build() |
| .verify(); |
| if (result.isVerified()) { |
| fail("APK signatures unexpectedly verified"); |
| } |
| } |
| |
| @Before |
| public void setUp() throws Exception { |
| keystore = project.file("the.keystore"); |
| |
| createKeystoreFile(keystoreName, keystore); |
| |
| GradleTestProjectUtils.setApkCreatorType(project, apkCreatorType); |
| |
| TestFileUtils.appendToFile( |
| project.getBuildFile(), |
| "" |
| + "apply plugin: 'com.android.application'\n" |
| + "\n" |
| + "android {\n" |
| + " compileSdkVersion " |
| + GradleTestProject.DEFAULT_COMPILE_SDK_VERSION |
| + "\n" |
| + " buildToolsVersion '" |
| + GradleTestProject.DEFAULT_BUILD_TOOL_VERSION |
| + "'\n" |
| + "\n" |
| + " defaultConfig {\n" |
| + " minSdkVersion " |
| + minSdkVersion |
| + "\n" |
| + " }\n" |
| + "\n" |
| + " signingConfigs {\n" |
| + " customDebug {\n" |
| + " storeFile file('the.keystore')\n" |
| + " storePassword '" |
| + STORE_PASSWORD |
| + "'\n" |
| + " keyAlias '" |
| + ALIAS_NAME |
| + "'\n" |
| + " keyPassword '" |
| + KEY_PASSWORD |
| + "'\n" |
| + " }\n" |
| + " }\n" |
| + "\n" |
| + " buildTypes {\n" |
| + " debug {\n" |
| + " signingConfig signingConfigs.customDebug\n" |
| + " }\n" |
| + "\n" |
| + " customSigning {\n" |
| + " initWith release\n" |
| + " }\n" |
| + " }\n" |
| + "\n" |
| + " applicationVariants.all { variant ->\n" |
| + " if (variant.buildType.name == \"customSigning\") {\n" |
| + " variant.outputsAreSigned = true\n" |
| + " // This usually means there is a task that generates the final outputs\n" |
| + " // and variant.outputs*.outputFile is set to point to these files.\n" |
| + " }\n" |
| + " }\n" |
| + "}" |
| + ""); |
| |
| } |
| |
| @Test |
| public void signingDsl() throws Exception { |
| GradleBuildResult result = project.executor().run("assembleDebug"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| assertThat(apk).contains("META-INF/" + certEntryName); |
| assertThat(apk).contains("META-INF/CERT.SF"); |
| ApkVerifier.Result verificationResult = assertApkSignaturesVerify(apk, minSdkVersion); |
| assertTrue(verificationResult.isVerifiedUsingV1Scheme()); |
| |
| // Check that signing config is not written to disk when passed from the build script (bug |
| // 137210434) |
| assertThat(result.getTasks()).doesNotContain(":signingConfigWriterDebug"); |
| assertThat(result.getTasks()).contains(":writeDebugSigningConfigVersions"); |
| } |
| |
| @Test |
| public void assembleWithInjectedSigningConfig() throws Exception { |
| // add prop args for signing override. |
| GradleBuildResult result = |
| project.executor() |
| .with(StringOption.IDE_SIGNING_STORE_FILE, keystore.getPath()) |
| .with(StringOption.IDE_SIGNING_STORE_PASSWORD, STORE_PASSWORD) |
| .with(StringOption.IDE_SIGNING_KEY_ALIAS, ALIAS_NAME) |
| .with(StringOption.IDE_SIGNING_KEY_PASSWORD, KEY_PASSWORD) |
| .with(OptionalBooleanOption.SIGNING_V1_ENABLED, true) |
| .with(OptionalBooleanOption.SIGNING_V2_ENABLED, true) |
| // http://b/149978740 |
| .with(BooleanOption.INCLUDE_DEPENDENCY_INFO_IN_APKS, false) |
| .run("assembleRelease"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.RELEASE_SIGNED); |
| |
| // Check for signing file inside the archive. |
| assertThat(apk).contains("META-INF/" + certEntryName); |
| assertThat(apk).contains("META-INF/CERT.SF"); |
