Restructure project

2025-10-16 11:50:14 +00:00 · 2020-07-04 04:09:19 -07:00
parent 9348c5bad9
commit 67f7935421
40 changed files with 7 additions and 6 deletions
--- a/app/build.gradle
+++ b/app/build.gradle
@@ -69,8 +69,8 @@ androidExtensions {

 dependencies {
    implementation fileTree(include: ['*.jar'], dir: 'libs')
-    implementation project(':shared')
-    implementation project(':signing')
+    implementation project(':app:shared')
+    implementation project(':app:signing')

    implementation 'com.github.topjohnwu:jtar:1.0.0'
    implementation 'com.jakewharton.timber:timber:4.7.1'
--- a/app/shared/.gitignore
+++ b/app/shared/.gitignore
@@ -0,0 +1 @@
+/build
--- a/app/shared/build.gradle
+++ b/app/shared/build.gradle
@@ -0,0 +1,12 @@
+apply plugin: 'com.android.library'
+
+android {
+    defaultConfig {
+        vectorDrawables.useSupportLibrary = true
+        consumerProguardFiles 'proguard-rules.pro'
+    }
+}
+
+dependencies {
+    implementation fileTree(dir: 'libs', include: ['*.jar'])
+}
--- a/app/shared/proguard-rules.pro
+++ b/app/shared/proguard-rules.pro
@@ -0,0 +1,25 @@
+# Add project specific ProGuard rules here.
+# You can control the set of applied configuration files using the
+# proguardFiles setting in build.gradle.
+#
+# For more details, see
+#   http://developer.android.com/guide/developing/tools/proguard.html
+
+# If your project uses WebView with JS, uncomment the following
+# and specify the fully qualified class name to the JavaScript interface
+# class:
+#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
+#   public *;
+#}
+
+# Uncomment this to preserve the line number information for
+# debugging stack traces.
+#-keepattributes SourceFile,LineNumberTable
+
+# If you keep the line number information, uncomment this to
+# hide the original source file name.
+#-renamesourcefileattribute SourceFile
+
+-keepclassmembers class * extends javax.net.ssl.SSLSocketFactory {
+    ** delegate;
+}
--- a/app/shared/src/main/AndroidManifest.xml
+++ b/app/shared/src/main/AndroidManifest.xml
@@ -0,0 +1,25 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    package="com.topjohnwu.shared">
+
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
+    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
+
+    <application
+        android:icon="@drawable/ic_launcher"
+        android:label="Magisk Manager"
+        android:installLocation="internalOnly"
+        android:usesCleartextTraffic="true"
+        android:supportsRtl="true"
+        android:theme="@android:style/Theme.Translucent.NoTitleBar"
+        tools:ignore="UnusedAttribute">
+
+        <provider
+            android:name="a.p"
+            android:authorities="${applicationId}.provider"
+            android:exported="false"
+            android:grantUriPermissions="true">
+        </provider>
+    </application>
+</manifest>
--- a/app/shared/src/main/java/a/p.java
+++ b/app/shared/src/main/java/a/p.java
@@ -0,0 +1,7 @@
+package a;
+
+import com.topjohnwu.magisk.FileProvider;
+
+public class p extends FileProvider {
+    /* Stub */
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/DynAPK.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/DynAPK.java
@@ -0,0 +1,68 @@
+package com.topjohnwu.magisk;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import java.io.File;
+import java.lang.reflect.Method;
+import java.util.Map;
+
+import static android.os.Build.VERSION.SDK_INT;
+
+public class DynAPK {
+
+    // Indices of the object array
+    private static final int STUB_VERSION_ENTRY = 0;
+    private static final int CLASS_COMPONENT_MAP = 1;
+
+    private static File dynDir;
+    private static Method addAssetPath;
+
+    private static File getDynDir(Context c) {
+        if (dynDir == null) {
+            if (SDK_INT >= 24) {
+                // Use protected context to allow directBootAware
+                c = c.createDeviceProtectedStorageContext();
+            }
+            dynDir = new File(c.getFilesDir().getParent(), "dyn");
+            dynDir.mkdir();
+        }
+        return dynDir;
+    }
+
+    public static File current(Context c) {
+        return new File(getDynDir(c), "current.apk");
+    }
+
+    public static File update(Context c) {
+        return new File(getDynDir(c), "update.apk");
+    }
+
+    public static Data load(Object o) {
+        Object[] arr = (Object[]) o;
+        Data data = new Data();
+        data.version = (int) arr[STUB_VERSION_ENTRY];
+        data.classToComponent = (Map<String, String>) arr[CLASS_COMPONENT_MAP];
+        return data;
+    }
+
+    public static Object pack(Data data) {
+        Object[] arr = new Object[2];
+        arr[STUB_VERSION_ENTRY] = data.version;
+        arr[CLASS_COMPONENT_MAP] = data.classToComponent;
+        return arr;
+    }
+
+    public static void addAssetPath(AssetManager asset, String path) {
+        try {
+            if (addAssetPath == null)
+                addAssetPath = AssetManager.class.getMethod("addAssetPath", String.class);
+            addAssetPath.invoke(asset, path);
+        } catch (Exception ignored) {}
+    }
+
+    public static class Data {
+        public int version;
+        public Map<String, String> classToComponent;
+    }
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/FileProvider.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/FileProvider.java
@@ -0,0 +1,351 @@
+package com.topjohnwu.magisk;
+
+import android.content.ContentProvider;
+import android.content.ContentValues;
+import android.content.Context;
+import android.content.pm.ProviderInfo;
+import android.database.Cursor;
+import android.database.MatrixCursor;
+import android.net.Uri;
+import android.os.Build;
+import android.os.Bundle;
+import android.os.Environment;
+import android.os.ParcelFileDescriptor;
+import android.provider.OpenableColumns;
+import android.text.TextUtils;
+import android.webkit.MimeTypeMap;
+
+import java.io.File;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Modified from androidx.core.content.FileProvider
+ */
+public class FileProvider extends ContentProvider {
+    private static final String[] COLUMNS = {
+            OpenableColumns.DISPLAY_NAME, OpenableColumns.SIZE };
+
+    private static final File DEVICE_ROOT = new File("/");
+
+    private static HashMap<String, PathStrategy> sCache = new HashMap<>();
+
+    private PathStrategy mStrategy;
+
+    public static ProviderCallHandler callHandler;
+
+    @Override
+    public boolean onCreate() {
+        return true;
+    }
+
+    @Override
+    public void attachInfo(Context context, ProviderInfo info) {
+        super.attachInfo(context, info);
+
+        
+        if (info.exported) {
+            throw new SecurityException("Provider must not be exported");
+        }
+        if (!info.grantUriPermissions) {
+            throw new SecurityException("Provider must grant uri permissions");
+        }
+
+        mStrategy = getPathStrategy(context, info.authority);
+    }
+
+    
+    public static Uri getUriForFile(Context context, String authority,
+                                    File file) {
+        final PathStrategy strategy = getPathStrategy(context, authority);
+        return strategy.getUriForFile(file);
+    }
+
+    @Override
+    public Cursor query(Uri uri, String[] projection, String selection,
+                        String[] selectionArgs,
+                        String sortOrder) {
+        
+        final File file = mStrategy.getFileForUri(uri);
+
+        if (projection == null) {
+            projection = COLUMNS;
+        }
+
+        String[] cols = new String[projection.length];
+        Object[] values = new Object[projection.length];
+        int i = 0;
+        for (String col : projection) {
+            if (OpenableColumns.DISPLAY_NAME.equals(col)) {
+                cols[i] = OpenableColumns.DISPLAY_NAME;
+                values[i++] = file.getName();
+            } else if (OpenableColumns.SIZE.equals(col)) {
+                cols[i] = OpenableColumns.SIZE;
+                values[i++] = file.length();
+            }
+        }
+
+        cols = copyOf(cols, i);
+        values = copyOf(values, i);
+
+        final MatrixCursor cursor = new MatrixCursor(cols, 1);
+        cursor.addRow(values);
+        return cursor;
+    }
+
+    @Override
+    public String getType(Uri uri) {
+        
+        final File file = mStrategy.getFileForUri(uri);
+
+        final int lastDot = file.getName().lastIndexOf('.');
+        if (lastDot >= 0) {
+            final String extension = file.getName().substring(lastDot + 1);
+            final String mime = MimeTypeMap.getSingleton().getMimeTypeFromExtension(extension);
+            if (mime != null) {
+                return mime;
+            }
+        }
+
+        return "application/octet-stream";
+    }
+
+    @Override
+    public Uri insert(Uri uri, ContentValues values) {
+        throw new UnsupportedOperationException("No external inserts");
+    }
+
+    @Override
+    public int update(Uri uri, ContentValues values, String selection,
+                      String[] selectionArgs) {
+        throw new UnsupportedOperationException("No external updates");
+    }
+
+    @Override
+    public int delete(Uri uri, String selection,
+                      String[] selectionArgs) {
+        
+        final File file = mStrategy.getFileForUri(uri);
+        return file.delete() ? 1 : 0;
+    }
+
+    @Override
+    public Bundle call(String method, String arg, Bundle extras) {
+        if (callHandler != null)
+            return callHandler.call(getContext(), method, arg, extras);
+        return Bundle.EMPTY;
+    }
+
+    @Override
+    public ParcelFileDescriptor openFile(Uri uri, String mode)
+            throws FileNotFoundException {
+        
+        final File file = mStrategy.getFileForUri(uri);
+        final int fileMode = modeToMode(mode);
+        return ParcelFileDescriptor.open(file, fileMode);
+    }
+
+    private static PathStrategy getPathStrategy(Context context, String authority) {
+        PathStrategy strat;
+        synchronized (sCache) {
+            strat = sCache.get(authority);
+            if (strat == null) {
+                strat = createPathStrategy(context, authority);
+                sCache.put(authority, strat);
+            }
+        }
+        return strat;
+    }
+
+    private static PathStrategy createPathStrategy(Context context, String authority) {
+        final SimplePathStrategy strat = new SimplePathStrategy(authority);
+
+        strat.addRoot("root_files", buildPath(DEVICE_ROOT, "."));
+        strat.addRoot("internal_files", buildPath(context.getFilesDir(), "."));
+        strat.addRoot("cache_files", buildPath(context.getCacheDir(), "."));
+        strat.addRoot("external_files", buildPath(Environment.getExternalStorageDirectory(), "."));
+        {
+            File[] externalFilesDirs = getExternalFilesDirs(context, null);
+            if (externalFilesDirs.length > 0) {
+                strat.addRoot("external_file_files", buildPath(externalFilesDirs[0], "."));
+            }
+        }
+        {
+            File[] externalCacheDirs = getExternalCacheDirs(context);
+            if (externalCacheDirs.length > 0) {
+                strat.addRoot("external_cache_files", buildPath(externalCacheDirs[0], "."));
+            }
+        }
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
+            File[] externalMediaDirs = context.getExternalMediaDirs();
+            if (externalMediaDirs.length > 0) {
+                strat.addRoot("external_media_files", buildPath(externalMediaDirs[0], "."));
+            }
+        }
+
+        return strat;
+    }
+
+    interface PathStrategy {
+        
+        Uri getUriForFile(File file);
+
+        File getFileForUri(Uri uri);
+    }
+
+    static class SimplePathStrategy implements PathStrategy {
+        private final String mAuthority;
+        private final HashMap<String, File> mRoots = new HashMap<>();
+
+        SimplePathStrategy(String authority) {
+            mAuthority = authority;
+        }
+
+        void addRoot(String name, File root) {
+            if (TextUtils.isEmpty(name)) {
+                throw new IllegalArgumentException("Name must not be empty");
+            }
+
+            try {
+                
+                root = root.getCanonicalFile();
+            } catch (IOException e) {
+                throw new IllegalArgumentException(
+                        "Failed to resolve canonical path for " + root, e);
+            }
+
+            mRoots.put(name, root);
+        }
+
+        @Override
+        public Uri getUriForFile(File file) {
+            String path;
+            try {
+                path = file.getCanonicalPath();
+            } catch (IOException e) {
+                throw new IllegalArgumentException("Failed to resolve canonical path for " + file);
+            }
+
+            
+            Map.Entry<String, File> mostSpecific = null;
+            for (Map.Entry<String, File> root : mRoots.entrySet()) {
+                final String rootPath = root.getValue().getPath();
+                if (path.startsWith(rootPath) && (mostSpecific == null
+                        || rootPath.length() > mostSpecific.getValue().getPath().length())) {
+                    mostSpecific = root;
+                }
+            }
+
+            if (mostSpecific == null) {
+                throw new IllegalArgumentException(
+                        "Failed to find configured root that contains " + path);
+            }
+
+            
+            final String rootPath = mostSpecific.getValue().getPath();
+            if (rootPath.endsWith("/")) {
+                path = path.substring(rootPath.length());
+            } else {
+                path = path.substring(rootPath.length() + 1);
+            }
+
+            
+            path = Uri.encode(mostSpecific.getKey()) + '/' + Uri.encode(path, "/");
+            return new Uri.Builder().scheme("content")
+                    .authority(mAuthority).encodedPath(path).build();
+        }
+
+        @Override
+        public File getFileForUri(Uri uri) {
+            String path = uri.getEncodedPath();
+
+            final int splitIndex = path.indexOf('/', 1);
+            final String tag = Uri.decode(path.substring(1, splitIndex));
+            path = Uri.decode(path.substring(splitIndex + 1));
+
+            final File root = mRoots.get(tag);
+            if (root == null) {
+                throw new IllegalArgumentException("Unable to find configured root for " + uri);
+            }
+
+            File file = new File(root, path);
+            try {
+                file = file.getCanonicalFile();
+            } catch (IOException e) {
+                throw new IllegalArgumentException("Failed to resolve canonical path for " + file);
+            }
+
+            if (!file.getPath().startsWith(root.getPath())) {
+                throw new SecurityException("Resolved path jumped beyond configured root");
+            }
+
+            return file;
+        }
+    }
+
+    
+    private static int modeToMode(String mode) {
+        int modeBits;
+        if ("r".equals(mode)) {
+            modeBits = ParcelFileDescriptor.MODE_READ_ONLY;
+        } else if ("w".equals(mode) || "wt".equals(mode)) {
+            modeBits = ParcelFileDescriptor.MODE_WRITE_ONLY
+                    | ParcelFileDescriptor.MODE_CREATE
+                    | ParcelFileDescriptor.MODE_TRUNCATE;
+        } else if ("wa".equals(mode)) {
+            modeBits = ParcelFileDescriptor.MODE_WRITE_ONLY
+                    | ParcelFileDescriptor.MODE_CREATE
+                    | ParcelFileDescriptor.MODE_APPEND;
+        } else if ("rw".equals(mode)) {
+            modeBits = ParcelFileDescriptor.MODE_READ_WRITE
+                    | ParcelFileDescriptor.MODE_CREATE;
+        } else if ("rwt".equals(mode)) {
+            modeBits = ParcelFileDescriptor.MODE_READ_WRITE
+                    | ParcelFileDescriptor.MODE_CREATE
+                    | ParcelFileDescriptor.MODE_TRUNCATE;
+        } else {
+            throw new IllegalArgumentException("Invalid mode: " + mode);
+        }
+        return modeBits;
+    }
+
+    private static File buildPath(File base, String... segments) {
+        File cur = base;
+        for (String segment : segments) {
+            if (segment != null) {
+                cur = new File(cur, segment);
+            }
+        }
+        return cur;
+    }
+
+    private static String[] copyOf(String[] original, int newLength) {
+        final String[] result = new String[newLength];
+        System.arraycopy(original, 0, result, 0, newLength);
+        return result;
+    }
+
+    private static Object[] copyOf(Object[] original, int newLength) {
+        final Object[] result = new Object[newLength];
+        System.arraycopy(original, 0, result, 0, newLength);
+        return result;
+    }
+
+    private static File[] getExternalFilesDirs(Context context, String type) {
+        if (Build.VERSION.SDK_INT >= 19) {
+            return context.getExternalFilesDirs(type);
+        } else {
+            return new File[] { context.getExternalFilesDir(type) };
+        }
+    }
+
+    private static File[] getExternalCacheDirs(Context context) {
+        if (Build.VERSION.SDK_INT >= 19) {
+            return context.getExternalCacheDirs();
+        } else {
+            return new File[] { context.getExternalCacheDir() };
+        }
+    }
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/ProcessPhoenix.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/ProcessPhoenix.java
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2014 Jake Wharton
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.topjohnwu.magisk;
+
+import android.app.Activity;
+import android.content.Context;
+import android.content.Intent;
+import android.os.Bundle;
+
+import java.util.ArrayList;
+
+import static android.content.Intent.FLAG_ACTIVITY_CLEAR_TASK;
+import static android.content.Intent.FLAG_ACTIVITY_NEW_TASK;
+
+/**
+ * Modified from JakeWharton/ProcessPhoenix
+ *
+ * Process Phoenix facilitates restarting your application process. This should only be used for
+ * things like fundamental state changes in your debug builds (e.g., changing from staging to
+ * production).
