From 8414168b5d2d53093ff49bf2779c86db81b7df1d Mon Sep 17 00:00:00 2001 From: fundavid Date: Tue, 30 Jul 2024 18:06:55 +0800 Subject: [PATCH 01/26] Intermediate CA verify Signed-off-by: fundavid --- interfaces/innerkits/local_code_sign/BUILD.gn | 3 + utils/src/huks_attest_verifier.cpp | 58 +++++++++++++++++-- 2 files changed, 57 insertions(+), 4 deletions(-) diff --git a/interfaces/innerkits/local_code_sign/BUILD.gn b/interfaces/innerkits/local_code_sign/BUILD.gn index 6257623..eeb2f96 100644 --- a/interfaces/innerkits/local_code_sign/BUILD.gn +++ b/interfaces/innerkits/local_code_sign/BUILD.gn @@ -44,6 +44,9 @@ ohos_shared_library("liblocal_code_sign_sdk") { if (build_variant == "root") { defines += [ "CODE_SIGNATURE_DEBUGGABLE" ] } + if (code_signature_support_oh_code_sign) { + defines += [ "VERIFY_KEY_ATTEST_CERTCHAIN" ] + } external_deps = [ "c_utils:utils", diff --git a/utils/src/huks_attest_verifier.cpp b/utils/src/huks_attest_verifier.cpp index 88dc72e..b9deed2 100644 --- a/utils/src/huks_attest_verifier.cpp +++ b/utils/src/huks_attest_verifier.cpp @@ -61,6 +61,9 @@ static bool g_verifierInited = false; static int g_saNid = 0; static int g_challengeNid = 0; static int g_attestationNid = 0; +#ifdef VERIFY_KEY_ATTEST_CERTCHAIN +static constexpr uint32_t COMMON_NAME_BUF_SIZE = 256; +#endif static inline int GetNidFromDefination(const std::vector &defVector) { @@ -273,6 +276,53 @@ static bool VerifyCertAndExtension(X509 *signCert, X509 *issuerCert, const ByteB return true; } +static bool VerifyIntermediateCASubject(const std::vector &certChainBuffer) +{ +#ifndef VERIFY_KEY_ATTEST_CERTCHAIN + LOG_INFO("Skip intermediate CA subject verification."); + return true; +#else + if (certChainBuffer.empty()) { + LOG_ERROR("The vector is empty"); + return false; + } + + auto certBuffer = certChainBuffer.back(); + X509 *cert = LoadCertFromBuffer(certBuffer.GetBuffer(), certBuffer.GetSize()); + if (cert == nullptr) { + LOG_ERROR("Load intermediate CA cert failed."); + return false; + } + + bool ret = false; + do { + X509_NAME *subjectName = X509_get_subject_name(cert); + if (subjectName == nullptr) { + LOG_ERROR("Get subject name failed."); + break; + } + + char commonNameBuf[COMMON_NAME_BUF_SIZE] = {0}; + int len = X509_NAME_get_text_by_NID(subjectName, NID_commonName, commonNameBuf, COMMON_NAME_BUF_SIZE); + if (len <= 0) { + LOG_ERROR("Get common name failed."); + break; + } + + if (!strstr(commonNameBuf, "Huawei CBG Mobile Equipment CA") && + !strstr(commonNameBuf, "Huawei CBG Equipment S2 CA") && + !strstr(commonNameBuf, "Huawei CBG Equipment S3 CA")) { + LOG_ERROR("Intermediate CA common name not matched, common name:%{private}s", commonNameBuf); + break; + } + + ret = true; + } while (0); + + X509_free(cert); + return ret; +#endif +} bool GetVerifiedCert(const ByteBuffer &buffer, const ByteBuffer &challenge, ByteBuffer &certBuffer) { @@ -282,13 +332,11 @@ bool GetVerifiedCert(const ByteBuffer &buffer, const ByteBuffer &challenge, Byte LOG_ERROR("Get cert chain failed."); return false; } - X509 *issuerCert = LoadCertFromBuffer(issuerBuffer.GetBuffer(), issuerBuffer.GetSize()); if (issuerCert == nullptr) { LOG_ERROR("Load issuerCert cert failed."); return false; } - bool ret = false; X509 *signCert = nullptr; STACK_OF(X509 *) certChain = nullptr; @@ -298,18 +346,20 @@ bool GetVerifiedCert(const ByteBuffer &buffer, const ByteBuffer &challenge, Byte LOG_ERROR("Load cert chain failed."); break; } + if (!VerifyIntermediateCASubject(certChainBuffer)) { + LOG_ERROR("Failed to verify the Intermediate CA subject."); + break; + } if (!VerifyIssurCert(issuerCert, certChain)) { LOG_ERROR("Verify issuer cert not pass."); break; } LOG_DEBUG("Verify issuer cert pass"); - signCert = LoadCertFromBuffer(certBuffer.GetBuffer(), certBuffer.GetSize()); if (signCert == nullptr) { LOG_ERROR("Load signing cert failed."); break; } - if (!VerifyCertAndExtension(signCert, issuerCert, challenge)) { break; } -- Gitee From bbc9d5604a369f0fc8c5f1c1837b7a07e28cefa3 Mon Sep 17 00:00:00 2001 From: yeyuning Date: Wed, 10 Jul 2024 15:40:45 +0800 Subject: [PATCH 02/26] =?UTF-8?q?=E4=B8=8D=E8=A7=A3=E5=8E=8Bso?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: yeyuning Change-Id: Ic32a26b12d8f14959fce114c53486642bd8258b9 --- .../code_sign_utils/src/code_sign_helper.cpp | 5 +- interfaces/innerkits/common/include/errcode.h | 4 +- test/unittest/code_sign_utils_test.cpp | 156 ++++++++++++++++++ utils/include/code_sign_block.h | 19 ++- utils/src/code_sign_block.cpp | 71 ++++++-- 5 files changed, 237 insertions(+), 18 deletions(-) diff --git a/interfaces/innerkits/code_sign_utils/src/code_sign_helper.cpp b/interfaces/innerkits/code_sign_utils/src/code_sign_helper.cpp index e21bd68..fd8ec19 100644 --- a/interfaces/innerkits/code_sign_utils/src/code_sign_helper.cpp +++ b/interfaces/innerkits/code_sign_utils/src/code_sign_helper.cpp @@ -88,10 +88,11 @@ void CodeSignHelper::ShowCodeSignInfo(const std::string &path, const struct code "file:%{public}s version:%{public}d hash_algorithm:%{public}d block_size:%{public}d sig_size:%{public}d " "data_size:%{public}lld salt_size:%{public}d salt:[%{public}d, ..., %{public}d, ..., %{public}d] " "flags:%{public}d tree_offset:%{public}lld root_hash:[%{public}d, %{public}d, %{public}d, ..., %{public}d, " - "..., %{public}d] }", + "..., %{public}d] pgtypeinfo_size:%{public}d pgtypeinfo_off:%{public}lld }", path.c_str(), arg.cs_version, arg.hash_algorithm, arg.block_size, arg.sig_size, arg.data_size, arg.salt_size, salt[0], salt[16], salt[31], arg.flags, arg.tree_offset, // 16, 31 data index - rootHashPtr[0], rootHashPtr[1], rootHashPtr[2], rootHashPtr[32], rootHashPtr[63]); // 2, 32, 63 data index + rootHashPtr[0], rootHashPtr[1], rootHashPtr[2], rootHashPtr[32], rootHashPtr[63], // 2, 32, 63 data index + arg.pgtypeinfo_size, arg.pgtypeinfo_off); } } } diff --git a/interfaces/innerkits/common/include/errcode.h b/interfaces/innerkits/common/include/errcode.h index 3086f94..4652b4a 100644 --- a/interfaces/innerkits/common/include/errcode.h +++ b/interfaces/innerkits/common/include/errcode.h @@ -96,7 +96,9 @@ enum SignBlockErrCode { CS_ERR_SO_SIGN_OFFSET = -0x619, CS_ERR_SO_SIGN_SIZE = -0x620, CS_ERR_SIGN_ADDR_ALIGN = -0x621, - CS_ERR_SIGN_EXTENSION_OFFSET_ALIGN = -0x622, + CS_ERR_INVALID_EXTENSION_OFFSET = -0x622, + CS_ERR_INVALID_PAGE_INFO_EXTENSION = -0x623, + CS_ERR_EXTENSION_SIGN_SIZE = -0x624, }; enum JitCodeSignErrCode { diff --git a/test/unittest/code_sign_utils_test.cpp b/test/unittest/code_sign_utils_test.cpp index 478ffc1..0f87845 100644 --- a/test/unittest/code_sign_utils_test.cpp +++ b/test/unittest/code_sign_utils_test.cpp @@ -682,6 +682,162 @@ HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0026, TestSize.Level0) ret = utils.EnforceCodeSignForAppWithOwnerId("test-app-identifier", hapRealPath, entryMap, FILE_ALL); EXPECT_EQ(ret, CS_ERR_NO_SIGNATURE); } + +/** + * @tc.name: CodeSignUtilsTest_0027 + * @tc.desc: test Extension address is beyond the end of the block + * @tc.type: Func + * @tc.require: + */ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0027, TestSize.Level0) +{ + CodeSignBlock codeSignBlock; + uintptr_t block[100] = {0}; + uintptr_t blockAddrEnd = reinterpret_cast(block + sizeof(block)); + uintptr_t extensionAddr = blockAddrEnd + 1; + code_sign_enable_arg arg = {}; + + int32_t ret = codeSignBlock.ProcessExtension(extensionAddr, blockAddrEnd, arg); + EXPECT_EQ(ret, CS_ERR_INVALID_EXTENSION_OFFSET); +} + +/** + * @tc.name: CodeSignUtilsTest_0028 + * @tc.desc: test Extension header size exceeds block boundary + * @tc.type: Func + * @tc.require: + */ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0028, TestSize.Level0) +{ + CodeSignBlock codeSignBlock; + uintptr_t block[100] = {0}; + uintptr_t blockAddrEnd = reinterpret_cast(block + sizeof(block)); + uintptr_t extensionAddr = blockAddrEnd - sizeof(ExtensionHeader) + 1; + code_sign_enable_arg arg = {}; + + int32_t ret = codeSignBlock.ProcessExtension(extensionAddr, blockAddrEnd, arg); + EXPECT_EQ(ret, CS_ERR_INVALID_EXTENSION_OFFSET); +} + +/** + * @tc.name: CodeSignUtilsTest_0029 + * @tc.desc: test Process Merkle Tree Extension + * @tc.type: Func + * @tc.require: + */ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0029, TestSize.Level0) +{ + CodeSignBlock codeSignBlock; + struct { + ExtensionHeader header; + MerkleTreeExtension merkleTree; + } block; + block.header.type = CodeSignBlock::CSB_EXTENSION_TYPE_MERKLE_TREE; + block.header.size = sizeof(MerkleTreeExtension); + block.merkleTree.treeOffset = 123; + + uint8_t fakeRootHash[64] = {0xde, 0xad, 0xbe, 0xef}; + std::copy(std::begin(fakeRootHash), std::end(fakeRootHash), std::begin(block.merkleTree.rootHash)); + + uintptr_t blockAddrEnd = reinterpret_cast(&block + 1); + uintptr_t extensionAddr = reinterpret_cast(&block); + code_sign_enable_arg arg = {}; + + int32_t ret = codeSignBlock.ProcessExtension(extensionAddr, blockAddrEnd, arg); + EXPECT_EQ(ret, CS_SUCCESS); + EXPECT_EQ(arg.tree_offset, 123); + EXPECT_EQ(arg.root_hash_ptr, reinterpret_cast(block.merkleTree.rootHash)); + EXPECT_EQ(arg.flags, CodeSignBlock::CSB_SIGN_INFO_MERKLE_TREE); +} + +/** + * @tc.name: CodeSignUtilsTest_0030 + * @tc.desc: test Process Page Info Extension + * @tc.type: Func + * @tc.require: + */ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0030, TestSize.Level0) +{ + CodeSignBlock codeSignBlock; + struct { + ExtensionHeader header; + PageInfoExtension pageInfo; + } block; + block.header.type = CodeSignBlock::CSB_EXTENSION_TYPE_PAGE_INFO; + block.header.size = sizeof(PageInfoExtension) + 50; + block.pageInfo.sign_size = 30; + block.pageInfo.unitSize = 2; + + uint8_t fakeSignature[64] = {0xde, 0xad, 0xbe, 0xef}; + std::copy(std::begin(fakeSignature), std::begin(fakeSignature) + + block.pageInfo.sign_size, block.pageInfo.signature); + + block.pageInfo.mapSize = 100; + block.pageInfo.mapOffset = 200; + + uintptr_t blockAddrEnd = reinterpret_cast(&block + 1); + uintptr_t extensionAddr = reinterpret_cast(&block); + code_sign_enable_arg arg = {}; + + int32_t ret = codeSignBlock.ProcessExtension(extensionAddr, blockAddrEnd, arg); + EXPECT_EQ(ret, CS_SUCCESS); + EXPECT_EQ(arg.sig_size, 30); + EXPECT_EQ(arg.sig_ptr, reinterpret_cast(block.pageInfo.signature)); + EXPECT_EQ(arg.pgtypeinfo_size, 100); + EXPECT_EQ(arg.pgtypeinfo_off, 200); + EXPECT_EQ(arg.cs_version, CodeSignBlock::CSB_EXTENSION_TYPE_PAGE_INFO_VERSION); + EXPECT_EQ(arg.flags, 2 << 1); +} + +/** + * @tc.name: CodeSignUtilsTest_0031 + * @tc.desc: test Invalid Page Info Extension Sign Size + * @tc.type: Func + * @tc.require: + */ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0031, TestSize.Level0) +{ + CodeSignBlock codeSignBlock; + struct { + ExtensionHeader header; + PageInfoExtension pageInfo; + } block; + block.header.type = CodeSignBlock::CSB_EXTENSION_TYPE_PAGE_INFO; + block.header.size = sizeof(PageInfoExtension); + block.pageInfo.sign_size = sizeof(PageInfoExtension) + 1; + + uintptr_t blockAddrEnd = reinterpret_cast(&block + 1); + uintptr_t extensionAddr = reinterpret_cast(&block); + code_sign_enable_arg arg = {}; + + int32_t ret = codeSignBlock.ProcessExtension(extensionAddr, blockAddrEnd, arg); + EXPECT_EQ(ret, CS_ERR_EXTENSION_SIGN_SIZE); +} + +/** + * @tc.name: CodeSignUtilsTest_0032 + * @tc.desc: test invalid PageInfoExtension UnitSize + * @tc.type: Func + * @tc.require: + */ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0032, TestSize.Level0) +{ + CodeSignBlock codeSignBlock; + struct { + ExtensionHeader header; + PageInfoExtension pageInfo; + } block; + block.header.type = CodeSignBlock::CSB_EXTENSION_TYPE_PAGE_INFO; + block.header.size = sizeof(PageInfoExtension); + block.pageInfo.unitSize = CodeSignBlock::CSB_SIGN_INFO_MAX_PAGEINFO_UNITSIZE + 1; + + uintptr_t blockAddrEnd = reinterpret_cast(&block + 1); + uintptr_t extensionAddr = reinterpret_cast(&block); + code_sign_enable_arg arg = {}; + + int32_t ret = codeSignBlock.ProcessExtension(extensionAddr, blockAddrEnd, arg); + EXPECT_EQ(ret, CS_ERR_INVALID_PAGE_INFO_EXTENSION); +} } // namespace CodeSign } // namespace Security } // namespace OHOS diff --git a/utils/include/code_sign_block.h b/utils/include/code_sign_block.h index 98a9bf1..c56d646 100644 --- a/utils/include/code_sign_block.h +++ b/utils/include/code_sign_block.h @@ -62,13 +62,25 @@ typedef struct { } FsVerityInfo; typedef struct { - uint32_t type; // MERKLE_TREE_INCLUDE + uint32_t type; uint32_t size; +} ExtensionHeader; + +typedef struct { uint64_t treeSize; uint64_t treeOffset; uint8_t rootHash[64]; } MerkleTreeExtension; +typedef struct { + uint64_t mapOffset; + uint64_t mapSize; + uint8_t unitSize; + uint8_t reversed[3]; + uint32_t sign_size; + uint8_t signature[0]; +} PageInfoExtension; + typedef struct { uint32_t saltSize; uint32_t signSize; @@ -114,10 +126,15 @@ public: static constexpr uint32_t CSB_HAP_HEADER_MAGIC = 0xC1B5CC66; static constexpr uint32_t CSB_SO_HEADER_MAGIC = 0xED2E720; static constexpr uint32_t CSB_SIGN_INFO_MERKLE_TREE = 0x1; + static constexpr uint32_t CSB_SIGN_INFO_RUNTIME_PAGE = 0x2; static constexpr uint32_t CSB_EXTENSION_TYPE_MERKLE_TREE = 1; + static constexpr uint32_t CSB_EXTENSION_TYPE_PAGE_INFO = 2; + static constexpr uint32_t CSB_SIGN_INFO_MAX_PAGEINFO_UNITSIZE = 7; + static constexpr uint32_t CSB_EXTENSION_TYPE_PAGE_INFO_VERSION = 2; int32_t ParseCodeSignBlock(const std::string &realPath, const EntryMap &entryMap, FileType fileType); int32_t GetOneFileAndCodeSignInfo(std::string &targetFile, struct code_sign_enable_arg &arg); + int32_t ProcessExtension(uintptr_t &extensionAddr, const uintptr_t blockAddrEnd, struct code_sign_enable_arg &arg); private: int32_t ParseNativeLibSignInfo(const EntryMap &entryMap); diff --git a/utils/src/code_sign_block.cpp b/utils/src/code_sign_block.cpp index 8057755..3061011 100644 --- a/utils/src/code_sign_block.cpp +++ b/utils/src/code_sign_block.cpp @@ -44,6 +44,56 @@ CodeSignBlock::CodeSignBlock() CodeSignBlock::~CodeSignBlock() { } +int32_t CodeSignBlock::ProcessExtension(uintptr_t &extensionAddr, + const uintptr_t blockAddrEnd, struct code_sign_enable_arg &arg) +{ + if (extensionAddr >= blockAddrEnd) { + LOG_ERROR("Extension address is beyond the end of the block"); + return CS_ERR_INVALID_EXTENSION_OFFSET; + } + auto extensionHeader = reinterpret_cast(extensionAddr); + extensionAddr = extensionAddr + sizeof(ExtensionHeader); + if (extensionAddr > blockAddrEnd) { + LOG_ERROR("Extension header size exceeds block boundary. ExtensionHeader size: %{public}zu bytes", + sizeof(ExtensionHeader)); + return CS_ERR_INVALID_EXTENSION_OFFSET; + } + LOG_DEBUG("extensionHeader->type:%{public}d, extensionHeader->size:%{public}d", extensionHeader->type, + extensionHeader->size); + switch (extensionHeader->type) { + case CSB_EXTENSION_TYPE_MERKLE_TREE: { + auto merkleExtension = reinterpret_cast(extensionAddr); + arg.tree_offset = merkleExtension->treeOffset; + arg.root_hash_ptr = reinterpret_cast(merkleExtension->rootHash); + arg.flags |= CSB_SIGN_INFO_MERKLE_TREE; + break; + } + case CSB_EXTENSION_TYPE_PAGE_INFO: { + auto pageInfoExtension = reinterpret_cast(extensionAddr); + arg.sig_size = pageInfoExtension->sign_size; + if (arg.sig_size > extensionHeader->size - sizeof(PageInfoExtension)) { + return CS_ERR_EXTENSION_SIGN_SIZE; + } + if (pageInfoExtension->unitSize > CSB_SIGN_INFO_MAX_PAGEINFO_UNITSIZE) { + return CS_ERR_INVALID_PAGE_INFO_EXTENSION; + } + arg.sig_ptr = reinterpret_cast(pageInfoExtension->signature); + arg.pgtypeinfo_size = pageInfoExtension->mapSize; + arg.pgtypeinfo_off = pageInfoExtension->mapOffset; + arg.cs_version = CSB_EXTENSION_TYPE_PAGE_INFO_VERSION; + arg.flags |= pageInfoExtension->unitSize << 1; + LOG_DEBUG("arg.sig_size:%{public}u, arg.pgtypeinfo_size:%{public}u, " + "arg.pgtypeinfo_off:%{public}llu, unitSize:%{public}u,arg.flags:%{public}u", arg.sig_size, + arg.pgtypeinfo_size, arg.pgtypeinfo_off, pageInfoExtension->unitSize, arg.flags); + break; + } + default: + break; + } + extensionAddr += extensionHeader->size; + return CS_SUCCESS; +} + int32_t CodeSignBlock::GetOneFileAndCodeSignInfo(std::string &targetFile, struct code_sign_enable_arg &arg) { int32_t ret; @@ -67,26 +117,19 @@ int32_t CodeSignBlock::GetOneFileAndCodeSignInfo(std::string &targetFile, struct arg.sig_size = signInfo->signSize; arg.sig_ptr = reinterpret_cast(signInfo->signature); arg.data_size = signInfo->dataSize; - arg.flags = signInfo->flags; - if (!(signInfo->flags & CSB_SIGN_INFO_MERKLE_TREE)) { + if (!signInfo->flags) { return CS_SUCCESS; } uint32_t extensionCount = 0; auto extensionAddr = reinterpret_cast(signInfo) + signInfo->extensionOffset; - do { - if (extensionAddr >= blockAddrEnd) { - return CS_ERR_SIGN_EXTENSION_OFFSET_ALIGN; - } - auto extension = reinterpret_cast(extensionAddr); - if (extension->type == CSB_EXTENSION_TYPE_MERKLE_TREE) { - arg.tree_offset = extension->treeOffset; - arg.root_hash_ptr = reinterpret_cast(extension->rootHash); - break; + while (extensionCount < signInfo->extensionNum) { + ret = ProcessExtension(extensionAddr, blockAddrEnd, arg); + if (ret != CS_SUCCESS) { + return ret; } - extensionAddr += extension->size; extensionCount++; - } while (extensionCount < signInfo->extensionNum); + } return CS_SUCCESS; } @@ -132,7 +175,7 @@ int32_t CodeSignBlock::ParseNativeLibSignInfo(const EntryMap &entryMap) } while (entryInfo < entryInfoEnd); if (entryMap.size() != signMap_.size() - signMapPreSize) { - LOG_DEBUG("signMap_ size:%{public}u, signMapPreSize:%{public}u", + LOG_ERROR("Libs signature not found: signMap_ size:%{public}u, signMapPreSize:%{public}u", static_cast(signMap_.size()), static_cast(signMapPreSize)); return CS_ERR_NO_SIGNATURE; } -- Gitee From 8ac6de8dd35ff211dab49f8ca909e5c76c6ff1d1 Mon Sep 17 00:00:00 2001 From: yeyuning Date: Thu, 1 Aug 2024 15:33:59 +0800 Subject: [PATCH 03/26] adhoc Signed-off-by: yeyuning Change-Id: Ia98e5cffe345047e6b57c36f498e7882cd5d0754 --- services/key_enable/BUILD.gn | 2 + services/key_enable/src/lib.rs | 2 +- services/key_enable/src/profile_utils.rs | 111 +++++-- test/unittest/BUILD.gn | 2 + test/unittest/rust_key_enable_test.rs | 359 +++++++++++++++++++++++ 5 files changed, 448 insertions(+), 28 deletions(-) diff --git a/services/key_enable/BUILD.gn b/services/key_enable/BUILD.gn index 7792a3d..31887f5 100644 --- a/services/key_enable/BUILD.gn +++ b/services/key_enable/BUILD.gn @@ -33,6 +33,7 @@ ohos_rust_executable("key_enable") { deps += [ "${rust_openssl_dir}/openssl:lib", "//third_party/rust/crates/cxx:lib", + "//third_party/rust/crates/lazy-static.rs:lib", ] external_deps += [ "c_utils:utils_rust" ] } @@ -61,6 +62,7 @@ ohos_rust_shared_ffi("key_enable_lib") { deps += [ "${rust_openssl_dir}/openssl:lib", "//third_party/rust/crates/cxx:lib", + "//third_party/rust/crates/lazy-static.rs:lib", ] external_deps += [ "c_utils:utils_rust" ] } diff --git a/services/key_enable/src/lib.rs b/services/key_enable/src/lib.rs index 3459613..97c078d 100644 --- a/services/key_enable/src/lib.rs +++ b/services/key_enable/src/lib.rs @@ -14,7 +14,7 @@ */ //!crate key_enable - +extern crate lazy_static; /// module contains cert chain func pub mod cert_chain_utils; /// module contains cert path func diff --git a/services/key_enable/src/profile_utils.rs b/services/key_enable/src/profile_utils.rs index b0d2d62..5a970b8 100644 --- a/services/key_enable/src/profile_utils.rs +++ b/services/key_enable/src/profile_utils.rs @@ -13,6 +13,7 @@ * limitations under the License. */ +use lazy_static::lazy_static; use super::cert_chain_utils::PemCollection; use super::cert_path_utils::{ add_cert_path_info, remove_cert_path_info, common_format_fabricate_name, @@ -52,9 +53,15 @@ const PROFILE_DEVICE_IDS_KEY: &str = "device-ids"; const PROFILE_BUNDLE_INFO_KEY: &str = "bundle-info"; const PROFILE_BUNDLE_INFO_RELEASE_KEY: &str = "distribution-certificate"; const PROFILE_BUNDLE_INFO_DEBUG_KEY: &str = "development-certificate"; +const PROFILE_APP_DISTRIBUTION_TYPE_KEY: &str = "app-distribution-type"; +const APP_DISTRIBUTION_TYPE_INTERNALTESTING: &str = "internaltesting"; +const APP_DISTRIBUTION_TYPE_ENTERPRISE: &str = "enterprise"; +const APP_DISTRIBUTION_TYPE_ENTERPRISE_NORMAL: &str = "enterprise_normal"; +const APP_DISTRIBUTION_TYPE_ENTERPRISE_MDM: &str = "enterprise_mdm"; const DEFAULT_MAX_CERT_PATH_LEN: u32 = 3; const PROFILE_RELEASE_TYPE: &str = "release"; const PROFILE_DEBUG_TYPE: &str = "debug"; + /// profile error pub enum ProfileError { /// add cert path error @@ -105,48 +112,91 @@ fn parse_pkcs7_data( flags: Pkcs7Flags, check_udid: bool, ) -> Result<(String, String, u32), Box> { - let stack_of_certs = Stack::::new()?; + let profile = verify_pkcs7_signature(pkcs7, root_store, flags)?; + let profile_json = parse_and_validate_profile(profile, check_udid)?; + get_cert_details(&profile_json) +} +fn verify_pkcs7_signature( + pkcs7: &Pkcs7, + root_store: &X509Store, + flags: Pkcs7Flags, +) -> Result, Box> { + let stack_of_certs = Stack::::new()?; let mut profile = Vec::new(); - if pkcs7.verify(&stack_of_certs, root_store, None, Some(&mut profile), flags).is_err() { - error!