| ApkVerifier.Result verificationResult = assertApkSignaturesVerify(apk, minSdkVersion); |
| assertTrue(verificationResult.isVerifiedUsingV1Scheme()); |
| |
| // Check that signing config is not written to disk when passed from the IDE (bug 137210434) |
| assertThat(result.getTasks()).doesNotContain(":signingConfigWriterRelease"); |
| assertThat(result.getTasks()).contains(":writeReleaseSigningConfigVersions"); |
| } |
| |
| @Test |
| public void checkCustomSigning() throws Exception { |
| Collection<Variant> variants = |
| project.model() |
| .ignoreSyncIssues(SyncIssue.SEVERITY_WARNING) |
| .fetchAndroidProjects() |
| .getOnlyModel() |
| .getVariants(); |
| |
| for (Variant variant : variants) { |
| // Release variant doesn't specify the signing config, so it should not be considered |
| // signed. |
| if (variant.getName().equals("release")) { |
| assertThat(variant.getMainArtifact().isSigned()).named(variant.getName()).isFalse(); |
| } |
| |
| // customSigning is identical to release, but overrides the signing check. |
| if (variant.getName().equals("customSigning")) { |
| assertThat(variant.getMainArtifact().isSigned()).named(variant.getName()).isTrue(); |
| } |
| } |
| } |
| |
| @Test |
| public void signingConfigsModel() throws Exception { |
| ModelBuilder modelBuilder = project.model(); |
| AndroidProject androidProject = |
| modelBuilder |
| .ignoreSyncIssues(SyncIssue.SEVERITY_WARNING) |
| .fetchAndroidProjects() |
| .getOnlyModel(); |
| |
| Collection<SigningConfig> signingConfigs = androidProject.getSigningConfigs(); |
| assertThat(signingConfigs.stream().map(SigningConfig::getName).collect(Collectors.toList())) |
| .containsExactly(BuilderConstants.DEBUG, "customDebug"); |
| |
| SigningConfig debugSigningConfig = |
| AndroidProjectUtils.getSigningConfig(androidProject, BuilderConstants.DEBUG); |
| |
| new SigningConfigHelper( |
| debugSigningConfig, |
| BuilderConstants.DEBUG, |
| modelBuilder.getPreferencesRootDir()) |
| .test(); |
| |
| SigningConfig mySigningConfig = |
| AndroidProjectUtils.getSigningConfig(androidProject, "customDebug"); |
| new SigningConfigHelper(mySigningConfig, "customDebug", keystore) |
| .setStorePassword(STORE_PASSWORD) |
| .setKeyAlias(ALIAS_NAME) |
| .setKeyPassword(KEY_PASSWORD) |
| .test(); |
| |
| Variant debugVariant = |
| AndroidProjectUtils.getVariantByName(androidProject, BuilderConstants.DEBUG); |
| assertThat(debugVariant.getMainArtifact().getSigningConfigName()).isEqualTo("customDebug"); |
| |
| AndroidArtifact androidTestArtifact = VariantUtils.getAndroidTestArtifact(debugVariant); |
| assertThat(androidTestArtifact.getSigningConfigName()).isEqualTo("customDebug"); |
| |
| Variant releaseVariant = AndroidProjectUtils.getVariantByName(androidProject, RELEASE); |
| assertThat(releaseVariant.getMainArtifact().getSigningConfigName()).isNull(); |
| } |
| |
| @Test |
| public void signingReportTask() throws Exception { |
| // SigningReportTask is not compatble |
| project.executor() |
| .withConfigurationCaching(BaseGradleExecutor.ConfigurationCaching.OFF) |
| .run("signingReport"); |
| } |
| |
| @Test |
| public void ShaAlgorithmChange() throws Exception { |
| |
| if (minSdkVersion < DigestAlgorithm.API_SHA_256_RSA_AND_ECDSA) { |