+ * <p>
+ * Trigger process recreation by calling {@link #triggerRebirth} with a {@link Context} instance.
+ */
+public class ProcessPhoenix extends Activity {
+    private static final String KEY_RESTART_INTENT = "phoenix_restart_intent";
+
+    public static void triggerRebirth(Context context, Intent intent) {
+        intent.addFlags(FLAG_ACTIVITY_NEW_TASK); // In case we are called with non-Activity context.
+        intent.putExtra(KEY_RESTART_INTENT, getRestartIntent(context));
+        context.startActivity(intent);
+        if (context instanceof Activity) {
+            ((Activity) context).finish();
+        }
+        Runtime.getRuntime().exit(0);
+    }
+
+    private static Intent getRestartIntent(Context context) {
+        String packageName = context.getPackageName();
+        Intent defaultIntent = context.getPackageManager().getLaunchIntentForPackage(packageName);
+        if (defaultIntent != null) {
+            defaultIntent.addFlags(FLAG_ACTIVITY_NEW_TASK | FLAG_ACTIVITY_CLEAR_TASK);
+            return defaultIntent;
+        }
+
+        throw new IllegalStateException();
+    }
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+
+        Intent intent = getIntent().getParcelableExtra(KEY_RESTART_INTENT);
+        startActivity(intent);
+        finish();
+        Runtime.getRuntime().exit(0);
+    }
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/ProviderCallHandler.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/ProviderCallHandler.java
@@ -0,0 +1,8 @@
+package com.topjohnwu.magisk;
+
+import android.content.Context;
+import android.os.Bundle;
+
+public interface ProviderCallHandler {
+    Bundle call(Context context, String method, String arg, Bundle extras);
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/net/BadRequest.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/net/BadRequest.java
@@ -0,0 +1,50 @@
+package com.topjohnwu.magisk.net;
+
+import org.json.JSONArray;
+import org.json.JSONObject;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+
+class BadRequest extends Request {
+
+    private IOException ex;
+
+    BadRequest(IOException e) { super(null); ex = e; }
+
+    @Override
+    public Request addHeaders(String key, String value) { return this; }
+
+    @Override
+    public Result<InputStream> execForInputStream() { fail(); return new Result<>(); }
+
+    @Override
+    public void getAsFile(File out, ResponseListener<File> rs) { fail(); }
+
+    @Override
+    public void execForFile(File out) { fail(); }
+
+    @Override
+    public void getAsString(ResponseListener<String> rs) { fail(); }
+
+    @Override
+    public Result<String> execForString() { fail(); return new Result<>(); }
+
+    @Override
+    public void getAsJSONObject(ResponseListener<JSONObject> rs) { fail(); }
+
+    @Override
+    public Result<JSONObject> execForJSONObject() { fail(); return new Result<>(); }
+
+    @Override
+    public void getAsJSONArray(ResponseListener<JSONArray> rs) { fail(); }
+
+    @Override
+    public Result<JSONArray> execForJSONArray() { fail(); return new Result<>(); }
+
+    private void fail() {
+        if (err != null)
+            err.onError(null, ex);
+    }
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/net/ErrorHandler.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/net/ErrorHandler.java
@@ -0,0 +1,7 @@
+package com.topjohnwu.magisk.net;
+
+import java.net.HttpURLConnection;
+
+public interface ErrorHandler {
+    void onError(HttpURLConnection conn, Exception e);
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/net/Networking.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/net/Networking.java
@@ -0,0 +1,64 @@
+package com.topjohnwu.magisk.net;
+
+import android.content.Context;
+import android.net.ConnectivityManager;
+import android.net.NetworkInfo;
+import android.os.Build;
+import android.os.Handler;
+import android.os.Looper;
+
+import java.io.IOException;
+import java.net.HttpURLConnection;
+import java.net.URL;
+
+import javax.net.ssl.HttpsURLConnection;
+
+public class Networking {
+
+    private static final int READ_TIMEOUT = 15000;
+    private static final int CONNECT_TIMEOUT = 15000;
+    static Handler mainHandler = new Handler(Looper.getMainLooper());
+
+    private static Request request(String url, String method) {
+        try {
+            HttpURLConnection conn = (HttpURLConnection) new URL(url).openConnection();
+            conn.setRequestMethod(method);
+            conn.setReadTimeout(READ_TIMEOUT);
+            conn.setConnectTimeout(CONNECT_TIMEOUT);
+            return new Request(conn);
+        } catch (IOException e) {
+            return new BadRequest(e);
+        }
+    }
+
+    public static Request get(String url) {
+        return request(url, "GET");
+    }
+
+    public static boolean init(Context context) {
+        try {
+            // Try installing new SSL provider from Google Play Service
+            Context gms = context.createPackageContext("com.google.android.gms",
+                    Context.CONTEXT_INCLUDE_CODE | Context.CONTEXT_IGNORE_SECURITY);
+            gms.getClassLoader()
+                    .loadClass("com.google.android.gms.common.security.ProviderInstallerImpl")
+                    .getMethod("insertProvider", Context.class)
+                    .invoke(null, gms);
+        } catch (Exception e) {
+            if (Build.VERSION.SDK_INT < 21) {
+                // Failed to update SSL provider, use NoSSLv3SocketFactory on SDK < 21
+                // and return false to notify potential issues
+                HttpsURLConnection.setDefaultSSLSocketFactory(new NoSSLv3SocketFactory());
+                return false;
+            }
+        }
+        return true;
+    }
+
+    public static boolean checkNetworkStatus(Context context) {
+        ConnectivityManager manager = (ConnectivityManager)
+                context.getSystemService(Context.CONNECTIVITY_SERVICE);
+        NetworkInfo networkInfo = manager.getActiveNetworkInfo();
+        return networkInfo != null && networkInfo.isConnected();
+    }
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/net/NoSSLv3SocketFactory.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/net/NoSSLv3SocketFactory.java
@@ -0,0 +1,70 @@
+package com.topjohnwu.magisk.net;
+
+import java.io.IOException;
+import java.net.InetAddress;
+import java.net.Socket;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.SSLSocketFactory;
+
+public class NoSSLv3SocketFactory extends SSLSocketFactory {
+
+    private final static SSLSocketFactory delegate = HttpsURLConnection.getDefaultSSLSocketFactory();
+
+    @Override
+    public String[] getDefaultCipherSuites() {
+        return delegate.getDefaultCipherSuites();
+    }
+
+    @Override
+    public String[] getSupportedCipherSuites() {
+        return delegate.getSupportedCipherSuites();
+    }
+
+    private Socket createSafeSocket(Socket socket) {
+        if (socket instanceof SSLSocket)
+            return new SSLSocketWrapper((SSLSocket) socket) {
+                @Override
+                public void setEnabledProtocols(String[] protocols) {
+                    List<String> proto = new ArrayList<>(Arrays.asList(getSupportedProtocols()));
+                    proto.remove("SSLv3");
+                    super.setEnabledProtocols(proto.toArray(new String[0]));
+                }
+            };
+        return socket;
+    }
+
+    @Override
+    public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException {
+        return createSafeSocket(delegate.createSocket(s, host, port, autoClose));
+    }
+
+    @Override
+    public Socket createSocket() throws IOException {
+        return createSafeSocket(delegate.createSocket());
+    }
+
+    @Override
+    public Socket createSocket(String host, int port) throws IOException {
+        return createSafeSocket(delegate.createSocket(host, port));
+    }
+
+    @Override
+    public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException {
+        return createSafeSocket(delegate.createSocket(host, port, localHost, localPort));
+    }
+
+    @Override
+    public Socket createSocket(InetAddress host, int port) throws IOException {
+        return createSafeSocket(delegate.createSocket(host, port));
+    }
+
+    @Override
+    public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException {
+        return createSafeSocket(delegate.createSocket(address, port, localAddress, localPort));
+    }
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/net/Request.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/net/Request.java
@@ -0,0 +1,215 @@
+package com.topjohnwu.magisk.net;
+
+import android.os.AsyncTask;
+
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+import java.io.BufferedInputStream;
+import java.io.BufferedOutputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.Closeable;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.FilterInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.HttpURLConnection;
+import java.util.Scanner;
+import java.util.concurrent.Executor;
+
+public class Request implements Closeable {
+    private HttpURLConnection conn;
+    private Executor executor = null;
+    private int code = -1;
+
+    ErrorHandler err = null;
+
+    private interface Requestor<T> {
+        T request() throws Exception;
+    }
+
+    public class Result<T> {
+        T result;
+
+        public T getResult() {
+            return result;
+        }
+
+        public int getCode() {
+            return code;
+        }
+
+        public boolean isSuccess() {
+            return code >= 200 && code <= 299;
+        }
+
+        public HttpURLConnection getConnection() {
+            return conn;
+        }
+    }
+
+    Request(HttpURLConnection c) {
+        conn = c;
+    }
+
+    @Override
+    public void close() {
+        conn.disconnect();
+    }
+
+    public Request addHeaders(String key, String value) {
+        conn.setRequestProperty(key, value);
+        return this;
+    }
+
+    public Request setErrorHandler(ErrorHandler handler) {
+        err = handler;
+        return this;
+    }
+
+    public Request setExecutor(Executor e) {
+        executor = e;
+        return this;
+    }
+
+    public Result<Void> connect() {
+        try {
+            connect0();
+        } catch (IOException e) {
+            if (err != null)
+                err.onError(conn, e);
+        }
+        return new Result<>();
+    }
+
+    public Result<InputStream> execForInputStream() {
+        return exec(this::getInputStream);
+    }
+
+    public void getAsFile(File out, ResponseListener<File> rs) {
+        submit(() -> dlFile(out), rs);
+    }
+
+    public void execForFile(File out) {
+        exec(() -> dlFile(out));
+    }
+
+    public void getAsBytes(ResponseListener<byte[]> rs) {
+        submit(this::dlBytes, rs);
+    }
+
+    public Result<byte[]> execForBytes() {
+        return exec(this::dlBytes);
+    }
+
+    public void getAsString(ResponseListener<String> rs) {
+        submit(this::dlString, rs);
+    }
+
+    public Result<String> execForString() {
+        return exec(this::dlString);
+    }
+
+    public void getAsJSONObject(ResponseListener<JSONObject> rs) {
+        submit(this::dlJSONObject, rs);
+    }
+
+    public Result<JSONObject> execForJSONObject() {
+        return exec(this::dlJSONObject);
+    }
+
+    public void getAsJSONArray(ResponseListener<JSONArray> rs) {
+        submit(this::dlJSONArray, rs);
+    }
+
+    public Result<JSONArray> execForJSONArray() {
+        return exec(this::dlJSONArray);
+    }
+
+    private void connect0() throws IOException {
+        conn.connect();
+        code = conn.getResponseCode();
+    }
+
+    private <T> Result<T> exec(Requestor<T> req) {
+        Result<T> res = new Result<>();
+        try {
+            res.result = req.request();
+        } catch (Exception e) {
+            if (err != null)
+                err.onError(conn, e);
+        }
+        return res;
+    }
+
+    private <T> void submit(Requestor<T> req, ResponseListener<T> rs) {
+        AsyncTask.THREAD_POOL_EXECUTOR.execute(() -> {
+            try {
+                T t = req.request();
+                Runnable cb = () -> rs.onResponse(t);
+                if (executor == null)
+                    Networking.mainHandler.post(cb);
+                else
+                    executor.execute(cb);
+            } catch (Exception e) {
+                if (err != null)
+                    err.onError(conn, e);
+            }
+        });
+    }
+
+    private BufferedInputStream getInputStream() throws IOException {
+        connect0();
+        InputStream in = new FilterInputStream(conn.getInputStream()) {
+            @Override
+            public void close() throws IOException {
+                super.close();
+                conn.disconnect();
+            }
+        };
+        return new BufferedInputStream(in);
+    }
+
+    private String dlString() throws IOException {
+        try (Scanner s = new Scanner(getInputStream(), "UTF-8")) {
+            s.useDelimiter("\\A");
+            return s.next();
+        }
+    }
+
+    private JSONObject dlJSONObject() throws IOException, JSONException {
+        return new JSONObject(dlString());
+    }
+
+    private JSONArray dlJSONArray() throws IOException, JSONException {
