Import Android SDK Platform P [4524038]

/google/data/ro/projects/android/fetch_artifact \
    --bid 4524038 \
    --target sdk_phone_armv7-win_sdk \
    sdk-repo-linux-sources-4524038.zip

AndroidVersion.ApiLevel has been modified to appear as 28

Change-Id: Ic193bf1cf0cae78d4f2bfb4fbddfe42025c5c3c2

16 files changed, 2158 insertions, 1098 deletions

diff --git a/android/util/FeatureFlagUtils.java b/android/util/FeatureFlagUtils.java
index 29baea17..bfb51309 100644
--- a/android/util/FeatureFlagUtils.java
+++ b/android/util/FeatureFlagUtils.java
@@ -21,6 +21,7 @@ import android.os.SystemProperties;
 import android.provider.Settings;
 import android.text.TextUtils;
 
+import java.util.HashMap;
 import java.util.Map;
 
 /**
@@ -33,6 +34,19 @@ public class FeatureFlagUtils {
     public static final String FFLAG_PREFIX = "sys.fflag.";
     public static final String FFLAG_OVERRIDE_PREFIX = FFLAG_PREFIX + "override.";
 
+    private static final Map<String, String> DEFAULT_FLAGS;
+    static {
+        DEFAULT_FLAGS = new HashMap<>();
+        DEFAULT_FLAGS.put("device_info_v2", "true");
+        DEFAULT_FLAGS.put("new_settings_suggestion", "true");
+        DEFAULT_FLAGS.put("settings_search_v2", "true");
+        DEFAULT_FLAGS.put("settings_app_info_v2", "false");
+        DEFAULT_FLAGS.put("settings_connected_device_v2", "true");
+        DEFAULT_FLAGS.put("settings_battery_v2", "false");
+        DEFAULT_FLAGS.put("settings_battery_display_app_list", "false");
+        DEFAULT_FLAGS.put("settings_security_settings_v2", "false");
+    }
+
     /**
      * Whether or not a flag is enabled.
      *
@@ -41,7 +55,7 @@ public class FeatureFlagUtils {
      */
     public static boolean isEnabled(Context context, String feature) {
         // Override precedence:
-        // Settings.Global -> sys.fflag.override.* -> sys.fflag.*
+        // Settings.Global -> sys.fflag.override.* -> static list
 
         // Step 1: check if feature flag is set in Settings.Global.
         String value;
@@ -57,8 +71,8 @@ public class FeatureFlagUtils {
         if (!TextUtils.isEmpty(value)) {
             return Boolean.parseBoolean(value);
         }
-        // Step 3: check if feature flag has any default value. Flag name: sys.fflag.<feature>
-        value = SystemProperties.get(FFLAG_PREFIX + feature);
+        // Step 3: check if feature flag has any default value.
+        value = getAllFeatureFlags().get(feature);
         return Boolean.parseBoolean(value);
     }
 
@@ -73,6 +87,6 @@ public class FeatureFlagUtils {
      * Returns all feature flags in their raw form.
      */
     public static Map<String, String> getAllFeatureFlags() {
-        return null;
+        return DEFAULT_FLAGS;
     }
 }
diff --git a/android/util/KeyValueListParser.java b/android/util/KeyValueListParser.java
index d50395e2..0a00794a 100644
--- a/android/util/KeyValueListParser.java
+++ b/android/util/KeyValueListParser.java
@@ -149,6 +149,34 @@ public class KeyValueListParser {
     }
 
     /**
+     * Get the value for key as an integer array.
+     *
+     * The value should be encoded as "0:1:2:3:4"
+     *
+     * @param key The key to lookup.
+     * @param def The value to return if the key was not found.
+     * @return the int[] value associated with the key.
+     */
+    public int[] getIntArray(String key, int[] def) {
+        String value = mValues.get(key);
+        if (value != null) {
+            try {
+                String[] parts = value.split(":");
+                if (parts.length > 0) {
+                    int[] ret = new int[parts.length];
+                    for (int i = 0; i < parts.length; i++) {
+                        ret[i] = Integer.parseInt(parts[i]);
+                    }
+                    return ret;
+                }
+            } catch (NumberFormatException e) {
+                // fallthrough
+            }
+        }
+        return def;
+    }
+
+    /**
      * @return the number of keys.
      */
     public int size() {
diff --git a/android/util/Log.java b/android/util/Log.java
index 02998653..b94e48b3 100644
--- a/android/util/Log.java
+++ b/android/util/Log.java
@@ -16,45 +16,12 @@
 
 package android.util;
 
-import android.os.DeadSystemException;
-
-import com.android.internal.os.RuntimeInit;
-import com.android.internal.util.FastPrintWriter;
-import com.android.internal.util.LineBreakBufferedWriter;
-
 import java.io.PrintWriter;
 import java.io.StringWriter;
-import java.io.Writer;
 import java.net.UnknownHostException;
 
 /**
- * API for sending log output.
- *
- * <p>Generally, you should use the {@link #v Log.v()}, {@link #d Log.d()},
- * {@link #i Log.i()}, {@link #w Log.w()}, and {@link #e Log.e()} methods to write logs.
- * You can then <a href="{@docRoot}studio/debug/am-logcat.html">view the logs in logcat</a>.
- *
- * <p>The order in terms of verbosity, from least to most is
- * ERROR, WARN, INFO, DEBUG, VERBOSE.  Verbose should never be compiled
- * into an application except during development.  Debug logs are compiled
- * in but stripped at runtime.  Error, warning and info logs are always kept.
- *
- * <p><b>Tip:</b> A good convention is to declare a <code>TAG</code> constant
- * in your class:
- *
- * <pre>private static final String TAG = "MyActivity";</pre>
- *
- * and use that in subsequent calls to the log methods.
- * </p>
- *
- * <p><b>Tip:</b> Don't forget that when you make a call like
- * <pre>Log.v(TAG, "index=" + i);</pre>
- * that when you're building the string to pass into Log.d, the compiler uses a
- * StringBuilder and at least three allocations occur: the StringBuilder
- * itself, the buffer, and the String object.  Realistically, there is also
- * another buffer allocation and copy, and even more pressure on the gc.
- * That means that if your log message is filtered out, you might be doing
- * significant work and incurring significant overhead.
+ * Mock Log implementation for testing on non android host.
  */
 public final class Log {
 
@@ -88,29 +55,6 @@ public final class Log {
      */
     public static final int ASSERT = 7;
 
-    /**
-     * Exception class used to capture a stack trace in {@link #wtf}.
-     * @hide
-     */
-    public static class TerribleFailure extends Exception {
-        TerribleFailure(String msg, Throwable cause) { super(msg, cause); }
-    }
-
-    /**
-     * Interface to handle terrible failures from {@link #wtf}.
-     *
-     * @hide
-     */
-    public interface TerribleFailureHandler {
-        void onTerribleFailure(String tag, TerribleFailure what, boolean system);
-    }
-
-    private static TerribleFailureHandler sWtfHandler = new TerribleFailureHandler() {
-            public void onTerribleFailure(String tag, TerribleFailure what, boolean system) {
-                RuntimeInit.wtf(tag, what, system);
-            }
-        };
-
     private Log() {
     }
 
@@ -121,7 +65,7 @@ public final class Log {
      * @param msg The message you would like logged.
      */
     public static int v(String tag, String msg) {
-        return println_native(LOG_ID_MAIN, VERBOSE, tag, msg);
+        return println(LOG_ID_MAIN, VERBOSE, tag, msg);
     }
 
     /**
@@ -132,7 +76,7 @@ public final class Log {
      * @param tr An exception to log
      */
     public static int v(String tag, String msg, Throwable tr) {
-        return printlns(LOG_ID_MAIN, VERBOSE, tag, msg, tr);
+        return println(LOG_ID_MAIN, VERBOSE, tag, msg + '\n' + getStackTraceString(tr));
     }
 
     /**
@@ -142,7 +86,7 @@ public final class Log {
      * @param msg The message you would like logged.
      */
     public static int d(String tag, String msg) {
-        return println_native(LOG_ID_MAIN, DEBUG, tag, msg);
+        return println(LOG_ID_MAIN, DEBUG, tag, msg);
     }
 
     /**
@@ -153,7 +97,7 @@ public final class Log {
      * @param tr An exception to log
      */
     public static int d(String tag, String msg, Throwable tr) {
-        return printlns(LOG_ID_MAIN, DEBUG, tag, msg, tr);
+        return println(LOG_ID_MAIN, DEBUG, tag, msg + '\n' + getStackTraceString(tr));
     }
 
     /**
@@ -163,7 +107,7 @@ public final class Log {
      * @param msg The message you would like logged.
      */
     public static int i(String tag, String msg) {
-        return println_native(LOG_ID_MAIN, INFO, tag, msg);
+        return println(LOG_ID_MAIN, INFO, tag, msg);
     }
 
     /**
@@ -174,7 +118,7 @@ public final class Log {
      * @param tr An exception to log
      */
     public static int i(String tag, String msg, Throwable tr) {
-        return printlns(LOG_ID_MAIN, INFO, tag, msg, tr);
+        return println(LOG_ID_MAIN, INFO, tag, msg + '\n' + getStackTraceString(tr));
     }
 
     /**
@@ -184,7 +128,7 @@ public final class Log {
      * @param msg The message you would like logged.
      */
     public static int w(String tag, String msg) {
-        return println_native(LOG_ID_MAIN, WARN, tag, msg);
+        return println(LOG_ID_MAIN, WARN, tag, msg);
     }
 
     /**
@@ -195,31 +139,9 @@ public final class Log {
      * @param tr An exception to log
      */
     public static int w(String tag, String msg, Throwable tr) {
-        return printlns(LOG_ID_MAIN, WARN, tag, msg, tr);
+        return println(LOG_ID_MAIN, WARN, tag, msg + '\n' + getStackTraceString(tr));
     }
 
-    /**
-     * Checks to see whether or not a log for the specified tag is loggable at the specified level.
-     *
-     *  The default level of any tag is set to INFO. This means that any level above and including
-     *  INFO will be logged. Before you make any calls to a logging method you should check to see
-     *  if your tag should be logged. You can change the default level by setting a system property:
-     *      'setprop log.tag.&lt;YOUR_LOG_TAG> &lt;LEVEL>'
-     *  Where level is either VERBOSE, DEBUG, INFO, WARN, ERROR, ASSERT, or SUPPRESS. SUPPRESS will
-     *  turn off all logging for your tag. You can also create a local.prop file that with the
-     *  following in it:
-     *      'log.tag.&lt;YOUR_LOG_TAG>=&lt;LEVEL>'
-     *  and place that in /data/local.prop.
-     *
-     * @param tag The tag to check.
-     * @param level The level to check.
-     * @return Whether or not that this is allowed to be logged.
-     * @throws IllegalArgumentException is thrown if the tag.length() > 23
-     *         for Nougat (7.0) releases (API <= 23) and prior, there is no
-     *         tag limit of concern after this API level.
-     */
-    public static native boolean isLoggable(String tag, int level);
-
     /*
      * Send a {@link #WARN} log message and log the exception.
      * @param tag Used to identify the source of a log message.  It usually identifies
@@ -227,7 +149,7 @@ public final class Log {
      * @param tr An exception to log
      */
     public static int w(String tag, Throwable tr) {
-        return printlns(LOG_ID_MAIN, WARN, tag, "", tr);
+        return println(LOG_ID_MAIN, WARN, tag, getStackTraceString(tr));
     }
 
     /**
@@ -237,7 +159,7 @@ public final class Log {
      * @param msg The message you would like logged.
      */
     public static int e(String tag, String msg) {
-        return println_native(LOG_ID_MAIN, ERROR, tag, msg);
+        return println(LOG_ID_MAIN, ERROR, tag, msg);
     }
 
     /**
@@ -248,82 +170,7 @@ public final class Log {
      * @param tr An exception to log
      */
     public static int e(String tag, String msg, Throwable tr) {
-        return printlns(LOG_ID_MAIN, ERROR, tag, msg, tr);
-    }
-
-    /**
-     * What a Terrible Failure: Report a condition that should never happen.
-     * The error will always be logged at level ASSERT with the call stack.
-     * Depending on system configuration, a report may be added to the
-     * {@link android.os.DropBoxManager} and/or the process may be terminated
-     * immediately with an error dialog.
-     * @param tag Used to identify the source of a log message.
-     * @param msg The message you would like logged.
-     */
-    public static int wtf(String tag, String msg) {
-        return wtf(LOG_ID_MAIN, tag, msg, null, false, false);
-    }
-
-    /**
-     * Like {@link #wtf(String, String)}, but also writes to the log the full
-     * call stack.
-     * @hide
-     */
-    public static int wtfStack(String tag, String msg) {
-        return wtf(LOG_ID_MAIN, tag, msg, null, true, false);
-    }
-
-    /**
-     * What a Terrible Failure: Report an exception that should never happen.
-     * Similar to {@link #wtf(String, String)}, with an exception to log.
-     * @param tag Used to identify the source of a log message.
-     * @param tr An exception to log.
-     */
-    public static int wtf(String tag, Throwable tr) {
-        return wtf(LOG_ID_MAIN, tag, tr.getMessage(), tr, false, false);
-    }
-
-    /**
-     * What a Terrible Failure: Report an exception that should never happen.
-     * Similar to {@link #wtf(String, Throwable)}, with a message as well.
-     * @param tag Used to identify the source of a log message.
-     * @param msg The message you would like logged.
-     * @param tr An exception to log.  May be null.
-     */
-    public static int wtf(String tag, String msg, Throwable tr) {
-        return wtf(LOG_ID_MAIN, tag, msg, tr, false, false);
-    }
-
-    static int wtf(int logId, String tag, String msg, Throwable tr, boolean localStack,
-            boolean system) {
-        TerribleFailure what = new TerribleFailure(msg, tr);
-        // Only mark this as ERROR, do not use ASSERT since that should be
-        // reserved for cases where the system is guaranteed to abort.
-        // The onTerribleFailure call does not always cause a crash.
-        int bytes = printlns(logId, ERROR, tag, msg, localStack ? what : tr);
-        sWtfHandler.onTerribleFailure(tag, what, system);
-        return bytes;
-    }
-
-    static void wtfQuiet(int logId, String tag, String msg, boolean system) {
-        TerribleFailure what = new TerribleFailure(msg, null);
-        sWtfHandler.onTerribleFailure(tag, what, system);
-    }
-
-    /**
-     * Sets the terrible failure handler, for testing.
-     *
-     * @return the old handler
-     *
-     * @hide
-     */
-    public static TerribleFailureHandler setWtfHandler(TerribleFailureHandler handler) {
-        if (handler == null) {
-            throw new NullPointerException("handler == null");
-        }
-        TerribleFailureHandler oldHandler = sWtfHandler;
-        sWtfHandler = handler;
-        return oldHandler;
+        return println(LOG_ID_MAIN, ERROR, tag, msg + '\n' + getStackTraceString(tr));
     }
 
