Allow update engine read public keys from otacerts.zip
The android build system installs both otacerts.zip and
update-payload-key.pub.pem on the device. And the latter is
converted from the X509 certificates inside the otacerts.zip
during the build time.
We can consolidate these two by letting update engine to parse
the public keys from otacerts.zip directly. This also allows
update engine to use multiple keys to verify the payload.
Bug: 116660991
Test: unittests pass
Change-Id: I0a499405f2835e1ff8b7916452cb3123046306a7
diff --git a/payload_consumer/payload_verifier.h b/payload_consumer/payload_verifier.h
index b5d5457..bc5231f 100644
--- a/payload_consumer/payload_verifier.h
+++ b/payload_consumer/payload_verifier.h
@@ -20,13 +20,14 @@
#include <memory>
#include <string>
#include <utility>
+#include <vector>
#include <brillo/secure_blob.h>
#include <openssl/evp.h>
#include "update_engine/update_metadata.pb.h"
-// This class holds the public key and implements methods used for payload
+// This class holds the public keys and implements methods used for payload
// signature verification. See payload_generator/payload_signer.h for payload
// signing.
@@ -47,6 +48,11 @@
static std::unique_ptr<PayloadVerifier> CreateInstance(
const std::string& pem_public_key);
+ // Extracts the public keys from the certificates contained in the input
+ // zip file. And creates a PayloadVerifier with these public keys.
+ static std::unique_ptr<PayloadVerifier> CreateInstanceFromZipPath(
+ const std::string& certificate_zip_path);
+
// Interprets |signature_proto| as a protocol buffer containing the
// |Signatures| message and decrypts each signature data using the stored
// public key. Pads the 32 bytes |sha256_hash_data| to 256 or 512 bytes
@@ -65,8 +71,9 @@
private:
explicit PayloadVerifier(
- std::unique_ptr<EVP_PKEY, decltype(&EVP_PKEY_free)>&& public_key)
- : public_key_(std::move(public_key)) {}
+ std::vector<std::unique_ptr<EVP_PKEY, decltype(&EVP_PKEY_free)>>&&
+ public_keys)
+ : public_keys_(std::move(public_keys)) {}
// Decrypts |sig_data| with the given |public_key| and populates
// |out_hash_data| with the decoded raw hash. Returns true if successful,
@@ -75,8 +82,7 @@
const EVP_PKEY* public_key,
brillo::Blob* out_hash_data) const;
- std::unique_ptr<EVP_PKEY, decltype(&EVP_PKEY_free)> public_key_{nullptr,
- nullptr};
+ std::vector<std::unique_ptr<EVP_PKEY, decltype(&EVP_PKEY_free)>> public_keys_;
};
} // namespace chromeos_update_engine