+        return new JSONArray(dlString());
+    }
+
+    private File dlFile(File f) throws IOException {
+        try (InputStream in  = getInputStream();
+             OutputStream out = new BufferedOutputStream(new FileOutputStream(f))) {
+            int len;
+            byte[] buf = new byte[4096];
+            while ((len = in.read(buf)) != -1) {
+                out.write(buf, 0, len);
+            }
+        }
+        return f;
+    }
+
+    private byte[] dlBytes() throws IOException {
+        int len = conn.getContentLength();
+        len = len > 0 ? len : 32;
+        ByteArrayOutputStream out = new ByteArrayOutputStream(len);
+        try (InputStream in  = getInputStream()) {
+            byte[] buf = new byte[4096];
+            while ((len = in.read(buf)) != -1) {
+                out.write(buf, 0, len);
+            }
+        }
+        return out.toByteArray();
+    }
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/net/ResponseListener.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/net/ResponseListener.java
@@ -0,0 +1,5 @@
+package com.topjohnwu.magisk.net;
+
+public interface ResponseListener<T> {
+    void onResponse(T response);
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/net/SSLSocketWrapper.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/net/SSLSocketWrapper.java
@@ -0,0 +1,333 @@
+package com.topjohnwu.magisk.net;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.InetAddress;
+import java.net.SocketAddress;
+import java.net.SocketException;
+import java.nio.channels.SocketChannel;
+
+import javax.net.ssl.HandshakeCompletedListener;
+import javax.net.ssl.SSLParameters;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.SSLSocket;
+
+class SSLSocketWrapper extends SSLSocket {
+
+    private SSLSocket mBase;
+
+    SSLSocketWrapper(SSLSocket socket) {
+        mBase = socket;
+    }
+
+    @Override
+    public String[] getSupportedCipherSuites() {
+        return mBase.getSupportedCipherSuites();
+    }
+
+    @Override
+    public String[] getEnabledCipherSuites() {
+        return mBase.getEnabledCipherSuites();
+    }
+
+    @Override
+    public void setEnabledCipherSuites(String[] suites) {
+        mBase.setEnabledCipherSuites(suites);
+    }
+
+    @Override
+    public String[] getSupportedProtocols() {
+        return mBase.getSupportedProtocols();
+    }
+
+    @Override
+    public String[] getEnabledProtocols() {
+        return mBase.getEnabledProtocols();
+    }
+
+    @Override
+    public void setEnabledProtocols(String[] protocols) {
+        mBase.setEnabledProtocols(protocols);
+    }
+
+    @Override
+    public SSLSession getSession() {
+        return mBase.getSession();
+    }
+
+    @Override
+    public SSLSession getHandshakeSession() {
+        throw new UnsupportedOperationException();
+    }
+
+    @Override
+    public void addHandshakeCompletedListener(HandshakeCompletedListener listener) {
+        mBase.addHandshakeCompletedListener(listener);
+    }
+
+    @Override
+    public void removeHandshakeCompletedListener(HandshakeCompletedListener listener) {
+        mBase.removeHandshakeCompletedListener(listener);
+    }
+
+    @Override
+    public void startHandshake() throws IOException {
+        mBase.startHandshake();
+    }
+
+    @Override
+    public void setUseClientMode(boolean mode) {
+        mBase.setUseClientMode(mode);
+    }
+
+    @Override
+    public boolean getUseClientMode() {
+        return mBase.getUseClientMode();
+    }
+
+    @Override
+    public void setNeedClientAuth(boolean need) {
+        mBase.setNeedClientAuth(need);
+    }
+
+    @Override
+    public boolean getNeedClientAuth() {
+        return mBase.getNeedClientAuth();
+    }
+
+    @Override
+    public void setWantClientAuth(boolean want) {
+        mBase.setWantClientAuth(want);
+    }
+
+    @Override
+    public boolean getWantClientAuth() {
+        return mBase.getWantClientAuth();
+    }
+
+    @Override
+    public void setEnableSessionCreation(boolean flag) {
+        mBase.setEnableSessionCreation(flag);
+    }
+
+    @Override
+    public boolean getEnableSessionCreation() {
+        return mBase.getEnableSessionCreation();
+    }
+
+    @Override
+    public SSLParameters getSSLParameters() {
+        return mBase.getSSLParameters();
+    }
+
+    @Override
+    public void setSSLParameters(SSLParameters params) {
+        mBase.setSSLParameters(params);
+    }
+
+    @Override
+    public String toString() {
+        return mBase.toString();
+    }
+
+    @Override
+    public void connect(SocketAddress endpoint) throws IOException {
+        mBase.connect(endpoint);
+    }
+
+    @Override
+    public void connect(SocketAddress endpoint, int timeout) throws IOException {
+        mBase.connect(endpoint, timeout);
+    }
+
+    @Override
+    public void bind(SocketAddress bindpoint) throws IOException {
+        mBase.bind(bindpoint);
+    }
+
+    @Override
+    public InetAddress getInetAddress() {
+        return mBase.getInetAddress();
+    }
+
+    @Override
+    public InetAddress getLocalAddress() {
+        return mBase.getLocalAddress();
+    }
+
+    @Override
+    public int getPort() {
+        return mBase.getPort();
+    }
+
+    @Override
+    public int getLocalPort() {
+        return mBase.getLocalPort();
+    }
+
+    @Override
+    public SocketAddress getRemoteSocketAddress() {
+        return mBase.getRemoteSocketAddress();
+    }
+
+    @Override
+    public SocketAddress getLocalSocketAddress() {
+        return mBase.getLocalSocketAddress();
+    }
+
+    @Override
+    public SocketChannel getChannel() {
+        return mBase.getChannel();
+    }
+
+    @Override
+    public InputStream getInputStream() throws IOException {
+        return mBase.getInputStream();
+    }
+
+    @Override
+    public OutputStream getOutputStream() throws IOException {
+        return mBase.getOutputStream();
+    }
+
+    @Override
+    public void setTcpNoDelay(boolean on) throws SocketException {
+        mBase.setTcpNoDelay(on);
+    }
+
+    @Override
+    public boolean getTcpNoDelay() throws SocketException {
+        return mBase.getTcpNoDelay();
+    }
+
+    @Override
+    public void setSoLinger(boolean on, int linger) throws SocketException {
+        mBase.setSoLinger(on, linger);
+    }
+
+    @Override
+    public int getSoLinger() throws SocketException {
+        return mBase.getSoLinger();
+    }
+
+    @Override
+    public void sendUrgentData(int data) throws IOException {
+        mBase.sendUrgentData(data);
+    }
+
+    @Override
+    public void setOOBInline(boolean on) throws SocketException {
+        mBase.setOOBInline(on);
+    }
+
+    @Override
+    public boolean getOOBInline() throws SocketException {
+        return mBase.getOOBInline();
+    }
+
+    @Override
+    public void setSoTimeout(int timeout) throws SocketException {
+        mBase.setSoTimeout(timeout);
+    }
+
+    @Override
+    public int getSoTimeout() throws SocketException {
+        return mBase.getSoTimeout();
+    }
+
+    @Override
+    public void setSendBufferSize(int size) throws SocketException {
+        mBase.setSendBufferSize(size);
+    }
+
+    @Override
+    public int getSendBufferSize() throws SocketException {
+        return mBase.getSendBufferSize();
+    }
+
+    @Override
+    public void setReceiveBufferSize(int size) throws SocketException {
+        mBase.setReceiveBufferSize(size);
+    }
+
+    @Override
+    public int getReceiveBufferSize() throws SocketException {
+        return mBase.getReceiveBufferSize();
+    }
+
+    @Override
+    public void setKeepAlive(boolean on) throws SocketException {
+        mBase.setKeepAlive(on);
+    }
+
+    @Override
+    public boolean getKeepAlive() throws SocketException {
+        return mBase.getKeepAlive();
+    }
+
+    @Override
+    public void setTrafficClass(int tc) throws SocketException {
+        mBase.setTrafficClass(tc);
+    }
+
+    @Override
+    public int getTrafficClass() throws SocketException {
+        return mBase.getTrafficClass();
+    }
+
+    @Override
+    public void setReuseAddress(boolean on) throws SocketException {
+        mBase.setReuseAddress(on);
+    }
+
+    @Override
+    public boolean getReuseAddress() throws SocketException {
+        return mBase.getReuseAddress();
+    }
+
+    @Override
+    public void close() throws IOException {
+        mBase.close();
+    }
+
+    @Override
+    public void shutdownInput() throws IOException {
+        mBase.shutdownInput();
+    }
+
+    @Override
+    public void shutdownOutput() throws IOException {
+        mBase.shutdownOutput();
+    }
+
+    @Override
+    public boolean isConnected() {
+        return mBase.isConnected();
+    }
+
+    @Override
+    public boolean isBound() {
+        return mBase.isBound();
+    }
+
+    @Override
+    public boolean isClosed() {
+        return mBase.isClosed();
+    }
+
+    @Override
+    public boolean isInputShutdown() {
+        return mBase.isInputShutdown();
+    }
+
+    @Override
+    public boolean isOutputShutdown() {
+        return mBase.isOutputShutdown();
+    }
+
+    @Override
+    public void setPerformancePreferences(int connectionTime, int latency, int bandwidth) {
+        mBase.setPerformancePreferences(connectionTime, latency, bandwidth);
+    }
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/utils/APKInstall.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/utils/APKInstall.java
@@ -0,0 +1,29 @@
+package com.topjohnwu.magisk.utils;
+
+import android.content.Context;
+import android.content.Intent;
+import android.net.Uri;
+import android.os.Build;
+
+import com.topjohnwu.magisk.FileProvider;
+
+import java.io.File;
+
+public class APKInstall {
+    public static void install(Context c, File apk) {
+        c.startActivity(installIntent(c, apk));
+    }
+
+    public static Intent installIntent(Context c, File apk) {
+        Intent install = new Intent(Intent.ACTION_INSTALL_PACKAGE);
+        install.addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
+        install.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
+            install.setData(FileProvider.getUriForFile(c, c.getPackageName() + ".provider", apk));
+        } else {
+            apk.setReadable(true, false);
+            install.setData(Uri.fromFile(apk));
+        }
+        return install;
+    }
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/utils/CompoundEnumeration.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/utils/CompoundEnumeration.java
@@ -0,0 +1,35 @@
+package com.topjohnwu.magisk.utils;
+
+import java.util.Enumeration;
+import java.util.NoSuchElementException;
+
+public class CompoundEnumeration<E> implements Enumeration<E> {
+    private Enumeration<E>[] enums;
+    private int index = 0;
+
+    @SafeVarargs
+    public CompoundEnumeration(Enumeration<E> ...enums) {
+        this.enums = enums;
+    }
+
+    private boolean next() {
+        while (index < enums.length) {
+            if (enums[index] != null && enums[index].hasMoreElements()) {
+                return true;
+            }
+            index++;
+        }
+        return false;
+    }
+
+    public boolean hasMoreElements() {
+        return next();
+    }
+
+    public E nextElement() {
+        if (!next()) {
+            throw new NoSuchElementException();
+        }
+        return enums[index].nextElement();
+    }
+}
--- a/app/shared/src/main/java/com/topjohnwu/magisk/utils/DynamicClassLoader.java
+++ b/app/shared/src/main/java/com/topjohnwu/magisk/utils/DynamicClassLoader.java
@@ -0,0 +1,60 @@
+package com.topjohnwu.magisk.utils;
+
+import java.io.File;
+import java.io.IOException;
+import java.net.URL;
+import java.util.Enumeration;
+
+import dalvik.system.DexClassLoader;
+
+public class DynamicClassLoader extends DexClassLoader {
+
+    private ClassLoader base = Object.class.getClassLoader();
+
+    public DynamicClassLoader(File apk, ClassLoader parent) {
+        super(apk.getPath(), apk.getParent(), null, parent);
+    }
+
+    @Override
+    protected Class<?> loadClass(String name, boolean resolve) throws ClassNotFoundException {
+        // First check if already loaded
+        Class cls = findLoadedClass(name);
+        if (cls != null)
+            return cls;
+
+        try {
+            // Then check boot classpath
+            return base.loadClass(name);
+        } catch (ClassNotFoundException ignored) {
+            try {
+                // Next try current dex
+                return findClass(name);
+            } catch (ClassNotFoundException fromSuper) {
+                try {
+                    // Finally try parent
+                    return getParent().loadClass(name);
+                } catch (ClassNotFoundException e) {
+                    throw fromSuper;
+                }
+            }
+        }
+    }
+
+    @Override
+    public URL getResource(String name) {
+        URL resource = base.getResource(name);
+        if (resource != null)
+            return resource;
+        resource = findResource(name);
+        if (resource != null)
+            return resource;
+        resource = getParent().getResource(name);
+        return resource;
+    }
+
+    @Override
+    public Enumeration<URL> getResources(String name) throws IOException {
