add support for Play Signing variant as Auditee

GrapheneOS · Oct 28, 2022 · 4efea63 · 4efea63
1 parent 81d0872
commit 4efea63
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/app/src/main/java/app/attestation/auditor/AttestationProtocol.java b/app/src/main/java/app/attestation/auditor/AttestationProtocol.java
@@ -231,12 +231,16 @@ class AttestationProtocol {
             OS_ENFORCED_FLAGS_SYSTEM_USER;
 
     private static final String AUDITOR_APP_PACKAGE_NAME_RELEASE = "app.attestation.auditor";
+    private static final String AUDITOR_APP_PACKAGE_NAME_PLAY = "app.attestation.auditor.play";
     private static final String AUDITOR_APP_PACKAGE_NAME_DEBUG = "app.attestation.auditor.debug";
     private static final String AUDITOR_APP_SIGNATURE_DIGEST_RELEASE =
             "990E04F0864B19F14F84E0E432F7A393F297AB105A22C1E1B10B442A4A62C42C";
+    private static final String AUDITOR_APP_SIGNATURE_DIGEST_PLAY =
+            "075335BD7B54C965222B5284D2A1FDEF1198AE45EC7B09A4934287A0E3A243C7";
     private static final String AUDITOR_APP_SIGNATURE_DIGEST_DEBUG =
             "17727D8B61D55A864936B1A7B4A2554A15151F32EBCF44CDAA6E6C3258231890";
     private static final byte AUDITOR_APP_VARIANT_RELEASE = 0;
+    private static final byte AUDITOR_APP_VARIANT_PLAY = 1;
     private static final byte AUDITOR_APP_VARIANT_DEBUG = 2;
     private static final int AUDITOR_APP_MINIMUM_VERSION = 47;
     private static final int OS_VERSION_MINIMUM = 80000;
@@ -687,6 +691,11 @@ private static Verified verifyStateless(final Certificate[] certificates,
                 throw new GeneralSecurityException("invalid Auditor app signing key");
             }
             appVariant = AUDITOR_APP_VARIANT_RELEASE;
+        } else if (AUDITOR_APP_PACKAGE_NAME_PLAY.equals(info.getPackageName())) {
+            if (!AUDITOR_APP_SIGNATURE_DIGEST_PLAY.equals(signatureDigest)) {
+                throw new GeneralSecurityException("invalid Auditor app signing key");
+            }
+            appVariant = AUDITOR_APP_VARIANT_PLAY;
         } else if (AUDITOR_APP_PACKAGE_NAME_DEBUG.equals(info.getPackageName())) {
             if (!BuildConfig.DEBUG) {
                 throw new GeneralSecurityException("debug builds are only trusted by debug builds");
@@ -1192,6 +1201,8 @@ private static VerificationResult verify(final Context context, final byte[] fin
         final String appVariant;
         if (verified.appVariant == AUDITOR_APP_VARIANT_RELEASE) {
             appVariant = context.getString(R.string.auditor_app_variant_release);
+        } else if (verified.appVariant == AUDITOR_APP_VARIANT_PLAY) {
+            appVariant = context.getString(R.string.auditor_app_variant_play);
         } else {
             appVariant = context.getString(R.string.auditor_app_variant_debug);
         }

diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
@@ -75,6 +75,7 @@
     <string name="auditor_app_version">Pinned Auditor app version: %d\n</string>
     <string name="auditor_app_variant">Pinned Auditor app variant: %s\n</string>
     <string name="auditor_app_variant_release">Release build signed by GrapheneOS</string>
+    <string name="auditor_app_variant_play">Release build signed by Play Store</string>
     <string name="auditor_app_variant_debug">Debug build signed by GrapheneOS</string>
     <string name="user_profile_secure">User profile secure: %s\n</string>
     <string name="enrolled_fingerprints">Enrolled fingerprints: %s\n</string>