Keystore 2.0: Handle new upgradedBlob field in CreateOperationResponse
A new optional field upgradedBlob has been added to
CreateOperationResponse that allows keystore2 to send back the upgraded
key (if one exists) on calls to create_operation. Update keystore2 to
return this field.
Bug: 173546754
Bug: 181910578
Change-Id: I6bbb877489f3313e774de2795ce5bf8bc77a5ccf
diff --git a/keystore2/src/security_level.rs b/keystore2/src/security_level.rs
index 2ad8fe1..d7a0a12 100644
--- a/keystore2/src/security_level.rs
+++ b/keystore2/src/security_level.rs
@@ -341,6 +341,10 @@
0 => None,
_ => Some(KeyParameters { keyParameter: begin_result.params }),
},
+ // An upgraded blob should only be returned if the caller has permission
+ // to use Domain::BLOB keys. If we got to this point, we already checked
+ // that the caller had that permission.
+ upgradedBlob: if key.domain == Domain::BLOB { upgraded_blob } else { None },
})
}