diff --git a/interfaces/innerkits/appverify_lite/BUILD.gn b/interfaces/innerkits/appverify_lite/BUILD.gn index fe3cfcfdacf6e8213667b776b5da7a855bc32d63..10420c0bbbe4ff1d6173ea509be662172e4e5530 100644 --- a/interfaces/innerkits/appverify_lite/BUILD.gn +++ b/interfaces/innerkits/appverify_lite/BUILD.gn @@ -10,6 +10,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. +import("//build/lite/config/hap_pack.gni") config("app_verify_config") { include_dirs = [ @@ -22,6 +23,9 @@ config("app_verify_config") { ] defines = [ "PARSE_PEM_FORMAT_SIGNED_DATA" ] + if (ohos_sign_haps_by_server) { + defines += [ "OHOS_SIGN_HAPS_BY_SERVER" ] + } cflags = [ "-Wall" ] } diff --git a/interfaces/innerkits/appverify_lite/src/app_verify.c b/interfaces/innerkits/appverify_lite/src/app_verify.c index ea47814920447642168f57ef91045773ca8b6ea0..09e58a7b717a8f37f7c4caaca86dae70f800349b 100644 --- a/interfaces/innerkits/appverify_lite/src/app_verify.c +++ b/interfaces/innerkits/appverify_lite/src/app_verify.c @@ -50,6 +50,7 @@ static const TrustAppCert g_trustAppList[] = { "C=CN, O=Huawei CBG, OU=HOS Development Team, CN=HOS Application Provision Profile Release_Debug", .issueCA = "C=CN, O=Huawei, OU=Huawei CBG, CN=Huawei CBG Software Signing Service CA", }, +#ifndef OHOS_SIGN_HAPS_BY_SERVER { .maxCertPath = CERT_MAX_DEPTH, .name = "huawei system apps", @@ -58,6 +59,7 @@ static const TrustAppCert g_trustAppList[] = { .profileDebugSignCert = "C=CN, O=OpenHarmony, OU=OpenHarmony Development Team, CN=OpenHarmony Software Signature", .issueCA = "C=CN, O=OpenHarmony, OU=OpenHarmony Development Team, CN=OpenHarmony Software Signature", }, +#endif }; static const TrustAppCert g_trustAppListTest[] = { diff --git a/interfaces/innerkits/appverify_lite/src/mbedtls_pkcs7.c b/interfaces/innerkits/appverify_lite/src/mbedtls_pkcs7.c index 61f31310d1fd3f69d8dec260a8888de6d68bdcac..3b4f5c32db3200154794311d9c69b977452032e1 100644 --- a/interfaces/innerkits/appverify_lite/src/mbedtls_pkcs7.c +++ b/interfaces/innerkits/appverify_lite/src/mbedtls_pkcs7.c @@ -1072,12 +1072,14 @@ int PKCS7_VerifyCertsChain(const Pkcs7 *pkcs7) if (rc == PKCS7_IS_REVOKED) { return PKCS7_IS_REVOKED; } +#ifndef OHOS_SIGN_HAPS_BY_SERVER rc = VerifyClicert(clicert, &g_selfSignedCert, pkcs7); LOG_DEBUG("Verify self : %d", rc); if (rc == PKCS7_SUCC) { signer = signer->next; continue; } +#endif return rc; } return PKCS7_SUCC; @@ -1321,8 +1323,10 @@ int PKCS7_ParseSignedData(const unsigned char *buf, size_t bufLen, Pkcs7 *pkcs7) /* loaded the root ca cert */ rc = LoadRootCert(); P_ERR_GOTO_WTTH_LOG(rc); +#ifndef OHOS_SIGN_HAPS_BY_SERVER rc = LoadSelfSignedCert(); P_ERR_GOTO_WTTH_LOG(rc); +#endif LOG_INFO("Begin to parse pkcs#7 signed data"); /* parse the ContentInfo total head */ rc = GetContentInfoType(&start, end, &(pkcs7->contentTypeOid), &hasContent); @@ -1358,5 +1362,7 @@ void PKCS7_FreeRes(Pkcs7 *pkcs7) FreeSignedDataCerts(pkcs7); FreeSignedDataCrl(pkcs7); UnLoadRootCert(); +#ifndef OHOS_SIGN_HAPS_BY_SERVER UnLoadSelfSignedCert(); +#endif }