(LOG_LABEL, "pkcs7 verify failed."); - return Err("pkcs7 verify failed.".into()); + pkcs7.verify(&stack_of_certs, root_store, None, Some(&mut profile), flags)?; + Ok(profile) +} + +/// validate bundle info and debug info +pub fn validate_bundle_and_distribution_type( + profile_json: &JsonValue, + check_udid: bool, +) -> Result<(), Box> { + let bundle_type = profile_json[PROFILE_TYPE_KEY].try_as_string()?.as_str(); + match bundle_type { + PROFILE_DEBUG_TYPE => { + if check_udid && verify_udid(profile_json).is_err() { + return Err("Invalid UDID.".into()); + } + }, + PROFILE_RELEASE_TYPE => { + let distribution_type = profile_json[PROFILE_APP_DISTRIBUTION_TYPE_KEY].try_as_string()?.as_str(); + match distribution_type { + APP_DISTRIBUTION_TYPE_INTERNALTESTING => { + if check_udid && verify_udid(profile_json).is_err() { + return Err("Invalid UDID.".into()); + } + }, + APP_DISTRIBUTION_TYPE_ENTERPRISE | + APP_DISTRIBUTION_TYPE_ENTERPRISE_NORMAL | + APP_DISTRIBUTION_TYPE_ENTERPRISE_MDM => { + }, + _ => { + return Err("Invalid app distribution type.".into()); + } + } + } + _ => { + return Err("Invalid bundle type.".into()); + }, } + Ok(()) +} + +fn parse_and_validate_profile( + profile: Vec, + check_udid: bool, +) -> Result> { let profile_json = JsonValue::from_text(profile)?; - let bundle_type = profile_json[PROFILE_TYPE_KEY].try_as_string()?.as_str(); + validate_bundle_and_distribution_type(&profile_json, check_udid)?; + Ok(profile_json) +} - if bundle_type == PROFILE_DEBUG_TYPE && check_udid && verify_udid(&profile_json).is_err() { - error!(LOG_LABEL, "udid verify failed."); - return Err("Invalid udid .".into()); - } +fn get_cert_details(profile_json: &JsonValue) -> Result<(String, String, u32), Box> { + let bundle_type = profile_json[PROFILE_TYPE_KEY].try_as_string()?.as_str(); let profile_type = match bundle_type { PROFILE_DEBUG_TYPE => DebugCertPathType::Developer as u32, PROFILE_RELEASE_TYPE => ReleaseCertPathType::Developer as u32, - _ => { - error!(LOG_LABEL, "pkcs7 verify failed."); - return Err("Invalid bundle type.".into()); - } + _ => return Err("Invalid bundle type.".into()), }; let signed_cert = match bundle_type { - PROFILE_DEBUG_TYPE => { - profile_json[PROFILE_BUNDLE_INFO_KEY][PROFILE_BUNDLE_INFO_DEBUG_KEY].try_as_string()? - } - PROFILE_RELEASE_TYPE => profile_json[PROFILE_BUNDLE_INFO_KEY] - [PROFILE_BUNDLE_INFO_RELEASE_KEY] - .try_as_string()?, - _ => { - error!(LOG_LABEL, "pkcs7 verify failed."); - return Err("Invalid bundle type.".into()); - } + PROFILE_DEBUG_TYPE => profile_json[PROFILE_BUNDLE_INFO_KEY][PROFILE_BUNDLE_INFO_DEBUG_KEY].try_as_string()?, + PROFILE_RELEASE_TYPE => profile_json[PROFILE_BUNDLE_INFO_KEY][PROFILE_BUNDLE_INFO_RELEASE_KEY].try_as_string()?, + _ => return Err("Invalid bundle type.".into()), }; let signed_pem = X509::from_pem(signed_cert.as_bytes())?; let subject = format_x509_fabricate_name(signed_pem.subject_name()); let issuer = format_x509_fabricate_name(signed_pem.issuer_name()); - Ok((subject, issuer, profile_type)) } -fn get_udid() -> Result { +lazy_static! { + /// global udid + pub static ref UDID: Result = init_udid(); +} + +fn init_udid() -> Result { let mut udid: Vec = vec![0; 128]; let result = unsafe { CodeSignGetUdid(udid.as_mut_ptr()) }; @@ -164,6 +214,12 @@ fn get_udid() -> Result { } } +/// get device udid +pub fn get_udid() -> Result { + UDID.clone() +} + + fn verify_signers( pkcs7: &Pkcs7, profile_signer: &[(&String, &String)], @@ -287,8 +343,9 @@ fn process_profile( let (subject, issuer, profile_type) = match parse_pkcs7_data(&pkcs7, x509_store, Pkcs7Flags::empty(), check_udid) { Ok(tuple) => tuple, - Err(_) => { - error!(LOG_LABEL, "Failed to parse profile file {}", @public(path)); + Err(e) => { + error!(LOG_LABEL, "Error parsing PKCS7 data: {}, profile file {}", + @public(e), @public(path)); report_parse_profile_err(&path, HisyseventProfileError::ParsePkcs7 as i32); continue; } diff --git a/test/unittest/BUILD.gn b/test/unittest/BUILD.gn index 34bd424..994db32 100644 --- a/test/unittest/BUILD.gn +++ b/test/unittest/BUILD.gn @@ -208,6 +208,7 @@ ohos_rust_static_library("rust_key_enable_lib") { "${code_signature_root_dir}/services/key_enable/utils:libkey_enable_utils", "${rust_openssl_dir}/openssl:lib", "//third_party/rust/crates/cxx:lib", + "//third_party/rust/crates/lazy-static.rs:lib", ] external_deps = [ "c_utils:utils_rust", @@ -237,6 +238,7 @@ ohos_rust_unittest("rust_key_enable_unittest") { resource_config_file = "resources/ohos_test.xml" crate_root = "./rust_key_enable_test.rs" sources = [ "./rust_key_enable_test.rs" ] + external_deps = [ "ylong_json:lib" ] deps = [ ":rust_key_enable_lib" ] subsystem_name = "security" part_name = "code_signature" diff --git a/test/unittest/rust_key_enable_test.rs b/test/unittest/rust_key_enable_test.rs index 8399195..26ce7a4 100644 --- a/test/unittest/rust_key_enable_test.rs +++ b/test/unittest/rust_key_enable_test.rs @@ -13,8 +13,14 @@ * limitations under the License. */ extern crate key_enable; +extern crate ylong_json; + +use std::thread; +use ylong_json::JsonValue; use key_enable::cert_chain_utils::PemCollection; use key_enable::cert_path_utils::TrustCertPath; +use key_enable::profile_utils::{UDID, get_udid, validate_bundle_and_distribution_type}; + // pem_cert_file const VALID_PEM_CERT: &str = "/data/test/tmp/valid_pem_cert.json"; @@ -99,3 +105,356 @@ fn test_empty_cert_path_json_file() { "Expected cert_paths.app_sources to be empty for an empty JSON file" ); } + +#[test] +fn test_parse_enterprise_profile() { + let profile_str = r#" + { + "version-name": "2.0.0", + "version-code": 2, + "app-distribution-type": "enterprise", + "uuid": "", + "validity": { + "not-before": 1, + "not-after": 2 + }, + "type": "release", + "bundle-info": { + "developer-id": "", + "distribution-certificate": "", + "bundle-name": "com.test.enterprise", + "apl": "normal", + "app-feature": "test_app", + "app-identifier": "123123" + }, + "acls": { + "allowed-acls": [ + "" + ] + }, + "app-privilege-capabilities": [], + "permissions": { + "restricted-permissions": [ + "" + ] + } + } + "#; + let profile_json =JsonValue::from_text(profile_str).unwrap(); + let result = validate_bundle_and_distribution_type(&profile_json, true); + assert!