Massive project restructure

crypto/.gitignore

@@ -0,0 +1 @@
+/build

crypto/build.gradle

@@ -0,0 +1,38 @@
+apply plugin: 'java-library'
+
+apply plugin: 'com.github.johnrengelman.shadow'
+apply plugin: 'java'
+
+sourceCompatibility = "1.8"
+targetCompatibility = "1.8"
+
+jar {
+    manifest {
+        attributes 'Main-Class': 'com.topjohnwu.crypto.ZipSigner'
+    }
+}
+
+shadowJar {
+    baseName = 'zipsigner'
+    classifier = null
+    version = 1.1
+}
+
+buildscript {
+    repositories {
+        jcenter()
+    }
+    dependencies {
+        classpath 'com.github.jengelman.gradle.plugins:shadow:2.0.1'
+    }
+}
+
+repositories {
+    jcenter()
+}
+
+dependencies {
+    implementation fileTree(include: ['*.jar'], dir: 'libs')
+    implementation 'org.bouncycastle:bcprov-jdk15on:1.58'
+    implementation 'org.bouncycastle:bcpkix-jdk15on:1.58'
+}

crypto/src/main/java/com/topjohnwu/crypto/ByteArrayStream.java

@@ -0,0 +1,34 @@
+package com.topjohnwu.crypto;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+public class ByteArrayStream extends ByteArrayOutputStream {
+    public byte[] getBuf() {
+        return buf;
+    }
+    public synchronized void readFrom(InputStream is) {
+        readFrom(is, Integer.MAX_VALUE);
+    }
+    public synchronized void readFrom(InputStream is, int len) {
+        int read;
+        byte buffer[] = new byte[4096];
+        try {
+            while ((read = is.read(buffer, 0, len < buffer.length ? len : buffer.length)) > 0) {
+                write(buffer, 0, read);
+                len -= read;
+            }
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+    }
+    public synchronized void writeTo(OutputStream out, int off, int len) throws IOException {
+        out.write(buf, off, len);
+    }
+    public ByteArrayInputStream getInputStream() {
+        return new ByteArrayInputStream(buf, 0, count);
+    }
+}

crypto/src/main/java/com/topjohnwu/crypto/CryptoUtils.java

@@ -0,0 +1,136 @@
+package com.topjohnwu.crypto;
+
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
+import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.asn1.x9.X9ObjectIdentifiers;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.GeneralSecurityException;
+import java.security.Key;
+import java.security.KeyFactory;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.Signature;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.security.spec.ECPrivateKeySpec;
+import java.security.spec.ECPublicKeySpec;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
+
+class CryptoUtils {
+
+    private static final Map<String, String> ID_TO_ALG;
+    private static final Map<String, String> ALG_TO_ID;
+
+    static {
+        ID_TO_ALG = new HashMap<>();
+        ALG_TO_ID = new HashMap<>();
+        ID_TO_ALG.put(X9ObjectIdentifiers.ecdsa_with_SHA256.getId(), "SHA256withECDSA");
+        ID_TO_ALG.put(X9ObjectIdentifiers.ecdsa_with_SHA384.getId(), "SHA384withECDSA");
+        ID_TO_ALG.put(X9ObjectIdentifiers.ecdsa_with_SHA512.getId(), "SHA512withECDSA");
+        ID_TO_ALG.put(PKCSObjectIdentifiers.sha1WithRSAEncryption.getId(), "SHA1withRSA");
+        ID_TO_ALG.put(PKCSObjectIdentifiers.sha256WithRSAEncryption.getId(), "SHA256withRSA");
+        ID_TO_ALG.put(PKCSObjectIdentifiers.sha512WithRSAEncryption.getId(), "SHA512withRSA");
+        ALG_TO_ID.put("SHA256withECDSA", X9ObjectIdentifiers.ecdsa_with_SHA256.getId());
+        ALG_TO_ID.put("SHA384withECDSA", X9ObjectIdentifiers.ecdsa_with_SHA384.getId());
+        ALG_TO_ID.put("SHA512withECDSA", X9ObjectIdentifiers.ecdsa_with_SHA512.getId());
+        ALG_TO_ID.put("SHA1withRSA", PKCSObjectIdentifiers.sha1WithRSAEncryption.getId());
+        ALG_TO_ID.put("SHA256withRSA", PKCSObjectIdentifiers.sha256WithRSAEncryption.getId());
+        ALG_TO_ID.put("SHA512withRSA", PKCSObjectIdentifiers.sha512WithRSAEncryption.getId());
+    }
+
+    private static String getSignatureAlgorithm(Key key) throws Exception {
+        if ("EC".equals(key.getAlgorithm())) {
+            int curveSize;
+            KeyFactory factory = KeyFactory.getInstance("EC");
+            if (key instanceof PublicKey) {
+                ECPublicKeySpec spec = factory.getKeySpec(key, ECPublicKeySpec.class);
+                curveSize = spec.getParams().getCurve().getField().getFieldSize();
+            } else if (key instanceof PrivateKey) {
+                ECPrivateKeySpec spec = factory.getKeySpec(key, ECPrivateKeySpec.class);
+                curveSize = spec.getParams().getCurve().getField().getFieldSize();
+            } else {
+                throw new InvalidKeySpecException();
+            }
+            if (curveSize <= 256) {
+                return "SHA256withECDSA";
+            } else if (curveSize <= 384) {
+                return "SHA384withECDSA";
+            } else {
+                return "SHA512withECDSA";
+            }
+        } else if ("RSA".equals(key.getAlgorithm())) {
+            return "SHA256withRSA";
+        } else {
+            throw new IllegalArgumentException("Unsupported key type " + key.getAlgorithm());
+        }
+    }
+
+    static AlgorithmIdentifier getSignatureAlgorithmIdentifier(Key key) throws Exception {
+        String id = ALG_TO_ID.get(getSignatureAlgorithm(key));
+        if (id == null) {
+            throw new IllegalArgumentException("Unsupported key type " + key.getAlgorithm());
+        }
+        return new AlgorithmIdentifier(new ASN1ObjectIdentifier(id));
+    }
+
+    static boolean verify(PublicKey key, byte[] input, byte[] signature,
+                          AlgorithmIdentifier algId) throws Exception {
+        String algName = ID_TO_ALG.get(algId.getAlgorithm().getId());
+        if (algName == null) {
+            throw new IllegalArgumentException("Unsupported algorithm " + algId.getAlgorithm());
+        }
+        Signature verifier = Signature.getInstance(algName);
+        verifier.initVerify(key);
+        verifier.update(input);
+        return verifier.verify(signature);
+    }
+
+    static byte[] sign(PrivateKey privateKey, byte[] input) throws Exception {
+        Signature signer = Signature.getInstance(getSignatureAlgorithm(privateKey));
+        signer.initSign(privateKey);
+        signer.update(input);
+        return signer.sign();
+    }
+
+    static X509Certificate readPublicKey(InputStream input)
+            throws IOException, GeneralSecurityException {
+        try {
+            CertificateFactory cf = CertificateFactory.getInstance("X.509");
+            return (X509Certificate) cf.generateCertificate(input);
+        } finally {
+            input.close();
+        }
+    }
+
+    /** Read a PKCS#8 format private key. */
+    static PrivateKey readPrivateKey(InputStream input)
+            throws IOException, GeneralSecurityException {
+        try {
+            byte[] buffer = new byte[4096];
+            int size = input.read(buffer);
+            byte[] bytes = Arrays.copyOf(buffer, size);
+            /* Check to see if this is in an EncryptedPrivateKeyInfo structure. */
+            PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(bytes);
+            /*
+             * Now it's in a PKCS#8 PrivateKeyInfo structure. Read its Algorithm
+             * OID and use that to construct a KeyFactory.
+             */
+            ASN1InputStream bIn = new ASN1InputStream(new ByteArrayInputStream(spec.getEncoded()));
+            PrivateKeyInfo pki = PrivateKeyInfo.getInstance(bIn.readObject());
+            String algOid = pki.getPrivateKeyAlgorithm().getAlgorithm().getId();
+            return KeyFactory.getInstance(algOid).generatePrivate(spec);
+        } finally {
+            input.close();
+        }
+    }
+}