     /**
@@ -346,7 +193,7 @@ public final class Log {
         }
 
         StringWriter sw = new StringWriter();
-        PrintWriter pw = new FastPrintWriter(sw, false, 256);
+        PrintWriter pw = new PrintWriter(sw);
         tr.printStackTrace(pw);
         pw.flush();
         return sw.toString();
@@ -361,7 +208,7 @@ public final class Log {
      * @return The number of bytes written.
      */
     public static int println(int priority, String tag, String msg) {
-        return println_native(LOG_ID_MAIN, priority, tag, msg);
+        return println(LOG_ID_MAIN, priority, tag, msg);
     }
 
     /** @hide */ public static final int LOG_ID_MAIN = 0;
@@ -370,115 +217,9 @@ public final class Log {
     /** @hide */ public static final int LOG_ID_SYSTEM = 3;
     /** @hide */ public static final int LOG_ID_CRASH = 4;
 
-    /** @hide */ public static native int println_native(int bufID,
-            int priority, String tag, String msg);
-
-    /**
-     * Return the maximum payload the log daemon accepts without truncation.
-     * @return LOGGER_ENTRY_MAX_PAYLOAD.
-     */
-    private static native int logger_entry_max_payload_native();
-
-    /**
-     * Helper function for long messages. Uses the LineBreakBufferedWriter to break
-     * up long messages and stacktraces along newlines, but tries to write in large
-     * chunks. This is to avoid truncation.
-     * @hide
-     */
-    public static int printlns(int bufID, int priority, String tag, String msg,
-            Throwable tr) {
-        ImmediateLogWriter logWriter = new ImmediateLogWriter(bufID, priority, tag);
-        // Acceptable buffer size. Get the native buffer size, subtract two zero terminators,
-        // and the length of the tag.
-        // Note: we implicitly accept possible truncation for Modified-UTF8 differences. It
-        //       is too expensive to compute that ahead of time.
-        int bufferSize = PreloadHolder.LOGGER_ENTRY_MAX_PAYLOAD    // Base.
-                - 2                                                // Two terminators.
-                - (tag != null ? tag.length() : 0)                 // Tag length.
-                - 32;                                              // Some slack.
-        // At least assume you can print *some* characters (tag is not too large).
-        bufferSize = Math.max(bufferSize, 100);
-
-        LineBreakBufferedWriter lbbw = new LineBreakBufferedWriter(logWriter, bufferSize);
-
-        lbbw.println(msg);
-
-        if (tr != null) {
-            // This is to reduce the amount of log spew that apps do in the non-error
-            // condition of the network being unavailable.
-            Throwable t = tr;
-            while (t != null) {
-                if (t instanceof UnknownHostException) {
-                    break;
-                }
-                if (t instanceof DeadSystemException) {
-                    lbbw.println("DeadSystemException: The system died; "
-                            + "earlier logs will point to the root cause");
-                    break;
-                }
-                t = t.getCause();
-            }
-            if (t == null) {
-                tr.printStackTrace(lbbw);
-            }
-        }
-
-        lbbw.flush();
-
-        return logWriter.getWritten();
-    }
-
-    /**
-     * PreloadHelper class. Caches the LOGGER_ENTRY_MAX_PAYLOAD value to avoid
-     * a JNI call during logging.
-     */
-    static class PreloadHolder {
-        public final static int LOGGER_ENTRY_MAX_PAYLOAD =
-                logger_entry_max_payload_native();
-    }
-
-    /**
-     * Helper class to write to the logcat. Different from LogWriter, this writes
-     * the whole given buffer and does not break along newlines.
-     */
-    private static class ImmediateLogWriter extends Writer {
-
-        private int bufID;
-        private int priority;
-        private String tag;
-
-        private int written = 0;
-
-        /**
-         * Create a writer that immediately writes to the log, using the given
-         * parameters.
-         */
-        public ImmediateLogWriter(int bufID, int priority, String tag) {
-            this.bufID = bufID;
-            this.priority = priority;
-            this.tag = tag;
-        }
-
-        public int getWritten() {
-            return written;
-        }
-
-        @Override
-        public void write(char[] cbuf, int off, int len) {
-            // Note: using String here has a bit of overhead as a Java object is created,
-            //       but using the char[] directly is not easier, as it needs to be translated
-            //       to a C char[] for logging.
-            written += println_native(bufID, priority, tag, new String(cbuf, off, len));
-        }
-
-        @Override
-        public void flush() {
-            // Ignored.
-        }
-
-        @Override
-        public void close() {
-            // Ignored.
-        }
+    /** @hide */ @SuppressWarnings("unused")
+    public static int println(int bufID,
+            int priority, String tag, String msg) {
+        return 0;
     }
 }
diff --git a/android/util/LruCache.java b/android/util/LruCache.java
index 40154880..52086065 100644
--- a/android/util/LruCache.java
+++ b/android/util/LruCache.java
@@ -20,6 +20,10 @@ import java.util.LinkedHashMap;
 import java.util.Map;
 
 /**
+ * BEGIN LAYOUTLIB CHANGE
+ * This is a custom version that doesn't use the non standard LinkedHashMap#eldest.
+ * END LAYOUTLIB CHANGE
+ *
  * A cache that holds strong references to a limited number of values. Each time
  * a value is accessed, it is moved to the head of a queue. When a value is
  * added to a full cache, the value at the end of that queue is evicted and may
@@ -87,8 +91,9 @@ public class LruCache<K, V> {
 
     /**
      * Sets the size of the cache.
-     *
      * @param maxSize The new maximum size.
+     *
+     * @hide
      */
     public void resize(int maxSize) {
         if (maxSize <= 0) {
@@ -185,13 +190,10 @@ public class LruCache<K, V> {
     }
 
     /**
-     * Remove the eldest entries until the total of remaining entries is at or
-     * below the requested size.
-     *
      * @param maxSize the maximum size of the cache before returning. May be -1
-     *            to evict even 0-sized elements.
+     *     to evict even 0-sized elements.
      */
-    public void trimToSize(int maxSize) {
+    private void trimToSize(int maxSize) {
         while (true) {
             K key;
             V value;
@@ -205,7 +207,16 @@ public class LruCache<K, V> {
                     break;
                 }
 
-                Map.Entry<K, V> toEvict = map.eldest();
+                // BEGIN LAYOUTLIB CHANGE
+                // get the last item in the linked list.
+                // This is not efficient, the goal here is to minimize the changes
+                // compared to the platform version.
+                Map.Entry<K, V> toEvict = null;
+                for (Map.Entry<K, V> entry : map.entrySet()) {
+                    toEvict = entry;
+                }
+                // END LAYOUTLIB CHANGE
+
                 if (toEvict == null) {
                     break;
                 }
diff --git a/android/util/Pools.java b/android/util/Pools.java
index 70581be8..f0b7e01d 100644
--- a/android/util/Pools.java
+++ b/android/util/Pools.java
@@ -130,22 +130,29 @@ public final class Pools {
     }
 
     /**
-     * Synchronized) pool of objects.
+     * Synchronized pool of objects.
      *
      * @param <T> The pooled type.
      */
     public static class SynchronizedPool<T> extends SimplePool<T> {
-        private final Object mLock = new Object();
+        private final Object mLock;
 
         /**
          * Creates a new instance.
          *
          * @param maxPoolSize The max pool size.
+         * @param lock an optional custom object to synchronize on
          *
          * @throws IllegalArgumentException If the max pool size is less than zero.
          */
-        public SynchronizedPool(int maxPoolSize) {
+        public SynchronizedPool(int maxPoolSize, Object lock) {
             super(maxPoolSize);
+            mLock = lock;
+        }
+
+        /** @see #SynchronizedPool(int, Object)  */
+        public SynchronizedPool(int maxPoolSize) {
+            this(maxPoolSize, new Object());
         }
 
         @Override
diff --git a/android/util/SparseBooleanArray.java b/android/util/SparseBooleanArray.java
index 4f76463a..68d347c9 100644
--- a/android/util/SparseBooleanArray.java
+++ b/android/util/SparseBooleanArray.java
@@ -117,7 +117,11 @@ public class SparseBooleanArray implements Cloneable {
         }
     }
 
-    /** @hide */
+    /**
+     * Removes the mapping at the specified index.
+     * <p>
+     * For indices outside of the range {@code 0...size()-1}, the behavior is undefined.
+     */
     public void removeAt(int index) {
         System.arraycopy(mKeys, index + 1, mKeys, index, mSize - (index + 1));
         System.arraycopy(mValues, index + 1, mValues, index, mSize - (index + 1));
diff --git a/android/util/StatsLog.java b/android/util/StatsLog.java
new file mode 100644
index 00000000..48053183
--- /dev/null
+++ b/android/util/StatsLog.java
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.util;
+
+/**
+ * StatsLog provides an API for developers to send events to statsd. The events can be used to
+ * define custom metrics inside statsd. We will rate-limit how often the calls can be made inside
+ * statsd.
+ */
+public final class StatsLog extends StatsLogInternal {
+    private static final String TAG = "StatsManager";
+
+    private StatsLog() {}
+
+    /**
+     * Logs a start event.
+     *
+     * @param label developer-chosen label that is from [0, 16).
+     * @return True if the log request was sent to statsd.
+     */
+    public static boolean logStart(int label) {
+        if (label >= 0 && label < 16) {
+            StatsLog.write(APP_HOOK, label, APP_HOOK__STATE__START);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Logs a stop event.
+     *
+     * @param label developer-chosen label that is from [0, 16).
+     * @return True if the log request was sent to statsd.
+     */
+    public static boolean logStop(int label) {
+        if (label >= 0 && label < 16) {
+            StatsLog.write(APP_HOOK, label, APP_HOOK__STATE__STOP);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Logs an event that does not represent a start or stop boundary.
+     *
+     * @param label developer-chosen label that is from [0, 16).
+     * @return True if the log request was sent to statsd.
+     */
+    public static boolean logEvent(int label) {
+        if (label >= 0 && label < 16) {
+            StatsLog.write(APP_HOOK, label, APP_HOOK__STATE__UNSPECIFIED);
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/android/util/StatsManager.java b/android/util/StatsManager.java
index 2bcd863c..26a3c361 100644
--- a/android/util/StatsManager.java
+++ b/android/util/StatsManager.java
@@ -93,10 +93,11 @@ public final class StatsManager {
     }
 
     /**
-     * Clients can request data with a binder call.
+     * Clients can request data with a binder call. This getter is destructive and also clears
+     * the retrieved metrics from statsd memory.
      *
      * @param configKey Configuration key to retrieve data from.
-     * @return Serialized ConfigMetricsReport proto. Returns null on failure.
+     * @return Serialized ConfigMetricsReportList proto. Returns null on failure.
      */
     @RequiresPermission(Manifest.permission.DUMP)
     public byte[] getData(String configKey) {
@@ -115,6 +116,30 @@ public final class StatsManager {
         }
     }
 
+    /**
+     * Clients can request metadata for statsd. Will contain stats across all configurations but not
+     * the actual metrics themselves (metrics must be collected via {@link #getData(String)}.
+     * This getter is not destructive and will not reset any metrics/counters.
+     *
+     * @return Serialized StatsdStatsReport proto. Returns null on failure.
+     */
+    @RequiresPermission(Manifest.permission.DUMP)
+    public byte[] getMetadata() {
+        synchronized (this) {
+            try {
+                IStatsManager service = getIStatsManagerLocked();
+                if (service == null) {
+                    Slog.d(TAG, "Failed to find statsd when getting metadata");
+                    return null;
+                }
+                return service.getMetadata();
+            } catch (RemoteException e) {
+                Slog.d(TAG, "Failed to connecto statsd when getting metadata");
+                return null;
+            }
+        }
+    }
+
     private class StatsdDeathRecipient implements IBinder.DeathRecipient {
         @Override
         public void binderDied() {
diff --git a/android/util/apk/ApkSignatureSchemeV2Verifier.java b/android/util/apk/ApkSignatureSchemeV2Verifier.java
index 18081234..530937e7 100644
--- a/android/util/apk/ApkSignatureSchemeV2Verifier.java
+++ b/android/util/apk/ApkSignatureSchemeV2Verifier.java
@@ -16,6 +16,21 @@
 
 package android.util.apk;
 
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_DSA_WITH_SHA256;
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_ECDSA_WITH_SHA256;
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_ECDSA_WITH_SHA512;
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256;
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512;
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_RSA_PSS_WITH_SHA256;
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_RSA_PSS_WITH_SHA512;
+import static android.util.apk.ApkSigningBlockUtils.compareSignatureAlgorithm;
+import static android.util.apk.ApkSigningBlockUtils.getContentDigestAlgorithmJcaDigestAlgorithm;
+import static android.util.apk.ApkSigningBlockUtils.getLengthPrefixedSlice;
+import static android.util.apk.ApkSigningBlockUtils.getSignatureAlgorithmContentDigestAlgorithm;
+import static android.util.apk.ApkSigningBlockUtils.getSignatureAlgorithmJcaKeyAlgorithm;
+import static android.util.apk.ApkSigningBlockUtils.getSignatureAlgorithmJcaSignatureAlgorithm;
+import static android.util.apk.ApkSigningBlockUtils.readLengthPrefixedByteArray;
+
 import android.util.ArrayMap;
 import android.util.Pair;
 
