diff --git a/core/app_prebuilt_internal.mk b/core/app_prebuilt_internal.mk index 86a4adf32..79639a830 100644 --- a/core/app_prebuilt_internal.mk +++ b/core/app_prebuilt_internal.mk @@ -183,6 +183,30 @@ $(built_module) : $(LOCAL_REPLACE_PREBUILT_APK_INSTALLED) $(transform-prebuilt-to-target) else # ! LOCAL_REPLACE_PREBUILT_APK_INSTALLED + +# If the SDK version is 30 or higher, the apk is signed with a v2+ scheme. +# Altering it will invalidate the signature. Just do error checks instead. +do_not_alter_apk := +ifeq (PRESIGNED,$(LOCAL_CERTIFICATE)) + ifneq (,$(LOCAL_SDK_VERSION)) + ifeq ($(call math_is_number,$(LOCAL_SDK_VERSION)),true) + ifeq ($(call math_gt,$(LOCAL_SDK_VERSION),29),true) + do_not_alter_apk := true + endif + endif + # TODO: Add system_current after fixing the existing modules. + ifneq ($(filter current test_current core_current,$(LOCAL_SDK_VERSION)),) + do_not_alter_apk := true + endif + endif +endif + +ifeq ($(do_not_alter_apk),true) +$(built_module) : $(my_prebuilt_src_file) | $(ZIPALIGN) + $(transform-prebuilt-to-target) + $(check-jni-dex-compression) + $(check-package-alignment) +else # Sign and align non-presigned .apks. # The embedded prebuilt jni to uncompress. ifeq ($(LOCAL_CERTIFICATE),PRESIGNED) @@ -229,6 +253,7 @@ endif # LOCAL_CERTIFICATE ifdef LOCAL_COMPRESSED_MODULE $(compress-package) endif # LOCAL_COMPRESSED_MODULE +endif # ! do_not_alter_apk endif # ! LOCAL_REPLACE_PREBUILT_APK_INSTALLED diff --git a/core/definitions.mk b/core/definitions.mk index 7f2cc4291..c5fe76b60 100644 --- a/core/definitions.mk +++ b/core/definitions.mk @@ -2380,6 +2380,15 @@ $(hide) if ! $(ZIPALIGN) -c -p 4 $@ >/dev/null ; then \ fi endef +# Verifies ZIP alignment of a package. +# +define check-package-alignment +$(hide) if ! $(ZIPALIGN) -c -p 4 $@ >/dev/null ; then \ + $(call echo-error,$@,Improper package alignment); \ + exit 1; \ + fi +endef + # Compress a package using the standard gzip algorithm. define compress-package $(hide) \ @@ -2448,6 +2457,15 @@ define uncompress-prebuilt-embedded-jni-libs fi endef +# Verifies shared JNI libraries and dex files in an apk are uncompressed. +# +define check-jni-dex-compression + if (zipinfo $@ 'lib/*.so' '*.dex' 2>/dev/null | grep -v ' stor ' >/dev/null) ; then \ + $(call echo-error,$@,Contains compressed JNI libraries and/or dex files); \ + exit 1; \ + fi +endef + # Remove unwanted shared JNI libraries embedded in an apk. # define remove-unwanted-prebuilt-embedded-jni-libs