feat(package_info_plus)!: Switch to SHA-256 for buildSignature on A…

…ndroid (#2835)
fluttercommunity · Apr 15, 2024 · 7259af2 · 7259af2
1 parent 7d712ef
commit 7259af2
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 6 deletions.
diff --git a/...o_plus/android/src/main/kotlin/dev/fluttercommunity/plus/packageinfo/PackageInfoPlugin.kt b/...o_plus/android/src/main/kotlin/dev/fluttercommunity/plus/packageinfo/PackageInfoPlugin.kt
@@ -94,9 +94,9 @@ class PackageInfoPlugin : MethodCallHandler, FlutterPlugin {
                 val signingInfo = packageInfo.signingInfo ?: return null
 
                 if (signingInfo.hasMultipleSigners()) {
-                    signatureToSha1(signingInfo.apkContentsSigners.first().toByteArray())
+                    signatureToSha256(signingInfo.apkContentsSigners.first().toByteArray())
                 } else {
-                    signatureToSha1(signingInfo.signingCertificateHistory.first().toByteArray())
+                    signatureToSha256(signingInfo.signingCertificateHistory.first().toByteArray())
                 }
             } else {
                 val packageInfo = pm.getPackageInfo(
@@ -108,7 +108,7 @@ class PackageInfoPlugin : MethodCallHandler, FlutterPlugin {
                 if (signatures.isNullOrEmpty() || packageInfo.signatures.first() == null) {
                     null
                 } else {
-                    signatureToSha1(signatures.first().toByteArray())
+                    signatureToSha256(signatures.first().toByteArray())
                 }
             }
         } catch (e: PackageManager.NameNotFoundException) {
@@ -120,8 +120,8 @@ class PackageInfoPlugin : MethodCallHandler, FlutterPlugin {
 
     // Credits https://gist.github.com/scottyab/b849701972d57cf9562e
     @Throws(NoSuchAlgorithmException::class)
-    private fun signatureToSha1(sig: ByteArray): String {
-        val digest = MessageDigest.getInstance("SHA1")
+    private fun signatureToSha256(sig: ByteArray): String {
+        val digest = MessageDigest.getInstance("SHA-256")
         digest.update(sig)
         val hashText = digest.digest()
         return bytesToHex(hashText)

diff --git a/packages/package_info_plus/package_info_plus/lib/package_info_plus.dart b/packages/package_info_plus/package_info_plus/lib/package_info_plus.dart
@@ -106,7 +106,9 @@ class PackageInfo {
   /// Docs about CFBundleVersion: https://developer.apple.com/documentation/bundleresources/information_property_list/cfbundleversion
   final String buildNumber;
 
-  /// The build signature. Empty string on iOS, signing key signature (hex) on Android.
+  /// The build signature.
+  /// Empty string on iOS.
+  /// SHA-256 signing key signature (hex) on Android.
   final String buildSignature;
 
   /// The installer store. Indicates through which store this application was installed.