@@ -23,56 +38,47 @@ import java.io.ByteArrayInputStream;
 import java.io.FileDescriptor;
 import java.io.IOException;
 import java.io.RandomAccessFile;
-import java.math.BigInteger;
 import java.nio.BufferUnderflowException;
 import java.nio.ByteBuffer;
-import java.nio.ByteOrder;
-import java.security.DigestException;
 import java.security.InvalidAlgorithmParameterException;
 import java.security.InvalidKeyException;
 import java.security.KeyFactory;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
-import java.security.NoSuchProviderException;
-import java.security.Principal;
 import java.security.PublicKey;
 import java.security.Signature;
 import java.security.SignatureException;
-import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
-import java.security.cert.CertificateExpiredException;
 import java.security.cert.CertificateFactory;
-import java.security.cert.CertificateNotYetValidException;
 import java.security.cert.X509Certificate;
 import java.security.spec.AlgorithmParameterSpec;
 import java.security.spec.InvalidKeySpecException;
-import java.security.spec.MGF1ParameterSpec;
-import java.security.spec.PSSParameterSpec;
 import java.security.spec.X509EncodedKeySpec;
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Date;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 
 /**
  * APK Signature Scheme v2 verifier.
  *
+ * <p>APK Signature Scheme v2 is a whole-file signature scheme which aims to protect every single
+ * bit of the APK, as opposed to the JAR Signature Scheme which protects only the names and
+ * uncompressed contents of ZIP entries.
+ *
+ * @see <a href="https://source.android.com/security/apksigning/v2.html">APK Signature Scheme v2</a>
+ *
  * @hide for internal use only.
  */
 public class ApkSignatureSchemeV2Verifier {
 
     /**
-     * {@code .SF} file header section attribute indicating that the APK is signed not just with
-     * JAR signature scheme but also with APK Signature Scheme v2 or newer. This attribute
-     * facilitates v2 signature stripping detection.
-     *
-     * <p>The attribute contains a comma-separated set of signature scheme IDs.
+     * ID of this signature scheme as used in X-Android-APK-Signed header used in JAR signing.
      */
-    public static final String SF_ATTRIBUTE_ANDROID_APK_SIGNED_NAME = "X-Android-APK-Signed";
     public static final int SF_ATTRIBUTE_ANDROID_APK_SIGNED_ID = 2;
 
+    private static final int APK_SIGNATURE_SCHEME_V2_BLOCK_ID = 0x7109871a;
+
     /**
      * Returns {@code true} if the provided APK contains an APK Signature Scheme V2 signature.
      *
@@ -97,8 +103,27 @@ public class ApkSignatureSchemeV2Verifier {
      */
     public static X509Certificate[][] verify(String apkFile)
             throws SignatureNotFoundException, SecurityException, IOException {
+        return verify(apkFile, true);
+    }
+
+    /**
+     * Returns the certificates associated with each signer for the given APK without verification.
+     * This method is dangerous and should not be used, unless the caller is absolutely certain the
+     * APK is trusted.  Specifically, verification is only done for the APK Signature Scheme v2
+     * Block while gathering signer information.  The APK contents are not verified.
+     *
+     * @throws SignatureNotFoundException if the APK is not signed using APK Signature Scheme v2.
+     * @throws IOException if an I/O error occurs while reading the APK file.
+     */
+    public static X509Certificate[][] plsCertsNoVerifyOnlyCerts(String apkFile)
+            throws SignatureNotFoundException, SecurityException, IOException {
+        return verify(apkFile, false);
+    }
+
+    private static X509Certificate[][] verify(String apkFile, boolean verifyIntegrity)
+            throws SignatureNotFoundException, SecurityException, IOException {
         try (RandomAccessFile apk = new RandomAccessFile(apkFile, "r")) {
-            return verify(apk);
+            return verify(apk, verifyIntegrity);
         }
     }
 
@@ -111,10 +136,10 @@ public class ApkSignatureSchemeV2Verifier {
      *         verify.
      * @throws IOException if an I/O error occurs while reading the APK file.
      */
-    private static X509Certificate[][] verify(RandomAccessFile apk)
+    private static X509Certificate[][] verify(RandomAccessFile apk, boolean verifyIntegrity)
             throws SignatureNotFoundException, SecurityException, IOException {
         SignatureInfo signatureInfo = findSignature(apk);
-        return verify(apk.getFD(), signatureInfo);
+        return verify(apk.getFD(), signatureInfo, verifyIntegrity);
     }
 
     /**
@@ -126,30 +151,7 @@ public class ApkSignatureSchemeV2Verifier {
      */
     private static SignatureInfo findSignature(RandomAccessFile apk)
             throws IOException, SignatureNotFoundException {
-        // Find the ZIP End of Central Directory (EoCD) record.
-        Pair<ByteBuffer, Long> eocdAndOffsetInFile = getEocd(apk);
-        ByteBuffer eocd = eocdAndOffsetInFile.first;
-        long eocdOffset = eocdAndOffsetInFile.second;
-        if (ZipUtils.isZip64EndOfCentralDirectoryLocatorPresent(apk, eocdOffset)) {
-            throw new SignatureNotFoundException("ZIP64 APK not supported");
-        }
-
-        // Find the APK Signing Block. The block immediately precedes the Central Directory.
-        long centralDirOffset = getCentralDirOffset(eocd, eocdOffset);
-        Pair<ByteBuffer, Long> apkSigningBlockAndOffsetInFile =
-                findApkSigningBlock(apk, centralDirOffset);
-        ByteBuffer apkSigningBlock = apkSigningBlockAndOffsetInFile.first;
-        long apkSigningBlockOffset = apkSigningBlockAndOffsetInFile.second;
-
-        // Find the APK Signature Scheme v2 Block inside the APK Signing Block.
-        ByteBuffer apkSignatureSchemeV2Block = findApkSignatureSchemeV2Block(apkSigningBlock);
-
-        return new SignatureInfo(
-                apkSignatureSchemeV2Block,
-                apkSigningBlockOffset,
-                centralDirOffset,
-                eocdOffset,
-                eocd);
+        return ApkSigningBlockUtils.findSignature(apk, APK_SIGNATURE_SCHEME_V2_BLOCK_ID);
     }
 
     /**
@@ -161,7 +163,8 @@ public class ApkSignatureSchemeV2Verifier {
      */
     private static X509Certificate[][] verify(
             FileDescriptor apkFileDescriptor,
-            SignatureInfo signatureInfo) throws SecurityException {
+            SignatureInfo signatureInfo,
+            boolean doVerifyIntegrity) throws SecurityException {
         int signerCount = 0;
         Map<Integer, byte[]> contentDigests = new ArrayMap<>();
         List<X509Certificate[]> signerCerts = new ArrayList<>();
@@ -198,13 +201,15 @@ public class ApkSignatureSchemeV2Verifier {
             throw new SecurityException("No content digests found");
         }
 
-        verifyIntegrity(
-                contentDigests,
-                apkFileDescriptor,
-                signatureInfo.apkSigningBlockOffset,
-                signatureInfo.centralDirOffset,
-                signatureInfo.eocdOffset,
-                signatureInfo.eocd);
+        if (doVerifyIntegrity) {
+            ApkSigningBlockUtils.verifyIntegrity(
+                    contentDigests,
+                    apkFileDescriptor,
+                    signatureInfo.apkSigningBlockOffset,
+                    signatureInfo.centralDirOffset,
+                    signatureInfo.eocdOffset,
+                    signatureInfo.eocd);
+        }
 
         return signerCerts.toArray(new X509Certificate[signerCerts.size()][]);
     }
@@ -328,7 +333,8 @@ public class ApkSignatureSchemeV2Verifier {
             } catch (CertificateException e) {
                 throw new SecurityException("Failed to decode certificate #" + certificateCount, e);
             }
-            certificate = new VerbatimX509Certificate(certificate, encodedCert);
+            certificate = new VerbatimX509Certificate(
+                    certificate, encodedCert);
             certs.add(certificate);
         }
 
@@ -342,235 +348,44 @@ public class ApkSignatureSchemeV2Verifier {
                     "Public key mismatch between certificate and signature record");
         }
 
-        return certs.toArray(new X509Certificate[certs.size()]);
-    }
-
-    private static void verifyIntegrity(
-            Map<Integer, byte[]> expectedDigests,
-            FileDescriptor apkFileDescriptor,
-            long apkSigningBlockOffset,
-            long centralDirOffset,
-            long eocdOffset,
-            ByteBuffer eocdBuf) throws SecurityException {
-
-        if (expectedDigests.isEmpty()) {
-            throw new SecurityException("No digests provided");
-        }
-
-        // We need to verify the integrity of the following three sections of the file:
-        // 1. Everything up to the start of the APK Signing Block.
-        // 2. ZIP Central Directory.
-        // 3. ZIP End of Central Directory (EoCD).
-        // Each of these sections is represented as a separate DataSource instance below.
-
-        // To handle large APKs, these sections are read in 1 MB chunks using memory-mapped I/O to
-        // avoid wasting physical memory. In most APK verification scenarios, the contents of the
-        // APK are already there in the OS's page cache and thus mmap does not use additional
-        // physical memory.
-        DataSource beforeApkSigningBlock =
-                new MemoryMappedFileDataSource(apkFileDescriptor, 0, apkSigningBlockOffset);
-        DataSource centralDir =
-                new MemoryMappedFileDataSource(
-                        apkFileDescriptor, centralDirOffset, eocdOffset - centralDirOffset);
+        ByteBuffer additionalAttrs = getLengthPrefixedSlice(signedData);
+        verifyAdditionalAttributes(additionalAttrs);
 
-        // For the purposes of integrity verification, ZIP End of Central Directory's field Start of
-        // Central Directory must be considered to point to the offset of the APK Signing Block.
-        eocdBuf = eocdBuf.duplicate();
-        eocdBuf.order(ByteOrder.LITTLE_ENDIAN);
-        ZipUtils.setZipEocdCentralDirectoryOffset(eocdBuf, apkSigningBlockOffset);
-        DataSource eocd = new ByteBufferDataSource(eocdBuf);
-
-        int[] digestAlgorithms = new int[expectedDigests.size()];
-        int digestAlgorithmCount = 0;
-        for (int digestAlgorithm : expectedDigests.keySet()) {
-            digestAlgorithms[digestAlgorithmCount] = digestAlgorithm;
-            digestAlgorithmCount++;
-        }
-        byte[][] actualDigests;
-        try {
-            actualDigests =
-                    computeContentDigests(
-                            digestAlgorithms,
-                            new DataSource[] {beforeApkSigningBlock, centralDir, eocd});
-        } catch (DigestException e) {
-            throw new SecurityException("Failed to compute digest(s) of contents", e);
-        }
-        for (int i = 0; i < digestAlgorithms.length; i++) {
-            int digestAlgorithm = digestAlgorithms[i];
-            byte[] expectedDigest = expectedDigests.get(digestAlgorithm);
-            byte[] actualDigest = actualDigests[i];
-            if (!MessageDigest.isEqual(expectedDigest, actualDigest)) {
-                throw new SecurityException(
-                        getContentDigestAlgorithmJcaDigestAlgorithm(digestAlgorithm)
-                                + " digest of contents did not verify");
-            }
-        }
+        return certs.toArray(new X509Certificate[certs.size()]);
     }
 
-    private static byte[][] computeContentDigests(
-            int[] digestAlgorithms,
-            DataSource[] contents) throws DigestException {
-        // For each digest algorithm the result is computed as follows:
-        // 1. Each segment of contents is split into consecutive chunks of 1 MB in size.
-        //    The final chunk will be shorter iff the length of segment is not a multiple of 1 MB.
-        //    No chunks are produced for empty (zero length) segments.
-        // 2. The digest of each chunk is computed over the concatenation of byte 0xa5, the chunk's
-        //    length in bytes (uint32 little-endian) and the chunk's contents.
-        // 3. The output digest is computed over the concatenation of the byte 0x5a, the number of
-        //    chunks (uint32 little-endian) and the concatenation of digests of chunks of all
-        //    segments in-order.
-
-        long totalChunkCountLong = 0;
-        for (DataSource input : contents) {
-            totalChunkCountLong += getChunkCount(input.size());
-        }
-        if (totalChunkCountLong >= Integer.MAX_VALUE / 1024) {
-            throw new DigestException("Too many chunks: " + totalChunkCountLong);
-        }
-        int totalChunkCount = (int) totalChunkCountLong;
-
-        byte[][] digestsOfChunks = new byte[digestAlgorithms.length][];
-        for (int i = 0; i < digestAlgorithms.length; i++) {
-            int digestAlgorithm = digestAlgorithms[i];
-            int digestOutputSizeBytes = getContentDigestAlgorithmOutputSizeBytes(digestAlgorithm);
-            byte[] concatenationOfChunkCountAndChunkDigests =
-                    new byte[5 + totalChunkCount * digestOutputSizeBytes];
-            concatenationOfChunkCountAndChunkDigests[0] = 0x5a;
-            setUnsignedInt32LittleEndian(
-                    totalChunkCount,
-                    concatenationOfChunkCountAndChunkDigests,
-                    1);
-            digestsOfChunks[i] = concatenationOfChunkCountAndChunkDigests;
-        }
+    // Attribute to check whether a newer APK Signature Scheme signature was stripped
+    private static final int STRIPPING_PROTECTION_ATTR_ID = 0xbeeff00d;
 