crypto/src/main/java/com/topjohnwu/crypto/JarMap.java

@@ -0,0 +1,122 @@
+package com.topjohnwu.crypto;
+
+import java.io.Closeable;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.LinkedHashMap;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.jar.JarInputStream;
+import java.util.jar.Manifest;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipFile;
+
+/*
+* A universal random access interface for both JarFile and JarInputStream
+*
+* In the case when JarInputStream is provided to constructor, the whole stream
+* will be loaded into memory for random access purposes.
+* On the other hand, when a JarFile is provided, it simply works as a wrapper.
+* */
+
+public class JarMap implements Closeable, AutoCloseable {
+    private JarFile jarFile;
+    private JarInputStream jis;
+    private boolean isInputStream = false;
+    private LinkedHashMap<String, JarEntry> bufMap;
+
+    public JarMap(File file) throws IOException {
+        this(file, true);
+    }
+
+    public JarMap(File file, boolean verify) throws IOException {
+        this(file, verify, ZipFile.OPEN_READ);
+    }
+
+    public JarMap(File file, boolean verify, int mode) throws IOException {
+        jarFile = new JarFile(file, verify, mode);
+    }
+
+    public JarMap(String name) throws IOException {
+        this(new File(name));
+    }
+
+    public JarMap(String name, boolean verify) throws IOException {
+        this(new File(name), verify);
+    }
+
+    public JarMap(InputStream is) throws IOException {
+        this(is, true);
+    }
+
+    public JarMap(InputStream is, boolean verify) throws IOException {
+        isInputStream = true;
+        bufMap = new LinkedHashMap<>();
+        jis = new JarInputStream(is, verify);
+        JarEntry entry;
+        while ((entry = jis.getNextJarEntry()) != null) {
+            bufMap.put(entry.getName(), new JarMapEntry(entry, jis));
+        }
+    }
+
+    public File getFile() {
+        return isInputStream ? null : new File(jarFile.getName());
+    }
+
+    public Manifest getManifest() throws IOException {
+        return isInputStream ? jis.getManifest() : jarFile.getManifest();
+    }
+
+    public InputStream getInputStream(ZipEntry ze) throws IOException {
+        return isInputStream ? ((JarMapEntry) bufMap.get(ze.getName())).data.getInputStream() :
+                jarFile.getInputStream(ze);
+    }
+
+    public OutputStream getOutputStream(ZipEntry ze) {
+        if (!isInputStream) // Only support InputStream mode
+            return null;
+        ByteArrayStream bs = ((JarMapEntry) bufMap.get(ze.getName())).data;
+        bs.reset();
+        return bs;
+    }
+
+    public byte[] getRawData(ZipEntry ze) throws IOException {
+        if (isInputStream) {
+            return ((JarMapEntry) bufMap.get(ze.getName())).data.toByteArray();
+        } else {
+            ByteArrayStream bytes = new ByteArrayStream();
+            bytes.readFrom(jarFile.getInputStream(ze));
+            return bytes.toByteArray();
+        }
+    }
+
+    public Enumeration<JarEntry> entries() {
+        return isInputStream ? Collections.enumeration(bufMap.values()) : jarFile.entries();
+    }
+
+    public ZipEntry getEntry(String name) {
+        return getJarEntry(name);
+    }
+
+    public JarEntry getJarEntry(String name) {
+        return isInputStream ? bufMap.get(name) : jarFile.getJarEntry(name);
+    }
+
+    @Override
+    public void close() throws IOException {
+        (isInputStream ? jis : jarFile).close();
+    }
+
+    private static class JarMapEntry extends JarEntry {
+        ByteArrayStream data;
+        JarMapEntry(JarEntry je, InputStream is) {
+            super(je);
+            data = new ByteArrayStream();
+            data.readFrom(is);
+        }
+    }
+}