(result.is_ok()); +} + +#[test] +fn test_parse_enterprise_normal_profile() { + let profile_str = r#" + { + "version-name": "2.0.0", + "version-code": 2, + "app-distribution-type": "enterprise_normal", + "uuid": "", + "validity": { + "not-before": 1, + "not-after": 2 + }, + "type": "release", + "bundle-info": { + "developer-id": "", + "distribution-certificate": "", + "bundle-name": "com.test.enterprise_normal", + "apl": "normal", + "app-feature": "test_app", + "app-identifier": "123123" + }, + "acls": { + "allowed-acls": [ + "" + ] + }, + "app-privilege-capabilities": [], + "permissions": { + "restricted-permissions": [ + "" + ] + } + } + "#; + let profile_json =JsonValue::from_text(profile_str).unwrap(); + let result = validate_bundle_and_distribution_type(&profile_json, true); + assert!(result.is_ok()); +} + +#[test] +fn test_parse_enterprise_mdm_profile() { + let profile_str = r#" + { + "version-name": "2.0.0", + "version-code": 2, + "app-distribution-type": "enterprise_mdm", + "uuid": "", + "validity": { + "not-before": 1, + "not-after": 2 + }, + "type": "release", + "bundle-info": { + "developer-id": "", + "distribution-certificate": "", + "bundle-name": "com.test.enterprise_mdm", + "apl": "normal", + "app-feature": "test_app", + "app-identifier": "123123" + }, + "acls": { + "allowed-acls": [ + "" + ] + }, + "app-privilege-capabilities": [], + "permissions": { + "restricted-permissions": [ + "" + ] + } + } + "#; + let profile_json =JsonValue::from_text(profile_str).unwrap(); + let result = validate_bundle_and_distribution_type(&profile_json, true); + assert!(result.is_ok()); +} + +#[test] +fn test_parse_debug_profile() { + let profile_str = r#" + { + "version-name": "2.0.0", + "version-code": 2, + "app-distribution-type": "developer", + "uuid": "", + "validity": { + "not-before": 1, + "not-after": 2 + }, + "type": "debug", + "bundle-info": { + "developer-id": "", + "development-certificate": "", + "bundle-name": "com.test.developer", + "apl": "normal", + "app-feature": "test_app", + "app-identifier": "123123" + }, + "acls": { + "allowed-acls": [ + "" + ] + }, + "app-privilege-capabilities": [], + "permissions": { + "restricted-permissions": [ + "" + ] + }, + "debug-info": { + "device-ids": [], + "device-id-type": "udid" + } + } + "#; + let udid = get_udid().expect("Failed to get UDID"); + let mut profile_json =JsonValue::from_text(profile_str).unwrap(); + profile_json["debug-info"]["device-ids"][0] = JsonValue::String(udid); + let result = validate_bundle_and_distribution_type(&profile_json, true); + assert!(result.is_ok()); +} + +#[test] +fn test_parse_iternaltesting_profile() { + let profile_str = r#" + { + "version-name": "2.0.0", + "version-code": 2, + "app-distribution-type": "internaltesting", + "uuid": "", + "validity": { + "not-before": 1, + "not-after": 2 + }, + "type": "release", + "bundle-info": { + "developer-id": "", + "distribution-certificate": "", + "bundle-name": "com.test.internaltesting", + "apl": "normal", + "app-feature": "test_app", + "app-identifier": "123123" + }, + "acls": { + "allowed-acls": [ + "" + ] + }, + "app-privilege-capabilities": [], + "permissions": { + "restricted-permissions": [ + "" + ] + }, + "debug-info": { + "device-ids": [], + "device-id-type": "udid" + } + } + "#; + let udid = get_udid().expect("Failed to get UDID"); + let mut profile_json =JsonValue::from_text(profile_str).unwrap(); + profile_json["debug-info"]["device-ids"][0] = JsonValue::String(udid); + let result = validate_bundle_and_distribution_type(&profile_json, true); + assert!(result.is_ok()); +} + +#[test] +fn test_parse_invalid_profile() { + let no_type_profile = r#" + { + "version-name": "2.0.0", + "version-code": 2, + "app-distribution-type": "internaltesting", + "uuid": "", + "validity": { + "not-before": 1, + "not-after": 2 + }, + "bundle-info": { + "developer-id": "", + "distribution-certificate": "", + "bundle-name": "com.test.internaltesting", + "apl": "normal", + "app-feature": "test_app", + "app-identifier": "123123" + }, + "acls": { + "allowed-acls": [ + "" + ] + }, + "app-privilege-capabilities": [], + "permissions": { + "restricted-permissions": [ + "" + ] + }, + "debug-info": { + "device-ids": [], + "device-id-type": "udid" + } + } + "#; + let no_distribution_profile = r#" + { + "version-name": "2.0.0", + "version-code": 2, + "uuid": "", + "validity": { + "not-before": 1, + "not-after": 2 + }, + "type": "release", + "bundle-info": { + "developer-id": "", + "distribution-certificate": "", + "bundle-name": "com.test.internaltesting", + "apl": "normal", + "app-feature": "test_app", + "app-identifier": "123123" + }, + "acls": { + "allowed-acls": [ + "" + ] + }, + "app-privilege-capabilities": [], + "permissions": { + "restricted-permissions": [ + "" + ] + }, + "debug-info": { + "device-ids": [], + "device-id-type": "udid" + } + } + "#; + let no_debug_info_profile = r#" + { + "version-name": "2.0.0", + "version-code": 2, + "app-distribution-type": "internaltesting", + "uuid": "", + "validity": { + "not-before": 1, + "not-after": 2 + }, + "type": "release", + "bundle-info": { + "developer-id": "", + "distribution-certificate": "", + "bundle-name": "com.test.internaltesting", + "apl": "normal", + "app-feature": "test_app", + "app-identifier": "123123" + }, + "acls": { + "allowed-acls": [ + "" + ] + }, + "app-privilege-capabilities": [], + "permissions": { + "restricted-permissions": [ + "" + ] + } + } + "#; + let udid = get_udid().expect("Failed to get UDID"); + let mut no_type_profile_json =JsonValue::from_text(no_type_profile).unwrap(); + no_type_profile_json["debug-info"]["device-ids"][0] = JsonValue::String(udid.clone()); + let result = validate_bundle_and_distribution_type(&no_type_profile_json, true); + assert!(result.is_err()); + + let mut no_distribution_profile_json =JsonValue::from_text(no_distribution_profile).unwrap(); + no_distribution_profile_json["debug-info"]["device-ids"][0] = JsonValue::String(udid.clone()); + let result = validate_bundle_and_distribution_type(&no_distribution_profile_json, true); + assert!(result.is_err()); + + let no_debug_info_profile_json =JsonValue::from_text(no_debug_info_profile).unwrap(); + let result = validate_bundle_and_distribution_type(&no_debug_info_profile_json, true); + assert!(result.is_err()); +} + +#[test] +fn test_get_udid_once() { + let udid_from_get = get_udid().expect("Failed to get UDID"); + let udid_from_global = UDID.clone().expect("UDID is None"); + + assert_eq!(udid_from_get, udid_from_global); +} + +#[test] +fn test_get_udid_concurrent() { + let num_threads = 10; + let mut handles = vec![]; + + for _ in 0..num_threads { + let handle = thread::spawn(|| { + let udid = get_udid().expect("Failed to get UDID"); + assert_eq!