-        byte[] chunkContentPrefix = new byte[5];
-        chunkContentPrefix[0] = (byte) 0xa5;
-        int chunkIndex = 0;
-        MessageDigest[] mds = new MessageDigest[digestAlgorithms.length];
-        for (int i = 0; i < digestAlgorithms.length; i++) {
-            String jcaAlgorithmName =
-                    getContentDigestAlgorithmJcaDigestAlgorithm(digestAlgorithms[i]);
-            try {
-                mds[i] = MessageDigest.getInstance(jcaAlgorithmName);
-            } catch (NoSuchAlgorithmException e) {
-                throw new RuntimeException(jcaAlgorithmName + " digest not supported", e);
+    private static void verifyAdditionalAttributes(ByteBuffer attrs)
+            throws SecurityException, IOException {
+        while (attrs.hasRemaining()) {
+            ByteBuffer attr = getLengthPrefixedSlice(attrs);
+            if (attr.remaining() < 4) {
+                throw new IOException("Remaining buffer too short to contain additional attribute "
+                        + "ID. Remaining: " + attr.remaining());
             }
-        }
-        // TODO: Compute digests of chunks in parallel when beneficial. This requires some research
-        // into how to parallelize (if at all) based on the capabilities of the hardware on which
-        // this code is running and based on the size of input.
-        DataDigester digester = new MultipleDigestDataDigester(mds);
-        int dataSourceIndex = 0;
-        for (DataSource input : contents) {
-            long inputOffset = 0;
-            long inputRemaining = input.size();
-            while (inputRemaining > 0) {
-                int chunkSize = (int) Math.min(inputRemaining, CHUNK_SIZE_BYTES);
-                setUnsignedInt32LittleEndian(chunkSize, chunkContentPrefix, 1);
-                for (int i = 0; i < mds.length; i++) {
-                    mds[i].update(chunkContentPrefix);
-                }
-                try {
-                    input.feedIntoDataDigester(digester, inputOffset, chunkSize);
-                } catch (IOException e) {
-                    throw new DigestException(
-                            "Failed to digest chunk #" + chunkIndex + " of section #"
-                                    + dataSourceIndex,
-                            e);
-                }
-                for (int i = 0; i < digestAlgorithms.length; i++) {
-                    int digestAlgorithm = digestAlgorithms[i];
-                    byte[] concatenationOfChunkCountAndChunkDigests = digestsOfChunks[i];
-                    int expectedDigestSizeBytes =
-                            getContentDigestAlgorithmOutputSizeBytes(digestAlgorithm);
-                    MessageDigest md = mds[i];
-                    int actualDigestSizeBytes =
-                            md.digest(
-                                    concatenationOfChunkCountAndChunkDigests,
-                                    5 + chunkIndex * expectedDigestSizeBytes,
-                                    expectedDigestSizeBytes);
-                    if (actualDigestSizeBytes != expectedDigestSizeBytes) {
-                        throw new RuntimeException(
-                                "Unexpected output size of " + md.getAlgorithm() + " digest: "
-                                        + actualDigestSizeBytes);
+            int id = attr.getInt();
+            switch (id) {
+                case STRIPPING_PROTECTION_ATTR_ID:
+                    if (attr.remaining() < 4) {
+                        throw new IOException("V2 Signature Scheme Stripping Protection Attribute "
+                                + " value too small.  Expected 4 bytes, but found "
+                                + attr.remaining());
                     }
-                }
-                inputOffset += chunkSize;
-                inputRemaining -= chunkSize;
-                chunkIndex++;
-            }
-            dataSourceIndex++;
-        }
-
-        byte[][] result = new byte[digestAlgorithms.length][];
-        for (int i = 0; i < digestAlgorithms.length; i++) {
-            int digestAlgorithm = digestAlgorithms[i];
-            byte[] input = digestsOfChunks[i];
-            String jcaAlgorithmName = getContentDigestAlgorithmJcaDigestAlgorithm(digestAlgorithm);
-            MessageDigest md;
-            try {
-                md = MessageDigest.getInstance(jcaAlgorithmName);
-            } catch (NoSuchAlgorithmException e) {
-                throw new RuntimeException(jcaAlgorithmName + " digest not supported", e);
+                    int vers = attr.getInt();
+                    if (vers == ApkSignatureSchemeV3Verifier.SF_ATTRIBUTE_ANDROID_APK_SIGNED_ID) {
+                        throw new SecurityException("V2 signature indicates APK is signed using APK"
+                                + " Signature Scheme v3, but none was found. Signature stripped?");
+                    }
+                    break;
+                default:
+                    // not the droid we're looking for, move along, move along.
+                    break;
             }
-            byte[] output = md.digest(input);
-            result[i] = output;
-        }
-        return result;
-    }
-
-    /**
-     * Returns the ZIP End of Central Directory (EoCD) and its offset in the file.
-     *
-     * @throws IOException if an I/O error occurs while reading the file.
-     * @throws SignatureNotFoundException if the EoCD could not be found.
-     */
-    private static Pair<ByteBuffer, Long> getEocd(RandomAccessFile apk)
-            throws IOException, SignatureNotFoundException {
-        Pair<ByteBuffer, Long> eocdAndOffsetInFile =
-                ZipUtils.findZipEndOfCentralDirectoryRecord(apk);
-        if (eocdAndOffsetInFile == null) {
-            throw new SignatureNotFoundException(
-                    "Not an APK file: ZIP End of Central Directory record not found");
-        }
-        return eocdAndOffsetInFile;
-    }
-
-    private static long getCentralDirOffset(ByteBuffer eocd, long eocdOffset)
-            throws SignatureNotFoundException {
-        // Look up the offset of ZIP Central Directory.
-        long centralDirOffset = ZipUtils.getZipEocdCentralDirectoryOffset(eocd);
-        if (centralDirOffset > eocdOffset) {
-            throw new SignatureNotFoundException(
-                    "ZIP Central Directory offset out of range: " + centralDirOffset
-                    + ". ZIP End of Central Directory offset: " + eocdOffset);
         }
-        long centralDirSize = ZipUtils.getZipEocdCentralDirectorySizeBytes(eocd);
-        if (centralDirOffset + centralDirSize != eocdOffset) {
-            throw new SignatureNotFoundException(
-                    "ZIP Central Directory is not immediately followed by End of Central"
-                    + " Directory");
-        }
-        return centralDirOffset;
-    }
-
-    private static final long getChunkCount(long inputSizeBytes) {
-        return (inputSizeBytes + CHUNK_SIZE_BYTES - 1) / CHUNK_SIZE_BYTES;
+        return;
     }
-
-    private static final int CHUNK_SIZE_BYTES = 1024 * 1024;
-
-    private static final int SIGNATURE_RSA_PSS_WITH_SHA256 = 0x0101;
-    private static final int SIGNATURE_RSA_PSS_WITH_SHA512 = 0x0102;
-    private static final int SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256 = 0x0103;
-    private static final int SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512 = 0x0104;
-    private static final int SIGNATURE_ECDSA_WITH_SHA256 = 0x0201;
-    private static final int SIGNATURE_ECDSA_WITH_SHA512 = 0x0202;
-    private static final int SIGNATURE_DSA_WITH_SHA256 = 0x0301;
-
-    private static final int CONTENT_DIGEST_CHUNKED_SHA256 = 1;
-    private static final int CONTENT_DIGEST_CHUNKED_SHA512 = 2;
-
     private static boolean isSupportedSignatureAlgorithm(int sigAlgorithm) {
         switch (sigAlgorithm) {
             case SIGNATURE_RSA_PSS_WITH_SHA256:
@@ -585,531 +400,4 @@ public class ApkSignatureSchemeV2Verifier {
                 return false;
         }
     }
-
-    private static int compareSignatureAlgorithm(int sigAlgorithm1, int sigAlgorithm2) {
-        int digestAlgorithm1 = getSignatureAlgorithmContentDigestAlgorithm(sigAlgorithm1);
-        int digestAlgorithm2 = getSignatureAlgorithmContentDigestAlgorithm(sigAlgorithm2);
-        return compareContentDigestAlgorithm(digestAlgorithm1, digestAlgorithm2);
-    }
-
-    private static int compareContentDigestAlgorithm(int digestAlgorithm1, int digestAlgorithm2) {
-        switch (digestAlgorithm1) {
-            case CONTENT_DIGEST_CHUNKED_SHA256:
-                switch (digestAlgorithm2) {
-                    case CONTENT_DIGEST_CHUNKED_SHA256:
-                        return 0;
-                    case CONTENT_DIGEST_CHUNKED_SHA512:
-                        return -1;
-                    default:
-                        throw new IllegalArgumentException(
-                                "Unknown digestAlgorithm2: " + digestAlgorithm2);
-                }
-            case CONTENT_DIGEST_CHUNKED_SHA512:
-                switch (digestAlgorithm2) {
-                    case CONTENT_DIGEST_CHUNKED_SHA256:
-                        return 1;
-                    case CONTENT_DIGEST_CHUNKED_SHA512:
-                        return 0;
-                    default:
-                        throw new IllegalArgumentException(
-                                "Unknown digestAlgorithm2: " + digestAlgorithm2);
-                }
-            default:
-                throw new IllegalArgumentException("Unknown digestAlgorithm1: " + digestAlgorithm1);
-        }
-    }
-
-    private static int getSignatureAlgorithmContentDigestAlgorithm(int sigAlgorithm) {
-        switch (sigAlgorithm) {
-            case SIGNATURE_RSA_PSS_WITH_SHA256:
-            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256:
-            case SIGNATURE_ECDSA_WITH_SHA256:
-            case SIGNATURE_DSA_WITH_SHA256:
-                return CONTENT_DIGEST_CHUNKED_SHA256;
-            case SIGNATURE_RSA_PSS_WITH_SHA512:
-            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512:
-            case SIGNATURE_ECDSA_WITH_SHA512:
-                return CONTENT_DIGEST_CHUNKED_SHA512;
-            default:
-                throw new IllegalArgumentException(
-                        "Unknown signature algorithm: 0x"
-                                + Long.toHexString(sigAlgorithm & 0xffffffff));
-        }
-    }
-
-    private static String getContentDigestAlgorithmJcaDigestAlgorithm(int digestAlgorithm) {
-        switch (digestAlgorithm) {
-            case CONTENT_DIGEST_CHUNKED_SHA256:
-                return "SHA-256";
-            case CONTENT_DIGEST_CHUNKED_SHA512:
-                return "SHA-512";
-            default:
-                throw new IllegalArgumentException(
-                        "Unknown content digest algorthm: " + digestAlgorithm);
-        }
-    }
-
-    private static int getContentDigestAlgorithmOutputSizeBytes(int digestAlgorithm) {
-        switch (digestAlgorithm) {
-            case CONTENT_DIGEST_CHUNKED_SHA256:
-                return 256 / 8;
-            case CONTENT_DIGEST_CHUNKED_SHA512:
-                return 512 / 8;
-            default:
-                throw new IllegalArgumentException(
-                        "Unknown content digest algorthm: " + digestAlgorithm);
-        }
-    }
-
-    private static String getSignatureAlgorithmJcaKeyAlgorithm(int sigAlgorithm) {
-        switch (sigAlgorithm) {
-            case SIGNATURE_RSA_PSS_WITH_SHA256:
-            case SIGNATURE_RSA_PSS_WITH_SHA512:
-            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256:
-            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512:
-                return "RSA";
-            case SIGNATURE_ECDSA_WITH_SHA256:
-            case SIGNATURE_ECDSA_WITH_SHA512:
-                return "EC";
-            case SIGNATURE_DSA_WITH_SHA256:
-                return "DSA";
-            default:
-                throw new IllegalArgumentException(
-                        "Unknown signature algorithm: 0x"
-                                + Long.toHexString(sigAlgorithm & 0xffffffff));
-        }
-    }
-
-    private static Pair<String, ? extends AlgorithmParameterSpec>
-            getSignatureAlgorithmJcaSignatureAlgorithm(int sigAlgorithm) {
-        switch (sigAlgorithm) {
-            case SIGNATURE_RSA_PSS_WITH_SHA256:
-                return Pair.create(
-                        "SHA256withRSA/PSS",
-                        new PSSParameterSpec(
-                                "SHA-256", "MGF1", MGF1ParameterSpec.SHA256, 256 / 8, 1));
-            case SIGNATURE_RSA_PSS_WITH_SHA512:
-                return Pair.create(
-                        "SHA512withRSA/PSS",
-                        new PSSParameterSpec(
-                                "SHA-512", "MGF1", MGF1ParameterSpec.SHA512, 512 / 8, 1));
-            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256:
-                return Pair.create("SHA256withRSA", null);
-            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512:
-                return Pair.create("SHA512withRSA", null);
-            case SIGNATURE_ECDSA_WITH_SHA256:
-                return Pair.create("SHA256withECDSA", null);
-            case SIGNATURE_ECDSA_WITH_SHA512:
-                return Pair.create("SHA512withECDSA", null);
-            case SIGNATURE_DSA_WITH_SHA256:
-                return Pair.create("SHA256withDSA", null);
-            default:
-                throw new IllegalArgumentException(
-                        "Unknown signature algorithm: 0x"
-                                + Long.toHexString(sigAlgorithm & 0xffffffff));
-        }
-    }
-
-    /**
-     * Returns new byte buffer whose content is a shared subsequence of this buffer's content
-     * between the specified start (inclusive) and end (exclusive) positions. As opposed to
-     * {@link ByteBuffer#slice()}, the returned buffer's byte order is the same as the source
-     * buffer's byte order.
-     */
-    private static ByteBuffer sliceFromTo(ByteBuffer source, int start, int end) {
-        if (start < 0) {
-            throw new IllegalArgumentException("start: " + start);
-        }
-        if (end < start) {
-            throw new IllegalArgumentException("end < start: " + end + " < " + start);
-        }
-        int capacity = source.capacity();
-        if (end > source.capacity()) {
-            throw new IllegalArgumentException("end > capacity: " + end + " > " + capacity);
-        }
-        int originalLimit = source.limit();
-        int originalPosition = source.position();
-        try {
-            source.position(0);
-            source.limit(end);
-            source.position(start);
-            ByteBuffer result = source.slice();
-            result.order(source.order());
-            return result;
-        } finally {
-            source.position(0);
-            source.limit(originalLimit);
-            source.position(originalPosition);
-        }
-    }
-
-    /**
-     * Relative <em>get</em> method for reading {@code size} number of bytes from the current
-     * position of this buffer.
-     *
-     * <p>This method reads the next {@code size} bytes at this buffer's current position,
-     * returning them as a {@code ByteBuffer} with start set to 0, limit and capacity set to
-     * {@code size}, byte order set to this buffer's byte order; and then increments the position by
-     * {@code size}.
-     */
-    private static ByteBuffer getByteBuffer(ByteBuffer source, int size)
-            throws BufferUnderflowException {