| project.execute("assembleDebug"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| assertThat(apk).containsFileWithMatch("META-INF/CERT.SF", "SHA1-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/CERT.SF", "SHA-1-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/CERT.SF", "SHA-256-Digest"); |
| assertThat(apk).containsFileWithMatch("META-INF/MANIFEST.MF", "SHA1-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/MANIFEST.MF", "SHA-1-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/MANIFEST.MF", "SHA-256-Digest"); |
| |
| TestFileUtils.searchRegexAndReplace( |
| project.getBuildFile(), |
| "minSdkVersion \\d+", |
| "minSdkVersion " + DigestAlgorithm.API_SHA_256_RSA_AND_ECDSA); |
| } |
| |
| TestUtils.waitForFileSystemTick(); |
| project.execute("assembleDebug"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| if ((certEntryName.endsWith(RSA.keyAlgorithm)) |
| || (certEntryName.endsWith(ECDSA.keyAlgorithm))) { |
| assertThat(apk).containsFileWithMatch("META-INF/CERT.SF", "SHA-256-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/CERT.SF", "SHA1-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/CERT.SF", "SHA-1-Digest"); |
| assertThat(apk).containsFileWithMatch("META-INF/MANIFEST.MF", "SHA-256-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/MANIFEST.MF", "SHA-1-Digest"); |
| } else { |
| assertThat(apk).containsFileWithMatch("META-INF/CERT.SF", "SHA1-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/CERT.SF", "SHA-1-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/CERT.SF", "SHA-256-Digest"); |
| assertThat(apk).containsFileWithMatch("META-INF/MANIFEST.MF", "SHA1-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/MANIFEST.MF", "SHA-1-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/MANIFEST.MF", "SHA-256-Digest"); |
| } |
| |
| TestFileUtils.searchRegexAndReplace( |
| project.getBuildFile(), |
| "minSdkVersion \\d+", |
| "minSdkVersion " + DigestAlgorithm.API_SHA_256_ALL_ALGORITHMS); |
| |
| TestUtils.waitForFileSystemTick(); |
| project.execute("assembleDebug"); |
| apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| assertThat(apk).containsFileWithMatch("META-INF/CERT.SF", "SHA-256-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/CERT.SF", "SHA1-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/CERT.SF", "SHA-1-Digest"); |
| assertThat(apk).containsFileWithMatch("META-INF/MANIFEST.MF", "SHA-256-Digest"); |
| assertThat(apk).containsFileWithoutContent("META-INF/MANIFEST.MF", "SHA-1-Digest"); |
| } |
| |
| @Test |
| public void signingSchemeToggle() throws Exception { |
| |
| // Toggles not specified -- testing their default values |
| project.execute("clean", "assembleDebug"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| assertThat(apk).contains("META-INF/" + certEntryName); |
| assertThat(apk).contains("META-INF/CERT.SF"); |
| assertThat(apk).containsApkSigningBlock(); |
| ApkVerifier.Result verificationResult = assertApkSignaturesVerify(apk, minSdkVersion); |
| assertTrue(verificationResult.isVerifiedUsingV1Scheme()); |
| assertTrue(verificationResult.isVerifiedUsingV2Scheme()); |
| |
| // Specified: v1SigningEnabled false, v2SigningEnabled false |
| TestFileUtils.searchAndReplace( |
| project.getBuildFile(), |
| "customDebug {", |
| "customDebug {\nv1SigningEnabled false\nv2SigningEnabled false"); |
| |
| TestUtils.waitForFileSystemTick(); |
| project.execute("clean", "assembleDebug"); |
| apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| assertThat(apk).doesNotContain("META-INF/" + certEntryName); |
| assertThat(apk).doesNotContain("META-INF/CERT.SF"); |
| assertThat(apk).doesNotContainApkSigningBlock(); |
| assertApkSignaturesDoNotVerify(apk, minSdkVersion); |
| |
| // Specified: v1SigningEnabled true, v2SigningEnabled false |
| TestFileUtils.searchAndReplace( |
| project.getBuildFile(), "v1SigningEnabled false", "v1SigningEnabled true"); |
| |
| TestUtils.waitForFileSystemTick(); |
| project.execute("clean", "assembleDebug"); |
| apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| assertThat(apk).contains("META-INF/" + certEntryName); |
| assertThat(apk).contains("META-INF/CERT.SF"); |
| assertThat(apk).doesNotContainApkSigningBlock(); |
| verificationResult = assertApkSignaturesVerify(apk, minSdkVersion); |
| assertTrue(verificationResult.isVerifiedUsingV1Scheme()); |
| assertFalse(verificationResult.isVerifiedUsingV2Scheme()); |
| |
| // Specified: v1SigningEnabled false, v2SigningEnabled true |
| TestFileUtils.searchAndReplace( |
| project.getBuildFile(), "v1SigningEnabled true", "v1SigningEnabled false"); |
| TestFileUtils.searchAndReplace( |
| project.getBuildFile(), "v2SigningEnabled false", "v2SigningEnabled true"); |
| |
| TestUtils.waitForFileSystemTick(); |
| project.execute("clean", "assembleDebug"); |
| apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| assertThat(apk).doesNotContain("META-INF/" + certEntryName); |
| assertThat(apk).doesNotContain("META-INF/CERT.SF"); |
| assertThat(apk).containsApkSigningBlock(); |
| // API Level 24 is the lowest level at which APKs don't have to be signed with v1 scheme |
| assertApkSignaturesDoNotVerify(apk, Math.min(23, minSdkVersion)); |
| verificationResult = assertApkSignaturesVerify(apk, Math.max(24, minSdkVersion)); |
| assertFalse(verificationResult.isVerifiedUsingV1Scheme()); |
| assertTrue(verificationResult.isVerifiedUsingV2Scheme()); |
| |
| // Specified: v1SigningEnabled true, v2SigningEnabled true |
| TestFileUtils.searchAndReplace( |
| project.getBuildFile(), "v1SigningEnabled false", "v1SigningEnabled true"); |
| |
| TestUtils.waitForFileSystemTick(); |
| project.execute("clean", "assembleDebug"); |
| apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| assertThat(apk).contains("META-INF/" + certEntryName); |
| assertThat(apk).contains("META-INF/CERT.SF"); |
| assertThat(apk).containsApkSigningBlock(); |
| verificationResult = assertApkSignaturesVerify(apk, minSdkVersion); |
| assertTrue(verificationResult.isVerifiedUsingV1Scheme()); |
| assertTrue(verificationResult.isVerifiedUsingV2Scheme()); |
| } |
| |
| @Test |
| public void assembleWithInjectedV1ConfigOnly() throws Exception { |
| // add prop args for signing override. |
| project.executor() |
| .with(StringOption.IDE_SIGNING_STORE_FILE, keystore.getPath()) |
| .with(StringOption.IDE_SIGNING_STORE_PASSWORD, STORE_PASSWORD) |
| .with(StringOption.IDE_SIGNING_KEY_ALIAS, ALIAS_NAME) |
| .with(StringOption.IDE_SIGNING_KEY_PASSWORD, KEY_PASSWORD) |
| .with(OptionalBooleanOption.SIGNING_V1_ENABLED, true) |
| .with(OptionalBooleanOption.SIGNING_V2_ENABLED, false) |
| // http://b/149978740 |
| .with(BooleanOption.INCLUDE_DEPENDENCY_INFO_IN_APKS, false) |
| .run("assembleRelease"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.RELEASE_SIGNED); |