+        return new CompoundEnumeration<>(base.getResources(name),
+                findResources(name), getParent().getResources(name));
+    }
+}
--- a/app/shared/src/main/res/drawable/ic_logo.xml
+++ b/app/shared/src/main/res/drawable/ic_logo.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<layer-list xmlns:android="http://schemas.android.com/apk/res/android">
+    <item>
+        <shape android:shape="oval">
+            <solid android:color="#00AF9C"/>
+        </shape>
+    </item>
+
+    <item android:drawable="@drawable/ic_magisk" />
+
+</layer-list>
--- a/app/shared/src/main/res/drawable/ic_magisk.xml
+++ b/app/shared/src/main/res/drawable/ic_magisk.xml
@@ -0,0 +1,18 @@
+<vector android:height="48dp" android:viewportHeight="720"
+    android:viewportWidth="720" android:width="48dp" xmlns:android="http://schemas.android.com/apk/res/android">
+    <path android:fillColor="#303030" android:pathData="M332.48,421.18c0,0 3.77,22.45 -0.82,71.95c-5.76,62.06 23.64,160.64 23.64,160.64c0,0 40.1,-98.78 33.1,-162.59c-5.75,-52.45 2.6,-70.79 0.82,-68.33c-30.81,42.57 -56.75,-1.67 -56.75,-1.67z"/>
+    <path android:fillColor="#ffffff" android:pathData="M407.6,474.45c5.01,38.77 -0.57,60.01 -7.81,101.51c-3.66,20.99 74.78,-63.1 104.86,-113.23c5.02,-8.36 -28.77,32.6 -62.19,3.35c-23.18,-20.28 -27.16,-26.44 -45.18,-44.06c-6.08,-5.94 6.74,24.72 10.32,52.43z"/>
+    <path android:fillColor="#ffffff" android:pathData="M321.99,425.09c-18.02,17.62 -22,23.78 -45.18,44.06c-33.42,29.25 -67.21,-11.71 -62.19,-3.35c30.08,50.13 108.52,134.22 104.86,113.23c-7.24,-41.5 -12.82,-62.74 -7.81,-101.51c3.58,-27.71 16.4,-58.37 10.32,-52.43z"/>
+    <path android:fillColor="#303030" android:pathData="M399.15,355.87c36.67,10.57 50.89,61.5 87.91,67.8c7.65,1.3 16.27,3.6 26.31,3.12c18.77,-0.9 42.51,-11.51 74.22,-56.5c9.38,-13.3 -23.27,85.66 -105.13,86.86c-59.96,0.88 -66.97,-58.7 -106.93,-60.51c-14.43,-0.65 -15.34,-28.17 -15.34,-28.17c0,0 17.22,-18.86 38.96,-12.6z"/>
+    <path android:fillColor="#303030" android:pathData="M321.51,355.59c-36.67,10.57 -50.89,61.5 -87.91,67.8c-7.65,1.3 -16.27,3.6 -26.31,3.12c-18.77,-0.9 -42.51,-11.51 -74.22,-56.5c-9.38,-13.3 23.27,85.66 105.13,86.86c59.96,0.88 66.97,-58.7 106.93,-60.51c14.43,-0.65 15.34,-28.17 15.34,-28.17c0,0 -17.22,-18.86 -38.96,-12.6z"/>
+    <path android:fillColor="#fbbcc9" android:pathData="M458.64,355.09c36.87,27.94 25.88,58.7 46.57,49.92c69.7,-29.55 57.51,-181.21 51.87,-162.87c-31.77,103.41 -100.99,109.2 -167.61,61.63c-13.01,-9.29 48.38,35.57 69.16,51.31z"/>
+    <path android:fillColor="#fbbcc9" android:pathData="M330.91,303.77c-66.62,47.56 -135.84,41.78 -167.61,-61.63c-5.63,-18.34 -17.82,133.31 51.87,162.87c20.7,8.78 9.7,-21.98 46.57,-49.92c20.78,-15.75 82.17,-60.6 69.16,-51.31z"/>
+    <path android:fillColor="#3747a9" android:pathData="M465.61,318c80.43,-3.32 95.29,-135.17 88.96,-119.08c-28.39,72.22 -135.86,45.05 -146.13,90.64c-2.02,8.94 18.2,30.06 57.17,28.45z"/>
+    <path android:fillColor="#3747a9" android:pathData="M311.95,289.55c-10.27,-45.59 -117.75,-18.41 -146.13,-90.64c-6.32,-16.09 8.53,115.76 88.96,119.08c38.97,1.61 59.19,-19.5 57.17,-28.45z"/>
+    <path android:fillColor="#ff6e40" android:pathData="M403.42,269.47c0,0 43.73,-23.5 81.16,-33.74c34.99,-9.58 61.22,-33.13 64.14,-58.01c2.18,-18.53 -27.05,-53.55 -27.05,-53.55c0,0 -20.51,56.9 -47.41,85.34c-29.28,30.96 -18.15,26.78 -70.84,59.96z"/>
+    <path android:fillColor="#ff6e40" android:pathData="M246.13,209.51c-26.9,-28.44 -47.41,-85.34 -47.41,-85.34c0,0 -29.23,35.01 -27.05,53.55c2.93,24.88 29.16,48.43 64.14,58.01c37.43,10.25 81.16,33.74 81.16,33.74c-52.69,-33.18 -41.55,-29 -70.84,-59.96z"/>
+    <path android:fillColor="#ffffff" android:pathData="M398.12,265.85c47.36,-38.85 72.53,-89.54 113.51,-145.02c7.73,-10.46 -34.58,-35.7 -51.31,-37.37c-16.73,-1.67 -30.77,59.79 -32.35,95.94c-1.44,33.01 -36.21,91.68 -29.84,86.45z"/>
+    <path android:fillColor="#ffffff" android:pathData="M292.42,179.39c-1.58,-36.15 -15.62,-97.61 -32.35,-95.94c-16.73,1.67 -59.04,26.91 -51.31,37.37c40.98,55.48 66.14,106.17 113.51,145.02c6.37,5.22 -28.4,-53.45 -29.84,-86.45z"/>
+    <path android:fillColor="#ffb327" android:pathData="M402.86,140.35c3.34,-26.76 15.37,-46.32 39.32,-62.75c-21.17,-7.08 -38.77,-12.83 -47.97,-5.3c-9.2,7.53 -34.2,32.7 -30.85,73.68c3.34,40.98 0.18,194.09 7.43,191.25c3.9,-104.87 37.09,-135 32.07,-196.89z"/>
+    <path android:fillColor="#ffb327" android:pathData="M349.59,337.24c7.24,2.83 4.08,-150.27 7.43,-191.25c3.34,-40.98 -21.65,-66.16 -30.85,-73.68c-9.2,-7.53 -26.8,-1.78 -47.97,5.3c23.95,16.43 35.98,35.98 39.32,62.75c-5.02,61.89 28.17,92.02 32.07,196.89z"/>
+</vector>
--- a/app/shared/src/main/res/values-anydpi-v21/drawable.xml
+++ b/app/shared/src/main/res/values-anydpi-v21/drawable.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <drawable name="ic_launcher">@drawable/ic_logo</drawable>
+</resources>
--- a/app/signing/.gitignore
+++ b/app/signing/.gitignore
@@ -0,0 +1 @@
+/build
--- a/app/signing/build.gradle
+++ b/app/signing/build.gradle
@@ -0,0 +1,39 @@
+apply plugin: 'java-library'
+
+apply plugin: 'com.github.johnrengelman.shadow'
+apply plugin: 'java'
+
+sourceCompatibility = "1.8"
+targetCompatibility = "1.8"
+
+jar {
+    manifest {
+        attributes 'Main-Class': 'com.topjohnwu.signing.ZipSigner'
+    }
+}
+
+shadowJar {
+    baseName = 'zipsigner'
+    classifier = null
+    version = 3.0
+}
+
+buildscript {
+    repositories {
+        jcenter()
+    }
+    dependencies {
+        classpath 'com.github.jengelman.gradle.plugins:shadow:2.0.4'
+    }
+}
+
+repositories {
+    jcenter()
+}
+
+dependencies {
+    implementation fileTree(include: ['*.jar'], dir: 'libs')
+
+    api "org.bouncycastle:bcprov-jdk15on:1.65.01"
+    api "org.bouncycastle:bcpkix-jdk15on:1.65"
+}
--- a/app/signing/src/main/java/com/topjohnwu/signing/BootSigner.java
+++ b/app/signing/src/main/java/com/topjohnwu/signing/BootSigner.java
@@ -0,0 +1,49 @@
+package com.topjohnwu.signing;
+
+import java.io.FileInputStream;
+import java.io.InputStream;
+
+public class BootSigner {
+
+    public static void main(String[] args) throws Exception {
+        if (args.length > 0 && "-verify".equals(args[0])) {
+            String certPath = "";
+            if (args.length >= 2) {
+                /* args[1] is the path to a public key certificate */
+                certPath = args[1];
+            }
+            boolean signed = SignBoot.verifySignature(System.in,
+                    certPath.isEmpty() ? null : new FileInputStream(certPath));
+            System.exit(signed ? 0 : 1);
+        } else if (args.length > 0 && "-sign".equals(args[0])) {
+            InputStream cert = null;
+            InputStream key = null;
+            String name = "/boot";
+
+            if (args.length >= 3) {
+                cert = new FileInputStream(args[1]);
+                key = new FileInputStream(args[2]);
+            }
+            if (args.length == 2) {
+                name = args[1];
+            } else if (args.length >= 4) {
+                name = args[3];
+            }
+
+            boolean success = SignBoot.doSignature(name, System.in, System.out, cert, key);
+            System.exit(success ? 0 : 1);
+        } else {
+            System.err.println(
+                    "BootSigner <actions> [args]\n" +
+                    "Input from stdin, outputs to stdout\n" +
+                    "\n" +
+                    "Actions:\n" +
+                    "   -verify [x509.pem]\n" +
+                    "      verify image, cert is optional\n" +
+                    "   -sign [x509.pem] [pk8] [name]\n" +
+                    "      sign image, name, cert and key pair are optional\n" +
+                    "      name should be /boot (default) or /recovery\n"
+            );
+        }
+    }
+}
--- a/app/signing/src/main/java/com/topjohnwu/signing/ByteArrayStream.java
+++ b/app/signing/src/main/java/com/topjohnwu/signing/ByteArrayStream.java
@@ -0,0 +1,30 @@
+package com.topjohnwu.signing;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+
+public class ByteArrayStream extends ByteArrayOutputStream {
+
+    public synchronized void readFrom(InputStream is) {
+        readFrom(is, Integer.MAX_VALUE);
+    }
+
+    public synchronized void readFrom(InputStream is, int len) {
+        int read;
+        byte buffer[] = new byte[4096];
+        try {
+            while ((read = is.read(buffer, 0, Math.min(len, buffer.length))) > 0) {
+                write(buffer, 0, read);
+                len -= read;
+            }
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+    }
+
+    public ByteArrayInputStream getInputStream() {
+        return new ByteArrayInputStream(buf, 0, count);
+    }
+}
--- a/app/signing/src/main/java/com/topjohnwu/signing/CryptoUtils.java
+++ b/app/signing/src/main/java/com/topjohnwu/signing/CryptoUtils.java
@@ -0,0 +1,115 @@
+package com.topjohnwu.signing;
+
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
+import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.asn1.x9.X9ObjectIdentifiers;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.GeneralSecurityException;
+import java.security.Key;
+import java.security.KeyFactory;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.security.spec.ECPrivateKeySpec;
+import java.security.spec.ECPublicKeySpec;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.util.HashMap;
+import java.util.Map;
+
+public class CryptoUtils {
+
+    static final Map<String, String> ID_TO_ALG;
+    static final Map<String, String> ALG_TO_ID;
+
+    static {
+        ID_TO_ALG = new HashMap<>();
+        ALG_TO_ID = new HashMap<>();
+        ID_TO_ALG.put(X9ObjectIdentifiers.ecdsa_with_SHA256.getId(), "SHA256withECDSA");
+        ID_TO_ALG.put(X9ObjectIdentifiers.ecdsa_with_SHA384.getId(), "SHA384withECDSA");
+        ID_TO_ALG.put(X9ObjectIdentifiers.ecdsa_with_SHA512.getId(), "SHA512withECDSA");
+        ID_TO_ALG.put(PKCSObjectIdentifiers.sha1WithRSAEncryption.getId(), "SHA1withRSA");
+        ID_TO_ALG.put(PKCSObjectIdentifiers.sha256WithRSAEncryption.getId(), "SHA256withRSA");
+        ID_TO_ALG.put(PKCSObjectIdentifiers.sha512WithRSAEncryption.getId(), "SHA512withRSA");
+        ALG_TO_ID.put("SHA256withECDSA", X9ObjectIdentifiers.ecdsa_with_SHA256.getId());
+        ALG_TO_ID.put("SHA384withECDSA", X9ObjectIdentifiers.ecdsa_with_SHA384.getId());
+        ALG_TO_ID.put("SHA512withECDSA", X9ObjectIdentifiers.ecdsa_with_SHA512.getId());
+        ALG_TO_ID.put("SHA1withRSA", PKCSObjectIdentifiers.sha1WithRSAEncryption.getId());
+        ALG_TO_ID.put("SHA256withRSA", PKCSObjectIdentifiers.sha256WithRSAEncryption.getId());
+        ALG_TO_ID.put("SHA512withRSA", PKCSObjectIdentifiers.sha512WithRSAEncryption.getId());
+    }
+
+    static String getSignatureAlgorithm(Key key) throws Exception {
+        if ("EC".equals(key.getAlgorithm())) {
+            int curveSize;
+            KeyFactory factory = KeyFactory.getInstance("EC");
+            if (key instanceof PublicKey) {
+                ECPublicKeySpec spec = factory.getKeySpec(key, ECPublicKeySpec.class);
+                curveSize = spec.getParams().getCurve().getField().getFieldSize();
+            } else if (key instanceof PrivateKey) {
+                ECPrivateKeySpec spec = factory.getKeySpec(key, ECPrivateKeySpec.class);
+                curveSize = spec.getParams().getCurve().getField().getFieldSize();
+            } else {
+                throw new InvalidKeySpecException();
+            }
+            if (curveSize <= 256) {
+                return "SHA256withECDSA";
+            } else if (curveSize <= 384) {
+                return "SHA384withECDSA";
+            } else {
+                return "SHA512withECDSA";
+            }
+        } else if ("RSA".equals(key.getAlgorithm())) {
+            return "SHA256withRSA";
+        } else {
+            throw new IllegalArgumentException("Unsupported key type " + key.getAlgorithm());
+        }
+    }
+
+    static AlgorithmIdentifier getSignatureAlgorithmIdentifier(Key key) throws Exception {
+        String id = ALG_TO_ID.get(getSignatureAlgorithm(key));
+        if (id == null) {
+            throw new IllegalArgumentException("Unsupported key type " + key.getAlgorithm());
+        }
+        return new AlgorithmIdentifier(new ASN1ObjectIdentifier(id));
+    }
+
+    public static X509Certificate readCertificate(InputStream input)
+            throws IOException, GeneralSecurityException {
+        try {
+            CertificateFactory cf = CertificateFactory.getInstance("X.509");
+            return (X509Certificate) cf.generateCertificate(input);
+        } finally {
+            input.close();
+        }
+    }
+
+    /** Read a PKCS#8 format private key. */
+    public static PrivateKey readPrivateKey(InputStream input)
+            throws IOException, GeneralSecurityException {
+        try {
+            ByteArrayStream buf = new ByteArrayStream();
+            buf.readFrom(input);
+            byte[] bytes = buf.toByteArray();
+            /* Check to see if this is in an EncryptedPrivateKeyInfo structure. */
+            PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(bytes);
+            /*
+             * Now it's in a PKCS#8 PrivateKeyInfo structure. Read its Algorithm
+             * OID and use that to construct a KeyFactory.
