Sync - #1

Make test certs more RFC 7468 compliant by ensuring each line consists of no more than 64 characters.

PiperOrigin-RevId: 893644193

…attribute

This is the first step toward making the constraints truly generic. Instead of
making each constraint take a specific attribute, make all the constraints
accept common types. The contraints are them customize to extract the constrained
attributes using mapping functions.

PiperOrigin-RevId: 899625172

PiperOrigin-RevId: 902573134

Some of the oldest factory chains are about to expires, but there is not a
practical mechanism to rotate. Given that, ignore the expiry on these certs.

If we find some day that the certs are not trustworthy, we'll revoke them.

PiperOrigin-RevId: 902798819

PiperOrigin-RevId: 903340853

PiperOrigin-RevId: 910876241

Patched from android#78,
originally authored by @thomasbuilds

PiperOrigin-RevId: 911352815

PiperOrigin-RevId: 914825126

PiperOrigin-RevId: 924767967

PiperOrigin-RevId: 927348379

Should compare the intermediate's issuer to the
anchor's subject.

PiperOrigin-RevId: 928611724

Factory certificates changed format at some point between 2016 and 2021,
which breaks the "isFactoryProvisioned" check.

Make the check a bit more lax so that we consider more cert types as
factory provisioned. This is safe because we are not relaxing the
isRemoteProvisioned check at all, and that is the check that attackers
want to spoof.

PiperOrigin-RevId: 930722556

PiperOrigin-RevId: 931089191

As noted by android#87, we were missing
tags 508 and 405. Oops!

Fixes android#87

PiperOrigin-RevId: 943503422

Test signature validation against a fake cert chain
whose intermediate certificate signs the leaf with a
p256 key using sha384. Generated using openssl.

PiperOrigin-RevId: 944011042
Change-Id: I93a349fda01615cab043566295a48be4888c9352

PiperOrigin-RevId: 945004516

This change also gives the LogHook methods. Supporting what can be
logged should not be a requirement.

PiperOrigin-RevId: 946969655

It's possible that a vulnerable keymint implementation could lie about the
security level. e.g. a vulnerable trusted OS could be coerced into claiming
it is actually StrongBox.

All certificates issued to StrongBox implementations have a StrongBox claim
in their certificate (carried within the subject). Add a constraint that checks
for this claim and matches it against the Google-signed certificate(s).

PiperOrigin-RevId: 948421025

PiperOrigin-RevId: 950733549

PiperOrigin-RevId: 950846227

PiperOrigin-RevId: 950945125

PiperOrigin-RevId: 951655871

PiperOrigin-RevId: 967327969

PiperOrigin-RevId: 967397038

Proguard ruthlessly targets function-local types, which breaks gson. Fix it.

PiperOrigin-RevId: 970616422

Block "obviously invalid" input values.

PiperOrigin-RevId: 971306073

It turns out there are commonly package lists longer than I expected!

Bump the default limit to 32 to hopefully address the most common upper bound.

I don't have data on this, so I'm admittedly guessing a bit here!

PiperOrigin-RevId: 971621632

Since these cert chains do not have verified boot hash in the root of
trust

PiperOrigin-RevId: 972105230

This new constraint type allows constraining chains to being factory
or remotely provisioned.

PiperOrigin-RevId: 976360263

PiperOrigin-RevId: 979199864

PiperOrigin-RevId: 979228512

PiperOrigin-RevId: 979828575

PiperOrigin-RevId: 981664058

PiperOrigin-RevId: 983201340

It's not included in the actual cert chains so it shouldn't
be in the jsons representing test data.

PiperOrigin-RevId: 983716755

Log when encountering malformed bools in key attestation extension
RootOfTrust.

PiperOrigin-RevId: 986955350

PiperOrigin-RevId: 987391156

PiperOrigin-RevId: 987415741

PiperOrigin-RevId: 987512226

PiperOrigin-RevId: 988165088

Assert unparseableExtension fails validation while invalidKeySize
succeeds.

PiperOrigin-RevId: 988417393

PiperOrigin-RevId: 989527382

PiperOrigin-RevId: 995851424

PiperOrigin-RevId: 997803738

PiperOrigin-RevId: 998506333

Keep the local shadow plugin and older trust anchors.

Co-authored-by: Cursor <cursoragent@cursor.com>