| |
| assertThat(apk).contains("META-INF/" + certEntryName); |
| assertThat(apk).contains("META-INF/CERT.SF"); |
| ApkVerifier.Result verificationResult = assertApkSignaturesVerify(apk, minSdkVersion); |
| assertTrue(verificationResult.isVerifiedUsingV1Scheme()); |
| assertFalse(verificationResult.isVerifiedUsingV2Scheme()); |
| } |
| |
| @Test |
| public void assembleWithInjectedV1ConfigDependencyInfoDisabled() throws Exception { |
| // add prop args for signing override. |
| project.executor() |
| .with(StringOption.IDE_SIGNING_STORE_FILE, keystore.getPath()) |
| .with(StringOption.IDE_SIGNING_STORE_PASSWORD, STORE_PASSWORD) |
| .with(StringOption.IDE_SIGNING_KEY_ALIAS, ALIAS_NAME) |
| .with(StringOption.IDE_SIGNING_KEY_PASSWORD, KEY_PASSWORD) |
| .with(OptionalBooleanOption.SIGNING_V1_ENABLED, true) |
| .with(OptionalBooleanOption.SIGNING_V2_ENABLED, false) |
| .with(BooleanOption.INCLUDE_DEPENDENCY_INFO_IN_APKS, false) |
| .run("assembleRelease"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.RELEASE_SIGNED); |
| |
| assertThat(apk).contains("META-INF/" + certEntryName); |
| assertThat(apk).contains("META-INF/CERT.SF"); |
| assertThat(apk).doesNotContainApkSigningBlock(); |
| ApkVerifier.Result verificationResult = assertApkSignaturesVerify(apk, minSdkVersion); |
| assertTrue(verificationResult.isVerifiedUsingV1Scheme()); |
| assertFalse(verificationResult.isVerifiedUsingV2Scheme()); |
| } |
| |
| @Test |
| public void assembleWithInjectedV2ConfigOnly() throws Exception { |
| // add prop args for signing override. |
| project.executor() |
| .with(StringOption.IDE_SIGNING_STORE_FILE, keystore.getPath()) |
| .with(StringOption.IDE_SIGNING_STORE_PASSWORD, STORE_PASSWORD) |
| .with(StringOption.IDE_SIGNING_KEY_ALIAS, ALIAS_NAME) |
| .with(StringOption.IDE_SIGNING_KEY_PASSWORD, KEY_PASSWORD) |
| .with(OptionalBooleanOption.SIGNING_V1_ENABLED, false) |
| // http://b/149978740 |
| .with(BooleanOption.INCLUDE_DEPENDENCY_INFO_IN_APKS, false) |
| .with(OptionalBooleanOption.SIGNING_V2_ENABLED, true) |
| .run("assembleRelease"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.RELEASE_SIGNED); |
| |
| assertThat(apk).doesNotContain("META-INF/" + certEntryName); |
| assertThat(apk).doesNotContain("META-INF/CERT.SF"); |
| assertThat(apk).containsApkSigningBlock(); |
| // API Level 24 is the lowest level at which APKs don't have to be signed with v1 scheme |
| assertApkSignaturesDoNotVerify(apk, 23); |
| ApkVerifier.Result verificationResult = |
| assertApkSignaturesVerify(apk, Math.max(minSdkVersion, 24)); |
| assertFalse(verificationResult.isVerifiedUsingV1Scheme()); |
| assertTrue(verificationResult.isVerifiedUsingV2Scheme()); |
| } |
| |
| @Test |
| @SuppressWarnings("ThrowableResultOfMethodCallIgnored") |
| public void failWithMissingKeyPassword() throws Exception { |
| TestFileUtils.searchAndReplace( |
| project.getBuildFile(), "keyPassword '" + KEY_PASSWORD + "'", ""); |
| project.executeExpectingFailure("assembleDebug"); |
| } |
| |
| @Test |
| public void signingWithV3() throws Exception { |
| // v3 signing is not supported by apkzlib |
| Assume.assumeTrue(apkCreatorType == APK_FLINGER); |
| TestFileUtils.searchAndReplace( |
| project.getBuildFile(), |
| "customDebug {", |
| "" |
| + "customDebug {\n" |
| + " v1SigningEnabled false\n" |