-        if (size < 0) {
-            throw new IllegalArgumentException("size: " + size);
-        }
-        int originalLimit = source.limit();
-        int position = source.position();
-        int limit = position + size;
-        if ((limit < position) || (limit > originalLimit)) {
-            throw new BufferUnderflowException();
-        }
-        source.limit(limit);
-        try {
-            ByteBuffer result = source.slice();
-            result.order(source.order());
-            source.position(limit);
-            return result;
-        } finally {
-            source.limit(originalLimit);
-        }
-    }
-
-    private static ByteBuffer getLengthPrefixedSlice(ByteBuffer source) throws IOException {
-        if (source.remaining() < 4) {
-            throw new IOException(
-                    "Remaining buffer too short to contain length of length-prefixed field."
-                            + " Remaining: " + source.remaining());
-        }
-        int len = source.getInt();
-        if (len < 0) {
-            throw new IllegalArgumentException("Negative length");
-        } else if (len > source.remaining()) {
-            throw new IOException("Length-prefixed field longer than remaining buffer."
-                    + " Field length: " + len + ", remaining: " + source.remaining());
-        }
-        return getByteBuffer(source, len);
-    }
-
-    private static byte[] readLengthPrefixedByteArray(ByteBuffer buf) throws IOException {
-        int len = buf.getInt();
-        if (len < 0) {
-            throw new IOException("Negative length");
-        } else if (len > buf.remaining()) {
-            throw new IOException("Underflow while reading length-prefixed value. Length: " + len
-                    + ", available: " + buf.remaining());
-        }
-        byte[] result = new byte[len];
-        buf.get(result);
-        return result;
-    }
-
-    private static void setUnsignedInt32LittleEndian(int value, byte[] result, int offset) {
-        result[offset] = (byte) (value & 0xff);
-        result[offset + 1] = (byte) ((value >>> 8) & 0xff);
-        result[offset + 2] = (byte) ((value >>> 16) & 0xff);
-        result[offset + 3] = (byte) ((value >>> 24) & 0xff);
-    }
-
-    private static final long APK_SIG_BLOCK_MAGIC_HI = 0x3234206b636f6c42L;
-    private static final long APK_SIG_BLOCK_MAGIC_LO = 0x20676953204b5041L;
-    private static final int APK_SIG_BLOCK_MIN_SIZE = 32;
-
-    private static final int APK_SIGNATURE_SCHEME_V2_BLOCK_ID = 0x7109871a;
-
-    private static Pair<ByteBuffer, Long> findApkSigningBlock(
-            RandomAccessFile apk, long centralDirOffset)
-                    throws IOException, SignatureNotFoundException {
-        // FORMAT:
-        // OFFSET       DATA TYPE  DESCRIPTION
-        // * @+0  bytes uint64:    size in bytes (excluding this field)
-        // * @+8  bytes payload
-        // * @-24 bytes uint64:    size in bytes (same as the one above)
-        // * @-16 bytes uint128:   magic
-
-        if (centralDirOffset < APK_SIG_BLOCK_MIN_SIZE) {
-            throw new SignatureNotFoundException(
-                    "APK too small for APK Signing Block. ZIP Central Directory offset: "
-                            + centralDirOffset);
-        }
-        // Read the magic and offset in file from the footer section of the block:
-        // * uint64:   size of block
-        // * 16 bytes: magic
-        ByteBuffer footer = ByteBuffer.allocate(24);
-        footer.order(ByteOrder.LITTLE_ENDIAN);
-        apk.seek(centralDirOffset - footer.capacity());
-        apk.readFully(footer.array(), footer.arrayOffset(), footer.capacity());
-        if ((footer.getLong(8) != APK_SIG_BLOCK_MAGIC_LO)
-                || (footer.getLong(16) != APK_SIG_BLOCK_MAGIC_HI)) {
-            throw new SignatureNotFoundException(
-                    "No APK Signing Block before ZIP Central Directory");
-        }
-        // Read and compare size fields
-        long apkSigBlockSizeInFooter = footer.getLong(0);
-        if ((apkSigBlockSizeInFooter < footer.capacity())
-                || (apkSigBlockSizeInFooter > Integer.MAX_VALUE - 8)) {
-            throw new SignatureNotFoundException(
-                    "APK Signing Block size out of range: " + apkSigBlockSizeInFooter);
-        }
-        int totalSize = (int) (apkSigBlockSizeInFooter + 8);
-        long apkSigBlockOffset = centralDirOffset - totalSize;
-        if (apkSigBlockOffset < 0) {
-            throw new SignatureNotFoundException(
-                    "APK Signing Block offset out of range: " + apkSigBlockOffset);
-        }
-        ByteBuffer apkSigBlock = ByteBuffer.allocate(totalSize);
-        apkSigBlock.order(ByteOrder.LITTLE_ENDIAN);
-        apk.seek(apkSigBlockOffset);
-        apk.readFully(apkSigBlock.array(), apkSigBlock.arrayOffset(), apkSigBlock.capacity());
-        long apkSigBlockSizeInHeader = apkSigBlock.getLong(0);
-        if (apkSigBlockSizeInHeader != apkSigBlockSizeInFooter) {
-            throw new SignatureNotFoundException(
-                    "APK Signing Block sizes in header and footer do not match: "
-                            + apkSigBlockSizeInHeader + " vs " + apkSigBlockSizeInFooter);
-        }
-        return Pair.create(apkSigBlock, apkSigBlockOffset);
-    }
-
-    private static ByteBuffer findApkSignatureSchemeV2Block(ByteBuffer apkSigningBlock)
-            throws SignatureNotFoundException {
-        checkByteOrderLittleEndian(apkSigningBlock);
-        // FORMAT:
-        // OFFSET       DATA TYPE  DESCRIPTION
-        // * @+0  bytes uint64:    size in bytes (excluding this field)
-        // * @+8  bytes pairs
-        // * @-24 bytes uint64:    size in bytes (same as the one above)
-        // * @-16 bytes uint128:   magic
-        ByteBuffer pairs = sliceFromTo(apkSigningBlock, 8, apkSigningBlock.capacity() - 24);
-
-        int entryCount = 0;
-        while (pairs.hasRemaining()) {
-            entryCount++;
-            if (pairs.remaining() < 8) {
-                throw new SignatureNotFoundException(
-                        "Insufficient data to read size of APK Signing Block entry #" + entryCount);
-            }
-            long lenLong = pairs.getLong();
-            if ((lenLong < 4) || (lenLong > Integer.MAX_VALUE)) {
-                throw new SignatureNotFoundException(
-                        "APK Signing Block entry #" + entryCount
-                                + " size out of range: " + lenLong);
-            }
-            int len = (int) lenLong;
-            int nextEntryPos = pairs.position() + len;
-            if (len > pairs.remaining()) {
-                throw new SignatureNotFoundException(
-                        "APK Signing Block entry #" + entryCount + " size out of range: " + len
-                                + ", available: " + pairs.remaining());
-            }
-            int id = pairs.getInt();
-            if (id == APK_SIGNATURE_SCHEME_V2_BLOCK_ID) {
-                return getByteBuffer(pairs, len - 4);
-            }
-            pairs.position(nextEntryPos);
-        }
-
-        throw new SignatureNotFoundException(
-                "No APK Signature Scheme v2 block in APK Signing Block");
-    }
-
-    private static void checkByteOrderLittleEndian(ByteBuffer buffer) {
-        if (buffer.order() != ByteOrder.LITTLE_ENDIAN) {
-            throw new IllegalArgumentException("ByteBuffer byte order must be little endian");
-        }
-    }
-
-    public static class SignatureNotFoundException extends Exception {
-        private static final long serialVersionUID = 1L;
-
-        public SignatureNotFoundException(String message) {
-            super(message);
-        }
-
-        public SignatureNotFoundException(String message, Throwable cause) {
-            super(message, cause);
-        }
-    }
-
-    /**
-     * {@link DataDigester} that updates multiple {@link MessageDigest}s whenever data is feeded.
-     */
-    private static class MultipleDigestDataDigester implements DataDigester {
-        private final MessageDigest[] mMds;
-
-        MultipleDigestDataDigester(MessageDigest[] mds) {
-            mMds = mds;
-        }
-
-        @Override
-        public void consume(ByteBuffer buffer) {
-            buffer = buffer.slice();
-            for (MessageDigest md : mMds) {
-                buffer.position(0);
-                md.update(buffer);
-            }
-        }
-
-        @Override
-        public void finish() {}
-    }
-
-    /**
-     * For legacy reasons we need to return exactly the original encoded certificate bytes, instead
-     * of letting the underlying implementation have a shot at re-encoding the data.
-     */
-    private static class VerbatimX509Certificate extends WrappedX509Certificate {
-        private byte[] encodedVerbatim;
-
-        public VerbatimX509Certificate(X509Certificate wrapped, byte[] encodedVerbatim) {
-            super(wrapped);
-            this.encodedVerbatim = encodedVerbatim;
-        }
-
-        @Override
-        public byte[] getEncoded() throws CertificateEncodingException {
-            return encodedVerbatim;
-        }
-    }
-
-    private static class WrappedX509Certificate extends X509Certificate {
-        private final X509Certificate wrapped;
-
-        public WrappedX509Certificate(X509Certificate wrapped) {
-            this.wrapped = wrapped;
-        }
-
-        @Override
-        public Set<String> getCriticalExtensionOIDs() {
-            return wrapped.getCriticalExtensionOIDs();
-        }
-
-        @Override
-        public byte[] getExtensionValue(String oid) {
-            return wrapped.getExtensionValue(oid);
-        }
-
-        @Override
-        public Set<String> getNonCriticalExtensionOIDs() {
-            return wrapped.getNonCriticalExtensionOIDs();
-        }
-
-        @Override
-        public boolean hasUnsupportedCriticalExtension() {
-            return wrapped.hasUnsupportedCriticalExtension();
-        }
-
-        @Override
-        public void checkValidity()
-                throws CertificateExpiredException, CertificateNotYetValidException {
-            wrapped.checkValidity();
-        }
-
-        @Override
-        public void checkValidity(Date date)
-                throws CertificateExpiredException, CertificateNotYetValidException {
-            wrapped.checkValidity(date);
-        }
-
-        @Override
-        public int getVersion() {
-            return wrapped.getVersion();
-        }
-
-        @Override
-        public BigInteger getSerialNumber() {
-            return wrapped.getSerialNumber();
-        }
-
-        @Override
-        public Principal getIssuerDN() {
-            return wrapped.getIssuerDN();
-        }
-
-        @Override
-        public Principal getSubjectDN() {
-            return wrapped.getSubjectDN();
-        }
-
-        @Override
-        public Date getNotBefore() {
-            return wrapped.getNotBefore();
-        }
-
-        @Override
-        public Date getNotAfter() {
-            return wrapped.getNotAfter();
-        }
-
-        @Override
-        public byte[] getTBSCertificate() throws CertificateEncodingException {
-            return wrapped.getTBSCertificate();
-        }
-
-        @Override
-        public byte[] getSignature() {
-            return wrapped.getSignature();
-        }
-
-        @Override
-        public String getSigAlgName() {
-            return wrapped.getSigAlgName();
-        }
-
-        @Override
-        public String getSigAlgOID() {
-            return wrapped.getSigAlgOID();
-        }
-
-        @Override
-        public byte[] getSigAlgParams() {
-            return wrapped.getSigAlgParams();
-        }
-
-        @Override
-        public boolean[] getIssuerUniqueID() {
-            return wrapped.getIssuerUniqueID();
-        }
-
-        @Override
-        public boolean[] getSubjectUniqueID() {
-            return wrapped.getSubjectUniqueID();
-        }
-
-        @Override
-        public boolean[] getKeyUsage() {
-            return wrapped.getKeyUsage();
-        }
-
-        @Override
-        public int getBasicConstraints() {
-            return wrapped.getBasicConstraints();
-        }
-
-        @Override
-        public byte[] getEncoded() throws CertificateEncodingException {
-            return wrapped.getEncoded();
-        }
-
-        @Override
-        public void verify(PublicKey key) throws CertificateException, NoSuchAlgorithmException,
-                InvalidKeyException, NoSuchProviderException, SignatureException {
-            wrapped.verify(key);
-        }
-
-        @Override
-        public void verify(PublicKey key, String sigProvider)
-                throws CertificateException, NoSuchAlgorithmException, InvalidKeyException,
-                NoSuchProviderException, SignatureException {
-            wrapped.verify(key, sigProvider);
-        }
-
-        @Override
-        public String toString() {
-            return wrapped.toString();
-        }
-
-        @Override
-        public PublicKey getPublicKey() {
-            return wrapped.getPublicKey();
-        }
-    }
 }
diff --git a/android/util/apk/ApkSignatureSchemeV3Verifier.java b/android/util/apk/ApkSignatureSchemeV3Verifier.java
new file mode 100644
index 00000000..e43dee35
--- /dev/null
+++ b/android/util/apk/ApkSignatureSchemeV3Verifier.java
@@ -0,0 +1,558 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.util.apk;
+
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_DSA_WITH_SHA256;
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_ECDSA_WITH_SHA256;
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_ECDSA_WITH_SHA512;
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256;
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512;
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_RSA_PSS_WITH_SHA256;
+import static android.util.apk.ApkSigningBlockUtils.SIGNATURE_RSA_PSS_WITH_SHA512;
+import static android.util.apk.ApkSigningBlockUtils.compareSignatureAlgorithm;
+import static android.util.apk.ApkSigningBlockUtils.getContentDigestAlgorithmJcaDigestAlgorithm;
+import static android.util.apk.ApkSigningBlockUtils.getLengthPrefixedSlice;
+import static android.util.apk.ApkSigningBlockUtils.getSignatureAlgorithmContentDigestAlgorithm;
+import static android.util.apk.ApkSigningBlockUtils.getSignatureAlgorithmJcaKeyAlgorithm;
+import static android.util.apk.ApkSigningBlockUtils.getSignatureAlgorithmJcaSignatureAlgorithm;
+import static android.util.apk.ApkSigningBlockUtils.readLengthPrefixedByteArray;
+
+import android.os.Build;
+import android.util.ArrayMap;
+import android.util.Pair;
+
+import java.io.ByteArrayInputStream;
+import java.io.FileDescriptor;
+import java.io.IOException;
+import java.io.RandomAccessFile;
+import java.nio.BufferUnderflowException;
+import java.nio.ByteBuffer;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidKeyException;
+import java.security.KeyFactory;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.PublicKey;
+import java.security.Signature;
+import java.security.SignatureException;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.security.spec.AlgorithmParameterSpec;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.X509EncodedKeySpec;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * APK Signature Scheme v3 verifier.
+ *
+ * @hide for internal use only.
+ */
+public class ApkSignatureSchemeV3Verifier {
+
+    /**
+     * ID of this signature scheme as used in X-Android-APK-Signed header used in JAR signing.
+     */
+    public static final int SF_ATTRIBUTE_ANDROID_APK_SIGNED_ID = 3;
+
