Tom Chan
287330e1a2
This change stores pairs of <certificate serial number, timestamp of last check against revocation list> locally on the device. It allows attestation to pass even when the device does not have an Internet connection to fetch the certificate revocation list (CRL) as long as a policy is satisfied. The current policy allows skipping CRL check for: 1. All certificates whose notBefore date is within 32 days 2. Chains whose leaf has notBefore date within 32 days and all other certs have notBefore date within 72 days 3. All certificates that have been checked against the CRL and found to be not revoked in the past 30 days This change also schedule a job to fetch the remote CRL if an attestation is requested when the device does not have Internet connection. Test: atest AttestationVerificationTest (the set of failed tests on user build is the same with and without my changes) and manual tests Bug: 389088384 Flag: EXEMPT bug fix Change-Id: Ia58b882cb1e084c1ec9929588bd94a1157b93a5e
35 lines
1.4 KiB
XML
35 lines
1.4 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
~ Copyright (C) 2021 The Android Open Source Project
|
|
~
|
|
~ Licensed under the Apache License, Version 2.0 (the "License");
|
|
~ you may not use this file except in compliance with the License.
|
|
~ You may obtain a copy of the License at
|
|
~
|
|
~ http://www.apache.org/licenses/LICENSE-2.0
|
|
~
|
|
~ Unless required by applicable law or agreed to in writing, software
|
|
~ distributed under the License is distributed on an "AS IS" BASIS,
|
|
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
~ See the License for the specific language governing permissions and
|
|
~ limitations under the License.
|
|
-->
|
|
|
|
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
|
|
package="android.security.attestationverification">
|
|
|
|
<uses-sdk android:minSdkVersion="30" android:targetSdkVersion="34" />
|
|
<uses-permission android:name="android.permission.USE_ATTESTATION_VERIFICATION_SERVICE" />
|
|
|
|
<application>
|
|
<uses-library android:name="android.test.runner"/>
|
|
<activity android:name=".SystemAttestationVerificationTest$TestActivity" />
|
|
<activity android:name=".PeerDeviceSystemAttestationVerificationTest$TestActivity" />
|
|
</application>
|
|
|
|
<!-- self-instrumenting test package. -->
|
|
<instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
|
|
android:targetPackage="android.security.attestationverification">
|
|
</instrumentation>
|
|
</manifest>
|