crypto/src/main/java/com/topjohnwu/crypto/SignAPK.java

@@ -0,0 +1,502 @@
+package com.topjohnwu.crypto;
+
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.DEROutputStream;
+import org.bouncycastle.asn1.cms.CMSObjectIdentifiers;
+import org.bouncycastle.cert.jcajce.JcaCertStore;
+import org.bouncycastle.cms.CMSException;
+import org.bouncycastle.cms.CMSProcessableByteArray;
+import org.bouncycastle.cms.CMSSignedData;
+import org.bouncycastle.cms.CMSSignedDataGenerator;
+import org.bouncycastle.cms.CMSTypedData;
+import org.bouncycastle.cms.jcajce.JcaSignerInfoGeneratorBuilder;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
+import org.bouncycastle.util.encoders.Base64;
+
+import java.io.BufferedOutputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.FilterOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.PrintStream;
+import java.io.RandomAccessFile;
+import java.security.DigestOutputStream;
+import java.security.GeneralSecurityException;
+import java.security.MessageDigest;
+import java.security.PrivateKey;
+import java.security.Provider;
+import java.security.Security;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.Locale;
+import java.util.Map;
+import java.util.TreeMap;
+import java.util.jar.Attributes;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.jar.JarOutputStream;
+import java.util.jar.Manifest;
+import java.util.regex.Pattern;
+
+/*
+* Modified from from AOSP(Marshmallow) SignAPK.java
+* */
+
+public class SignAPK {
+
+    private static final String CERT_SF_NAME = "META-INF/CERT.SF";
+    private static final String CERT_SIG_NAME = "META-INF/CERT.%s";
+
+    public static Provider sBouncyCastleProvider;
+    // bitmasks for which hash algorithms we need the manifest to include.
+    private static final int USE_SHA1 = 1;
+    private static final int USE_SHA256 = 2;
+
+    static {
+        sBouncyCastleProvider = new BouncyCastleProvider();
+        Security.insertProviderAt(sBouncyCastleProvider, 1);
+    }
+
+    public static void signZip(InputStream publicIn, InputStream privateIn,
+                               JarMap input, File output, boolean minSign) throws Exception {
+        int alignment = 4;
+        BufferedOutputStream outputFile;
+        int hashes = 0;
+        X509Certificate publicKey = CryptoUtils.readPublicKey(publicIn);
+        hashes |= getDigestAlgorithm(publicKey);
+
+        // Set the ZIP file timestamp to the starting valid time
+        // of the 0th certificate plus one hour (to match what
+        // we've historically done).
+        long timestamp = publicKey.getNotBefore().getTime() + 3600L * 1000;
+        PrivateKey privateKey = CryptoUtils.readPrivateKey(privateIn);
+
+        outputFile = new BufferedOutputStream(new FileOutputStream(output));
+        if (minSign) {
+            signWholeFile(input.getFile(), publicKey, privateKey, outputFile);
+        } else {
+            JarOutputStream outputJar = new JarOutputStream(outputFile);
+            // For signing .apks, use the maximum compression to make
+            // them as small as possible (since they live forever on
+            // the system partition).  For OTA packages, use the
+            // default compression level, which is much much faster
+            // and produces output that is only a tiny bit larger
+            // (~0.1% on full OTA packages I tested).
+            outputJar.setLevel(9);
+            Manifest manifest = addDigestsToManifest(input, hashes);
+            copyFiles(manifest, input, outputJar, timestamp, alignment);
+            signFile(manifest, input, publicKey, privateKey, outputJar);
+            outputJar.close();
+        }
+        input.close();
+        outputFile.close();
+    }
+
+    /**
+     * Return one of USE_SHA1 or USE_SHA256 according to the signature
+     * algorithm specified in the cert.
+     */
+    private static int getDigestAlgorithm(X509Certificate cert) {
+        String sigAlg = cert.getSigAlgName().toUpperCase(Locale.US);
+        if ("SHA1WITHRSA".equals(sigAlg) ||
+                "MD5WITHRSA".equals(sigAlg)) {     // see "HISTORICAL NOTE" above.
+            return USE_SHA1;
+        } else if (sigAlg.startsWith("SHA256WITH")) {
+            return USE_SHA256;
+        } else {
+            throw new IllegalArgumentException("unsupported signature algorithm \"" + sigAlg +
+                    "\" in cert [" + cert.getSubjectDN());
+        }
+    }
+    /** Returns the expected signature algorithm for this key type. */
+    private static String getSignatureAlgorithm(X509Certificate cert) {
+        String sigAlg = cert.getSigAlgName().toUpperCase(Locale.US);
+        String keyType = cert.getPublicKey().getAlgorithm().toUpperCase(Locale.US);
+        if ("RSA".equalsIgnoreCase(keyType)) {
+            if (getDigestAlgorithm(cert) == USE_SHA256) {
+                return "SHA256withRSA";
+            } else {
+                return "SHA1withRSA";
+            }
+        } else if ("EC".equalsIgnoreCase(keyType)) {
+            return "SHA256withECDSA";
+        } else {
+            throw new IllegalArgumentException("unsupported key type: " + keyType);
+        }
+    }
+    // Files matching this pattern are not copied to the output.
+    private static Pattern stripPattern =
+            Pattern.compile("^(META-INF/((.*)[.](SF|RSA|DSA|EC)|com/android/otacert))|(" +
+                    Pattern.quote(JarFile.MANIFEST_NAME) + ")$");
+
+    /**
+     * Add the hash(es) of every file to the manifest, creating it if