+    private static final int APK_SIGNATURE_SCHEME_V3_BLOCK_ID = 0xf05368c0;
+
+    /**
+     * Returns {@code true} if the provided APK contains an APK Signature Scheme V3 signature.
+     *
+     * <p><b>NOTE: This method does not verify the signature.</b>
+     */
+    public static boolean hasSignature(String apkFile) throws IOException {
+        try (RandomAccessFile apk = new RandomAccessFile(apkFile, "r")) {
+            findSignature(apk);
+            return true;
+        } catch (SignatureNotFoundException e) {
+            return false;
+        }
+    }
+
+    /**
+     * Verifies APK Signature Scheme v3 signatures of the provided APK and returns the certificates
+     * associated with each signer.
+     *
+     * @throws SignatureNotFoundException if the APK is not signed using APK Signature Scheme v3.
+     * @throws SecurityException if the APK Signature Scheme v3 signature of this APK does not
+     * verify.
+     * @throws IOException if an I/O error occurs while reading the APK file.
+     */
+    public static VerifiedSigner verify(String apkFile)
+            throws SignatureNotFoundException, SecurityException, IOException {
+        return verify(apkFile, true);
+    }
+
+    /**
+     * Returns the certificates associated with each signer for the given APK without verification.
+     * This method is dangerous and should not be used, unless the caller is absolutely certain the
+     * APK is trusted.  Specifically, verification is only done for the APK Signature Scheme v3
+     * Block while gathering signer information.  The APK contents are not verified.
+     *
+     * @throws SignatureNotFoundException if the APK is not signed using APK Signature Scheme v3.
+     * @throws IOException if an I/O error occurs while reading the APK file.
+     */
+    public static VerifiedSigner plsCertsNoVerifyOnlyCerts(String apkFile)
+            throws SignatureNotFoundException, SecurityException, IOException {
+        return verify(apkFile, false);
+    }
+
+    private static VerifiedSigner verify(String apkFile, boolean verifyIntegrity)
+            throws SignatureNotFoundException, SecurityException, IOException {
+        try (RandomAccessFile apk = new RandomAccessFile(apkFile, "r")) {
+            return verify(apk, verifyIntegrity);
+        }
+    }
+
+    /**
+     * Verifies APK Signature Scheme v3 signatures of the provided APK and returns the certificates
+     * associated with each signer.
+     *
+     * @throws SignatureNotFoundException if the APK is not signed using APK Signature Scheme v3.
+     * @throws SecurityException if an APK Signature Scheme v3 signature of this APK does not
+     *         verify.
+     * @throws IOException if an I/O error occurs while reading the APK file.
+     */
+    private static VerifiedSigner verify(RandomAccessFile apk, boolean verifyIntegrity)
+            throws SignatureNotFoundException, SecurityException, IOException {
+        SignatureInfo signatureInfo = findSignature(apk);
+        return verify(apk.getFD(), signatureInfo, verifyIntegrity);
+    }
+
+    /**
+     * Returns the APK Signature Scheme v3 block contained in the provided APK file and the
+     * additional information relevant for verifying the block against the file.
+     *
+     * @throws SignatureNotFoundException if the APK is not signed using APK Signature Scheme v3.
+     * @throws IOException if an I/O error occurs while reading the APK file.
+     */
+    private static SignatureInfo findSignature(RandomAccessFile apk)
+            throws IOException, SignatureNotFoundException {
+        return ApkSigningBlockUtils.findSignature(apk, APK_SIGNATURE_SCHEME_V3_BLOCK_ID);
+    }
+
+    /**
+     * Verifies the contents of the provided APK file against the provided APK Signature Scheme v3
+     * Block.
+     *
+     * @param signatureInfo APK Signature Scheme v3 Block and information relevant for verifying it
+     *        against the APK file.
+     */
+    private static VerifiedSigner verify(
+            FileDescriptor apkFileDescriptor,
+            SignatureInfo signatureInfo,
+            boolean doVerifyIntegrity) throws SecurityException {
+        int signerCount = 0;
+        Map<Integer, byte[]> contentDigests = new ArrayMap<>();
+        VerifiedSigner result = null;
+        CertificateFactory certFactory;
+        try {
+            certFactory = CertificateFactory.getInstance("X.509");
+        } catch (CertificateException e) {
+            throw new RuntimeException("Failed to obtain X.509 CertificateFactory", e);
+        }
+        ByteBuffer signers;
+        try {
+            signers = getLengthPrefixedSlice(signatureInfo.signatureBlock);
+        } catch (IOException e) {
+            throw new SecurityException("Failed to read list of signers", e);
+        }
+        while (signers.hasRemaining()) {
+            try {
+                ByteBuffer signer = getLengthPrefixedSlice(signers);
+                result = verifySigner(signer, contentDigests, certFactory);
+                signerCount++;
+            } catch (PlatformNotSupportedException e) {
+                // this signer is for a different platform, ignore it.
+                continue;
+            } catch (IOException | BufferUnderflowException | SecurityException e) {
+                throw new SecurityException(
+                        "Failed to parse/verify signer #" + signerCount + " block",
+                        e);
+            }
+        }
+
+        if (signerCount < 1 || result == null) {
+            throw new SecurityException("No signers found");
+        }
+
+        if (signerCount != 1) {
+            throw new SecurityException("APK Signature Scheme V3 only supports one signer: "
+                    + "multiple signers found.");
+        }
+
+        if (contentDigests.isEmpty()) {
+            throw new SecurityException("No content digests found");
+        }
+
+        if (doVerifyIntegrity) {
+            ApkSigningBlockUtils.verifyIntegrity(
+                    contentDigests,
+                    apkFileDescriptor,
+                    signatureInfo.apkSigningBlockOffset,
+                    signatureInfo.centralDirOffset,
+                    signatureInfo.eocdOffset,
+                    signatureInfo.eocd);
+        }
+
+        return result;
+    }
+
+    private static VerifiedSigner verifySigner(
+            ByteBuffer signerBlock,
+            Map<Integer, byte[]> contentDigests,
+            CertificateFactory certFactory)
+            throws SecurityException, IOException, PlatformNotSupportedException {
+        ByteBuffer signedData = getLengthPrefixedSlice(signerBlock);
+        int minSdkVersion = signerBlock.getInt();
+        int maxSdkVersion = signerBlock.getInt();
+
+        if (Build.VERSION.SDK_INT < minSdkVersion || Build.VERSION.SDK_INT > maxSdkVersion) {
+            // this signature isn't meant to be used with this platform, skip it.
+            throw new PlatformNotSupportedException(
+                    "Signer not supported by this platform "
+                    + "version. This platform: " + Build.VERSION.SDK_INT
+                    + ", signer minSdkVersion: " + minSdkVersion
+                    + ", maxSdkVersion: " + maxSdkVersion);
+        }
+
+        ByteBuffer signatures = getLengthPrefixedSlice(signerBlock);
+        byte[] publicKeyBytes = readLengthPrefixedByteArray(signerBlock);
+
+        int signatureCount = 0;
+        int bestSigAlgorithm = -1;
+        byte[] bestSigAlgorithmSignatureBytes = null;
+        List<Integer> signaturesSigAlgorithms = new ArrayList<>();
+        while (signatures.hasRemaining()) {
+            signatureCount++;
+            try {
+                ByteBuffer signature = getLengthPrefixedSlice(signatures);
+                if (signature.remaining() < 8) {
+                    throw new SecurityException("Signature record too short");
+                }
+                int sigAlgorithm = signature.getInt();
+                signaturesSigAlgorithms.add(sigAlgorithm);
+                if (!isSupportedSignatureAlgorithm(sigAlgorithm)) {
+                    continue;
+                }
+                if ((bestSigAlgorithm == -1)
+                        || (compareSignatureAlgorithm(sigAlgorithm, bestSigAlgorithm) > 0)) {
+                    bestSigAlgorithm = sigAlgorithm;
+                    bestSigAlgorithmSignatureBytes = readLengthPrefixedByteArray(signature);
+                }
+            } catch (IOException | BufferUnderflowException e) {
+                throw new SecurityException(
+                        "Failed to parse signature record #" + signatureCount,
+                        e);
+            }
+        }
+        if (bestSigAlgorithm == -1) {
+            if (signatureCount == 0) {
+                throw new SecurityException("No signatures found");
+            } else {
+                throw new SecurityException("No supported signatures found");
+            }
+        }
+
+        String keyAlgorithm = getSignatureAlgorithmJcaKeyAlgorithm(bestSigAlgorithm);
+        Pair<String, ? extends AlgorithmParameterSpec> signatureAlgorithmParams =
+                getSignatureAlgorithmJcaSignatureAlgorithm(bestSigAlgorithm);
+        String jcaSignatureAlgorithm = signatureAlgorithmParams.first;
+        AlgorithmParameterSpec jcaSignatureAlgorithmParams = signatureAlgorithmParams.second;
+        boolean sigVerified;
+        try {
+            PublicKey publicKey =
+                    KeyFactory.getInstance(keyAlgorithm)
+                            .generatePublic(new X509EncodedKeySpec(publicKeyBytes));
+            Signature sig = Signature.getInstance(jcaSignatureAlgorithm);
+            sig.initVerify(publicKey);
+            if (jcaSignatureAlgorithmParams != null) {
+                sig.setParameter(jcaSignatureAlgorithmParams);
+            }
+            sig.update(signedData);
+            sigVerified = sig.verify(bestSigAlgorithmSignatureBytes);
+        } catch (NoSuchAlgorithmException | InvalidKeySpecException | InvalidKeyException
+                | InvalidAlgorithmParameterException | SignatureException e) {
+            throw new SecurityException(
+                    "Failed to verify " + jcaSignatureAlgorithm + " signature", e);
+        }
+        if (!sigVerified) {
+            throw new SecurityException(jcaSignatureAlgorithm + " signature did not verify");
+        }
+
+        // Signature over signedData has verified.
+
+        byte[] contentDigest = null;
+        signedData.clear();
+        ByteBuffer digests = getLengthPrefixedSlice(signedData);
+        List<Integer> digestsSigAlgorithms = new ArrayList<>();
+        int digestCount = 0;
+        while (digests.hasRemaining()) {
+            digestCount++;
+            try {
+                ByteBuffer digest = getLengthPrefixedSlice(digests);
+                if (digest.remaining() < 8) {
+                    throw new IOException("Record too short");
+                }
+                int sigAlgorithm = digest.getInt();
+                digestsSigAlgorithms.add(sigAlgorithm);
+                if (sigAlgorithm == bestSigAlgorithm) {
+                    contentDigest = readLengthPrefixedByteArray(digest);
+                }
+            } catch (IOException | BufferUnderflowException e) {
+                throw new IOException("Failed to parse digest record #" + digestCount, e);
+            }
+        }
+
+        if (!signaturesSigAlgorithms.equals(digestsSigAlgorithms)) {
+            throw new SecurityException(
+                    "Signature algorithms don't match between digests and signatures records");
+        }
+        int digestAlgorithm = getSignatureAlgorithmContentDigestAlgorithm(bestSigAlgorithm);
+        byte[] previousSignerDigest = contentDigests.put(digestAlgorithm, contentDigest);
+        if ((previousSignerDigest != null)
+                && (!MessageDigest.isEqual(previousSignerDigest, contentDigest))) {
+            throw new SecurityException(
+                    getContentDigestAlgorithmJcaDigestAlgorithm(digestAlgorithm)
+                    + " contents digest does not match the digest specified by a preceding signer");
+        }
+
+        ByteBuffer certificates = getLengthPrefixedSlice(signedData);
+        List<X509Certificate> certs = new ArrayList<>();
+        int certificateCount = 0;
+        while (certificates.hasRemaining()) {
+            certificateCount++;
+            byte[] encodedCert = readLengthPrefixedByteArray(certificates);
+            X509Certificate certificate;
+            try {
+                certificate = (X509Certificate)
+                        certFactory.generateCertificate(new ByteArrayInputStream(encodedCert));
+            } catch (CertificateException e) {
+                throw new SecurityException("Failed to decode certificate #" + certificateCount, e);
+            }
+            certificate = new VerbatimX509Certificate(
+                    certificate, encodedCert);
+            certs.add(certificate);
+        }
+
+        if (certs.isEmpty()) {
+            throw new SecurityException("No certificates listed");
+        }
+        X509Certificate mainCertificate = certs.get(0);
+        byte[] certificatePublicKeyBytes = mainCertificate.getPublicKey().getEncoded();
+        if (!Arrays.equals(publicKeyBytes, certificatePublicKeyBytes)) {
+            throw new SecurityException(
+                    "Public key mismatch between certificate and signature record");
+        }
+
+        int signedMinSDK = signedData.getInt();
+        if (signedMinSDK != minSdkVersion) {
+            throw new SecurityException(
+                    "minSdkVersion mismatch between signed and unsigned in v3 signer block.");
+        }
+
+        int signedMaxSDK = signedData.getInt();
+        if (signedMaxSDK != maxSdkVersion) {
+            throw new SecurityException(
+                    "maxSdkVersion mismatch between signed and unsigned in v3 signer block.");
+        }
+
+        ByteBuffer additionalAttrs = getLengthPrefixedSlice(signedData);
+        return verifyAdditionalAttributes(additionalAttrs, certs, certFactory);
+    }
+
+    private static final int PROOF_OF_ROTATION_ATTR_ID = 0x3ba06f8c;
+
+    private static VerifiedSigner verifyAdditionalAttributes(ByteBuffer attrs,
+            List<X509Certificate> certs, CertificateFactory certFactory) throws IOException {
+        X509Certificate[] certChain = certs.toArray(new X509Certificate[certs.size()]);
+        VerifiedProofOfRotation por = null;
+
+        while (attrs.hasRemaining()) {
+            ByteBuffer attr = getLengthPrefixedSlice(attrs);
+            if (attr.remaining() < 4) {
+                throw new IOException("Remaining buffer too short to contain additional attribute "
+                        + "ID. Remaining: " + attr.remaining());
+            }
+            int id = attr.getInt();
+            switch(id) {
+                case PROOF_OF_ROTATION_ATTR_ID:
+                    if (por != null) {
+                        throw new SecurityException("Encountered multiple Proof-of-rotation records"
+                                + " when verifying APK Signature Scheme v3 signature");
+                    }
+                    por = verifyProofOfRotationStruct(attr, certFactory);
+                    // make sure that the last certificate in the Proof-of-rotation record matches
+                    // the one used to sign this APK.
+                    try {
+                        if (por.certs.size() > 0
+                                && !Arrays.equals(por.certs.get(por.certs.size() - 1).getEncoded(),