+             */
+            ASN1InputStream bIn = new ASN1InputStream(new ByteArrayInputStream(spec.getEncoded()));
+            PrivateKeyInfo pki = PrivateKeyInfo.getInstance(bIn.readObject());
+            String algOid = pki.getPrivateKeyAlgorithm().getAlgorithm().getId();
+            return KeyFactory.getInstance(algOid).generatePrivate(spec);
+        } finally {
+            input.close();
+        }
+    }
+}
--- a/app/signing/src/main/java/com/topjohnwu/signing/JarMap.java
+++ b/app/signing/src/main/java/com/topjohnwu/signing/JarMap.java
@@ -0,0 +1,174 @@
+package com.topjohnwu.signing;
+
+import java.io.Closeable;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.LinkedHashMap;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.jar.JarInputStream;
+import java.util.jar.Manifest;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipFile;
+
+public abstract class JarMap implements Closeable {
+
+    LinkedHashMap<String, JarEntry> entryMap;
+
+    public static JarMap open(String file) throws IOException {
+        return new FileMap(new File(file), true, ZipFile.OPEN_READ);
+    }
+
+    public static JarMap open(File file, boolean verify) throws IOException {
+        return new FileMap(file, verify, ZipFile.OPEN_READ);
+    }
+
+    public static JarMap open(String file, boolean verify) throws IOException {
+        return new FileMap(new File(file), verify, ZipFile.OPEN_READ);
+    }
+
+    public static JarMap open(InputStream is, boolean verify) throws IOException {
+        return new StreamMap(is, verify);
+    }
+
+    public File getFile() {
+        return null;
+    }
+
+    public abstract Manifest getManifest() throws IOException;
+
+    public InputStream getInputStream(ZipEntry ze) throws IOException {
+        JarMapEntry e = getMapEntry(ze.getName());
+        return e != null ? e.data.getInputStream() : null;
+    }
+
+    public OutputStream getOutputStream(ZipEntry ze) {
+        if (entryMap == null)
+            entryMap = new LinkedHashMap<>();
+        JarMapEntry e = new JarMapEntry(ze.getName());
+        entryMap.put(ze.getName(), e);
+        return e.data;
+    }
+
+    public byte[] getRawData(ZipEntry ze) throws IOException {
+        JarMapEntry e = getMapEntry(ze.getName());
+        return e != null ? e.data.toByteArray() : null;
+    }
+
+    public abstract Enumeration<JarEntry> entries();
+
+    public final ZipEntry getEntry(String name) {
+        return getJarEntry(name);
+    }
+
+    public JarEntry getJarEntry(String name) {
+        return getMapEntry(name);
+    }
+
+    JarMapEntry getMapEntry(String name) {
+        JarMapEntry e = null;
+        if (entryMap != null)
+            e = (JarMapEntry) entryMap.get(name);
+        return e;
+    }
+
+    private static class FileMap extends JarMap {
+
+        private JarFile jarFile;
+
+        FileMap(File file, boolean verify, int mode) throws IOException {
+            jarFile = new JarFile(file, verify, mode);
+        }
+
+        @Override
+        public File getFile() {
+            return new File(jarFile.getName());
+        }
+
+        @Override
+        public Manifest getManifest() throws IOException {
+            return jarFile.getManifest();
+        }
+
+        @Override
+        public InputStream getInputStream(ZipEntry ze) throws IOException {
+            InputStream is = super.getInputStream(ze);
+            return is != null ? is : jarFile.getInputStream(ze);
+        }
+
+        @Override
+        public byte[] getRawData(ZipEntry ze) throws IOException {
+            byte[] b = super.getRawData(ze);
+            if (b != null)
+                return b;
+            ByteArrayStream bytes = new ByteArrayStream();
+            bytes.readFrom(jarFile.getInputStream(ze));
+            return bytes.toByteArray();
+        }
+
+        @Override
+        public Enumeration<JarEntry> entries() {
+            return jarFile.entries();
+        }
+
+        @Override
+        public JarEntry getJarEntry(String name) {
+            JarEntry e = getMapEntry(name);
+            return e != null ? e : jarFile.getJarEntry(name);
+        }
+
+        @Override
+        public void close() throws IOException {
+            jarFile.close();
+        }
+    }
+
+    private static class StreamMap extends JarMap {
+
+        private JarInputStream jis;
+
+        StreamMap(InputStream is, boolean verify) throws IOException {
+            jis = new JarInputStream(is, verify);
+            entryMap = new LinkedHashMap<>();
+            JarEntry entry;
+            while ((entry = jis.getNextJarEntry()) != null) {
+                entryMap.put(entry.getName(), new JarMapEntry(entry, jis));
+            }
+        }
+
+        @Override
+        public Manifest getManifest() {
+            return jis.getManifest();
+        }
+
+        @Override
+        public Enumeration<JarEntry> entries() {
+            return Collections.enumeration(entryMap.values());
+        }
+
+        @Override
+        public void close() throws IOException {
+            jis.close();
+        }
+    }
+
+    private static class JarMapEntry extends JarEntry {
+
+        ByteArrayStream data;
+
+        JarMapEntry(JarEntry je, InputStream is) {
+            super(je);
+            data = new ByteArrayStream();
+            data.readFrom(is);
+        }
+
+        JarMapEntry(String s) {
+            super(s);
+            data = new ByteArrayStream();
+        }
+    }
+}
--- a/app/signing/src/main/java/com/topjohnwu/signing/SignAPK.java
+++ b/app/signing/src/main/java/com/topjohnwu/signing/SignAPK.java
@@ -0,0 +1,526 @@
+package com.topjohnwu.signing;
+
+import org.bouncycastle.asn1.ASN1Encoding;
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1OutputStream;
+import org.bouncycastle.asn1.cms.CMSObjectIdentifiers;
+import org.bouncycastle.cert.jcajce.JcaCertStore;
+import org.bouncycastle.cms.CMSException;
+import org.bouncycastle.cms.CMSProcessableByteArray;
+import org.bouncycastle.cms.CMSSignedData;
+import org.bouncycastle.cms.CMSSignedDataGenerator;
+import org.bouncycastle.cms.CMSTypedData;
+import org.bouncycastle.cms.jcajce.JcaSignerInfoGeneratorBuilder;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
+import org.bouncycastle.util.encoders.Base64;
+
+import java.io.BufferedOutputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.FilterOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.PrintStream;
+import java.io.RandomAccessFile;
+import java.security.DigestOutputStream;
+import java.security.GeneralSecurityException;
+import java.security.MessageDigest;
+import java.security.PrivateKey;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.Locale;
+import java.util.Map;
+import java.util.TreeMap;
+import java.util.jar.Attributes;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.jar.JarOutputStream;
+import java.util.jar.Manifest;
+import java.util.regex.Pattern;
+
+/*
+* Modified from from AOSP
+* https://android.googlesource.com/platform/build/+/refs/heads/marshmallow-release/tools/signapk/SignApk.java
+* */
+
+public class SignAPK {
+
+    private static final String CERT_SF_NAME = "META-INF/CERT.SF";
+    private static final String CERT_SIG_NAME = "META-INF/CERT.%s";
+
+    // bitmasks for which hash algorithms we need the manifest to include.
+    private static final int USE_SHA1 = 1;
+    private static final int USE_SHA256 = 2;
+
+    public static void signAndAdjust(X509Certificate cert, PrivateKey key,
+                                     JarMap input, OutputStream output) throws Exception {
+        File temp1 = File.createTempFile("signAPK", null);
+        File temp2 = File.createTempFile("signAPK", null);
+
+        try {
+            try (OutputStream out = new BufferedOutputStream(new FileOutputStream(temp1))) {
+                sign(cert, key, input, out, false);
+            }
+
+            ZipAdjust.adjust(temp1, temp2);
+
+            try (JarMap map = JarMap.open(temp2, false)) {
+                sign(cert, key, map, output, true);
+            }
+        } finally {
+            temp1.delete();
+            temp2.delete();
+        }
+    }
+
+    public static void sign(X509Certificate cert, PrivateKey key,
+                            JarMap input, OutputStream output) throws Exception {
+        sign(cert, key, input, output, false);
+    }
+
+    private static void sign(X509Certificate cert, PrivateKey key, JarMap input,
+                             OutputStream output, boolean wholeFile) throws Exception {
+        int hashes = 0;
+        hashes |= getDigestAlgorithm(cert);
+
+        // Set the ZIP file timestamp to the starting valid time
+        // of the 0th certificate plus one hour (to match what
+        // we've historically done).
+        long timestamp = cert.getNotBefore().getTime() + 3600L * 1000;
+
+        if (wholeFile) {
+            signWholeFile(input.getFile(), cert, key, output);
+        } else {
+            JarOutputStream outputJar = new JarOutputStream(output);
+            // For signing .apks, use the maximum compression to make
+            // them as small as possible (since they live forever on
+            // the system partition).  For OTA packages, use the
+            // default compression level, which is much much faster
+            // and produces output that is only a tiny bit larger
+            // (~0.1% on full OTA packages I tested).
+            outputJar.setLevel(9);
+            Manifest manifest = addDigestsToManifest(input, hashes);
+            copyFiles(manifest, input, outputJar, timestamp, 4);
+            signFile(manifest, input, cert, key, outputJar);
+            outputJar.close();
+        }
+    }
+
+    /**
+     * Return one of USE_SHA1 or USE_SHA256 according to the signature
+     * algorithm specified in the cert.
+     */
+    private static int getDigestAlgorithm(X509Certificate cert) {
+        String sigAlg = cert.getSigAlgName().toUpperCase(Locale.US);
+        if (sigAlg.startsWith("SHA1WITHRSA") || sigAlg.startsWith("MD5WITHRSA")) {
+            return USE_SHA1;
+        } else if (sigAlg.startsWith("SHA256WITH")) {
+            return USE_SHA256;
+        } else {
+            throw new IllegalArgumentException("unsupported signature algorithm \"" + sigAlg +
+                    "\" in cert [" + cert.getSubjectDN());
+        }
+    }
+
+    /** Returns the expected signature algorithm for this key type. */
+    private static String getSignatureAlgorithm(X509Certificate cert) {
+        String sigAlg = cert.getSigAlgName().toUpperCase(Locale.US);
+        String keyType = cert.getPublicKey().getAlgorithm().toUpperCase(Locale.US);
+        if ("RSA".equalsIgnoreCase(keyType)) {
+            if (getDigestAlgorithm(cert) == USE_SHA256) {
+                return "SHA256withRSA";
+            } else {
+                return "SHA1withRSA";
+            }
+        } else if ("EC".equalsIgnoreCase(keyType)) {
+            return "SHA256withECDSA";
+        } else {
+            throw new IllegalArgumentException("unsupported key type: " + keyType);
+        }
+    }
+
+    // Files matching this pattern are not copied to the output.
+    private static Pattern stripPattern =
+            Pattern.compile("^(META-INF/((.*)[.](SF|RSA|DSA|EC)|com/android/otacert))|(" +
+                    Pattern.quote(JarFile.MANIFEST_NAME) + ")$");
+
+    /**
+     * Add the hash(es) of every file to the manifest, creating it if
+     * necessary.
+     */
+    private static Manifest addDigestsToManifest(JarMap jar, int hashes)
+            throws IOException, GeneralSecurityException {
+        Manifest input = jar.getManifest();
+        Manifest output = new Manifest();
+        Attributes main = output.getMainAttributes();
+        if (input != null) {
+            main.putAll(input.getMainAttributes());
+        } else {
+            main.putValue("Manifest-Version", "1.0");
+            main.putValue("Created-By", "1.0 (Android SignApk)");
+        }
+        MessageDigest md_sha1 = null;
+        MessageDigest md_sha256 = null;
+        if ((hashes & USE_SHA1) != 0) {
+            md_sha1 = MessageDigest.getInstance("SHA1");
+        }
+        if ((hashes & USE_SHA256) != 0) {
+            md_sha256 = MessageDigest.getInstance("SHA256");
+        }
+        byte[] buffer = new byte[4096];
+        int num;
+        // We sort the input entries by name, and add them to the
+        // output manifest in sorted order.  We expect that the output
+        // map will be deterministic.
+        TreeMap<String, JarEntry> byName = new TreeMap<>();
+        for (Enumeration<JarEntry> e = jar.entries(); e.hasMoreElements(); ) {
+            JarEntry entry = e.nextElement();
+            byName.put(entry.getName(), entry);
+        }
+        for (JarEntry entry: byName.values()) {
+            String name = entry.getName();
+            if (!entry.isDirectory() &&
+                    (stripPattern == null || !stripPattern.matcher(name).matches())) {
+                InputStream data = jar.getInputStream(entry);
+                while ((num = data.read(buffer)) > 0) {
+                    if (md_sha1 != null) md_sha1.update(buffer, 0, num);
+                    if (md_sha256 != null) md_sha256.update(buffer, 0, num);
+                }
+                Attributes attr = new Attributes();
+                if (md_sha1 != null) {
+                    attr.putValue("SHA1-Digest",
+                            new String(Base64.encode(md_sha1.digest()), "ASCII"));
+                }
+                if (md_sha256 != null) {
+                    attr.putValue("SHA-256-Digest",
+                            new String(Base64.encode(md_sha256.digest()), "ASCII"));
+                }
+                output.getEntries().put(name, attr);
+            }
+        }
+        return output;
+    }
+
+    /**
+     * Write to another stream and track how many bytes have been
+     * written.