+     * necessary.
+     */
+    private static Manifest addDigestsToManifest(JarMap jar, int hashes)
+            throws IOException, GeneralSecurityException {
+        Manifest input = jar.getManifest();
+        Manifest output = new Manifest();
+        Attributes main = output.getMainAttributes();
+        if (input != null) {
+            main.putAll(input.getMainAttributes());
+        } else {
+            main.putValue("Manifest-Version", "1.0");
+            main.putValue("Created-By", "1.0 (Android SignApk)");
+        }
+        MessageDigest md_sha1 = null;
+        MessageDigest md_sha256 = null;
+        if ((hashes & USE_SHA1) != 0) {
+            md_sha1 = MessageDigest.getInstance("SHA1");
+        }
+        if ((hashes & USE_SHA256) != 0) {
+            md_sha256 = MessageDigest.getInstance("SHA256");
+        }
+        byte[] buffer = new byte[4096];
+        int num;
+        // We sort the input entries by name, and add them to the
+        // output manifest in sorted order.  We expect that the output
+        // map will be deterministic.
+        TreeMap<String, JarEntry> byName = new TreeMap<String, JarEntry>();
+        for (Enumeration<JarEntry> e = jar.entries(); e.hasMoreElements(); ) {
+            JarEntry entry = e.nextElement();
+            byName.put(entry.getName(), entry);
+        }
+        for (JarEntry entry: byName.values()) {
+            String name = entry.getName();
+            if (!entry.isDirectory() &&
+                    (stripPattern == null || !stripPattern.matcher(name).matches())) {
+                InputStream data = jar.getInputStream(entry);
+                while ((num = data.read(buffer)) > 0) {
+                    if (md_sha1 != null) md_sha1.update(buffer, 0, num);
+                    if (md_sha256 != null) md_sha256.update(buffer, 0, num);
+                }
+                Attributes attr = null;
+                if (input != null) attr = input.getAttributes(name);
+                attr = attr != null ? new Attributes(attr) : new Attributes();
+                if (md_sha1 != null) {
+                    attr.putValue("SHA1-Digest",
+                            new String(Base64.encode(md_sha1.digest()), "ASCII"));
+                }
+                if (md_sha256 != null) {
+                    attr.putValue("SHA-256-Digest",
+                            new String(Base64.encode(md_sha256.digest()), "ASCII"));
+                }
+                output.getEntries().put(name, attr);
+            }
+        }
+        return output;
+    }
+
+    /** Write to another stream and track how many bytes have been
+     *  written.
+     */
+    private static class CountOutputStream extends FilterOutputStream {
+        private int mCount;
+        public CountOutputStream(OutputStream out) {
+            super(out);
+            mCount = 0;
+        }
+        @Override
+        public void write(int b) throws IOException {
+            super.write(b);
+            mCount++;
+        }
+        @Override
+        public void write(byte[] b, int off, int len) throws IOException {
+            super.write(b, off, len);
+            mCount += len;
+        }
+        public int size() {
+            return mCount;
+        }
+    }
+    /** Write a .SF file with a digest of the specified manifest. */
+    private static void writeSignatureFile(Manifest manifest, OutputStream out,
+                                           int hash)
+            throws IOException, GeneralSecurityException {
+        Manifest sf = new Manifest();
+        Attributes main = sf.getMainAttributes();
+        main.putValue("Signature-Version", "1.0");
+        main.putValue("Created-By", "1.0 (Android SignApk)");
+        MessageDigest md = MessageDigest.getInstance(
+                hash == USE_SHA256 ? "SHA256" : "SHA1");
+        PrintStream print = new PrintStream(
+                new DigestOutputStream(new ByteArrayOutputStream(), md),
+                true, "UTF-8");
+        // Digest of the entire manifest
+        manifest.write(print);
+        print.flush();
+        main.putValue(hash == USE_SHA256 ? "SHA-256-Digest-Manifest" : "SHA1-Digest-Manifest",
+                new String(Base64.encode(md.digest()), "ASCII"));
+        Map<String, Attributes> entries = manifest.getEntries();
+        for (Map.Entry<String, Attributes> entry : entries.entrySet()) {
+            // Digest of the manifest stanza for this entry.
+            print.print("Name: " + entry.getKey() + "\r\n");
+            for (Map.Entry<Object, Object> att : entry.getValue().entrySet()) {
+                print.print(att.getKey() + ": " + att.getValue() + "\r\n");
+            }
+            print.print("\r\n");
+            print.flush();
+            Attributes sfAttr = new Attributes();
+            sfAttr.putValue(hash == USE_SHA256 ? "SHA-256-Digest" : "SHA1-Digest-Manifest",
+                    new String(Base64.encode(md.digest()), "ASCII"));
+            sf.getEntries().put(entry.getKey(), sfAttr);
+        }
+        CountOutputStream cout = new CountOutputStream(out);
+        sf.write(cout);
+        // A bug in the java.util.jar implementation of Android platforms
+        // up to version 1.6 will cause a spurious IOException to be thrown
+        // if the length of the signature file is a multiple of 1024 bytes.
+        // As a workaround, add an extra CRLF in this case.
+        if ((cout.size() % 1024) == 0) {
+            cout.write('\r');
