tree 19dc585fe2fc7b9b2ee1db4998893ddf7b1cc6f9
parent cc639ba38824d95b1031269621a80893acc0fa93
author Michael Groover <mpgroover@google.com> 1595818354 -0700
committer Michael Groover <mpgroover@google.com> 1595878849 -0700

Add API to verify source stamp signature

This commit adds support to verify just the source stamp signature in
an APK without performing full signature verification. A client can
use the apksig library to verify just the source stamp as follows:

ApkVerifier apkVerifier = new ApkVerifier.Builder(inputApk)
        .setMinCheckedPlatformVersion(minSdkVersion)
        .setMaxCheckedPlatformVersion(maxSdkVersion)
        .build();
ApkVerifier.Result result =
        apkVerifier.verifySourceStamp(expectedCertDigest);
// If result#isVerified does not return true then the source stamp
// verification failed.
if (!result.isVerified()) {
    ApkVerifier.Result.SourceStampInfo.SourceStampVerificationStatus
        status =
           result.getSourceStampInfo().getSourceStampVerificationStatus();
    // Client specific behavior based on the status of the source stamp
    // verification as defined in
    // ApkVerifier.Result.SourceStampInfo.SourceStampVerificationStatus.
    for (ApkVerifier.IssueWithParams error : result.getAllErrors()) {
        // log each error as appropriate
    }
}

Bug: 162188996
Test: gradlew test
Change-Id: I4675e9c50b0f4f9b0fd58aa9fbc15c9ee0313864