| + " v2SigningEnabled false\n" |
| + " enableV3Signing true\n"); |
| project.executor().run("assembleDebug"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| |
| assertThat(apk).doesNotContain("META-INF/" + certEntryName); |
| assertThat(apk).doesNotContain("META-INF/CERT.SF"); |
| assertThat(apk).containsApkSigningBlock(); |
| // API Level 28 is the lowest level that supports v3 signing |
| ApkVerifier.Result verificationResult = |
| assertApkSignaturesVerify(apk, Math.max(minSdkVersion, 28)); |
| assertThat(verificationResult.isVerifiedUsingV1Scheme()).isFalse(); |
| assertThat(verificationResult.isVerifiedUsingV2Scheme()).isFalse(); |
| assertThat(verificationResult.isVerifiedUsingV3Scheme()).isTrue(); |
| } |
| |
| @Test |
| public void signingWithV4AndV2() throws Exception { |
| // v4 signing is not supported by apkzlib |
| Assume.assumeTrue(apkCreatorType == APK_FLINGER); |
| TestFileUtils.searchAndReplace( |
| project.getBuildFile(), |
| "customDebug {", |
| "" |
| + "customDebug {\n" |
| + " v1SigningEnabled false\n" |
| + " v2SigningEnabled true\n" |
| + " enableV3Signing false\n" |
| + " enableV4Signing true\n"); |
| project.executor().run("assembleDebug"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| |
| assertThat(apk).doesNotContain("META-INF/" + certEntryName); |
| assertThat(apk).doesNotContain("META-INF/CERT.SF"); |
| assertThat(apk).containsApkSigningBlock(); |
| // API Level 28 is the lowest level that supports v4 signing |
| ApkVerifier.Result verificationResult = |
| assertApkSignaturesVerify(apk, Math.max(minSdkVersion, 28)); |
| assertThat(verificationResult.isVerifiedUsingV1Scheme()).isFalse(); |
| assertThat(verificationResult.isVerifiedUsingV2Scheme()).isTrue(); |
| assertThat(verificationResult.isVerifiedUsingV3Scheme()).isFalse(); |
| assertThat(verificationResult.isVerifiedUsingV4Scheme()).isTrue(); |
| } |
| |
| @Test |
| public void signingWithV4AndV3() throws Exception { |
| // v4 and v3 signing are not supported by apkzlib |
| Assume.assumeTrue(apkCreatorType == APK_FLINGER); |
| TestFileUtils.searchAndReplace( |
| project.getBuildFile(), |
| "customDebug {", |
| "" |
| + "customDebug {\n" |
| + " v1SigningEnabled false\n" |
| + " v2SigningEnabled false\n" |
| + " enableV3Signing true\n" |
| + " enableV4Signing true\n"); |
| project.executor().run("assembleDebug"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| |
| assertThat(apk).doesNotContain("META-INF/" + certEntryName); |
| assertThat(apk).doesNotContain("META-INF/CERT.SF"); |
| assertThat(apk).containsApkSigningBlock(); |
| // API Level 28 is the lowest level that supports v4 signing |
| ApkVerifier.Result verificationResult = |
| assertApkSignaturesVerify(apk, Math.max(minSdkVersion, 28)); |
| assertThat(verificationResult.isVerifiedUsingV1Scheme()).isFalse(); |
| assertThat(verificationResult.isVerifiedUsingV2Scheme()).isFalse(); |
| assertThat(verificationResult.isVerifiedUsingV3Scheme()).isTrue(); |
| assertThat(verificationResult.isVerifiedUsingV4Scheme()).isTrue(); |
| } |
| |
| /** |
| * Test that injecting signing config data doesn't change which signature versions are enabled |
| * if signature versions aren't injected. |
| * |
| * This test is a corner case for v1 and v2 because the IDE currently always injects non-null |
