diff --git a/app/src/main/java/app/universal/patch/manager/util/PM.kt b/app/src/main/java/app/universal/patch/manager/util/PM.kt index 0c8c937c..d3a75fb1 100644 --- a/app/src/main/java/app/universal/patch/manager/util/PM.kt +++ b/app/src/main/java/app/universal/patch/manager/util/PM.kt @@ -249,16 +249,14 @@ class PM( ) val signingFlags = if (includeSigning) { if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) { - val modernFlag = PackageManager.GET_SIGNING_CERTIFICATES.toLong() - // Android 9/10 only collect archive certificates when GET_SIGNATURES is also set. - // Keep SigningInfo for the current signer and verified certificate rotation history. - // https://android.googlesource.com/platform/frameworks/base/+/android-10.0.0_r47/core/java/android/content/pm/PackageManager.java + // Always include GET_SIGNATURES alongside GET_SIGNING_CERTIFICATES: Android 9/10 + // and several Android 11-13 OEM builds (e.g., Unisoc/Alldocube Android 13) gate + // PackageParser.collectCertificates() in getPackageArchiveInfo() on + // (flags & GET_SIGNATURES) != 0 while still populating SigningInfo when + // GET_SIGNING_CERTIFICATES is set. @Suppress("DEPRECATION") - if (Build.VERSION.SDK_INT < Build.VERSION_CODES.R) { - modernFlag or PackageManager.GET_SIGNATURES.toLong() - } else { - modernFlag - } + PackageManager.GET_SIGNING_CERTIFICATES.toLong() or + PackageManager.GET_SIGNATURES.toLong() } else { @Suppress("DEPRECATION") PackageManager.GET_SIGNATURES.toLong() diff --git a/app/src/test/scripts/archive-signing-test.py b/app/src/test/scripts/archive-signing-test.py index 70e39e2c..ff527678 100644 --- a/app/src/test/scripts/archive-signing-test.py +++ b/app/src/test/scripts/archive-signing-test.py @@ -74,7 +74,8 @@ class PackageInfoFlags private constructor(val value: Long) { // https://android.googlesource.com/platform/frameworks/base/+/android-10.0.0_r47/core/java/android/content/pm/PackageManager.java val legacy = flags and GET_SIGNATURES.toLong() != 0L val modern = flags and GET_SIGNING_CERTIFICATES.toLong() != 0L - val collect = legacy || (Build.VERSION.SDK_INT >= 30 && modern) + // Android 9/10 and some Android 11-13 OEM frameworks gate collectCertificates on GET_SIGNATURES alone. + val collect = legacy if (collect && !validSignature) return null return PackageInfo().apply { if (collect && legacy) signatures = history?.take(1)?.toTypedArray() ?: current @@ -130,7 +131,7 @@ class Reader { val flags = manager.lastFlags check(flags and PackageManager.GET_META_DATA.toLong() != 0L) check(flags and PackageManager.GET_ACTIVITIES.toLong() != 0L) - check((flags and PackageManager.GET_SIGNATURES.toLong() != 0L) == (sdk < 30)) + check(flags and PackageManager.GET_SIGNATURES.toLong() != 0L) check((flags and PackageManager.GET_SIGNING_CERTIFICATES.toLong() != 0L) == (sdk >= 28)) // Multi-signer identities must still require every signer.