+     */
+    private static class CountOutputStream extends FilterOutputStream {
+        private int mCount;
+        public CountOutputStream(OutputStream out) {
+            super(out);
+            mCount = 0;
+        }
+        @Override
+        public void write(int b) throws IOException {
+            super.write(b);
+            mCount++;
+        }
+        @Override
+        public void write(byte[] b, int off, int len) throws IOException {
+            super.write(b, off, len);
+            mCount += len;
+        }
+        public int size() {
+            return mCount;
+        }
+    }
+
+    /**
+     * An OutputStream that does literally nothing
+     */
+    private static OutputStream stubStream = new OutputStream() {
+        @Override
+        public void write(int b) {}
+
+        @Override
+        public void write(byte[] b, int off, int len) {}
+    };
+
+    /** Write a .SF file with a digest of the specified manifest. */
+    private static void writeSignatureFile(Manifest manifest, OutputStream out, int hash)
+            throws IOException, GeneralSecurityException {
+        Manifest sf = new Manifest();
+        Attributes main = sf.getMainAttributes();
+        main.putValue("Signature-Version", "1.0");
+        main.putValue("Created-By", "1.0 (Android SignApk)");
+        MessageDigest md = MessageDigest.getInstance(
+                hash == USE_SHA256 ? "SHA256" : "SHA1");
+        PrintStream print = new PrintStream(
+                new DigestOutputStream(stubStream, md),
+                true, "UTF-8");
+        // Digest of the entire manifest
+        manifest.write(print);
+        print.flush();
+        main.putValue(hash == USE_SHA256 ? "SHA-256-Digest-Manifest" : "SHA1-Digest-Manifest",
+                new String(Base64.encode(md.digest()), "ASCII"));
+        Map<String, Attributes> entries = manifest.getEntries();
+        for (Map.Entry<String, Attributes> entry : entries.entrySet()) {
+            // Digest of the manifest stanza for this entry.
+            print.print("Name: " + entry.getKey() + "\r\n");
+            for (Map.Entry<Object, Object> att : entry.getValue().entrySet()) {
+                print.print(att.getKey() + ": " + att.getValue() + "\r\n");
+            }
+            print.print("\r\n");
+            print.flush();
+            Attributes sfAttr = new Attributes();
+            sfAttr.putValue(hash == USE_SHA256 ? "SHA-256-Digest" : "SHA1-Digest",
+                    new String(Base64.encode(md.digest()), "ASCII"));
+            sf.getEntries().put(entry.getKey(), sfAttr);
+        }
+        CountOutputStream cout = new CountOutputStream(out);
+        sf.write(cout);
+        // A bug in the java.util.jar implementation of Android platforms
+        // up to version 1.6 will cause a spurious IOException to be thrown
+        // if the length of the signature file is a multiple of 1024 bytes.
+        // As a workaround, add an extra CRLF in this case.
+        if ((cout.size() % 1024) == 0) {
+            cout.write('\r');
+            cout.write('\n');
+        }
+    }
+
+    /** Sign data and write the digital signature to 'out'. */
+    private static void writeSignatureBlock(
+            CMSTypedData data, X509Certificate publicKey, PrivateKey privateKey,
+            OutputStream out)
+            throws IOException,
+            CertificateEncodingException,
+            OperatorCreationException,
+            CMSException {
+        ArrayList<X509Certificate> certList = new ArrayList<>(1);
+        certList.add(publicKey);
+        JcaCertStore certs = new JcaCertStore(certList);
+        CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
+        ContentSigner signer = new JcaContentSignerBuilder(getSignatureAlgorithm(publicKey))
+                .build(privateKey);
+        gen.addSignerInfoGenerator(
+                new JcaSignerInfoGeneratorBuilder(
+                        new JcaDigestCalculatorProviderBuilder().build())
+                        .setDirectSignature(true)
+                        .build(signer, publicKey));
+        gen.addCertificates(certs);
+        CMSSignedData sigData = gen.generate(data, false);
+        ASN1InputStream asn1 = new ASN1InputStream(sigData.getEncoded());
+        ASN1OutputStream dos = ASN1OutputStream.create(out, ASN1Encoding.DER);
+        dos.writeObject(asn1.readObject());
+    }
+
+    /**
+     * Copy all the files in a manifest from input to output.  We set
+     * the modification times in the output to a fixed time, so as to
+     * reduce variation in the output file and make incremental OTAs
+     * more efficient.
+     */
+    private static void copyFiles(Manifest manifest, JarMap in, JarOutputStream out,
+                                  long timestamp, int alignment) throws IOException {
+        byte[] buffer = new byte[4096];
+        int num;
+        Map<String, Attributes> entries = manifest.getEntries();
+        ArrayList<String> names = new ArrayList<>(entries.keySet());
+        Collections.sort(names);
+        boolean firstEntry = true;
+        long offset = 0L;
+        // We do the copy in two passes -- first copying all the
+        // entries that are STORED, then copying all the entries that
+        // have any other compression flag (which in practice means
+        // DEFLATED).  This groups all the stored entries together at
+        // the start of the file and makes it easier to do alignment
+        // on them (since only stored entries are aligned).
+        for (String name : names) {
+            JarEntry inEntry = in.getJarEntry(name);
+            JarEntry outEntry = null;
+            if (inEntry.getMethod() != JarEntry.STORED) continue;
+            // Preserve the STORED method of the input entry.
+            outEntry = new JarEntry(inEntry);
+            outEntry.setTime(timestamp);
+            // 'offset' is the offset into the file at which we expect
+            // the file data to begin.  This is the value we need to
+            // make a multiple of 'alignement'.
+            offset += JarFile.LOCHDR + outEntry.getName().length();
+            if (firstEntry) {
+                // The first entry in a jar file has an extra field of
+                // four bytes that you can't get rid of; any extra
+                // data you specify in the JarEntry is appended to
+                // these forced four bytes.  This is JAR_MAGIC in
+                // JarOutputStream; the bytes are 0xfeca0000.
+                offset += 4;
+                firstEntry = false;
+            }
+            if (alignment > 0 && (offset % alignment != 0)) {
+                // Set the "extra data" of the entry to between 1 and
+                // alignment-1 bytes, to make the file data begin at
+                // an aligned offset.
+                int needed = alignment - (int)(offset % alignment);
+                outEntry.setExtra(new byte[needed]);
+                offset += needed;
+            }
+            out.putNextEntry(outEntry);
+            InputStream data = in.getInputStream(inEntry);
+            while ((num = data.read(buffer)) > 0) {
+                out.write(buffer, 0, num);
+                offset += num;
+            }
+            out.flush();
+        }
+        // Copy all the non-STORED entries.  We don't attempt to
+        // maintain the 'offset' variable past this point; we don't do
+        // alignment on these entries.
+        for (String name : names) {
+            JarEntry inEntry = in.getJarEntry(name);
+            JarEntry outEntry = null;
+            if (inEntry.getMethod() == JarEntry.STORED) continue;
+            // Create a new entry so that the compressed len is recomputed.
+            outEntry = new JarEntry(name);
+            outEntry.setTime(timestamp);
+            out.putNextEntry(outEntry);
+            InputStream data = in.getInputStream(inEntry);
+            while ((num = data.read(buffer)) > 0) {
+                out.write(buffer, 0, num);
+            }
+            out.flush();
+        }
+    }
+
+    // This class is to provide a file's content, but trimming out the last two bytes
+    // Used for signWholeFile
+    private static class CMSProcessableFile implements CMSTypedData {
+
+        private ASN1ObjectIdentifier type;
+        private RandomAccessFile file;
+
+        CMSProcessableFile(File file) throws FileNotFoundException {
+            this.file = new RandomAccessFile(file, "r");
+            type = new ASN1ObjectIdentifier(CMSObjectIdentifiers.data.getId());
+        }
+
+        @Override
+        public ASN1ObjectIdentifier getContentType() {
+            return type;
+        }
+
+        @Override
+        public void write(OutputStream out) throws IOException, CMSException {
+            file.seek(0);
+            int read;
+            byte buffer[] = new byte[4096];
+            int len = (int) file.length() - 2;
+            while ((read = file.read(buffer, 0, len < buffer.length ? len : buffer.length)) > 0) {
+                out.write(buffer, 0, read);
+                len -= read;
+            }
+        }
+
+        @Override
+        public Object getContent() {
+            return file;
+        }
+
+        byte[] getTail() throws IOException {
+            byte tail[] = new byte[22];
+            file.seek(file.length() - 22);
+            file.readFully(tail);
+            return tail;
+        }
+    }
+
+    private static void signWholeFile(File input, X509Certificate publicKey,
+                                      PrivateKey privateKey, OutputStream outputStream)
+            throws Exception {
+        ByteArrayOutputStream temp = new ByteArrayOutputStream();
+        // put a readable message and a null char at the start of the
+        // archive comment, so that tools that display the comment
+        // (hopefully) show something sensible.
+        // TODO: anything more useful we can put in this message?
+        byte[] message = "signed by SignApk".getBytes("UTF-8");
+        temp.write(message);
+        temp.write(0);
+
+        CMSProcessableFile cmsFile = new CMSProcessableFile(input);
+        writeSignatureBlock(cmsFile, publicKey, privateKey, temp);
+
+        // For a zip with no archive comment, the
+        // end-of-central-directory record will be 22 bytes long, so
+        // we expect to find the EOCD marker 22 bytes from the end.
+        byte[] zipData = cmsFile.getTail();
+        if (zipData[zipData.length-22] != 0x50 ||
+                zipData[zipData.length-21] != 0x4b ||
+                zipData[zipData.length-20] != 0x05 ||
+                zipData[zipData.length-19] != 0x06) {
+            throw new IllegalArgumentException("zip data already has an archive comment");
+        }
+        int total_size = temp.size() + 6;
+        if (total_size > 0xffff) {
+            throw new IllegalArgumentException("signature is too big for ZIP file comment");
+        }
+        // signature starts this many bytes from the end of the file
+        int signature_start = total_size - message.length - 1;
+        temp.write(signature_start & 0xff);
+        temp.write((signature_start >> 8) & 0xff);
+        // Why the 0xff bytes?  In a zip file with no archive comment,
+        // bytes [-6:-2] of the file are the little-endian offset from
+        // the start of the file to the central directory.  So for the
+        // two high bytes to be 0xff 0xff, the archive would have to
+        // be nearly 4GB in size.  So it's unlikely that a real
+        // commentless archive would have 0xffs here, and lets us tell
+        // an old signed archive from a new one.
+        temp.write(0xff);
+        temp.write(0xff);
+        temp.write(total_size & 0xff);
+        temp.write((total_size >> 8) & 0xff);
+        temp.flush();
+        // Signature verification checks that the EOCD header is the
+        // last such sequence in the file (to avoid minzip finding a
+        // fake EOCD appended after the signature in its scan).  The
+        // odds of producing this sequence by chance are very low, but
+        // let's catch it here if it does.
+        byte[] b = temp.toByteArray();
+        for (int i = 0; i < b.length-3; ++i) {
+            if (b[i] == 0x50 && b[i+1] == 0x4b && b[i+2] == 0x05 && b[i+3] == 0x06) {
+                throw new IllegalArgumentException("found spurious EOCD header at " + i);
+            }
+        }
+        cmsFile.write(outputStream);
+        outputStream.write(total_size & 0xff);
+        outputStream.write((total_size >> 8) & 0xff);
+        temp.writeTo(outputStream);
+        outputStream.close();
+    }
+
+    private static void signFile(Manifest manifest, JarMap inputJar,
+                                 X509Certificate cert, PrivateKey privateKey,
+                                 JarOutputStream outputJar)
+            throws Exception {
+        // Assume the certificate is valid for at least an hour.