(udid, UDID.clone().expect("UDID is None")); + }); + handles.push(handle); + } + + for handle in handles { + handle.join().expect("Thread panicked"); + } +} \ No newline at end of file -- Gitee From 4170e5688b2f4cfdba5008238ee2055e657f5d92 Mon Sep 17 00:00:00 2001 From: zhenghui Date: Mon, 5 Aug 2024 20:13:09 +0800 Subject: [PATCH 04/26] =?UTF-8?q?=E8=B0=83=E7=94=A8rust=E6=B5=8B=E4=B8=8D?= =?UTF-8?q?=E4=BA=86=E8=A6=86=E7=9B=96=E7=8E=87?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: zhenghui --- test/unittest/code_sign_utils_test.cpp | 51 ------------------ .../pkcs7/add_and_remove_profile.p7b | Bin 3895 -> 0 bytes .../demo_cert/pkcs7/verify_test_profile.hap | Bin 58062 -> 0 bytes .../demo_cert/pkcs7/verify_test_profile.p7b | Bin 3468 -> 0 bytes test/unittest/resources/ohos_test.xml | 3 -- 5 files changed, 54 deletions(-) delete mode 100644 test/unittest/resources/demo_cert/pkcs7/add_and_remove_profile.p7b delete mode 100644 test/unittest/resources/demo_cert/pkcs7/verify_test_profile.hap delete mode 100644 test/unittest/resources/demo_cert/pkcs7/verify_test_profile.p7b diff --git a/test/unittest/code_sign_utils_test.cpp b/test/unittest/code_sign_utils_test.cpp index 478ffc1..aaa675b 100644 --- a/test/unittest/code_sign_utils_test.cpp +++ b/test/unittest/code_sign_utils_test.cpp @@ -537,57 +537,6 @@ HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0020, TestSize.Level0) EXPECT_EQ(ret, CS_ERR_INVALID_OWNER_ID); } -/** - * @tc.name: CodeSignUtilsTest_0021 - * @tc.desc: Enable key in profile successfully - * @tc.type: Func - * @tc.require: - */ -HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0021, TestSize.Level0) -{ - std::string profileEnablePath = PROFILE_BASE_PATH + "/demo_cert/pkcs7/verify_test_profile.p7b"; - std::string hapEnablePath = APP_BASE_PATH + "/verify_test_profile.hap"; - ByteBuffer buffer; - bool flag = ReadSignatureFromFile(profileEnablePath, buffer); - EXPECT_EQ(flag, true); - - string bundlName = "CodeSignUtilsTest"; - int32_t ret = CodeSignUtils::EnableKeyInProfile(bundlName, buffer); - EXPECT_EQ(ret, CS_SUCCESS); - - EntryMap entryMap; - CodeSignUtils utils; - ret = utils.EnforceCodeSignForApp(hapEnablePath, entryMap, FILE_SELF); - EXPECT_EQ(ret, CS_SUCCESS); -} - -/** - * @tc.name: CodeSignUtilsTest_0022 - * @tc.desc: Remove key in profile successfully - * @tc.type: Func - * @tc.require: - */ -HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0022, TestSize.Level0) -{ - std::string profileEnablePath = PROFILE_BASE_PATH + "/demo_cert/pkcs7/add_and_remove_profile.p7b"; - ByteBuffer buffer; - bool flag = ReadSignatureFromFile(profileEnablePath, buffer); - EXPECT_EQ(flag, true); - - string bundlName = "CodeSignUtilsTest"; - int32_t ret = CodeSignUtils::EnableKeyInProfile(bundlName, buffer); - EXPECT_EQ(ret, CS_SUCCESS); - - std::string pathOnDisk = "/data/service/el0/profiles/developer/CodeSignUtilsTest/profile.p7b"; - std::string realPath; - EXPECT_EQ(OHOS::PathToRealPath(pathOnDisk, realPath), true); - - ret = CodeSignUtils::RemoveKeyInProfile(bundlName); - EXPECT_EQ(ret, CS_SUCCESS); - - EXPECT_EQ(OHOS::PathToRealPath(pathOnDisk, realPath), false); -} - /** * @tc.name: CodeSignUtilsTest_0023 * @tc.desc: enable code signature for app diff --git a/test/unittest/resources/demo_cert/pkcs7/add_and_remove_profile.p7b b/test/unittest/resources/demo_cert/pkcs7/add_and_remove_profile.p7b deleted file mode 100644 index 0be372ddb4521bd17251dc2acd26ac9ad85c06fd..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 3895 zcmcgvYjhK38g4EvH%qHUZp$?&MMLN}xslXGnaSkd$*oD6glL&0lVqC7%p{p)k|5Hp zM^=_a*Ru*J7t5ufN5mUiSdYqjj@G-2D7&cOh3)F{Lsn$PmA%ch65Nab-66?PVjWJ17oK)p0(G!iOZQuw3Q>k=xX4j5FpkpPfJn@kdr zLHs{BMJ7nDqG(;EpczgTBa%#BI2Y0xwFbRTturhh!to?W$cnNIJ=g=Ou^|K`|_mR}C>@(w#+`%$1@k^_meAAAm7yp&X@6RoH=~TtNg5`{9hsjrlO%>w;*N8aG6{sv>2{v(clP<@Dp+G&r*%-gN5aNMYG38dp5x7~p!+Kc9d zDFbLO=ZaO4iY>z0Lwd}WEk`0se>_T;QnVk_2b?erSKCvzNUoSoQ06pi4Ui=V?gEyj z?a4sNQnDa8p0T$CIGYP^;c~uUF;guSW5P{pm2Ph;n^Z>-%mnjh81}<1B$dgfGs0!@ z0D-*)3kzDSyOiQqoG))>W)#qqIe1%R&gs!tEXQu42StXO-<*6wBZm zv>Hlh+A>B?4RZDzjH7T00XYwAup$(IidkLG5uv)GH0#lX5)i5Q|f@T8Vl~^a&f+cuX+-CWs-A~<_uzrLlvLi9Hni(2y73xQ30#L z$2gsBW@p5Wx`}jw%Iip{-Wkkb8NYgIHe0mB(6Tw5Wr{9~2g#RwEMn8xktnV7E?X9* zhYZW?LjT9aE;;3h>BpJu5~7S}S&CSatq4v}iB>pl=Qv9VmPj-CEKUg<#W9d1aIPqt zv?49I|8S^N2#kcu1VM{#D*CkoQfssd!K?8&RS-QHrznOe5~|_#3WefkAt+dMmMn;4 zXecKyICP$jb3)pf$O+> z?b;)*uF>=OCN}rL`e)y-_l9PU?UgKD0|+TpvnBF}bNapAuRQxLwRpfe-q1J*|9#W) z^3T)oy|2t(PknT@vh2x?PhBa!=}3X?yKw7rDVVM7KA!3ewtW7^1oP3upHUCI)p~R< zvY(xGYOub$-1?rz*pv8rV9_&AG&f&WnEA>YK{lu$n^#9<)9{I5{a7lOqhk!ieP26T z$S_(v;_@;wDS^gI+No9kLSCbg#cJf3{zT=TO#SU!&(u3!{`Vs0i#VKht~#Wew6*ly z>2UbSiY+^r_k8=z(XiaQ9-rhNz_d(kO^O7g(RsPC8TMsjXNHhaqD1> zd*6}G%};KQ@RQ#h+dWyT1|+0_kMPaVo9Fq5Zrrr(Sm?mr`gBtliH1>nuHfFF4n-$1@c#Glo`?)h~9{;8_-TClcBNo%FOO&Vhg9VQxd}HSL2pyuSqMksyM|ZWLa4AahyTI5J2_KPG!gF#Y0Va)JyJ zV&6SMC1BRY#e`a@L70UaNUhcZVFZc>)^aH-hZOR8@|}lkuWotmiR}k>yuQ7y^P@Yz zeD1vkEuWtM%&C9scwKxVn0Rr3OXW6Tkl)JYbCa6uh+Fn=NjPdtsS57=;oOR=&n}T2PjwK6g$M5|w66)m8 diff --git a/test/unittest/resources/demo_cert/pkcs7/verify_test_profile.hap b/test/unittest/resources/demo_cert/pkcs7/verify_test_profile.hap deleted file mode 100644 index 28b6fc409bd30240f3f2d9e19367237b86788e65..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 58062 zcmeG_2S8Iv(=Q>74k9Af7?2_m5_(ZEA)%}Nl_ zp8d|=`&rN4{b%1xARt)IyZgTX{}b4}_jYGyXJ=<;XZO9#i|uGcF~Kkf2A@_zPFn|E zzQe{alq|86mJ*HHvp|tmD3hq!;*87>2N9UzV~~JB0tN{fBw&z$K>`K|7$jhjfI$KV z2^b_`kbpq~|H~v0%ZnE9fM=7S++1TgqLu$C5{B8rIR#Q%NH&mWLOu|S#WI|6A9q#ouN#)CwHgyB*PKaf#~XJ z-i7>okX}ME2Y{B4ydXtFl0X^=X$_=}knTfz328LoPl7ZP(p*SOA#H%P8`4oo=OC3r zrFS7A9ucp1AU%ZCzyiY>Lt;X5hs1>x0x1PjcSt3W#zC47X(^;NkoH144(U3iomLoj z0Mc#w0$fTKl z)tD)_{*fm@%l}WOg8U<6P5W_K7!pv02H4?do%?uM4swF{8J=Tpo zB*a8xl7zy{Oo=25@T77aPb$x;i7F6l#5FK&lA^SXV8)q>ED1J{l&L6SONzw>N|}UR zP$E_;K|Hv?JfU_~i6`0s!_UNoygY>{TT6xQz;(bTeJ2flf|#j9rBbLc(_E=ck%Jja z<=G0%Tqcp{XmT+-B%ClpE|{GXq^tIfl4nVZF&m{yp;2g{!!aA^BM^i%y9Be;K!+uY zb1-kD4hb@aCc3a7L!#1G3K(oyS$lls_3!juvIs_`FwDpp#vcqXtS1`mFlNztS=BiS z8;Q=z$SUAPv*2C~8opynuu0#v5DX=gm_%7HLW?HQNSFmtcA+Is@;R!Frz1HCCn+M(hSjL;XT0bQQ52_F8wopr z7kRb93C=)8xjKUP@S+Js(Vi--rpo-BXmNq0J+4-mtyCSRC@4_K^VC>NVyiV?lBrN- zMP(IZbfjRW98IoNjnT#O63p5syHK7PlaYr}(=sqyj$BfdC|2c2G#DK;2QtN&aTcgO z*s_NYF)?0+r&^WiSs<3mzo5*Z>X>~EZM5~Nrf-ZhVGNb2fwl!^hZspiWYajPHVpf- zv9v&`P-&RB@-nkkiUOu{dqu879fapN2b-H{A*#k<4Ja6Wu*r;@C3Y1A!jcr@bh9Mc z;zF5*nJE*i)l7X(nUZ3#7FlX$6&kbD+=K}qg`6-!E=6Lw#+@k>1J}8+VwJeSRR@B= za0c0ExVdnOIq-33I%|iIGn`giA9ST1{Z+J`U4chLrLV3|tz~ohJL=HV`m~Zy%&bdM zwc)K%v!^Fh1RcdB%9&C%GZVM&S?)}=M8ia#$VB#pnXOQP359ZPHxTXl4gr0_V^uQ{ zQ9XXyddAJgS& zgDBQ@I&N|6?DcP&mJpw5VrDxgnw{8HRv7W_>dI`@t{qceD3dXroPb&UvX?@d#pEzU z(RC2hxrShL9I7OmLY2H$yR=%SgZYB$e)}|uwy`!