+            cout.write('\n');
+        }
+    }
+    /** Sign data and write the digital signature to 'out'. */
+    private static void writeSignatureBlock(
+            CMSTypedData data, X509Certificate publicKey, PrivateKey privateKey,
+            OutputStream out)
+            throws IOException,
+            CertificateEncodingException,
+            OperatorCreationException,
+            CMSException {
+        ArrayList<X509Certificate> certList = new ArrayList<>(1);
+        certList.add(publicKey);
+        JcaCertStore certs = new JcaCertStore(certList);
+        CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
+        ContentSigner signer = new JcaContentSignerBuilder(getSignatureAlgorithm(publicKey))
+                .setProvider(sBouncyCastleProvider)
+                .build(privateKey);
+        gen.addSignerInfoGenerator(
+                new JcaSignerInfoGeneratorBuilder(
+                        new JcaDigestCalculatorProviderBuilder()
+                                .setProvider(sBouncyCastleProvider)
+                                .build())
+                        .setDirectSignature(true)
+                        .build(signer, publicKey));
+        gen.addCertificates(certs);
+        CMSSignedData sigData = gen.generate(data, false);
+        ASN1InputStream asn1 = new ASN1InputStream(sigData.getEncoded());
+        DEROutputStream dos = new DEROutputStream(out);
+        dos.writeObject(asn1.readObject());
+    }
+    /**
+     * Copy all the files in a manifest from input to output.  We set
+     * the modification times in the output to a fixed time, so as to
+     * reduce variation in the output file and make incremental OTAs
+     * more efficient.
+     */
+    private static void copyFiles(Manifest manifest, JarMap in, JarOutputStream out,
+                                  long timestamp, int alignment) throws IOException {
+        byte[] buffer = new byte[4096];
+        int num;
+        Map<String, Attributes> entries = manifest.getEntries();
+        ArrayList<String> names = new ArrayList<>(entries.keySet());
+        Collections.sort(names);
+        boolean firstEntry = true;
+        long offset = 0L;
+        // We do the copy in two passes -- first copying all the
+        // entries that are STORED, then copying all the entries that
+        // have any other compression flag (which in practice means
+        // DEFLATED).  This groups all the stored entries together at
+        // the start of the file and makes it easier to do alignment
+        // on them (since only stored entries are aligned).
+        for (String name : names) {
+            JarEntry inEntry = in.getJarEntry(name);
+            JarEntry outEntry = null;
+            if (inEntry.getMethod() != JarEntry.STORED) continue;
+            // Preserve the STORED method of the input entry.
+            outEntry = new JarEntry(inEntry);
+            outEntry.setTime(timestamp);
+            // 'offset' is the offset into the file at which we expect
+            // the file data to begin.  This is the value we need to
+            // make a multiple of 'alignement'.
+            offset += JarFile.LOCHDR + outEntry.getName().length();
+            if (firstEntry) {
+                // The first entry in a jar file has an extra field of
+                // four bytes that you can't get rid of; any extra
+                // data you specify in the JarEntry is appended to
+                // these forced four bytes.  This is JAR_MAGIC in
+                // JarOutputStream; the bytes are 0xfeca0000.
+                offset += 4;
+                firstEntry = false;
+            }
+            if (alignment > 0 && (offset % alignment != 0)) {
+                // Set the "extra data" of the entry to between 1 and
+                // alignment-1 bytes, to make the file data begin at
+                // an aligned offset.
+                int needed = alignment - (int)(offset % alignment);
+                outEntry.setExtra(new byte[needed]);
+                offset += needed;
+            }
+            out.putNextEntry(outEntry);
+            InputStream data = in.getInputStream(inEntry);
+            while ((num = data.read(buffer)) > 0) {
+                out.write(buffer, 0, num);
+                offset += num;
+            }
+            out.flush();
+        }
+        // Copy all the non-STORED entries.  We don't attempt to
+        // maintain the 'offset' variable past this point; we don't do
+        // alignment on these entries.
+        for (String name : names) {
+            JarEntry inEntry = in.getJarEntry(name);
+            JarEntry outEntry = null;
+            if (inEntry.getMethod() == JarEntry.STORED) continue;
+            // Create a new entry so that the compressed len is recomputed.
+            outEntry = new JarEntry(name);
+            outEntry.setTime(timestamp);
+            out.putNextEntry(outEntry);
+            InputStream data = in.getInputStream(inEntry);
+            while ((num = data.read(buffer)) > 0) {
+                out.write(buffer, 0, num);
+            }
+            out.flush();
+        }
+    }
+
+    // This class is to provide a file's content, but trimming out the last two bytes
+    // Used for signWholeFile
+    private static class CMSProcessableFile implements CMSTypedData {
+
+        private ASN1ObjectIdentifier type;
+        private RandomAccessFile file;
+
+        CMSProcessableFile(File file) throws FileNotFoundException {