+        long timestamp = cert.getNotBefore().getTime() + 3600L * 1000;
+        // MANIFEST.MF
+        JarEntry je = new JarEntry(JarFile.MANIFEST_NAME);
+        je.setTime(timestamp);
+        outputJar.putNextEntry(je);
+        manifest.write(outputJar);
+        je = new JarEntry(CERT_SF_NAME);
+        je.setTime(timestamp);
+        outputJar.putNextEntry(je);
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        writeSignatureFile(manifest, baos, getDigestAlgorithm(cert));
+        byte[] signedData = baos.toByteArray();
+        outputJar.write(signedData);
+        // CERT.{EC,RSA} / CERT#.{EC,RSA}
+        final String keyType = cert.getPublicKey().getAlgorithm();
+        je = new JarEntry(String.format(CERT_SIG_NAME, keyType));
+        je.setTime(timestamp);
+        outputJar.putNextEntry(je);
+        writeSignatureBlock(new CMSProcessableByteArray(signedData),
+                cert, privateKey, outputJar);
+    }
+}
--- a/app/signing/src/main/java/com/topjohnwu/signing/SignBoot.java
+++ b/app/signing/src/main/java/com/topjohnwu/signing/SignBoot.java
@@ -0,0 +1,317 @@
+package com.topjohnwu.signing;
+
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1Integer;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DEROctetString;
+import org.bouncycastle.asn1.DERPrintableString;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+
+import java.io.ByteArrayInputStream;
+import java.io.FilterInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.Signature;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+
+public class SignBoot {
+
+    private static final int BOOT_IMAGE_HEADER_V1_RECOVERY_DTBO_SIZE_OFFSET = 1632;
+    private static final int BOOT_IMAGE_HEADER_V2_DTB_SIZE_OFFSET = 1648;
+
+    // Arbitrary maximum header version value; when greater assume the field is dt/extra size
+    private static final int BOOT_IMAGE_HEADER_VERSION_MAXIMUM = 8;
+
+    // Maximum header size byte value to read (currently the bootimg minimum page size)
+    private static final int BOOT_IMAGE_HEADER_SIZE_MAXIMUM = 2048;
+
+    private static class PushBackRWStream extends FilterInputStream {
+        private OutputStream out;
+        private int pos = 0;
+        private byte[] backBuf;
+
+        PushBackRWStream(InputStream in, OutputStream o) {
+            super(in);
+            out = o;
+        }
+
+        @Override
+        public int read() throws IOException {
+            int b;
+            if (backBuf != null && backBuf.length > pos) {
+                b = backBuf[pos++];
+            } else {
+                b = super.read();
+                out.write(b);
+            }
+            return b;
+        }
+
+        @Override
+        public int read(byte[] bytes, int off, int len) throws IOException {
+            int read = 0;
+            if (backBuf != null && backBuf.length > pos) {
+                read = Math.min(len, backBuf.length - pos);
+                System.arraycopy(backBuf, pos, bytes, off, read);
+                pos += read;
+                off += read;
+                len -= read;
+            }
+            if (len > 0) {
+                int ar = super.read(bytes, off, len);
+                read += ar;
+                out.write(bytes, off, ar);
+            }
+            return read;
+        }
+
+        void unread(byte[] buf) {
+            backBuf = buf;
+        }
+    }
+
+    public static boolean doSignature(String target, InputStream imgIn, OutputStream imgOut,
+                                      InputStream cert, InputStream key) {
+        try {
+            PushBackRWStream in = new PushBackRWStream(imgIn, imgOut);
+            byte[] hdr = new byte[BOOT_IMAGE_HEADER_SIZE_MAXIMUM];
+            // First read the header
+            in.read(hdr);
+            int signableSize = getSignableImageSize(hdr);
+            // Unread header
+            in.unread(hdr);
+            BootSignature bootsig = new BootSignature(target, signableSize);
+            if (cert == null) {
+                cert = SignBoot.class.getResourceAsStream("/keys/verity.x509.pem");
+            }
+            X509Certificate certificate = CryptoUtils.readCertificate(cert);
+            bootsig.setCertificate(certificate);
+            if (key == null) {
+                key = SignBoot.class.getResourceAsStream("/keys/verity.pk8");
+            }
+            PrivateKey privateKey = CryptoUtils.readPrivateKey(key);
+            byte[] sig = bootsig.sign(privateKey, in, signableSize);
+            bootsig.setSignature(sig, CryptoUtils.getSignatureAlgorithmIdentifier(privateKey));
+            byte[] encoded_bootsig = bootsig.getEncoded();
+            imgOut.write(encoded_bootsig);
+            imgOut.flush();
+            return true;
+        } catch (Exception e) {
+            e.printStackTrace();
+            return false;
+        }
+    }
+
+    public static boolean verifySignature(InputStream imgIn, InputStream certIn) {
+        try {
+            // Read the header for size
+            byte[] hdr = new byte[BOOT_IMAGE_HEADER_SIZE_MAXIMUM];
+            if (imgIn.read(hdr) != hdr.length) {
+                System.err.println("Unable to read image header");
+                return false;
+            }
+            int signableSize = getSignableImageSize(hdr);
+
+            // Read the rest of the image
+            byte[] rawImg = Arrays.copyOf(hdr, signableSize);
+            int remain = signableSize - hdr.length;
+            if (imgIn.read(rawImg, hdr.length, remain) != remain) {
+                System.err.println("Unable to read image");
+                return false;
+            }
+
+            // Read footer, which contains the signature
+            byte[] signature = new byte[4096];
+            if (imgIn.read(signature) == -1 || Arrays.equals(signature, new byte [signature.length])) {
+                System.err.println("Invalid image: not signed");
+                return false;
+            }
+
+            BootSignature bootsig = new BootSignature(signature);
+            if (certIn != null) {
+                bootsig.setCertificate(CryptoUtils.readCertificate(certIn));
+            }
+            if (bootsig.verify(rawImg, signableSize)) {
+                System.err.println("Signature is VALID");
+                return true;
+            } else {
+                System.err.println("Signature is INVALID");
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+            return false;
+        }
+        return false;
+    }
+
+    public static int getSignableImageSize(byte[] data) throws Exception {
+        if (!Arrays.equals(Arrays.copyOfRange(data, 0, 8),
+                "ANDROID!".getBytes("US-ASCII"))) {
+            throw new IllegalArgumentException("Invalid image header: missing magic");
+        }
+        ByteBuffer image = ByteBuffer.wrap(data);
+        image.order(ByteOrder.LITTLE_ENDIAN);
+        image.getLong(); // magic
+        int kernelSize = image.getInt();
+        image.getInt(); // kernel_addr
+        int ramdskSize = image.getInt();
+        image.getInt(); // ramdisk_addr
+        int secondSize = image.getInt();
+        image.getLong(); // second_addr + tags_addr
+        int pageSize = image.getInt();
+        int length = pageSize // include the page aligned image header
+                + ((kernelSize + pageSize - 1) / pageSize) * pageSize
+                + ((ramdskSize + pageSize - 1) / pageSize) * pageSize
+                + ((secondSize + pageSize - 1) / pageSize) * pageSize;
+        int headerVersion = image.getInt(); // boot image header version or dt/extra size
+        if (headerVersion > 0 && headerVersion < BOOT_IMAGE_HEADER_VERSION_MAXIMUM) {
+            image.position(BOOT_IMAGE_HEADER_V1_RECOVERY_DTBO_SIZE_OFFSET);
+            int recoveryDtboLength = image.getInt();
+            length += ((recoveryDtboLength + pageSize - 1) / pageSize) * pageSize;
+            image.getLong(); // recovery_dtbo address
+            int headerSize = image.getInt();
+            if (headerVersion == 2) {
+                image.position(BOOT_IMAGE_HEADER_V2_DTB_SIZE_OFFSET);
+                int dtbLength = image.getInt();
+                length += ((dtbLength + pageSize - 1) / pageSize) * pageSize;
+                image.getLong(); // dtb address
+            }
+            if (image.position() != headerSize) {
+                throw new IllegalArgumentException(
+                        "Invalid image header: invalid header length");
+            }
+        } else {
+            // headerVersion is 0 or actually dt/extra size in this case
+            length += ((headerVersion + pageSize - 1) / pageSize) * pageSize;
+        }
+        length = ((length + pageSize - 1) / pageSize) * pageSize;
+        if (length <= 0) {
+            throw new IllegalArgumentException("Invalid image header: invalid length");
+        }
+        return length;
+    }
+
+    static class BootSignature extends ASN1Object {
+        private ASN1Integer formatVersion;
+        private ASN1Encodable certificate;
+        private AlgorithmIdentifier algId;
+        private DERPrintableString target;
+        private ASN1Integer length;
+        private DEROctetString signature;
+        private PublicKey publicKey;
+        private static final int FORMAT_VERSION = 1;
+
+        /**
+         * Initializes the object for signing an image file
+         * @param target Target name, included in the signed data
+         * @param length Length of the image, included in the signed data
+         */
+        public BootSignature(String target, int length) {
+            this.formatVersion = new ASN1Integer(FORMAT_VERSION);
+            this.target = new DERPrintableString(target);
+            this.length = new ASN1Integer(length);
+        }
+
+        /**
+         * Initializes the object for verifying a signed image file
+         * @param signature Signature footer
+         */
+        public BootSignature(byte[] signature) throws Exception {
+            ASN1InputStream stream = new ASN1InputStream(signature);
+            ASN1Sequence sequence = (ASN1Sequence) stream.readObject();
+            formatVersion = (ASN1Integer) sequence.getObjectAt(0);
+            if (formatVersion.getValue().intValue() != FORMAT_VERSION) {
+                throw new IllegalArgumentException("Unsupported format version");
+            }
+            certificate = sequence.getObjectAt(1);
+            byte[] encoded = ((ASN1Object) certificate).getEncoded();
+            ByteArrayInputStream bis = new ByteArrayInputStream(encoded);
+            CertificateFactory cf = CertificateFactory.getInstance("X.509");
+            X509Certificate c = (X509Certificate) cf.generateCertificate(bis);
+            publicKey = c.getPublicKey();
+            ASN1Sequence algId = (ASN1Sequence) sequence.getObjectAt(2);
+            this.algId = new AlgorithmIdentifier((ASN1ObjectIdentifier) algId.getObjectAt(0));
+            ASN1Sequence attrs = (ASN1Sequence) sequence.getObjectAt(3);
+            target = (DERPrintableString) attrs.getObjectAt(0);
+            length = (ASN1Integer) attrs.getObjectAt(1);
+            this.signature = (DEROctetString) sequence.getObjectAt(4);
+        }
+
+        public ASN1Object getAuthenticatedAttributes() {
+            ASN1EncodableVector attrs = new ASN1EncodableVector();
+            attrs.add(target);
+            attrs.add(length);
+            return new DERSequence(attrs);
+        }
+
+        public byte[] getEncodedAuthenticatedAttributes() throws IOException {
+            return getAuthenticatedAttributes().getEncoded();
+        }
+
+        public void setSignature(byte[] sig, AlgorithmIdentifier algId) {
+            this.algId = algId;
+            signature = new DEROctetString(sig);
+        }
+
+        public void setCertificate(X509Certificate cert)
+                throws CertificateEncodingException, IOException {
+            ASN1InputStream s = new ASN1InputStream(cert.getEncoded());
+            certificate = s.readObject();
+            publicKey = cert.getPublicKey();
+        }
+
+        public byte[] sign(PrivateKey key, InputStream is, int len) throws Exception {
+            Signature signer = Signature.getInstance(CryptoUtils.getSignatureAlgorithm(key));
+            signer.initSign(key);
+            int read;
+            byte buffer[] = new byte[4096];
+            while ((read = is.read(buffer, 0, Math.min(len, buffer.length))) > 0) {
+                signer.update(buffer, 0, read);
+                len -= read;
+            }
+            signer.update(getEncodedAuthenticatedAttributes());
+            return signer.sign();
+        }
+
+        public boolean verify(byte[] image, int length) throws Exception {
+            if (this.length.getValue().intValue() != length) {
+                throw new IllegalArgumentException("Invalid image length");
+            }
+            String algName = CryptoUtils.ID_TO_ALG.get(algId.getAlgorithm().getId());
+            if (algName == null) {
+                throw new IllegalArgumentException("Unsupported algorithm " + algId.getAlgorithm());
+            }
+            Signature verifier = Signature.getInstance(algName);
+            verifier.initVerify(publicKey);
+            verifier.update(image, 0, length);
+            verifier.update(getEncodedAuthenticatedAttributes());
+            return verifier.verify(signature.getOctets());
+        }
+
+        @Override
+        public ASN1Primitive toASN1Primitive() {
+            ASN1EncodableVector v = new ASN1EncodableVector();
+            v.add(formatVersion);
+            v.add(certificate);
+            v.add(algId);
+            v.add(getAuthenticatedAttributes());
+            v.add(signature);
+            return new DERSequence(v);
+        }
+
+    }
+}
--- a/app/signing/src/main/java/com/topjohnwu/signing/ZipAdjust.java
+++ b/app/signing/src/main/java/com/topjohnwu/signing/ZipAdjust.java
@@ -0,0 +1,277 @@
+package com.topjohnwu.signing;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.io.RandomAccessFile;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+
+public class ZipAdjust {
+
+    public static void adjust(File input, File output) throws IOException {
+        try (
+            RandomAccessFile in = new RandomAccessFile(input, "r");
+            FileOutputStream out = new FileOutputStream(output)
+        ) {
+            adjust(in, out);
+        }
+    }
+
+    public static void adjust(RandomAccessFile in, OutputStream out) throws IOException {
+
+        CentralFooter footer = new CentralFooter(in);
+        int outOff = 0;
+        long centralOff = unsigned(footer.centralDirectoryOffset);
+        CentralHeader[] centralHeaders = new CentralHeader[unsigned(footer.numEntries)];
+
+        // Loop through central directory entries
+        for (int i = 0; i < centralHeaders.length; ++i) {
+            // Read central header
+            in.seek(centralOff);
+            centralHeaders[i] = new CentralHeader(in);
+            centralOff = in.getFilePointer();
+
+            // Read local header
+            in.seek(unsigned(centralHeaders[i].localHeaderOffset));
+            LocalHeader localHeader = new LocalHeader(in);
+
+            // Make sure local and central headers matches, and strip out data descriptor flag
+            centralHeaders[i].localHeaderOffset = outOff;
+            centralHeaders[i].flags &= ~(1 << 3);
+            localHeader.flags = centralHeaders[i].flags;
