Closed anestisb closed 6 years ago
Preserving the original Qualcomm signature for vendor/app/QAS_DVC_MSP/QAS_DVC_MSP.apk
appears to resolve the problem.
include $(CLEAR_VARS)
LOCAL_MODULE := QAS_DVC_MSP
LOCAL_MODULE_TAGS := optional
LOCAL_BUILT_MODULE_STEM := package.apk
LOCAL_MODULE_OWNER := google
LOCAL_MODULE_PATH := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_VENDOR)/app
LOCAL_SRC_FILES := vendor/app/QAS_DVC_MSP/QAS_DVC_MSP.apk
LOCAL_CERTIFICATE := PRESIGNED
LOCAL_MODULE_CLASS := APPS
LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
LOCAL_DEX_PREOPT := false
include $(BUILD_PREBUILT)
I wonder if it's safer to restore the old logic where all bytecode under /vendor is left PRESIGNED or explicitly handle each case. Or maybe add some detection logic to keep non-Google signatures such as Qualcomm & Verizon (see here)
Furthermore the "com.qualcomm.ltebc_vzw" classes from the QAS_DVC_MSP.apk appear to strongly bind with the "vzw_msdc_api.apk". More specifically the first has a copy of the latter under its assets dir (assets/vzw_msdc_api/vzw_msdc_api.apk
). It compares the MD5 sig of the asset against the one located under the /vendor/app/vzw_msdc_api/vzw_msdc_api.apk
. If they don't match it tries to override destination which of course fails since /vendor is read-only.
Keeping the original PRESIGNED signature for vzw_msdc_api.apk
satisfies the previous check and prevents a bunch of error/warning LTE messages from being displayed in logcat.
There is a lot of functionality implemented in the two packages so not sure what exactly is broken when they're resigned. However, since signature checks are hardcoded inside the code it seems that both APKs should be excluded from resigning. This is not a problem for android-prepare-vendor since all bytecode under /vendor is never optimised and stripped in factory images.
After I've looked into the N6p/N5x vendor bits I'll decide if it's better to explicitly exclude the APKs or add some generic certificate parsing logic in the scripts that will preserve the sigs for APKs not signed by Google (e.g. Qualcom, Verizon, etc.).
Created a temp branch to test the vendor PRESIGNED requirements. Can be found here
I had to change CarrierServices ims and imssettings to PRESIGNED to get them to stop crashing on API27. Wasn't sure if anyone else was having this problem so I didn't open a new ticket.
E AndroidRuntime: java.lang.SecurityException: Signature check failed for com.google.android.ims
@mydongistiny thanks for reporting.
Is the signature error produced by the affected apps themselves or from a third app (a Google one?)? Did you use the naked or the full config for sailfish?
@anestisb The error is from whenever another app tries to use it like Messenger, SetupWizard etc. And I used the full config, but it was on marlin. I forgot this report for for sailfish sorry. Here's a bigger part of the logcat in case you wanted to see it. https://hastebin.com/ocemamoyaw.sql
Thanks. I'll try to reproduce and confirm the fix.
@mydongistiny I haven't been able to reproduce the issue. However, I've made a set of changes based on some static analysis checks I did against the mentioned archives. Can you please pull the latest update of the vendor_presigned branch and check if it resolves your problem?
It's not a problem anymore with CarrierServices gone I guess because everything works fine now on the regular branch.
Sounds good. Closing then.
Spotted when building AOSP with API-26 naked config