$$<*7Nkfoq*z$Q7%Z z8Q@Umj+YHVV16ZxB|sKrm;8Tu-yK zj;EcTiNRcJKw&CD$c9uv%nK60-u9Bh$~9RmE0kc)g-V!OB?2i7AE8Wws#jyS zuHa+yJkfz%#;5LK%a!l_;8pipCH{ zWPCG(L23n-5-9fafTCY?MQC4yLF!2qJw`?N0ub@s6DN3x;L!x}QH7;l0B&)_DK2-1 zvL!l-Xa|Nt8rm8!3Plvx6GbF!4z!;^+NtG(4Mi7qSZHsDL5d{^+9857by#T2hCv!l zU~v)FFvT8`Bs--&6c3Q#eaP^h~T4uBd!iK=CsF5U#RcamMI!?4u zxUqtAsW?McZM38kwa#q0s0s-CRfDaX!e`fG@~UyQTxu(=J^R*lPixWs6j-mxpLhmr z@E=@U*@WeH!AT+0?&7NJu_}SqrmJ%STy&6HW?`COYK32uPhu%nOApxqUYi1FM->I# z@cx`M0p6twuBPN_Oi(r1!P{Ej)a2qq3_EvN>enz5b*-O2^`_YMdu>|6I-w!)q7V3b zY+@R&k_J&g6cN*|i!*XTtCk2l05m{aeZpsH^{PY%h$?|8_mdj5J*NY!vpscrnl%Vj zEmIMh|1RMYj(C0Y)t2He!uLv8OY8rmkkJZ5Ct|$&wML+}rsHrr57Wh$Q*Sxpce+%s zp4ezvRU7=Pl^?J7-|3h-tExveYL7|nSk(Exb=a&roZYH{2-xsn=K!v68R=37^q1GT z!~~)5@FNq<#GM|Os;SwXS=tw$N$RMh?!_zKk~()iaMHT%j<7Gz!?1kNPQ+NtT2niI zhZJ1#IzOM?jA#NVROGPIg28)6TMo$QrBSsP$X}%;YcG(?OJkx7aFvngZ(Dr>2^@72 z<^pbRW61Z{UBLE4^#!`?Q&ob{t1f_E^@Y9u1uPD#OU(5z?DQ{~`WML8t|Cp-zo6@1 zz&Yk`O?^PZgqXFE)IdnK5gIiVQfx6X6%*6ajl_&}1|KuS9OH8PkvevayB-1jBAt*r#K$w zYy#J`bef170#wY?8C+99$0T~Sm|NDa#RS!2sjbBduZ4ow(g13qqFNf_wZN&i7F)a) zYIQA*pcV<8(jF5i1p@@*1@n$#Vxx4j7FIPF znMNQp5VA2sHVH9;&Pb;LGX2{srRY`qEzE+{s+cvUbjQ|{8)Jf1>1OS)bn|vrg6mq2 zp`&q*wGyTyjv0t!;}9CKolXUgk+vZ?iZ%2^NCS|EH?0vy1`VWo(rI+Yw>5~a#~6d+ zqU|a{C3H0|K3CMWG(I^9DuasY=~Om_20}BYmXk2SSiu~@8o@7uQ=ym(>O?x9WV!#zX z-Wl5QE@p&MS|NR9B7H>`0IVLg(2PN)7>ChaF&rK#oiX1y7?Gv`9D{9YOhALZ$ki$# zRELiTP(fq{$Zfz3q*FX7)KFS$LX7m5geDl%aR^fn1VJdSxffAnNe3bnwlx?kFkV2$ z#*H9ji_C`6K4?B}H$vKBp_ns}^(BR2k?{BckOWMq7OWEkwE)a1FzQ1Qf^GBD4ta_mex*U(05eKnM{qb#SsYWY2=HAQGGE$p~BDC1hE3K zKqVLmc8x>lujE$qD&xB zN0UfHNJi;KQ%I0K6VAw1W>$9emee+S;AJF$A4;N3BvHqZNJA0)R0KZ@!J9G2AP)>= zL8cg41J4-nOQsrWxov*IltHjL(+sh^82?^@e`5hgCdL#h!X{HlHafXbspt&okf|gs z71x7i7feUvNHl^PL5HB(hUQ~#OZG9bC4(EOV+Q&}uR{o~wA5G^Otn<>d15lGZ0Jp? zPE;Q%g8`nawoMd@k?p6HsFbP}dR#Eoc7#5)S@x*4OYv`g!c-mM#-9?^ve&9k_VkI+ z2u-NF9nJJ1iFO#(5JtXME+7+KF99VhLavu^j?MIFm@&a;U>MUsS7&2Ac&+T9M=4eH z5}jFH-4JK3Qs{T%dnY8ari_M7DGUY!v7QfU5vc*F2(D;ATQ@Yk zhB%uL}=}!bi5&+B8JlLS%El zn5rR&Gb)WZ0*!oq*^o@T)wWx*GM75}I*GTR_{JJinwrzdO&PWfYJO9yttCCbDXlSs zn%k7x*pi;xl+n~0?1ZE#xvd!-1x?8`@(#GS&$h*A)?{I9Emz{8qN;JOl$nJYZM4e1f2 z-=SOtHx%DPY74jKTEUGrF{G)GE<&<`dva-zVr%@)z3_6oqvehmhEfCU4u&4{t$I?0 zcqRoL=l>6%Qh0KaRmaUoJWKl+V9ke~K~}6FCc*>EUJ{iWZiYjKw>y!O4bO7JB}=IP zpftkKmTMo@0+6ma!e6N#N9?X8D2In>5l3Bh8Sq3Ade{i%v3R^No_iRN7lXd=vv2z9 zh|olT4fiW55+llCIQd{W$;D6qBCB;(m+;TBUssjiljp~;A&)4f02fVtUwFR|(yI>y z=LQ$(-ze2uO%%H)@OW{E16b)n!jMb*I#Uhoye2WR-(rH7-X)=_U=OxBx+Q_06wuU?q%DZqt5bO!2Z z8D3x2wGbEWx3|4EN2r@(ktqHz_fo+>*GsrOYju@ezpHpWqN{2P{(IH$^Yn-o<9xaO zO^rvILRg!U&)e6}bM}9~6bY*L|9Q(tOuGL~y{SJ6<9I@Ed=z&6YvT;3^*y-azgBN8 zc~%>eh&t%urFG4pI2F7U|Efil7aW|*3zOp-S}!(^gI9`+q814ptu}4sigu}k&04sB z&m}%x;jDdT;u2|{@YQas{q=c{|D8>(<_hm>yhTK_f^+!bzT$2AniT+2{rE3yRds#!pCMBJ$oyJ8V(RLkFx2a~ z%l$orMe&btUca#Z9+CeORQ}>9!kdcs53YxG_0)g6G(H(hpwP0&Z;^5JIMfbCSpIZE z1gb6xms;^RdA8re8zFt<;>qyZ4Zbk+OZ_VO|HBs!_>U>#XH~a)9P!W&LSXgCMAyU^ z`tEIz+I^3DJQ=a2AV%wFIjoKRp9eaxr@+W(4eEA_vtu(cFX^Y1F6 z^nZsUBF)P)Xx?Y1lW(>UpVK_>C&H@<2D9MqP+xR!sIJ>uwSH3vw}`%YBa3)+`)Pl0Hk}7jJbbxTlT;jT>pt(D;NALp5ItUk(I!beE~=VUeP%sSEki;@pxOAA!B*f450fccF1@uiXY1dxF1v>>+ml!Yw%bE;%lz+Dz6bZ5*x|tqw8i_dGs&!u{)$ zs6J@D6{0Z&hVgq;1l^|>e0iXJ9Xmh@-v#|E<^Xn;@pjZNZNg#%6ONim-4tLRNkil^6)*5h+$dJid||0Lj|toKQ_ZY!2I>?F;2ul8nL}R1Jhf zkhrs?5E%il)UiO4B^3t&w`q7DQ52Ph3b}s%{{CKEe|MHloFS1B@I<^Y905Jf1f=o8 z8W?`=tOBW=7aOI=3zy^0f)G3KGxSgMdqGGNg$k#yjc^HMwa;sXK}eVFtRha6zN~)JFkc)%jAHOxs3rCTbpj!6MGt z>Jqg^QozntKsR*<_T?G~fJ4ZHxG1R!(ieartOs5RE+_Vv<1ivFP~;>cpjCBzEke$j z3YkI`gaf1z@vYLTqj}YbsxNjgZVmcTwbT};jAwoVR)dN+YMOQoiL?sElBl&BgGPr; z3i?*kS*pp6f{-C%8LsU_CuiwG<`A+&Pw&;MQ3S;==#m#`ah9Z)G*f~GGtp(*;8!3M z4T^Z7K^-O~IKhLwhN~p_Fvu3m)G&TgAVh5h9$eD36r)OEpwCsvJm5<_qE8?KD|+xT z2oH!!NTJHSFO;Bh)@NWI#2AY$5@YRQ)vtwF3h4GB?*G%iaDhDL$- zC-efh-9f}+AL{(1e}lBWTbDWp5z0sqibj@KM+lk^lZ?*P;=(FWg3^E*A(6SWw2=t4 zwd-ad!WbinzJ0p`4b*24e20+Xm&H_Pi$24+R*<-UdFbR06`RzYR2M9sdq@BiDoU21 zNmU^eL7gCga6H6UR48OjnAkYp|AB{|5nJdN;~j;m35T`yqw{7Yj0mU)d2$H`-T;Or zBoT0J^~!R46J^n15L;Z3kbnjYd`R5@2K^5tU`Z&(IMhRW0!OHl)D#95Ji|}w07n`e zd&3caH%_XABLj{v;E3oU-r$r3KRd?pWpG6JD8{&c`EG6b6K#1@0CE6a9X}SBsDxJ? zVjA+1hk*JJYX@NPYkQns7Yy%D&#GSX%z%)Wp14opsq-n=N;w3G#tESL5rfCz@p=%S zW|-dG49~agk2BngVy(5%z$l4^;bRM`uK`D7!c+A)S=3w`tuw~dr*5XrBS>Ra%;?(JKI-5 zv;@6*xz_J10+yN?y@tL)sTC;omsNRKY;=UVNfQ(35c8-=K|CDc*BzKE15^WBoQ}PK zgS|$WqDfF>Yl*wR|>+R0;;&^dAIbNPzUk@%f$k!`~>y3U&fj%s#O_h}$6fX$Z)&*DXSh*UF zGRV`jsHlitSEd&w~~eR6(mX@setO>m;m36Q(E3IC#un0CzxD zDTDB^iV9UC%tJaU#^yp)dv&ft$@KDKdox|YZIa4Sjw_BL5(VL2r94v-C1}S2B5bKN zD=5H+%i(+b3%tU8e7RhqkT3KN6AC$;a1Ngr;Nusr!_|d))Zu1T;|lA=McPoHgqj5s z75KJU;V8&C-s&LS@2Hy>e!cXxxLMk;lXdVCRxhq6Fyo2(Rd_By9NM;e*lzSNBa_-`?R& zm;X?9aOt|K40cumXANiP)W)gl%Vb#zQIYH19N*11q1g;G^)E14m_cqO^=**rO6l5h z)yfCYgS}7Q+Isr@w35(0MdPQbA8ncTsE@be)=ck5)K>xJ4dz)*z0EkE`Y3(L&8K;P zP=7Wg zieE1`zAEfzoa}LA#Q@iN?wRhAg?-0MtPf>ml@6UYVOalLjVpIg2zWj0(NF3IGt=#9 zOOr{8EoN;$PLyx!O%HhAR9RH!`I~#xbKAS3i6=5Ahy22wF<_MM^rMr`H#QI7-)R(@FVgg8R^`eOFu5&f8Wc`qS+gZfDcA#OGm~{YZ!MqpE7#e z-a&3hn|VKB1e~GH+_-zng6v7RoqDG+4=s0#D)+dsE^Vv*$JJJ^RCacwZSp?OHg|hA zweR^e+r0aY?3DO8-tqT89h&AXGdn10{c&>7)h*SYNg)S>f%i8Yn$nUqxbcn2+@Tiz z?)WeK!-oBvQDw|^iQ`(<;|ibO-nQJcp>?!*lLxLQ{ZCzTUc1>$KKNXd{sZq#S-q5V zE}`MJ>yLkkeq{5iX{X83fd{-kazkFtIrO|+^Jo46fs>Z>6* z*3EX>bh~-D`FN!hHL7{k=rqca?(|-YW3AY4m64~9q!r%Jdpl@$uIzEF z!F^fEFO&LQ+&12>A8q|Mf%Dcm#ctD-E7A`-nyw`O$laMTb?pzr!Rt+PrnQxkoBY1} z<=J1JxT*(OZeBBfJb&hu%_;Rdc=d_nqR!V=o!IuW za`D)9(gq_h1%IHu9h}n63xwQnj&XR7h4J14@;}4EOFJyeDYrh?VC378UZv5SMs4l* zF~Fz7VOVZS5vs;vCnL;e@iODV-6p^2_miTeas}^tP-^b>-0_24m*4DuZePYRYQ*DH ztq;#iA4z}ZvU%@>bw}P_+8Q#Z^rf15;pYLD2W8QNw)_c3XbNZ2>F@dv1S!$GL8~P3s&&c%WJMw^c@F?M^(4upmPQdK7+w$fFQI6 zp8@$kdj5;SXE68-2A{#;GyFgC89Hq1;{Oo>yQ9Q{4Z1ov8*1(YVOSl$!&vY)#^U=8 zx5KY(gbTxdgJHknYxf%h>s_a#?G3bJQ2!dAS1&HC+yBCTgMYpBzP#TMP%rLx?>GFK z$`6CxJteWdJhK@rWrw?7niZseNF|qRv>z(uhWq#Q?a!3kC^2;uk`=N*3K0dmX zIzZCvlKSYhO&_ORn0Dy!)}o_*ZeI`mSn}>;Pbk4_ck00c6bS$lQ_Cb;L5=c zLq>FP**s*R-_^y!OI>fIO}QE1aoc(8JfnR-oG-FcU)yQB=+)dMVa?PxWJ{Y_9vrhW z$+qFT@EJD?w>K-b-sxwZka^eG<<^TQg6kQx-wl#JX>okIFKgjO<@Sh6{;hYP%G*$u zA#cf@_w?qH5%aGMTuWQt;AF{?2}vh*7g)9GzPe+3u78_dsV+GkZ{AtCPU1WLMhctX z#f_im?^!W5IBIugk0X2YE>3LNL?AE~2!dB6aj|-`ecZ>bJq{eP4n}Y zoZi~w){#ls_e8casdHC$-mvWYTt@D+w}mAampSZ_Jg`pcU3mX=A!!CDZPJXw_8iA6 znB(Js9-8&HJehCW`V{1q>~fmx$F=i5@mdf~+q!(iZ?}!tW%gApy_D)WsJM+y_d?s4 zsm=5A%DU|D(!QDFsh%yUzE|>Fjc_{r$7WzOc1m^{=?;Y>aN4P z9v}O7$hic6@rPxbhesT@&9pfeDIW0ddE1_g|p3~aW|t2-OW!Oi2Kbbpg%Qt zi`mQxFR!;G=S+Xl=B3qZ&!AguS9MF*%87l)Zb{qPN+KWUb*N|Z!G3G4H~!v(&uZ{M zU}NvKY;RecD;*sMyy5P6c9k{N?DufLcl1{ejMIlS>mQQ8@WM;W$zEe<*$242(%;-$ zxt{cM$XKtI^nNc}D6cMko}4>zpyXk%z$F`2_gS~KEXUdCXeX@q^ZoAwhkP{dqwrTg zZn<+}=@aL&NtQ-7p|jt5ci9uPJdnIBfZ?;DOB*IV*rg(qRT0xwV&DAAc}uM0BJ6!{ zyN8>C_cZb7XIi{+Nx;n(XImEE9I@l@@j<1x_T=yA_;x^NOQYs13dwKWsJmaUY_)#k zk{?rMrG=WbeRtqm+wC`l9`8=xKFr1O%*RohPg0b|sHl$g@il^;# z-|6zY<-2`~hB0j^ZpHg-PRtjzx#0cUJ)|<_TC4rWo9rbgyBHsj-rdnHXIQaCsQE}n zSw*Cv&xpI*ejM-l$}GgK!H$3rLn#rz58Xef%zfy~jLLOS5A1pqJS}}#z@4XiZ}tm) zbkm!Bb7@iePd$=TDmq+$nx>h0_vuK^v+a5Fo`pL1@p=2U_-J@o-_9!Gkv8s(5)PaB zV*T*DPv?gnb$RU8vtMa)R?isWwb_d|sU~=ot`O0+}`{!