Update CTS shims

* define a update hash such that com.android.cts.priv.ctsshim can't
  be updated
* create a new APK to verify that <restrict-update> works as expected

Bug: 29311441
Change-Id: I61f3ae3dbd9c79b2dcdfbc30757af0f9a669fce6

6 files changed, 28 insertions, 2 deletions

diff --git a/packages/CtsShim/CtsShim.apk b/packages/CtsShim/CtsShim.apk
index 40f7dbdc235e..7a27a438fcc6 100644
--- a/packages/CtsShim/CtsShim.apk
+++ b/packages/CtsShim/CtsShim.apk
diff --git a/packages/CtsShim/CtsShimPriv.apk b/packages/CtsShim/CtsShimPriv.apk
index b5dcc600d7a9..63e86883589b 100644
--- a/packages/CtsShim/CtsShimPriv.apk
+++ b/packages/CtsShim/CtsShimPriv.apk
diff --git a/packages/CtsShim/build/Android.mk b/packages/CtsShim/build/Android.mk
index bf6ae4151dae..21f0afe573be 100644
--- a/packages/CtsShim/build/Android.mk
+++ b/packages/CtsShim/build/Android.mk
@@ -63,6 +63,27 @@ LOCAL_FULL_MANIFEST_FILE := $(gen)
 include $(BUILD_PACKAGE)
 
 ###########################################################
+# Variant: Privileged app upgrade w/ the wrong SHA
+
+include $(CLEAR_VARS)
+# this needs to be a privileged application
+LOCAL_PRIVILEGED_MODULE := true
+
+LOCAL_MODULE_TAGS := optional
+LOCAL_SDK_VERSION := current
+LOCAL_PROGUARD_ENABLED := disabled
+LOCAL_DEX_PREOPT := false
+# anything to make this package's SHA different from CtsShimPrivUpgrade
+LOCAL_AAPT_FLAGS := --version-name WrongSHA
+
+LOCAL_PACKAGE_NAME := CtsShimPrivUpgradeWrongSHA
+
+LOCAL_MANIFEST_FILE := shim_priv_upgrade/AndroidManifest.xml
+
+include $(BUILD_PACKAGE)
+
+
+###########################################################
 # Variant: System app
 
 include $(CLEAR_VARS)
diff --git a/packages/CtsShim/build/README b/packages/CtsShim/build/README
index 333b87c8cb9d..9869377738b8 100644
--- a/packages/CtsShim/build/README
+++ b/packages/CtsShim/build/README
@@ -7,12 +7,14 @@ NOTE: The need to include a binary on the system image may be deprecated if a
 solution involving a temporarily writable /system partition is implemented.
 
 build:
-    $ tapas CtsShim CtsShimPriv CtsShimPrivUpgrade
+    $ tapas CtsShim CtsShimPriv CtsShimPrivUpgrade CtsShimPrivUpgradeWrongSHA
     $ m
 
 local testing:
     $ cp $OUT/system/priv-app/CtsShimPrivUpgrade/CtsShimPrivUpgrade.apk \
         cts/hostsidetests/appsecurity/test-apps/PrivilegedUpdateApp
+    $ cp $OUT/system/priv-app/CtsShimPrivUpgradeWrongSHA/CtsShimPrivUpgradeWrongSHA.apk \
+        cts/hostsidetests/appsecurity/test-apps/PrivilegedUpdateApp
     $ cp $OUT/system/priv-app/CtsShimPriv/CtsShimPriv.apk \
         frameworks/base/packages/CtsShim
     $ cp $OUT/system/app/CtsShim/CtsShim.apk \
diff --git a/packages/CtsShim/build/shim/AndroidManifest.xml b/packages/CtsShim/build/shim/AndroidManifest.xml
index 24e942b1ba64..9b813ace8b80 100644
--- a/packages/CtsShim/build/shim/AndroidManifest.xml
+++ b/packages/CtsShim/build/shim/AndroidManifest.xml
@@ -22,6 +22,9 @@
     <uses-sdk android:minSdkVersion="24"
         android:targetSdkVersion="24" />
 
+    <restrict-update
+        android:hash="__CAN_NOT_BE_UPDATED__" />
+
     <application
         android:hasCode="false"
         tools:ignore="AllowBackup,MissingApplicationIcon" >
diff --git a/packages/CtsShim/build/shim_priv/AndroidManifest.xml b/packages/CtsShim/build/shim_priv/AndroidManifest.xml
index 7ba76cf026d6..5195ef79d93b 100644
--- a/packages/CtsShim/build/shim_priv/AndroidManifest.xml
+++ b/packages/CtsShim/build/shim_priv/AndroidManifest.xml
@@ -22,7 +22,7 @@
     <uses-sdk android:minSdkVersion="24"
         android:targetSdkVersion="24" />
 
-    <restrict-upgrade
+    <restrict-update
         android:hash="__HASH__" />
 
     <application