+            this.file = new RandomAccessFile(file, "r");
+            type = new ASN1ObjectIdentifier(CMSObjectIdentifiers.data.getId());
+        }
+
+        @Override
+        public ASN1ObjectIdentifier getContentType() {
+            return type;
+        }
+
+        @Override
+        public void write(OutputStream out) throws IOException, CMSException {
+            file.seek(0);
+            int read;
+            byte buffer[] = new byte[4096];
+            int len = (int) file.length() - 2;
+            while ((read = file.read(buffer, 0, len < buffer.length ? len : buffer.length)) > 0) {
+                out.write(buffer, 0, read);
+                len -= read;
+            }
+        }
+
+        @Override
+        public Object getContent() {
+            return file;
+        }
+
+        byte[] getTail() throws IOException {
+            byte tail[] = new byte[22];
+            file.seek(file.length() - 22);
+            file.readFully(tail);
+            return tail;
+        }
+    }
+
+    private static void signWholeFile(File input, X509Certificate publicKey,
+                                      PrivateKey privateKey, OutputStream outputStream)
+            throws Exception {
+        ByteArrayOutputStream temp = new ByteArrayOutputStream();
+        // put a readable message and a null char at the start of the
+        // archive comment, so that tools that display the comment
+        // (hopefully) show something sensible.
+        // TODO: anything more useful we can put in this message?
+        byte[] message = "signed by SignApk".getBytes("UTF-8");
+        temp.write(message);
+        temp.write(0);
+
+        CMSProcessableFile cmsFile = new CMSProcessableFile(input);
+        writeSignatureBlock(cmsFile, publicKey, privateKey, temp);
+
+        // For a zip with no archive comment, the
+        // end-of-central-directory record will be 22 bytes long, so
+        // we expect to find the EOCD marker 22 bytes from the end.
+        byte[] zipData = cmsFile.getTail();
+        if (zipData[zipData.length-22] != 0x50 ||
+                zipData[zipData.length-21] != 0x4b ||
+                zipData[zipData.length-20] != 0x05 ||
+                zipData[zipData.length-19] != 0x06) {
+            throw new IllegalArgumentException("zip data already has an archive comment");
+        }
+        int total_size = temp.size() + 6;
+        if (total_size > 0xffff) {
+            throw new IllegalArgumentException("signature is too big for ZIP file comment");
+        }
+        // signature starts this many bytes from the end of the file
+        int signature_start = total_size - message.length - 1;
+        temp.write(signature_start & 0xff);
+        temp.write((signature_start >> 8) & 0xff);
+        // Why the 0xff bytes?  In a zip file with no archive comment,
+        // bytes [-6:-2] of the file are the little-endian offset from
+        // the start of the file to the central directory.  So for the
+        // two high bytes to be 0xff 0xff, the archive would have to
+        // be nearly 4GB in size.  So it's unlikely that a real
+        // commentless archive would have 0xffs here, and lets us tell
+        // an old signed archive from a new one.
+        temp.write(0xff);
+        temp.write(0xff);
+        temp.write(total_size & 0xff);
+        temp.write((total_size >> 8) & 0xff);
+        temp.flush();
+        // Signature verification checks that the EOCD header is the
+        // last such sequence in the file (to avoid minzip finding a
+        // fake EOCD appended after the signature in its scan).  The
+        // odds of producing this sequence by chance are very low, but
+        // let's catch it here if it does.
+        byte[] b = temp.toByteArray();
+        for (int i = 0; i < b.length-3; ++i) {
+            if (b[i] == 0x50 && b[i+1] == 0x4b && b[i+2] == 0x05 && b[i+3] == 0x06) {
+                throw new IllegalArgumentException("found spurious EOCD header at " + i);
+            }
+        }
+        cmsFile.write(outputStream);
+        outputStream.write(total_size & 0xff);
+        outputStream.write((total_size >> 8) & 0xff);
+        temp.writeTo(outputStream);
+    }
+    private static void signFile(Manifest manifest, JarMap inputJar,
+                                 X509Certificate publicKey, PrivateKey privateKey,
+                                 JarOutputStream outputJar)
+            throws Exception {
+        // Assume the certificate is valid for at least an hour.
+        long timestamp = publicKey.getNotBefore().getTime() + 3600L * 1000;
+        // MANIFEST.MF
+        JarEntry je = new JarEntry(JarFile.MANIFEST_NAME);
+        je.setTime(timestamp);
+        outputJar.putNextEntry(je);
+        manifest.write(outputJar);
+        je = new JarEntry(CERT_SF_NAME);
+        je.setTime(timestamp);
+        outputJar.putNextEntry(je);
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        writeSignatureFile(manifest, baos, getDigestAlgorithm(publicKey));
+        byte[] signedData = baos.toByteArray();
+        outputJar.write(signedData);
+        // CERT.{EC,RSA} / CERT#.{EC,RSA}
+        final String keyType = publicKey.getPublicKey().getAlgorithm();
+        je = new JarEntry(String.format(CERT_SIG_NAME, keyType));
+        je.setTime(timestamp);
+        outputJar.putNextEntry(je);
+        writeSignatureBlock(new CMSProcessableByteArray(signedData),
+                publicKey, privateKey, outputJar);
+    }
+}