+            localHeader.crc32 = centralHeaders[i].crc32;
+            localHeader.compressedSize = centralHeaders[i].compressedSize;
+            localHeader.uncompressedSize = centralHeaders[i].uncompressedSize;
+            localHeader.fileNameLength = centralHeaders[i].fileNameLength;
+            localHeader.filename = centralHeaders[i].filename;
+
+            // Write local header
+            outOff += localHeader.write(out);
+
+            // Copy data
+            int read;
+            long len = unsigned(localHeader.compressedSize);
+            outOff += len;
+            byte data[] = new byte[4096];
+            while ((read = in.read(data, 0,
+                    len < data.length ? (int) len : data.length)) > 0) {
+                out.write(data, 0, read);
+                len -= read;
+            }
+        }
+
+        footer.centralDirectoryOffset = outOff;
+
+        // Write central directory
+        outOff = 0;
+        for (CentralHeader header : centralHeaders)
+            outOff += header.write(out);
+
+        // Write central directory record
+        footer.centralDirectorySize = outOff;
+        footer.write(out);
+    }
+
+    public static short unsigned(byte n) {
+        return (short)(n & 0xff);
+    }
+
+    public static int unsigned(short n) {
+        return n & 0xffff;
+    }
+
+    public static long unsigned(int n) {
+        return n & 0xffffffffL;
+    }
+
+    public static class CentralFooter {
+
+        static final int MAGIC =  0x06054b50;
+        
+        int signature;
+        short diskNumber;
+        short centralDirectoryDiskNumber;
+        short numEntriesThisDisk;
+        short numEntries;
+        int centralDirectorySize;
+        int centralDirectoryOffset;
+        short zipCommentLength;
+        // byte[] comments;
+
+        CentralFooter(RandomAccessFile file) throws IOException {
+            byte[] buffer = new byte[22];
+            for (long i = file.length() - 4; i >= 0; --i) {
+                file.seek(i);
+                file.read(buffer, 0 ,4);
+                ByteBuffer buf = ByteBuffer.wrap(buffer).order(ByteOrder.LITTLE_ENDIAN);
+                signature = buf.getInt();
+                if (signature != MAGIC) {
+                    continue;
+                }
+                file.read(buffer, 4, buffer.length - 4);
+                diskNumber = buf.getShort();
+                centralDirectoryDiskNumber = buf.getShort();
+                numEntriesThisDisk = buf.getShort();
+                numEntries = buf.getShort();
+                centralDirectorySize = buf.getInt();
+                centralDirectoryOffset = buf.getInt();
+                zipCommentLength = buf.getShort();
+                break;
+            }
+        }
+
+        int write(OutputStream out) throws IOException {
+            byte[] buffer = new byte[22];
+            ByteBuffer buf = ByteBuffer.wrap(buffer).order(ByteOrder.LITTLE_ENDIAN);
+            buf.putInt(signature);
+            buf.putShort(diskNumber);
+            buf.putShort(centralDirectoryDiskNumber);
+            buf.putShort(numEntriesThisDisk);
+            buf.putShort(numEntries);
+            buf.putInt(centralDirectorySize);
+            buf.putInt(centralDirectoryOffset);
+            buf.putShort((short) 0);  // zipCommentLength
+            out.write(buffer);
+            return buffer.length;
+        }
+    }
+
+    static class CentralHeader {
+
+        static final int MAGIC =  0x02014b50;
+
+        int signature;
+        short versionMadeBy;
+        short versionNeededToExtract;
+        short flags;
+        short compressionMethod;
+        short lastModFileTime;
+        short lastModFileDate;
+        int crc32;
+        int compressedSize;
+        int uncompressedSize;
+        short fileNameLength;
+        short extraFieldLength;
+        short fileCommentLength;
+        short diskNumberStart;
+        short internalFileAttributes;
+        int externalFileAttributes;
+        int localHeaderOffset;
+        byte[] filename;
+        // byte[] extra;
+        // byte[] comment;
+
+        CentralHeader(RandomAccessFile file) throws IOException {
+            byte[] buffer = new byte[46];
+            file.read(buffer);
+            ByteBuffer buf = ByteBuffer.wrap(buffer).order(ByteOrder.LITTLE_ENDIAN);
+            signature = buf.getInt();
+            if (signature != MAGIC)
+                throw new IOException();
+            versionMadeBy = buf.getShort();
+            versionNeededToExtract = buf.getShort();
+            flags = buf.getShort();
+            compressionMethod = buf.getShort();
+            lastModFileTime = buf.getShort();
+            lastModFileDate = buf.getShort();
+            crc32 = buf.getInt();
+            compressedSize = buf.getInt();
+            uncompressedSize = buf.getInt();
+            fileNameLength = buf.getShort();
+            extraFieldLength = buf.getShort();
+            fileCommentLength = buf.getShort();
+            diskNumberStart = buf.getShort();
+            internalFileAttributes = buf.getShort();
+            externalFileAttributes = buf.getInt();
+            localHeaderOffset = buf.getInt();
+            filename = new byte[unsigned(fileNameLength)];
+            file.read(filename);
+            file.skipBytes(unsigned(extraFieldLength) + unsigned(fileCommentLength));
+        }
+
+        int write(OutputStream out) throws IOException {
+            byte[] buffer = new byte[46];
+            ByteBuffer buf = ByteBuffer.wrap(buffer).order(ByteOrder.LITTLE_ENDIAN);
+            buf.putInt(signature);
+            buf.putShort(versionMadeBy);
+            buf.putShort(versionNeededToExtract);
+            buf.putShort(flags);
+            buf.putShort(compressionMethod);
+            buf.putShort(lastModFileTime);
+            buf.putShort(lastModFileDate);
+            buf.putInt(crc32);
+            buf.putInt(compressedSize);
+            buf.putInt(uncompressedSize);
+            buf.putShort(fileNameLength);
+            buf.putShort((short) 0); // extraFieldLength
+            buf.putShort((short) 0); // fileCommentLength
+            buf.putShort(diskNumberStart);
+            buf.putShort(internalFileAttributes);
+            buf.putInt(externalFileAttributes);
+            buf.putInt(localHeaderOffset);
+            out.write(buffer);
+            out.write(filename);
+            return buffer.length + filename.length;
+        }
+    }
+
+    static class LocalHeader {
+
+        static final int MAGIC = 0x04034b50;
+
+        int signature;
+        short versionNeededToExtract;
+        short flags;
+        short compressionMethod;
+        short lastModFileTime;
+        short lastModFileDate;
+        int crc32;
+        int compressedSize;
+        int uncompressedSize;
+        short fileNameLength;
+        short extraFieldLength;
+        byte[] filename;
+        // byte[] extra;
+
+        LocalHeader(RandomAccessFile file) throws IOException {
+            byte[] buffer = new byte[30];
+            file.read(buffer);
+            ByteBuffer buf = ByteBuffer.wrap(buffer).order(ByteOrder.LITTLE_ENDIAN);
+            signature = buf.getInt();
+            if (signature != MAGIC)
+                throw new IOException();
+            versionNeededToExtract = buf.getShort();
+            flags = buf.getShort();
+            compressionMethod = buf.getShort();
+            lastModFileTime = buf.getShort();
+            lastModFileDate = buf.getShort();
+            crc32 = buf.getInt();
+            compressedSize = buf.getInt();
+            uncompressedSize = buf.getInt();
+            fileNameLength = buf.getShort();
+            extraFieldLength = buf.getShort();
+            file.skipBytes(unsigned(fileNameLength) + unsigned(extraFieldLength));
+        }
+
+        int write(OutputStream out) throws IOException {
+            byte[] buffer = new byte[30];
+            ByteBuffer buf = ByteBuffer.wrap(buffer).order(ByteOrder.LITTLE_ENDIAN);
+            buf.putInt(signature);
+            buf.putShort(versionNeededToExtract);
+            buf.putShort(flags);
+            buf.putShort(compressionMethod);
+            buf.putShort(lastModFileTime);
+            buf.putShort(lastModFileDate);
+            buf.putInt(crc32);
+            buf.putInt(compressedSize);
+            buf.putInt(uncompressedSize);
+            buf.putShort(fileNameLength);
+            buf.putShort((short) 0); // extraFieldLength
+            out.write(buffer);
+            out.write(filename);
+            return buffer.length + filename.length;
+        }
+    }
+}
--- a/app/signing/src/main/java/com/topjohnwu/signing/ZipSigner.java
+++ b/app/signing/src/main/java/com/topjohnwu/signing/ZipSigner.java
@@ -0,0 +1,82 @@
+package com.topjohnwu.signing;
+
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.Security;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+
+public class ZipSigner {
+
+    private static void usage() {
+        System.err.println("ZipSigner usage:");
+        System.err.println("  zipsigner.jar input.jar output.jar");
+        System.err.println("    sign jar with AOSP test keys");
+        System.err.println("  zipsigner.jar x509.pem pk8 input.jar output.jar");
+        System.err.println("    sign jar with certificate / private key pair");
+        System.err.println("  zipsigner.jar keyStore keyStorePass alias keyPass input.jar output.jar");
+        System.err.println("    sign jar with Java KeyStore");
+        System.exit(2);
+    }
+
+    private static void sign(JarMap input, OutputStream output) throws Exception {
+        sign(SignAPK.class.getResourceAsStream("/keys/testkey.x509.pem"),
+                SignAPK.class.getResourceAsStream("/keys/testkey.pk8"), input, output);
+    }
+
+    private static void sign(InputStream certIs, InputStream keyIs,
+                             JarMap input, OutputStream output) throws Exception {
+        X509Certificate cert = CryptoUtils.readCertificate(certIs);
+        PrivateKey key = CryptoUtils.readPrivateKey(keyIs);
+        SignAPK.signAndAdjust(cert, key, input, output);
+    }
+
+    private static void sign(String keyStore, String keyStorePass, String alias, String keyPass,
+                             JarMap in, OutputStream out) throws Exception {
+        KeyStore ks;
+        try {
+            ks = KeyStore.getInstance("JKS");
+            try (InputStream is = new FileInputStream(keyStore)) {
+                ks.load(is, keyStorePass.toCharArray());
+            }
+        } catch (KeyStoreException|IOException|CertificateException|NoSuchAlgorithmException e) {
+            ks = KeyStore.getInstance("PKCS12");
+            try (InputStream is = new FileInputStream(keyStore)) {
+                ks.load(is, keyStorePass.toCharArray());
+            }
+        }
+        X509Certificate cert = (X509Certificate) ks.getCertificate(alias);
+        PrivateKey key = (PrivateKey) ks.getKey(alias, keyPass.toCharArray());
+        SignAPK.signAndAdjust(cert, key, in, out);
+    }
+
+    public static void main(String[] args) throws Exception {
+        if (args.length != 2 && args.length != 4 && args.length != 6)
+            usage();
+
+        Security.insertProviderAt(new BouncyCastleProvider(), 1);
+
+        try (JarMap in = JarMap.open(args[args.length - 2], false);
+             OutputStream out = new FileOutputStream(args[args.length - 1])) {
+            if (args.length == 2) {
+                sign(in, out);
+            } else if (args.length == 4) {
+                try (InputStream cert = new FileInputStream(args[0]);
+                     InputStream key = new FileInputStream(args[1])) {
+                    sign(cert, key, in, out);
+                }
+            } else if (args.length == 6) {
+                sign(args[0], args[1], args[2], args[3], in, out);
+            }
+        }
+    }
+}
--- a/app/signing/src/main/resources/keys/testkey.pk8
+++ b/app/signing/src/main/resources/keys/testkey.pk8
--- a/app/signing/src/main/resources/keys/testkey.x509.pem
+++ b/app/signing/src/main/resources/keys/testkey.x509.pem
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEqDCCA5CgAwIBAgIJAJNurL4H8gHfMA0GCSqGSIb3DQEBBQUAMIGUMQswCQYD
+VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4g
+VmlldzEQMA4GA1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UE
+AxMHQW5kcm9pZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTAe
+Fw0wODAyMjkwMTMzNDZaFw0zNTA3MTcwMTMzNDZaMIGUMQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4G
+A1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9p
+ZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTCCASAwDQYJKoZI
+hvcNAQEBBQADggENADCCAQgCggEBANaTGQTexgskse3HYuDZ2CU+Ps1s6x3i/waM
+qOi8qM1r03hupwqnbOYOuw+ZNVn/2T53qUPn6D1LZLjk/qLT5lbx4meoG7+yMLV4
+wgRDvkxyGLhG9SEVhvA4oU6Jwr44f46+z4/Kw9oe4zDJ6pPQp8PcSvNQIg1QCAcy
+4ICXF+5qBTNZ5qaU7Cyz8oSgpGbIepTYOzEJOmc3Li9kEsBubULxWBjf/gOBzAzU
+RNps3cO4JFgZSAGzJWQTT7/emMkod0jb9WdqVA2BVMi7yge54kdVMxHEa5r3b97s
+zI5p58ii0I54JiCUP5lyfTwE/nKZHZnfm644oLIXf6MdW2r+6R8CAQOjgfwwgfkw
+HQYDVR0OBBYEFEhZAFY9JyxGrhGGBaR0GawJyowRMIHJBgNVHSMEgcEwgb6AFEhZ
+AFY9JyxGrhGGBaR0GawJyowRoYGapIGXMIGUMQswCQYDVQQGEwJVUzETMBEGA1UE
+CBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4GA1UEChMH
+QW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEiMCAG
+CSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbYIJAJNurL4H8gHfMAwGA1Ud
+EwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAHqvlozrUMRBBVEY0NqrrwFbinZa
+J6cVosK0TyIUFf/azgMJWr+kLfcHCHJsIGnlw27drgQAvilFLAhLwn62oX6snb4Y
+LCBOsVMR9FXYJLZW2+TcIkCRLXWG/oiVHQGo/rWuWkJgU134NDEFJCJGjDbiLCpe
+ZTWHdcwauTJ9pUbo8EvHRkU3cYfGmLaLfgn9gP+pWA7LFQNvXwBnDa6sppCccEX
+31I828XzgXpJ4O+mDL1/dBd+ek8ZPUP0IgdyZm5MTYPhvVqGCHzzTy3sIeJFymwr
+sBbmg2OAUNLEMO6nwmocSdN2ClirfxqCzJOLSDE4QyS9BAH6EhY6UFcOaE0=
+-----END CERTIFICATE-----
--- a/app/signing/src/main/resources/keys/verity.pk8
+++ b/app/signing/src/main/resources/keys/verity.pk8
--- a/app/signing/src/main/resources/keys/verity.x509.pem
+++ b/app/signing/src/main/resources/keys/verity.x509.pem
@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIID/TCCAuWgAwIBAgIJAJcPmDkJqolJMA0GCSqGSIb3DQEBBQUAMIGUMQswCQYD
+VQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4g
+VmlldzEQMA4GA1UECgwHQW5kcm9pZDEQMA4GA1UECwwHQW5kcm9pZDEQMA4GA1UE
+AwwHQW5kcm9pZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTAe
+Fw0xNDExMDYxOTA3NDBaFw00MjAzMjQxOTA3NDBaMIGUMQswCQYDVQQGEwJVUzET
+MBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEQMA4G
+A1UECgwHQW5kcm9pZDEQMA4GA1UECwwHQW5kcm9pZDEQMA4GA1UEAwwHQW5kcm9p
+ZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAOjreE0vTVSRenuzO9vnaWfk0eQzYab0gqpi
+6xAzi6dmD+ugoEKJmbPiuE5Dwf21isZ9uhUUu0dQM46dK4ocKxMRrcnmGxydFn6o
+fs3ODJMXOkv2gKXL/FdbEPdDbxzdu8z3yk+W67udM/fW7WbaQ3DO0knu+izKak/3
+T41c5uoXmQ81UNtAzRGzGchNVXMmWuTGOkg6U+0I2Td7K8yvUMWhAWPPpKLtVH9r
+AL5TzjYNR92izdKcz3AjRsI3CTjtpiVABGeX0TcjRSuZB7K9EK56HV+OFNS6I1NP
+jdD7FIShyGlqqZdUOkAUZYanbpgeT5N7QL6uuqcGpoTOkalu6kkCAwEAAaNQME4w
+HQYDVR0OBBYEFH5DM/m7oArf4O3peeKO0ZIEkrQPMB8GA1UdIwQYMBaAFH5DM/m7
+oArf4O3peeKO0ZIEkrQPMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEB
+AHO3NSvDE5jFvMehGGtS8BnFYdFKRIglDMc4niWSzhzOVYRH4WajxdtBWc5fx0ix
+NF/+hVKVhP6AIOQa+++sk+HIi7RvioPPbhjcsVlZe7cUEGrLSSveGouQyc+j0+m6
+JF84kszIl5GGNMTnx0XRPO+g8t6h5LWfnVydgZfpGRRg+WHewk1U2HlvTjIceb0N
+dcoJ8WKJAFWdcuE7VIm4w+vF/DYX/A2Oyzr2+QRhmYSv1cusgAeC1tvH4ap+J1Lg
+UnOu5Kh/FqPLLSwNVQp4Bu7b9QFfqK8Moj84bj88NqRGZgDyqzuTrFxn6FW7dmyA
+yttuAJAEAymk1mipd9+zp38=
+-----END CERTIFICATE-----