+                                        certChain[0].getEncoded())) {
+                            throw new SecurityException("Terminal certificate in Proof-of-rotation"
+                                    + " record does not match APK signing certificate");
+                        }
+                    } catch (CertificateEncodingException e) {
+                        throw new SecurityException("Failed to encode certificate when comparing"
+                                + " Proof-of-rotation record and signing certificate", e);
+                    }
+
+                    break;
+                default:
+                    // not the droid we're looking for, move along, move along.
+                    break;
+            }
+        }
+        return new VerifiedSigner(certChain, por);
+    }
+
+    private static VerifiedProofOfRotation verifyProofOfRotationStruct(
+            ByteBuffer porBuf,
+            CertificateFactory certFactory)
+            throws SecurityException, IOException {
+        int levelCount = 0;
+        int lastSigAlgorithm = -1;
+        X509Certificate lastCert = null;
+        List<X509Certificate> certs = new ArrayList<>();
+        List<Integer> flagsList = new ArrayList<>();
+
+        // Proof-of-rotation struct:
+        // is basically a singly linked list of nodes, called levels here, each of which have the
+        // following structure:
+        // * length-prefix for the entire level
+        //     - length-prefixed signed data (if previous level exists)
+        //         * length-prefixed X509 Certificate
+        //         * uint32 signature algorithm ID describing how this signed data was signed
+        //     - uint32 flags describing how to treat the cert contained in this level
+        //     - uint32 signature algorithm ID to use to verify the signature of the next level. The
+        //         algorithm here must match the one in the signed data section of the next level.
+        //     - length-prefixed signature over the signed data in this level.  The signature here
+        //         is verified using the certificate from the previous level.
+        // The linking is provided by the certificate of each level signing the one of the next.
+        while (porBuf.hasRemaining()) {
+            levelCount++;
+            try {
+                ByteBuffer level = getLengthPrefixedSlice(porBuf);
+                ByteBuffer signedData = getLengthPrefixedSlice(level);
+                int flags = level.getInt();
+                int sigAlgorithm = level.getInt();
+                byte[] signature = readLengthPrefixedByteArray(level);
+
+                if (lastCert != null) {
+                    // Use previous level cert to verify current level
+                    Pair<String, ? extends AlgorithmParameterSpec> sigAlgParams =
+                            getSignatureAlgorithmJcaSignatureAlgorithm(lastSigAlgorithm);
+                    PublicKey publicKey = lastCert.getPublicKey();
+                    Signature sig = Signature.getInstance(sigAlgParams.first);
+                    sig.initVerify(publicKey);
+                    if (sigAlgParams.second != null) {
+                        sig.setParameter(sigAlgParams.second);
+                    }
+                    sig.update(signedData);
+                    if (!sig.verify(signature)) {
+                        throw new SecurityException("Unable to verify signature of certificate #"
+                                + levelCount + " using " + sigAlgParams.first + " when verifying"
+                                + " Proof-of-rotation record");
+                    }
+                }
+
+                byte[] encodedCert = readLengthPrefixedByteArray(signedData);
+                int signedSigAlgorithm = signedData.getInt();
+                if (lastCert != null && lastSigAlgorithm != signedSigAlgorithm) {
+                    throw new SecurityException("Signing algorithm ID mismatch for certificate #"
+                            + levelCount + " when verifying Proof-of-rotation record");
+                }
+                lastCert = (X509Certificate)
+                        certFactory.generateCertificate(new ByteArrayInputStream(encodedCert));
+                lastCert = new VerbatimX509Certificate(lastCert, encodedCert);
+
+                lastSigAlgorithm = sigAlgorithm;
+                certs.add(lastCert);
+                flagsList.add(flags);
+            } catch (IOException | BufferUnderflowException e) {
+                throw new IOException("Failed to parse Proof-of-rotation record", e);
+            } catch (NoSuchAlgorithmException | InvalidKeyException
+                    | InvalidAlgorithmParameterException | SignatureException e) {
+                throw new SecurityException(
+                        "Failed to verify signature over signed data for certificate #"
+                                + levelCount + " when verifying Proof-of-rotation record", e);
+            } catch (CertificateException e) {
+                throw new SecurityException("Failed to decode certificate #" + levelCount
+                        + " when verifying Proof-of-rotation record", e);
+            }
+        }
+        return new VerifiedProofOfRotation(certs, flagsList);
+    }
+
+    private static boolean isSupportedSignatureAlgorithm(int sigAlgorithm) {
+        switch (sigAlgorithm) {
+            case SIGNATURE_RSA_PSS_WITH_SHA256:
+            case SIGNATURE_RSA_PSS_WITH_SHA512:
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256:
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512:
+            case SIGNATURE_ECDSA_WITH_SHA256:
+            case SIGNATURE_ECDSA_WITH_SHA512:
+            case SIGNATURE_DSA_WITH_SHA256:
+                return true;
+            default:
+                return false;
+        }
+    }
+
+    /**
+     * Verified processed proof of rotation.
+     *
+     * @hide for internal use only.
+     */
+    public static class VerifiedProofOfRotation {
+        public final List<X509Certificate> certs;
+        public final List<Integer> flagsList;
+
+        public VerifiedProofOfRotation(List<X509Certificate> certs, List<Integer> flagsList) {
+            this.certs = certs;
+            this.flagsList = flagsList;
+        }
+    }
+
+    /**
+     * Verified APK Signature Scheme v3 signer, including the proof of rotation structure.
+     *
+     * @hide for internal use only.
+     */
+    public static class VerifiedSigner {
+        public final X509Certificate[] certs;
+        public final VerifiedProofOfRotation por;
+
+        public VerifiedSigner(X509Certificate[] certs, VerifiedProofOfRotation por) {
+            this.certs = certs;
+            this.por = por;
+        }
+
+    }
+
+    private static class PlatformNotSupportedException extends Exception {
+
+        PlatformNotSupportedException(String s) {
+            super(s);
+        }
+    }
+}
diff --git a/android/util/apk/ApkSignatureVerifier.java b/android/util/apk/ApkSignatureVerifier.java
new file mode 100644
index 00000000..81467292
--- /dev/null
+++ b/android/util/apk/ApkSignatureVerifier.java
@@ -0,0 +1,381 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.util.apk;
+
+import static android.content.pm.PackageManager.INSTALL_PARSE_FAILED_BAD_MANIFEST;
+import static android.content.pm.PackageManager.INSTALL_PARSE_FAILED_CERTIFICATE_ENCODING;
+import static android.content.pm.PackageManager.INSTALL_PARSE_FAILED_INCONSISTENT_CERTIFICATES;
+import static android.content.pm.PackageManager.INSTALL_PARSE_FAILED_NO_CERTIFICATES;
+import static android.content.pm.PackageManager.INSTALL_PARSE_FAILED_UNEXPECTED_EXCEPTION;
+import static android.os.Trace.TRACE_TAG_PACKAGE_MANAGER;
+
+import android.content.pm.PackageParser;
+import android.content.pm.PackageParser.PackageParserException;
+import android.content.pm.Signature;
+import android.os.Trace;
+import android.util.jar.StrictJarFile;
+
+import com.android.internal.util.ArrayUtils;
+
+import libcore.io.IoUtils;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.GeneralSecurityException;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateEncodingException;
+import java.util.ArrayList;
+import java.util.Iterator;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.zip.ZipEntry;
+
+/**
+ * Facade class that takes care of the details of APK verification on
+ * behalf of PackageParser.
+ *
+ * @hide for internal use only.
+ */
+public class ApkSignatureVerifier {
+
+    public static final int VERSION_JAR_SIGNATURE_SCHEME = 1;
+    public static final int VERSION_APK_SIGNATURE_SCHEME_V2 = 2;
+    public static final int VERSION_APK_SIGNATURE_SCHEME_V3 = 3;
+
+    private static final AtomicReference<byte[]> sBuffer = new AtomicReference<>();
+
+    /**
+     * Verifies the provided APK and returns the certificates associated with each signer.
+     *
+     * @throws PackageParserException if the APK's signature failed to verify.
+     */
+    public static Result verify(String apkPath, int minSignatureSchemeVersion)
+            throws PackageParserException {
+
+        if (minSignatureSchemeVersion > VERSION_APK_SIGNATURE_SCHEME_V3) {
+            // V3 and before are older than the requested minimum signing version
+            throw new PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                    "No signature found in package of version " + minSignatureSchemeVersion
+            + " or newer for package " + apkPath);
+        }
+
+        // first try v3
+        Trace.traceBegin(TRACE_TAG_PACKAGE_MANAGER, "verifyV3");
+        try {
+            ApkSignatureSchemeV3Verifier.VerifiedSigner vSigner =
+                    ApkSignatureSchemeV3Verifier.verify(apkPath);
+            Certificate[][] signerCerts = new Certificate[][] { vSigner.certs };
+            Signature[] signerSigs = convertToSignatures(signerCerts);
+            return new Result(signerCerts, signerSigs, VERSION_APK_SIGNATURE_SCHEME_V3);
+        } catch (SignatureNotFoundException e) {
+            // not signed with v2, try older if allowed
+            if (minSignatureSchemeVersion >= VERSION_APK_SIGNATURE_SCHEME_V3) {
+                throw new PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                        "No APK Signature Scheme v3 signature in package " + apkPath, e);
+            }
+        } catch (Exception e) {
+            // APK Signature Scheme v2 signature found but did not verify
+            throw new  PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                    "Failed to collect certificates from " + apkPath
+                            + " using APK Signature Scheme v2", e);
+        } finally {
+            Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER);
+        }
+
+        // redundant, protective version check
+        if (minSignatureSchemeVersion > VERSION_APK_SIGNATURE_SCHEME_V2) {
+            // V2 and before are older than the requested minimum signing version
+            throw new PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                    "No signature found in package of version " + minSignatureSchemeVersion
+                            + " or newer for package " + apkPath);
+        }
+
+        // try v2
+        Trace.traceBegin(TRACE_TAG_PACKAGE_MANAGER, "verifyV2");
+        try {
+            Certificate[][] signerCerts = ApkSignatureSchemeV2Verifier.verify(apkPath);
+            Signature[] signerSigs = convertToSignatures(signerCerts);
+
+            return new Result(signerCerts, signerSigs, VERSION_APK_SIGNATURE_SCHEME_V2);
+        } catch (SignatureNotFoundException e) {
+            // not signed with v2, try older if allowed
+            if (minSignatureSchemeVersion >= VERSION_APK_SIGNATURE_SCHEME_V2) {
+                throw new PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                        "No APK Signature Scheme v2 signature in package " + apkPath, e);
+            }
+        } catch (Exception e) {
+            // APK Signature Scheme v2 signature found but did not verify
+            throw new  PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                    "Failed to collect certificates from " + apkPath
+                            + " using APK Signature Scheme v2", e);
+        } finally {
+            Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER);
+        }
+
+        // redundant, protective version check
+        if (minSignatureSchemeVersion > VERSION_JAR_SIGNATURE_SCHEME) {
+            // V1 and is older than the requested minimum signing version
+            throw new PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                    "No signature found in package of version " + minSignatureSchemeVersion
+                            + " or newer for package " + apkPath);
+        }
+
+        // v2 didn't work, try jarsigner
+        return verifyV1Signature(apkPath, true);
+    }
+
+    /**
+     * Verifies the provided APK and returns the certificates associated with each signer.
+     *
+     * @param verifyFull whether to verify all contents of this APK or just collect certificates.
+     *
+     * @throws PackageParserException if there was a problem collecting certificates
+     */
+    private static Result verifyV1Signature(String apkPath, boolean verifyFull)
+            throws PackageParserException {
+        StrictJarFile jarFile = null;
+
+        try {
+            final Certificate[][] lastCerts;
+            final Signature[] lastSigs;
+
+            Trace.traceBegin(TRACE_TAG_PACKAGE_MANAGER, "strictJarFileCtor");
+
+            // we still pass verify = true to ctor to collect certs, even though we're not checking
+            // the whole jar.
+            jarFile = new StrictJarFile(
+                    apkPath,
+                    true, // collect certs
+                    verifyFull); // whether to reject APK with stripped v2 signatures (b/27887819)
+            final List<ZipEntry> toVerify = new ArrayList<>();
+
+            // Gather certs from AndroidManifest.xml, which every APK must have, as an optimization
+            // to not need to verify the whole APK when verifyFUll == false.
+            final ZipEntry manifestEntry = jarFile.findEntry(
+                    PackageParser.ANDROID_MANIFEST_FILENAME);
+            if (manifestEntry == null) {
+                throw new PackageParserException(INSTALL_PARSE_FAILED_BAD_MANIFEST,
+                        "Package " + apkPath + " has no manifest");
+            }
+            lastCerts = loadCertificates(jarFile, manifestEntry);
+            if (ArrayUtils.isEmpty(lastCerts)) {
+                throw new PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES, "Package "
+                        + apkPath + " has no certificates at entry "
+                        + PackageParser.ANDROID_MANIFEST_FILENAME);
+            }
+            lastSigs = convertToSignatures(lastCerts);
+
+            // fully verify all contents, except for AndroidManifest.xml  and the META-INF/ files.
+            if (verifyFull) {
+                final Iterator<ZipEntry> i = jarFile.iterator();
+                while (i.hasNext()) {
+                    final ZipEntry entry = i.next();
+                    if (entry.isDirectory()) continue;
+
+                    final String entryName = entry.getName();
+                    if (entryName.startsWith("META-INF/")) continue;
+                    if (entryName.equals(PackageParser.ANDROID_MANIFEST_FILENAME)) continue;
+
+                    toVerify.add(entry);
+                }
+
+                for (ZipEntry entry : toVerify) {
+                    final Certificate[][] entryCerts = loadCertificates(jarFile, entry);