crypto/src/main/java/com/topjohnwu/crypto/SignBoot.java

@@ -0,0 +1,231 @@
+package com.topjohnwu.crypto;
+
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1Integer;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DEROctetString;
+import org.bouncycastle.asn1.DERPrintableString;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.Security;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+
+public class SignBoot {
+
+    static {
+        Security.addProvider(new BouncyCastleProvider());
+    }
+
+    public static boolean doSignature(String target, InputStream imgIn, OutputStream imgOut,
+                                   InputStream keyIn, InputStream certIn) {
+        try {
+            ByteArrayStream bas = new ByteArrayStream();
+            bas.readFrom(imgIn);
+            byte[] image = bas.toByteArray();
+            bas.close();
+            int signableSize = getSignableImageSize(image);
+            if (signableSize < image.length) {
+                System.err.println("NOTE: truncating input from " +
+                        image.length + " to " + signableSize + " bytes");
+                image = Arrays.copyOf(image, signableSize);
+            } else if (signableSize > image.length) {
+                throw new IllegalArgumentException("Invalid image: too short, expected " +
+                        signableSize + " bytes");
+            }
+            BootSignature bootsig = new BootSignature(target, image.length);
+            X509Certificate cert = CryptoUtils.readPublicKey(certIn);
+            bootsig.setCertificate(cert);
+            PrivateKey key = CryptoUtils.readPrivateKey(keyIn);
+            bootsig.setSignature(bootsig.sign(image, key),
+                    CryptoUtils.getSignatureAlgorithmIdentifier(key));
+            byte[] encoded_bootsig = bootsig.getEncoded();
+            imgOut.write(image);
+            imgOut.write(encoded_bootsig);
+            imgOut.flush();
+            return true;
+        } catch (Exception e) {
+            e.printStackTrace(System.err);
+            return false;
+        }
+    }
+
+    public static boolean verifySignature(InputStream imgIn, InputStream certPath) {
+        try {
+            ByteArrayStream bas = new ByteArrayStream();
+            bas.readFrom(imgIn);
+            byte[] image = bas.toByteArray();
+            bas.close();
+            int signableSize = getSignableImageSize(image);
+            if (signableSize >= image.length) {
+                System.err.println("Invalid image: not signed");
+                return false;
+            }
+            byte[] signature = Arrays.copyOfRange(image, signableSize, image.length);
+            BootSignature bootsig = new BootSignature(signature);
+            if (certPath != null) {
+                bootsig.setCertificate(CryptoUtils.readPublicKey(certPath));
+            }
+            if (bootsig.verify(Arrays.copyOf(image, signableSize))) {
+                System.err.println("Signature is VALID");
+                return true;
+            } else {
+                System.err.println("Signature is INVALID");
+            }
+        } catch (Exception e) {
+            e.printStackTrace(System.err);
+            System.err.println("Invalid image: not signed");
+        }
+        return false;
+    }
+
+    public static int getSignableImageSize(byte[] data) throws Exception {
+        if (!Arrays.equals(Arrays.copyOfRange(data, 0, 8),
+                "ANDROID!".getBytes("US-ASCII"))) {
+            throw new IllegalArgumentException("Invalid image header: missing magic");
+        }
+        ByteBuffer image = ByteBuffer.wrap(data);
+        image.order(ByteOrder.LITTLE_ENDIAN);
+        image.getLong(); // magic
+        int kernelSize = image.getInt();
+        image.getInt(); // kernel_addr
+        int ramdskSize = image.getInt();
+        image.getInt(); // ramdisk_addr
+        int secondSize = image.getInt();
+        image.getLong(); // second_addr + tags_addr
+        int pageSize = image.getInt();
+        int length = pageSize // include the page aligned image header
+                + ((kernelSize + pageSize - 1) / pageSize) * pageSize
+                + ((ramdskSize + pageSize - 1) / pageSize) * pageSize
+                + ((secondSize + pageSize - 1) / pageSize) * pageSize;
+        length = ((length + pageSize - 1) / pageSize) * pageSize;
+        if (length <= 0) {
+            throw new IllegalArgumentException("Invalid image header: invalid length");
+        }
+        return length;
+    }
+
+    static class BootSignature extends ASN1Object {
+        private ASN1Integer formatVersion;
+        private ASN1Encodable certificate;
+        private AlgorithmIdentifier algorithmIdentifier;
+        private DERPrintableString target;
+        private ASN1Integer length;
+        private DEROctetString signature;
+        private PublicKey publicKey;
+        private static final int FORMAT_VERSION = 1;
+
+        /**
+         * Initializes the object for signing an image file
+         * @param target Target name, included in the signed data
+         * @param length Length of the image, included in the signed data
+         */
+        public BootSignature(String target, int length) {
+            this.formatVersion = new ASN1Integer(FORMAT_VERSION);
+            this.target = new DERPrintableString(target);
+            this.length = new ASN1Integer(length);
+        }
+
+        /**
+         * Initializes the object for verifying a signed image file
+         * @param signature Signature footer
+         */
+        public BootSignature(byte[] signature)
+                throws Exception {
+            ASN1InputStream stream = new ASN1InputStream(signature);
+            ASN1Sequence sequence = (ASN1Sequence) stream.readObject();
+            formatVersion = (ASN1Integer) sequence.getObjectAt(0);
+            if (formatVersion.getValue().intValue() != FORMAT_VERSION) {
+                throw new IllegalArgumentException("Unsupported format version");
+            }
+            certificate = sequence.getObjectAt(1);
+            byte[] encoded = ((ASN1Object) certificate).getEncoded();
+            ByteArrayInputStream bis = new ByteArrayInputStream(encoded);
+            CertificateFactory cf = CertificateFactory.getInstance("X.509");
+            X509Certificate c = (X509Certificate) cf.generateCertificate(bis);
+            publicKey = c.getPublicKey();
+            ASN1Sequence algId = (ASN1Sequence) sequence.getObjectAt(2);
+            algorithmIdentifier = new AlgorithmIdentifier(
+                    (ASN1ObjectIdentifier) algId.getObjectAt(0));
+            ASN1Sequence attrs = (ASN1Sequence) sequence.getObjectAt(3);
+            target = (DERPrintableString) attrs.getObjectAt(0);
+            length = (ASN1Integer) attrs.getObjectAt(1);
+            this.signature = (DEROctetString) sequence.getObjectAt(4);
+        }
+
+        public ASN1Object getAuthenticatedAttributes() {
+            ASN1EncodableVector attrs = new ASN1EncodableVector();
+            attrs.add(target);
+            attrs.add(length);
+            return new DERSequence(attrs);
+        }
+
+        public byte[] getEncodedAuthenticatedAttributes() throws IOException {
+            return getAuthenticatedAttributes().getEncoded();
+        }
+
+        public void setSignature(byte[] sig, AlgorithmIdentifier algId) {
+            algorithmIdentifier = algId;
+            signature = new DEROctetString(sig);
+        }
+
+        public void setCertificate(X509Certificate cert)
+                throws Exception, IOException, CertificateEncodingException {
+            ASN1InputStream s = new ASN1InputStream(cert.getEncoded());
+            certificate = s.readObject();
+            publicKey = cert.getPublicKey();
+        }
+
+        public byte[] generateSignableImage(byte[] image) throws IOException {
+            byte[] attrs = getEncodedAuthenticatedAttributes();
+            byte[] signable = Arrays.copyOf(image, image.length + attrs.length);
+            for (int i=0; i < attrs.length; i++) {
+                signable[i+image.length] = attrs[i];
+            }
+            return signable;
+        }
+
+        public byte[] sign(byte[] image, PrivateKey key) throws Exception {
+            byte[] signable = generateSignableImage(image);
+            return CryptoUtils.sign(key, signable);
+        }
+
+        public boolean verify(byte[] image) throws Exception {
+            if (length.getValue().intValue() != image.length) {
+                throw new IllegalArgumentException("Invalid image length");
+            }
+            byte[] signable = generateSignableImage(image);
+            return CryptoUtils.verify(publicKey, signable, signature.getOctets(),
+                    algorithmIdentifier);
+        }
+
+        @Override
+        public ASN1Primitive toASN1Primitive() {
+            ASN1EncodableVector v = new ASN1EncodableVector();
+            v.add(formatVersion);
+            v.add(certificate);
+            v.add(algorithmIdentifier);
+            v.add(getAuthenticatedAttributes());
+            v.add(signature);
+            return new DERSequence(v);
+        }
+
+    }
+}

