From d693b91f34cce7c8e628053c0afc3e17036a0f9a Mon Sep 17 00:00:00 2001
From: oxmc <oxmc7769.mail@gmail.com>
Date: Sat, 15 Aug 2026 05:03:29 -0700
Subject: [PATCH] Fix build: platform_apis, missing AIDL import, private-scope
 leak

- Android.bp: sdk_version is empty (platform APIs) but platform_apis
  wasn't set, which Soong doesn't just reject cleanly -- it panics.
- PawletCacheService.kt was missing the pawletos.cache.IPawletCacheService
  import (different package than the file's own os.pawlet.cache).
- CacheToken.isExpired called CacheTokenVerifier's private parseIso8601,
  invisible outside that object; moved it to file scope so both can use it.
---
 Android.bp                                |  1 +
 src/os/pawlet/cache/PawletCacheService.kt |  1 +
 src/os/pawlet/cache/trust/CacheToken.kt   | 22 +++++++++++-----------
 3 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/Android.bp b/Android.bp
index 49c1dc3..0a3c1d7 100644
--- a/Android.bp
+++ b/Android.bp
@@ -23,6 +23,7 @@ android_app {
     // No hidden-API/privileged-permission surface needed — just platform-signed
     // so BgUpd (also platform-signed) can hold the signature-level BIND_RESOLVER
     // permission this app defines.
+    platform_apis: true,
     certificate: "platform",
     system_ext_specific: true,
 
diff --git a/src/os/pawlet/cache/PawletCacheService.kt b/src/os/pawlet/cache/PawletCacheService.kt
index fe2f649..577f3fd 100644
--- a/src/os/pawlet/cache/PawletCacheService.kt
+++ b/src/os/pawlet/cache/PawletCacheService.kt
@@ -10,6 +10,7 @@ import android.net.Uri
 import android.os.IBinder
 import android.util.Log
 import os.pawlet.cache.discovery.DiscoveredCache
+import pawletos.cache.IPawletCacheService
 import java.util.concurrent.Executors
 import java.util.concurrent.TimeUnit
 import java.util.concurrent.atomic.AtomicReference
diff --git a/src/os/pawlet/cache/trust/CacheToken.kt b/src/os/pawlet/cache/trust/CacheToken.kt
index 82af7ce..ba5df41 100644
--- a/src/os/pawlet/cache/trust/CacheToken.kt
+++ b/src/os/pawlet/cache/trust/CacheToken.kt
@@ -16,6 +16,17 @@ import java.text.SimpleDateFormat
 import java.util.Locale
 import java.util.TimeZone
 
+private fun parseIso8601(value: String): Long? = try {
+    SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'", Locale.US).apply {
+        timeZone = TimeZone.getTimeZone("UTC")
+    }.parse(value)?.time
+        ?: SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'", Locale.US).apply {
+            timeZone = TimeZone.getTimeZone("UTC")
+        }.parse(value)?.time
+} catch (e: Exception) {
+    null
+}
+
 /**
  * A verified, parsed CacheToken — the central authority's attestation that a
  * given TLS public key belongs to a legitimately registered cache server.
@@ -115,15 +126,4 @@ object CacheTokenVerifier {
         }
         return sb.append('}').toString()
     }
-
-    private fun parseIso8601(value: String): Long? = try {
-        SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'", Locale.US).apply {
-            timeZone = TimeZone.getTimeZone("UTC")
-        }.parse(value)?.time
-            ?: SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'", Locale.US).apply {
-                timeZone = TimeZone.getTimeZone("UTC")
-            }.parse(value)?.time
-    } catch (e: Exception) {
-        null
-    }
 }