*qDt4jnzB_D?&HcOMUQBt?)|>mj zaLeG+=g6vniZ(xxukGj>a?)ncjteoix27|B76&AED7%NnomU=hpPpiJdGO_n-p977 zX52V2v}~i}z{)@T=JwObFHfUvy5HPU9Bqa>K@nTlg*p8|uO-MbtQCluCM)B*4;SSCBA3qrOV&cA~r?%aX>r>cNxwZSC6Sg;gxNzoo z^*XlyvxS*EVDoS0rp0sbQZ_N2Z|wC;nbz&y{_O*f=MQ+a#n^{B(|PQYn;%NAA36Fu z_1>uTL%S|VTkNL>uD1R?d(rkwq-7yyW@+YIR#_JNR~$I~z`5*&V>^Do_3bLSZXc3A zWPj+TQeM2~zS&~iqs=bXoK<61r<$!4|3I-Dub!o9HF^4p&9ThO7tZ#L@95<9>d#JB z4$U*QNjiV&>Pp9FC*B?Gd1Yki%EF~TOn)@KLF|*3WBZt^*QeY3Hv4KyV&eT55hl!v zL#Lddt%1B`}s{YYCDDC@5{+J(fO#IBsz|6|up7dEIeH}1q=cwf0KOVSrJlAbjuG60(uiM?pa;PMtMRwQr?EO(8=e>U5x4*FQ#%=ZC?6M806B=d=oVuo=)rL-8 zyix~^x45x*Y}ceogUY7fE`IG}8?lht*-0JNwKY?2b70m7R*=)|k_Ey(N5WrpCY6+q zY@}YaT}2IaD4NsAs>pwKV3$2(-S#&RG+SOKyB9Z+)k&S(sr^gKBZ{=bL6)jWc9?TT z?}E(-%RAb}+NUR=I{Yb%t4z`)}H!}x^x6gcdqJyVh^sln@CnDUobPMpUJlkPZ za`7gl*8{bBt$99ptL@IhgHtBBJKW59&}iS{8P`r7&UW*7kxa4M;oJS=yZtyc z`2BC&dz|r@@Cr=-)L_r?Hmb}~#eGaq@mua+xYLDCPeoI>&g|%CB#B^L>lX>Zvl8q} zCs_(7pSkz;_%`onO}SA$ZwkhVpW52pl>O{lG4-U&uV-3F!pB)Jw#}n$II=hR%>2VH zUTfQbJbh3^I_?-4u=2jkiJ`aqxhy04r>P5*4vuAso~}E1@?dlFlUaAopPZZT z?z)+mz;}pbS4{oo8R^g@XQ6+}>|>Gs<3hzRC%?fh7^djh{XxyEWIkXW#K38f`wF+-CO$ z@tqy#Rlj#GF>B3^I$5|f<;R4J=ci31k8kS6IY0PVOW~DYlV@~(>AHJDkM`S!zBq7i zLeSYJZT{T7HR$EN7O#zm79T&`X64f)!5r(O?*y}QlqG&C;KH6hJwKuIl1@{kmBK?4 z<`l278~Z3F)N%ClrhlYNS@28S;0f7oZ=II?6eBp=?dMlFe@l8<+V$<4t=tXwoArBi zpR_tHw0v~R6t8Y8EmEgQdv_g_zw4pwgj3Xn^~m+^3$AyAlQtz1fu(+cKu3fS05Am#*jRy8?7c-@`{R_sOg=2fS z8XXvarR0g-!ULs({9{9NuU#S+uMpqzI@L9~!8wnL^LrAVlkZvw&S=xWVEDU=F3Zo( z9lr3aX~RN6z_#2bBi`OF-`!{fzuShRLm~ERsA^&n7It&-xTkrpqIDMW3zx6<^ZaS% zkBvueniYNMb=0FfJGh>SvySg2UF}ac!}8Wzk8AMfALzN9dhWU$FH#*vFY`dj>C?wG z>U#_Zo?A;%J1@bVI2l%MG>VwYvz}=wsa0GhT7C3(gbP(J|fH#Aq;bV}1 zK>`K|7$jhjfI$KV2^b_`kbpq~1_>A>@OcRcS6OOg$A&jIp$@?gH$LI<<0WeMc`fsz zI~5BaY}sciZ9BbaSU=;Hb|FbOOMbZ~vYbBhxvUS}w}tt#Rjn!S=Qf!>VZ`a}Yb{d> z9$n;p?B2^se6eZ&ynQVK+HJjjJb(4;Re$y`YSlmVj!8@P(7i7-Z+~{n@Rr`~^RaQi zk0DnscdI<~dF~9Q1_>A>V32@80tN{fBw&z$K>`K|7$jhjfI$KV2^b{scSztTZa@nX zM2z^WpX|fyb|TzN6h;A^v`1fG{vg;2z~PiL(rCtQ21gElX-=Y(E6N$MkkyGyB5}<* zrZnU9!I2~hyiS#bE_7g|igMZwPC40|Q%>4YVMHd8$&}nH+YfWhXbgZk(vD(eM8!Cn zTvLuQ%_xaNvmu8?a~pCRpbHZlQ@to(Tzifk$~CpI(#vHgO2h?R2Tm(gWMtDszeq2F z2Q!SvX<=vX#pR$M^?Pvxy}4cN%zXm6Ufx{oB`5bgnQ-Aa5lpnKj|pugG)^kVhDOJm zPbO*QU__!D@iEHz^ebcelQ#7|+ql`K!0p19Sg+NmbB|Jw8_nGr*J@Ue9=>wp*9@6*lwYIkB9Uz(#WiN@Gr=vWDjeZ(ue0&2&!3 z4HsLNZu*njcdkbS#{vOZl1Lxnz072K8K*hAM(?0)__pVYJCdGOv8$#idrlwm^Eval zlqNO%3f>yek&wCAj4sEX`7J8j|MMG}`@W8h0IQq4=Tq7jx6S2E+~0hJ?DCV6c55bA zT9ZSMtCb7h_GwS%GR$&~M&>BX_C)*Y(b z01C!3%D^Zhzl$Z~^34a%d}Q8X?*|vf!%SX5$I?w6rZanO{UbH?c-I+o+n2vte=?O4 zF+vnERXLfzU|GepO=)iv7n)gI%p5xAOoa8kLFSh>E|~i^&GxNR%Mq%JOxNad>eQ%y z{`82)^Z1a3YT<~aW3I7HEXnFBq(;rvn0Dn@cTgq8?i7Yc7G=l7a5^BHGK&zNx~zb~>o<+kuh zMB~9!&?7PE(M_!$wUF#+SCf-}vG??CkgvCwz8;~=f5#Bkqe87_KioHKrJe8c;RolZ z-M-6f?M%7eZt>q2DK%Z{FxXzn?N?*uH*Em1}w}Tz@#8(|PT= zDK37o>o%<1HKWPQ1y6?!vwC`bYO7(d`lqjTYx(Mr16N1C@kpAN$r0DEO?B$XH|SWM zwynm*LKrJf!G#_H1E*;o^Xid)2zCL%C&^K5N1A3 z0GH$A?ZfTD@vJVTa9I@Qw*Fo3h0nKL@YuJ<`@RPJ7h`z5i+C4nCZ;-3oQkTTM@>#!JqQV+*D zokpIn>|SzEpgJAS7`)>Z+riF*GMa#@|C@RH1pZJRg5Z>!53On}@?*?PAgd5MuC^aj zPIajU1W$%)PbsI`mg)lYd1zz0dEqeutK#)}5W)H&<|RY`^T1=^NizyjbV?6A%wP~p zp-zMFIFcL{9@-Eh;T0B2vml0EERIOzr4a2@CklmuMO`}kMx~~7 z&}4Y|`bLGv%ThaYiaQE;1q6&Jv70=SQwvHMUX&S8tW5O^=ZHZTQQ;kA8PMKLucV^R ziM&L9PNr76QG6unZgN7_B0j$;8lqe$W~9c1#lFk2X&EsoN} z_vXdm&~X8LUUqZ#}^@6D5ia{>hNj1H=p7)^{kuBUHNWK66~kjnRo(IoYbN$mh+G8Gz?P~M@q zL+=Q6u4gwnJ|rNZN*%+bdNgVc%jbfFij^`Lc5;QPKr919WNNY{Vof131gu=JFho%r z6rkY1;!FsX3$ZaFva6y&Vn!YsL~GW|?1J?sYy&zPD-NnrpnC+iVYvcbUFC+<&0?)Rv?>%iHW8 zdFjH{7NW)e&y7y}xmQkhOAKwfeSbyVIO9gYOz=5kBpey`sQcZ#VOeQd@98U1ymsYTkF#!A?-|y6U%T;Dj|v&qd*8R-+MfiVyL48r1q&^B28_mNo7%+uFsgcxqDqiiSaB zT)no}Snox0!eKQxKioF4^9M#EU($czx(j3SucR?Ihf~JAniRiw|(g;j%*D*Pxu z=+{MPXW9iF;erWA&-T(+@ll*G;4o=Us+X&M@pnSBJFz z3g^VI7j4*!u6oBx4F}iYn;7<@iC6D@_f0v2Z(`Vs{?cCb&7sfVbA0A%k+I+r;hA-it+xO zYoj=IzrEm^JaLS@RABA&G-$xq$1{Ci#Yjh<`?xje$vAG2*T?jcvlgSDEC-{PJ;0}J zu2{)bOLOGR44EP`AH7`y!swI8CKyD)hg;(iIzPy1>!8bb*cgVAC3X_MyhHB;FD3OP zg78BO_l(RB2ldJfrv?caBw&z$K>`K|7$jhjfI$KV2^b_`kbpq~1_>A>@V`X@wf6%G zFSk2d4sq2`YJlC*YsQ@r3`6??#EaELVx^j0AXe%D{GUFpEvMSA5wC81c@|dVrQ)?Q zYrl238grCX?;X6g(Q3b9wHobozTRt$h!?KbM%I7p5qe!>^(PW~u+H}xz!Nz5yT$R> zT7HfmdW%x^XFzd1^mOl3s!gi)%N43gtt+dCRP9$S)FxRw+F&)wm*YMmSzqkI*p5^h RLNtayS9o*kn4{?Ge*k^clKlVx diff --git a/test/unittest/resources/demo_cert/pkcs7/verify_test_profile.p7b b/test/unittest/resources/demo_cert/pkcs7/verify_test_profile.p7b deleted file mode 100644 index d17fdc5cd783dbba61ebcbd8f91645df6631930f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 3468 zcmcgvYj6|S6}BF>F-Blwz(4^T@vsBPzAH<%;6G+nrN@$=Yle-_|eG> z`k|fkxOcxj=R4n>3zCxMX&JNH3~k>^1nI(#q@)=nB{88u07*b*TE?O_gMbu?g#wUF zEqItH=t!nc5GPZ|E|xZtk*J@hWE2r1rDaliAt(gWISWo!rNx|k$sFkb zf(RKTi73f!=8RG9ASv@x9-80JO*WB1I!s1neTXb!k}?pH5KT36xkJ9iMMfCE$L}H- z{*z?<4?*=tbDjpZ+Kf7*2DYJn-Z~018Z}r#qk)~I7iNtJ>@}izbX_>KJK5 zYca&7hao$viDS5}7zsK9KA$TDH94t(w@P2-tD~GYv;otgeOYiEBOcAdYY^6{4>mYz ztYN2I;l%;U8hkD@)_}5D1KiAEuo>eP8y2tTyk>16jx}KM2fhY`#_%Ys!TT`kQP!lj zHK2A3G4|u~VdZtyBkzpsZE#KhcSda}s%C4el}1O6iE+x6N~6vibX0@*d@UU6&%tbU zlmR@Fh3Z(BJ|1?+b%5Y%Vbqy|PVReMaywgXgKdb{HBen6!dJSE>aR71Agoyf!#1bG zqQUWSwbJ7bI1FZmvI*1_!v-P_$r~yVH>#zhI;*i3B5Oi%iz88~ucJ&X=7}17cDov& zs-O|rY8vi`bmLh|6C`=@@%CZI2Zf zS5}qAJgCk?7#V86o9YRu3W@CW@R zNRTcdTj|Ou_b+ek1zutCN&) zw(W)76MyQ!*Jq6T!z+rjB5Kvi@tby9K?TU=;7pz-9uLN~jQM+8mvr1;Gq=z0>Y1^) z`>WI?J7jt=l1~^V5d2px775c^z+~PYDIO;tbB4I~_MU|K!ns!u|KdjK_jl?g0_)J8 ziTo+RBZN}+uRWNNbT%I}OdpNh_!ZghOFQ(;)+|;x_xl?=+PgkO*10cvzPYmJ_LVhh zC5!I=W-GU(qpczF$^8*!@QvvU%TuSW{C#JO1zgg8x^iZZb>ce$&E9L%5ARfF#rNHh zF75rtsKXq8v>bm<5AbKy71gStSb*~CG}lUiq`Y330UK?+DUh(vwnQ$*4P zvL2Erb@tE2DN>O$MU0j7G_MaxTDRPkm`>g=pucp%q4|ruWtm%=-oEZ|oL{hc$Gqfs zZ+_$u>sMj=_V5N|_x_IC-Sziuog+r}xR$T`n|}1pmn4^u?cQ;(e(b%OxvL^QdCyM9 zqYmTJ(scd5cOqaO7{wDMn` zyC?Fd0JjjZwQN50!ME(*xf{1$tU0poV1DQDHRnbgE9;)}Qp+r5qHg#0NwRGh-lN6S z{EmEPvk**weflryh5M(aTgU8LbGu_TFul;M{Z9<-4ex5&y5%<5*l1bbd~r|Ch1s2F z_2b)8IUW%lk9r4qG=+TU`JqUjV)q7#5u_}Z59SeXJ{?7T0)?h-`|{M*H*%B*R=&Th z{-4+28TsO?6JNXa5!0$UxHs+2ft&dg&s=;(^477^T}#6?D^4x_N%&Ax=bL}Fg6bn5 zZ!9ROINJ5byPGF&*?nupimY4b+o!I$yKK>s*|~SGpT4s8JDGi_3lKxZ>9HL7KREVS zaT{{NhJm?urPpBpWJSvaUzhRg z3)j2Get7-jXilt74x`z9Ws&XHu9>oXM{D-Kw_!upyTRvr#w90xzx=X!O{8}%aW(8< z)_C7ny!PD3g-}v}a3q_{T^m5)skCw6L>+uX>F|T`4{j(KB8ZFqaIX=7Ne_&SRA>}; zC~`+2cPy3`mp~lxiXKMAkW`#^TUKVBE4x)T<1dr%G%ar#|KhgM1+(Mr_Q1h0W$T`m zp8&%joa92W0qBHNQ+Dab+N$plvmxZN)}xo!1wO6MdrK!?fA>}Ek=3jBZCc8u{0{&8 j^cT>=Xl`2LysOKWzWnvslL10^=7^>>@9y%F&dUD*85CR& diff --git a/test/unittest/resources/ohos_test.xml b/test/unittest/resources/ohos_test.xml index 9723e6a..da43cba 100644 --- a/test/unittest/resources/ohos_test.xml +++ b/test/unittest/resources/ohos_test.xml @@ -63,9 +63,6 @@