commit 7a78d630e11532d6f854ba7d794362804b33c950
author Tianjie Xu <xunchang@google.com> Tue Oct 08 16:32:39 2019 -0700
committer Tianjie Xu <xunchang@google.com> Tue Oct 15 18:15:29 2019 -0700
tree c442a3ed386ae1623defd9647c6f81e65c3db8f4
parent 9cad266457c59e8330c830c369784764b36386c1

Allow update engine read public keys from otacerts.zip

The android build system installs both otacerts.zip and
update-payload-key.pub.pem on the device. And the latter is
converted from the X509 certificates inside the otacerts.zip
during the build time.

We can consolidate these two by letting update engine to parse
the public keys from otacerts.zip directly. This also allows
update engine to use multiple keys to verify the payload.

Bug: 116660991
Test: unittests pass
Change-Id: I0a499405f2835e1ff8b7916452cb3123046306a7

payload_consumer/payload_metadata.cc

diff --git a/payload_consumer/payload_metadata.cc b/payload_consumer/payload_metadata.cc
index c81d3a9..0952646 100644
--- a/payload_consumer/payload_metadata.cc
+++ b/payload_consumer/payload_metadata.cc
@@ -159,7 +159,7 @@
 ErrorCode PayloadMetadata::ValidateMetadataSignature(
     const brillo::Blob& payload,
     const string& metadata_signature,
-    const string& pem_public_key) const {
+    const PayloadVerifier& payload_verifier) const {
   if (payload.size() < metadata_size_ + metadata_signature_size_)
     return ErrorCode::kDownloadMetadataSignatureError;
 
@@ -201,16 +201,9 @@
     return ErrorCode::kDownloadMetadataSignatureVerificationError;
   }
 
-  auto payload_verifier = PayloadVerifier::CreateInstance(pem_public_key);
-  if (!payload_verifier) {
-    LOG(ERROR) << "Failed to create the payload verifier from "
-               << pem_public_key;
-    return ErrorCode::kDownloadMetadataSignatureVerificationError;
-  }
-
   if (!metadata_signature_blob.empty()) {
     brillo::Blob decrypted_signature;
-    if (!payload_verifier->VerifyRawSignature(
+    if (!payload_verifier.VerifyRawSignature(
             metadata_signature_blob, metadata_hash, &decrypted_signature)) {
       LOG(ERROR) << "Manifest hash verification failed. Decrypted hash = ";
       utils::HexDumpVector(decrypted_signature);
@@ -219,8 +212,8 @@
       return ErrorCode::kDownloadMetadataSignatureMismatch;
     }
   } else {
-    if (!payload_verifier->VerifySignature(metadata_signature_protobuf,
-                                           metadata_hash)) {
+    if (!payload_verifier.VerifySignature(metadata_signature_protobuf,
+                                          metadata_hash)) {
       LOG(ERROR) << "Manifest hash verification failed.";
       return ErrorCode::kDownloadMetadataSignatureMismatch;
     }