crypto/src/main/java/com/topjohnwu/crypto/ZipSigner.java

@@ -0,0 +1,42 @@
+package com.topjohnwu.crypto;
+
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.InputStream;
+import java.security.Security;
+
+public class ZipSigner {
+    public static void main(String[] args) {
+        boolean minSign = false;
+        int argStart = 0;
+
+        if (args.length < 4) {
+            System.err.println("Usage: zipsigner [-m] publickey.x509[.pem] privatekey.pk8 input.jar output.jar");
+            System.exit(2);
+        }
+
+        if (args[0].equals("-m")) {
+            minSign = true;
+            argStart = 1;
+        }
+
+        SignAPK.sBouncyCastleProvider = new BouncyCastleProvider();
+        Security.insertProviderAt(SignAPK.sBouncyCastleProvider, 1);
+
+        File pubKey = new File(args[argStart]);
+        File privKey = new File(args[argStart + 1]);
+        File input = new File(args[argStart + 2]);
+        File output = new File(args[argStart + 3]);
+
+        try (InputStream pub = new FileInputStream(pubKey);
+             InputStream priv = new FileInputStream(privKey);
+             JarMap jar = new JarMap(input, false)) {
+            SignAPK.signZip(pub, priv, jar, output, minSign);
+        } catch (Exception e) {
+            e.printStackTrace();
+            System.exit(1);
+        }
+    }
+}