Add TestSignaturesIgnoredForMaxSDK test

https://android.googlesource.com/platform/tools/apksig/+/5941d7112b28d5dada825aad757781f0b3ecf23b
ActorExpose · Oct 11, 2019 · 3ecfb3e · 3ecfb3e
1 parent 069af32
commit 3ecfb3e
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/apkverifier_test.go b/apkverifier_test.go
@@ -31,7 +31,7 @@ func Example() {
 	}
 }
 
-// From https://android.googlesource.com/platform/tools/apksig
+// From https://android.googlesource.com/platform/tools/apksig 5941d7112b28d5dada825aad757781f0b3ecf23b
 var (
 	DSA_KEY_NAMES                  = []string{"1024", "2048", "3072"}
 	DSA_KEY_NAMES_1024_AND_SMALLER = []string{"1024"}
@@ -168,6 +168,14 @@ func TestV3StrippedRejected(t *testing.T) {
 	assertVerificationFailure(t, "v3-stripped.apk", "was stripped, downgrade attack")
 }
 
+func TestSignaturesIgnoredForMaxSDK(t *testing.T) {
+	// The V2 signature scheme was introduced in N, and V3 was introduced in P. This test
+	// verifies a max SDK of pre-P ignores the V3 signature and a max SDK of pre-N ignores both
+	// the V2 and V3 signatures.
+	assertVerifiedSdk(t, "v1v2v3-with-rsa-2048-lineage-3-signers.apk", -1, 26)
+	assertVerifiedSdk(t, "v1v2v3-with-rsa-2048-lineage-3-signers.apk", -1, 23)
+}
+
 func TestV2OneSignerOneSignatureAccepted(t *testing.T) {
 	// APK signed with v2 scheme only, one signer, one signature
 	assertVerifiedForEachSdk(t, "v2-only-with-dsa-sha256-%s.apk", DSA_KEY_NAMES, 25, math.MaxInt32)

diff --git a/runtests.sh b/runtests.sh
@@ -2,7 +2,7 @@
 set -eux
 
 if ! [ -d "apksig_for_tests" ]; then
-    git clone --depth=1 -b oreo-mr1-iot-release https://android.googlesource.com/platform/tools/apksig apksig_for_tests
+    git clone --depth=1 -b android-o-mr1-iot-release-1.0.14 https://android.googlesource.com/platform/tools/apksig apksig_for_tests
 else
     echo "Using cached apksig_for_test directory"
 fi