| * values for both of them when it injects signing config info. |
| * |
| * But this is an important regression test for v3 and v4. Previously, if the IDE injected |
| * signing config info, then we wouldn't sign with v3 or v4 even if they were enabled via the |
| * DSL. |
| */ |
| @Test |
| public void signingWithDslVersionsWithInjectedSigningConfig() throws Exception { |
| // v4 and v3 signing are not supported by apkzlib |
| Assume.assumeTrue(apkCreatorType == APK_FLINGER); |
| // set enableV1Signing and enableV2Signing to false below because we're testing that |
| // they're not being overridden by the "injected" null values which would cause v1 and v2 |
| // signing to be enabled by default. |
| TestFileUtils.searchAndReplace( |
| project.getBuildFile(), |
| "customDebug {", |
| "" |
| + "customDebug {\n" |
| + " enableV1Signing false\n" |
| + " enableV2Signing false\n" |
| + " enableV3Signing true\n" |
| + " enableV4Signing true\n"); |
| project.executor() |
| .with(StringOption.IDE_SIGNING_STORE_FILE, keystore.getPath()) |
| .with(StringOption.IDE_SIGNING_STORE_PASSWORD, STORE_PASSWORD) |
| .with(StringOption.IDE_SIGNING_KEY_ALIAS, ALIAS_NAME) |
| .with(StringOption.IDE_SIGNING_KEY_PASSWORD, KEY_PASSWORD) |
| // http://b/149978740 |
| .with(BooleanOption.INCLUDE_DEPENDENCY_INFO_IN_APKS, false) |
| .run("assembleDebug"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| |
| assertThat(apk).doesNotContain("META-INF/" + certEntryName); |
| assertThat(apk).doesNotContain("META-INF/CERT.SF"); |
| assertThat(apk).containsApkSigningBlock(); |
| ApkVerifier.Result verificationResult = assertApkSignaturesVerify(apk, 24); |
| assertThat(verificationResult.isVerifiedUsingV2Scheme()).isFalse(); |
| assertThat(verificationResult.isVerifiedUsingV3Scheme()).isTrue(); |
| assertThat(verificationResult.isVerifiedUsingV4Scheme()).isTrue(); |
| } |
| |
| @Test |
| public void enableSigningWithVariantApi() throws Exception { |
| // v4 and v3 signing are not supported by apkzlib |
| Assume.assumeTrue(apkCreatorType == APK_FLINGER); |
| TestFileUtils.appendToFile( |
| project.getBuildFile(), |
| "\n" |
| + "androidComponents {\n" |
| + " onVariants(selector().withName('debug'), {\n" |
| + " signingConfig.enableV1Signing.set(true)\n" |
| + " signingConfig.enableV2Signing.set(true)\n" |
| + " signingConfig.enableV3Signing.set(true)\n" |
| + " signingConfig.enableV4Signing.set(true)\n" |
| + " })\n" |
| + "}\n"); |
| |
| project.executor() |
| .with(StringOption.IDE_SIGNING_STORE_FILE, keystore.getPath()) |
| .with(StringOption.IDE_SIGNING_STORE_PASSWORD, STORE_PASSWORD) |
| .with(StringOption.IDE_SIGNING_KEY_ALIAS, ALIAS_NAME) |
| .with(StringOption.IDE_SIGNING_KEY_PASSWORD, KEY_PASSWORD) |
| // http://b/149978740 |
| .with(BooleanOption.INCLUDE_DEPENDENCY_INFO_IN_APKS, false) |
| .run("assembleDebug"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| |
| assertThat(apk).contains("META-INF/" + certEntryName); |
| assertThat(apk).contains("META-INF/CERT.SF"); |
| assertThat(apk).containsApkSigningBlock(); |
| ApkVerifier.Result verificationResult = |
| assertApkSignaturesVerify(apk, Math.max(minSdkVersion, 23)); |
| assertThat(verificationResult.isVerifiedUsingV1Scheme()).isTrue(); |
| assertThat(verificationResult.isVerifiedUsingV2Scheme()).isTrue(); |
| assertThat(verificationResult.isVerifiedUsingV3Scheme()).isTrue(); |
