blob: aba53b01f6873b35b7eb8b930aebc0d40d958da5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
|
#!/sbin/sh
# Validate that the incoming OTA is compatible with an already-installed
# system
grep -q "Command:.*\"--wipe\_data\"" /tmp/recovery.log
if [ $? -eq 0 ]; then
echo "Data will be wiped after install; skipping signature check..."
exit 0
fi
grep -q "Command:.*\"--headless\"" /tmp/recovery.log
if [ $? -eq 0 ]; then
echo "Headless mode install; skipping signature check..."
exit 0
fi
if [ -f "/data/system/packages.xml" -a -f "/tmp/releasekey" ]; then
relkey=$(cat "/tmp/releasekey")
OLDIFS="$IFS"
IFS=""
while read line; do
if [ "${#line}" -gt 4094 ]; then
continue
fi
params=${line# *<package *}
if [ "$line" != "$params" ]; then
kvp=${params%% *}
params=${params#* }
while [ "$kvp" != "$params" ]; do
key=${kvp%%=*}
val=${kvp#*=}
vlen=$(( ${#val} - 2 ))
val=${val:1:$vlen}
if [ "$key" = "name" ]; then
package="$val"
fi
kvp=${params%% *}
params=${params#* }
done
continue
fi
params=${line# *<cert *}
if [ "$line" != "$params" ]; then
keyidx=""
keyval=""
kvp=${params%% *}
params=${params#* }
while [ "$kvp" != "$params" ]; do
key=${kvp%%=*}
val=${kvp#*=}
vlen=$(( ${#val} - 2 ))
val=${val:1:$vlen}
if [ "$key" = "index" ]; then
keyidx="$val"
fi
if [ "$key" = "key" ]; then
keyval="$val"
fi
kvp=${params%% *}
params=${params#* }
done
if [ -n "$keyidx" ]; then
if [ "$package" = "com.android.htmlviewer" ]; then
cert_idx="$keyidx"
fi
fi
if [ -n "$keyval" ]; then
eval "key_$keyidx=$keyval"
fi
continue
fi
done < "/data/system/packages.xml"
IFS="$OLDIFS"
# Tools missing? Err on the side of caution and exit cleanly
if [ -z "$cert_idx" ]; then
echo "Package cert index not found; skipping signature check..."
exit 0
fi
varname="key_$cert_idx"
eval "pkgkey=\$$varname"
if [ "$pkgkey" != "$relkey" ]; then
echo "You have an installed system that isn't signed with this build's key, aborting..."
exit 124
fi
fi
exit 0
|