| assertThat(verificationResult.isVerifiedUsingV4Scheme()).isTrue(); |
| } |
| |
| @Test |
| public void injectedValuesOverrideVariantApi() throws Exception { |
| // v4 and v3 signing are not supported by apkzlib |
| Assume.assumeTrue(apkCreatorType == APK_FLINGER); |
| TestFileUtils.appendToFile( |
| project.getBuildFile(), |
| "\n" |
| + "androidComponents {\n" |
| + " onVariants(selector().withName('debug'), {\n" |
| + " signingConfig.enableV1Signing.set(false)\n" |
| + " signingConfig.enableV2Signing.set(false)\n" |
| + " signingConfig.enableV3Signing.set(true)\n" |
| + " signingConfig.enableV4Signing.set(true)\n" |
| + " })\n" |
| + "}\n"); |
| |
| project.executor() |
| .with(StringOption.IDE_SIGNING_STORE_FILE, keystore.getPath()) |
| .with(StringOption.IDE_SIGNING_STORE_PASSWORD, STORE_PASSWORD) |
| .with(StringOption.IDE_SIGNING_KEY_ALIAS, ALIAS_NAME) |
| .with(StringOption.IDE_SIGNING_KEY_PASSWORD, KEY_PASSWORD) |
| .with(OptionalBooleanOption.SIGNING_V1_ENABLED, true) |
| .with(OptionalBooleanOption.SIGNING_V2_ENABLED, true) |
| // http://b/149978740 |
| .with(BooleanOption.INCLUDE_DEPENDENCY_INFO_IN_APKS, false) |
| .run("assembleDebug"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| |
| assertThat(apk).contains("META-INF/" + certEntryName); |
| assertThat(apk).contains("META-INF/CERT.SF"); |
| assertThat(apk).containsApkSigningBlock(); |
| ApkVerifier.Result verificationResult = |
| assertApkSignaturesVerify(apk, Math.max(minSdkVersion, 23)); |
| assertThat(verificationResult.isVerifiedUsingV1Scheme()).isTrue(); |
| assertThat(verificationResult.isVerifiedUsingV2Scheme()).isTrue(); |
| assertThat(verificationResult.isVerifiedUsingV3Scheme()).isTrue(); |
| assertThat(verificationResult.isVerifiedUsingV4Scheme()).isTrue(); |
| } |
| |
| @Test |
| public void signingWithEnableV1SigningFalse() throws Exception { |
| TestFileUtils.searchAndReplace( |
| project.getBuildFile(), |
| "customDebug {", |
| "" |
| + "customDebug {\n" |
| + " enableV1Signing false\n"); |
| project.executor().run("assembleDebug"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| |
| assertThat(apk).doesNotContain("META-INF/" + certEntryName); |
| assertThat(apk).doesNotContain("META-INF/CERT.SF"); |
| assertThat(apk).containsApkSigningBlock(); |
| ApkVerifier.Result verificationResult = |
| assertApkSignaturesVerify(apk, Math.max(minSdkVersion, 24)); |
| assertThat(verificationResult.isVerifiedUsingV1Scheme()).isFalse(); |
| assertThat(verificationResult.isVerifiedUsingV2Scheme()).isTrue(); |
| } |
| |
| @Test |
| public void signingWithEnableV2SigningFalse() throws Exception { |
| TestFileUtils.searchAndReplace( |
| project.getBuildFile(), |
| "customDebug {", |
| "" |
| + "customDebug {\n" |
| + " enableV2Signing false\n"); |
| project.executor().run("assembleDebug"); |
| Apk apk = project.getApk(GradleTestProject.ApkType.DEBUG); |
| |
| assertThat(apk).contains("META-INF/" + certEntryName); |
| assertThat(apk).contains("META-INF/CERT.SF"); |
| assertThat(apk).doesNotContainApkSigningBlock(); |
| ApkVerifier.Result verificationResult = assertApkSignaturesVerify(apk, minSdkVersion); |
| assertThat(verificationResult.isVerifiedUsingV1Scheme()).isTrue(); |
| assertThat(verificationResult.isVerifiedUsingV2Scheme()).isFalse(); |
| } |
| } |