+                    if (ArrayUtils.isEmpty(entryCerts)) {
+                        throw new PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                                "Package " + apkPath + " has no certificates at entry "
+                                        + entry.getName());
+                    }
+
+                    // make sure all entries use the same signing certs
+                    final Signature[] entrySigs = convertToSignatures(entryCerts);
+                    if (!Signature.areExactMatch(lastSigs, entrySigs)) {
+                        throw new PackageParserException(
+                                INSTALL_PARSE_FAILED_INCONSISTENT_CERTIFICATES,
+                                "Package " + apkPath + " has mismatched certificates at entry "
+                                        + entry.getName());
+                    }
+                }
+            }
+            return new Result(lastCerts, lastSigs, VERSION_JAR_SIGNATURE_SCHEME);
+        } catch (GeneralSecurityException e) {
+            throw new PackageParserException(INSTALL_PARSE_FAILED_CERTIFICATE_ENCODING,
+                    "Failed to collect certificates from " + apkPath, e);
+        } catch (IOException | RuntimeException e) {
+            throw new PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                    "Failed to collect certificates from " + apkPath, e);
+        } finally {
+            Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER);
+            closeQuietly(jarFile);
+        }
+    }
+
+    private static Certificate[][] loadCertificates(StrictJarFile jarFile, ZipEntry entry)
+            throws PackageParserException {
+        InputStream is = null;
+        try {
+            // We must read the stream for the JarEntry to retrieve
+            // its certificates.
+            is = jarFile.getInputStream(entry);
+            readFullyIgnoringContents(is);
+            return jarFile.getCertificateChains(entry);
+        } catch (IOException | RuntimeException e) {
+            throw new PackageParserException(INSTALL_PARSE_FAILED_UNEXPECTED_EXCEPTION,
+                    "Failed reading " + entry.getName() + " in " + jarFile, e);
+        } finally {
+            IoUtils.closeQuietly(is);
+        }
+    }
+
+    private static void readFullyIgnoringContents(InputStream in) throws IOException {
+        byte[] buffer = sBuffer.getAndSet(null);
+        if (buffer == null) {
+            buffer = new byte[4096];
+        }
+
+        int n = 0;
+        int count = 0;
+        while ((n = in.read(buffer, 0, buffer.length)) != -1) {
+            count += n;
+        }
+
+        sBuffer.set(buffer);
+        return;
+    }
+
+    /**
+     * Converts an array of certificate chains into the {@code Signature} equivalent used by the
+     * PackageManager.
+     *
+     * @throws CertificateEncodingException if it is unable to create a Signature object.
+     */
+    public static Signature[] convertToSignatures(Certificate[][] certs)
+            throws CertificateEncodingException {
+        final Signature[] res = new Signature[certs.length];
+        for (int i = 0; i < certs.length; i++) {
+            res[i] = new Signature(certs[i]);
+        }
+        return res;
+    }
+
+    private static void closeQuietly(StrictJarFile jarFile) {
+        if (jarFile != null) {
+            try {
+                jarFile.close();
+            } catch (Exception ignored) {
+            }
+        }
+    }
+
+    /**
+     * Returns the certificates associated with each signer for the given APK without verification.
+     * This method is dangerous and should not be used, unless the caller is absolutely certain the
+     * APK is trusted.
+     *
+     * @throws PackageParserException if the APK's signature failed to verify.
+     * or greater is not found, except in the case of no JAR signature.
+     */
+    public static Result plsCertsNoVerifyOnlyCerts(String apkPath, int minSignatureSchemeVersion)
+            throws PackageParserException {
+
+        if (minSignatureSchemeVersion > VERSION_APK_SIGNATURE_SCHEME_V3) {
+            // V3 and before are older than the requested minimum signing version
+            throw new PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                    "No signature found in package of version " + minSignatureSchemeVersion
+                            + " or newer for package " + apkPath);
+        }
+
+        // first try v3
+        Trace.traceBegin(TRACE_TAG_PACKAGE_MANAGER, "verifyV3");
+        try {
+            ApkSignatureSchemeV3Verifier.VerifiedSigner vSigner =
+                    ApkSignatureSchemeV3Verifier.plsCertsNoVerifyOnlyCerts(apkPath);
+            Certificate[][] signerCerts = new Certificate[][] { vSigner.certs };
+            Signature[] signerSigs = convertToSignatures(signerCerts);
+            return new Result(signerCerts, signerSigs, VERSION_APK_SIGNATURE_SCHEME_V3);
+        } catch (SignatureNotFoundException e) {
+            // not signed with v2, try older if allowed
+            if (minSignatureSchemeVersion >= VERSION_APK_SIGNATURE_SCHEME_V3) {
+                throw new PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                        "No APK Signature Scheme v3 signature in package " + apkPath, e);
+            }
+        } catch (Exception e) {
+            // APK Signature Scheme v2 signature found but did not verify
+            throw new  PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                    "Failed to collect certificates from " + apkPath
+                            + " using APK Signature Scheme v2", e);
+        } finally {
+            Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER);
+        }
+
+        // redundant, protective version check
+        if (minSignatureSchemeVersion > VERSION_APK_SIGNATURE_SCHEME_V2) {
+            // V2 and before are older than the requested minimum signing version
+            throw new PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                    "No signature found in package of version " + minSignatureSchemeVersion
+                            + " or newer for package " + apkPath);
+        }
+
+        // first try v2
+        Trace.traceBegin(TRACE_TAG_PACKAGE_MANAGER, "certsOnlyV2");
+        try {
+            Certificate[][] signerCerts =
+                    ApkSignatureSchemeV2Verifier.plsCertsNoVerifyOnlyCerts(apkPath);
+            Signature[] signerSigs = convertToSignatures(signerCerts);
+            return new Result(signerCerts, signerSigs, VERSION_APK_SIGNATURE_SCHEME_V2);
+        } catch (SignatureNotFoundException e) {
+            // not signed with v2, try older if allowed
+            if (minSignatureSchemeVersion >= VERSION_APK_SIGNATURE_SCHEME_V2) {
+                throw new PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                        "No APK Signature Scheme v2 signature in package " + apkPath, e);
+            }
+        } catch (Exception e) {
+            // APK Signature Scheme v2 signature found but did not verify
+            throw new  PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                    "Failed to collect certificates from " + apkPath
+                            + " using APK Signature Scheme v2", e);
+        } finally {
+            Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER);
+        }
+
+        // redundant, protective version check
+        if (minSignatureSchemeVersion > VERSION_JAR_SIGNATURE_SCHEME) {
+            // V1 and is older than the requested minimum signing version
+            throw new PackageParserException(INSTALL_PARSE_FAILED_NO_CERTIFICATES,
+                    "No signature found in package of version " + minSignatureSchemeVersion
+                            + " or newer for package " + apkPath);
+        }
+
+        // v2 didn't work, try jarsigner
+        return verifyV1Signature(apkPath, false);
+    }
+
+    /**
+     * Result of a successful APK verification operation.
+     */
+    public static class Result {
+        public final Certificate[][] certs;
+        public final Signature[] sigs;
+        public final int signatureSchemeVersion;
+
+        public Result(Certificate[][] certs, Signature[] sigs, int signingVersion) {
+            this.certs = certs;
+            this.sigs = sigs;
+            this.signatureSchemeVersion = signingVersion;
+        }
+    }
+}
diff --git a/android/util/apk/ApkSigningBlockUtils.java b/android/util/apk/ApkSigningBlockUtils.java
new file mode 100644
index 00000000..9279510a
--- /dev/null
+++ b/android/util/apk/ApkSigningBlockUtils.java
@@ -0,0 +1,663 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.util.apk;
+
+import android.util.Pair;
+
+import java.io.FileDescriptor;
+import java.io.IOException;
+import java.io.RandomAccessFile;
+import java.nio.BufferUnderflowException;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+import java.security.DigestException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.spec.AlgorithmParameterSpec;
+import java.security.spec.MGF1ParameterSpec;
+import java.security.spec.PSSParameterSpec;
+import java.util.Map;
+
+/**
+ * Utility class for an APK Signature Scheme using the APK Signing Block.
+ *
+ * @hide for internal use only.
+ */
+final class ApkSigningBlockUtils {
+
+    private ApkSigningBlockUtils() {
+    }
+
+    /**
+     * Returns the APK Signature Scheme block contained in the provided APK file and the
+     * additional information relevant for verifying the block against the file.
+     *
+     * @param blockId the ID value in the APK Signing Block's sequence of ID-value pairs
+     *                identifying the appropriate block to find, e.g. the APK Signature Scheme v2
+     *                block ID.
+     *
+     * @throws SignatureNotFoundException if the APK is not signed using this scheme.
+     * @throws IOException if an I/O error occurs while reading the APK file.
+     */
+    static SignatureInfo findSignature(RandomAccessFile apk, int blockId)
+            throws IOException, SignatureNotFoundException {
+        // Find the ZIP End of Central Directory (EoCD) record.
+        Pair<ByteBuffer, Long> eocdAndOffsetInFile = getEocd(apk);
+        ByteBuffer eocd = eocdAndOffsetInFile.first;
+        long eocdOffset = eocdAndOffsetInFile.second;
+        if (ZipUtils.isZip64EndOfCentralDirectoryLocatorPresent(apk, eocdOffset)) {
+            throw new SignatureNotFoundException("ZIP64 APK not supported");
+        }
+
+        // Find the APK Signing Block. The block immediately precedes the Central Directory.
+        long centralDirOffset = getCentralDirOffset(eocd, eocdOffset);
+        Pair<ByteBuffer, Long> apkSigningBlockAndOffsetInFile =
+                findApkSigningBlock(apk, centralDirOffset);
+        ByteBuffer apkSigningBlock = apkSigningBlockAndOffsetInFile.first;
+        long apkSigningBlockOffset = apkSigningBlockAndOffsetInFile.second;
+
+        // Find the APK Signature Scheme Block inside the APK Signing Block.
+        ByteBuffer apkSignatureSchemeBlock = findApkSignatureSchemeBlock(apkSigningBlock,
+                blockId);
+
+        return new SignatureInfo(
+                apkSignatureSchemeBlock,
+                apkSigningBlockOffset,
+                centralDirOffset,
+                eocdOffset,
+                eocd);
+    }
+
+    static void verifyIntegrity(
+            Map<Integer, byte[]> expectedDigests,
+            FileDescriptor apkFileDescriptor,
+            long apkSigningBlockOffset,
+            long centralDirOffset,
+            long eocdOffset,
+            ByteBuffer eocdBuf) throws SecurityException {
+
+        if (expectedDigests.isEmpty()) {
+            throw new SecurityException("No digests provided");
+        }
+
+        // We need to verify the integrity of the following three sections of the file:
+        // 1. Everything up to the start of the APK Signing Block.
+        // 2. ZIP Central Directory.
+        // 3. ZIP End of Central Directory (EoCD).
+        // Each of these sections is represented as a separate DataSource instance below.
+
+        // To handle large APKs, these sections are read in 1 MB chunks using memory-mapped I/O to
+        // avoid wasting physical memory. In most APK verification scenarios, the contents of the
+        // APK are already there in the OS's page cache and thus mmap does not use additional
+        // physical memory.
+        DataSource beforeApkSigningBlock =
+                new MemoryMappedFileDataSource(apkFileDescriptor, 0, apkSigningBlockOffset);
+        DataSource centralDir =
+                new MemoryMappedFileDataSource(
+                        apkFileDescriptor, centralDirOffset, eocdOffset - centralDirOffset);
+
+        // For the purposes of integrity verification, ZIP End of Central Directory's field Start of
+        // Central Directory must be considered to point to the offset of the APK Signing Block.
+        eocdBuf = eocdBuf.duplicate();
+        eocdBuf.order(ByteOrder.LITTLE_ENDIAN);
+        ZipUtils.setZipEocdCentralDirectoryOffset(eocdBuf, apkSigningBlockOffset);
+        DataSource eocd = new ByteBufferDataSource(eocdBuf);
+
+        int[] digestAlgorithms = new int[expectedDigests.size()];
+        int digestAlgorithmCount = 0;
+        for (int digestAlgorithm : expectedDigests.keySet()) {
+            digestAlgorithms[digestAlgorithmCount] = digestAlgorithm;
+            digestAlgorithmCount++;
+        }
+        byte[][] actualDigests;
+        try {
+            actualDigests =
+                    computeContentDigests(
+                            digestAlgorithms,
+                            new DataSource[] {beforeApkSigningBlock, centralDir, eocd});
+        } catch (DigestException e) {
+            throw new SecurityException("Failed to compute digest(s) of contents", e);
+        }
+        for (int i = 0; i < digestAlgorithms.length; i++) {
+            int digestAlgorithm = digestAlgorithms[i];
+            byte[] expectedDigest = expectedDigests.get(digestAlgorithm);
+            byte[] actualDigest = actualDigests[i];
+            if (!MessageDigest.isEqual(expectedDigest, actualDigest)) {
+                throw new SecurityException(
+                        getContentDigestAlgorithmJcaDigestAlgorithm(digestAlgorithm)
+                                + " digest of contents did not verify");
+            }
+        }
+    }
+
+    private static byte[][] computeContentDigests(
+            int[] digestAlgorithms,
+            DataSource[] contents) throws DigestException {
+        // For each digest algorithm the result is computed as follows:
+        // 1. Each segment of contents is split into consecutive chunks of 1 MB in size.
+        //    The final chunk will be shorter iff the length of segment is not a multiple of 1 MB.
+        //    No chunks are produced for empty (zero length) segments.
+        // 2. The digest of each chunk is computed over the concatenation of byte 0xa5, the chunk's
+        //    length in bytes (uint32 little-endian) and the chunk's contents.
+        // 3. The output digest is computed over the concatenation of the byte 0x5a, the number of
+        //    chunks (uint32 little-endian) and the concatenation of digests of chunks of all
+        //    segments in-order.
+
+        long totalChunkCountLong = 0;
+        for (DataSource input : contents) {
+            totalChunkCountLong += getChunkCount(input.size());
+        }
+        if (totalChunkCountLong >= Integer.MAX_VALUE / 1024) {
+            throw new DigestException("Too many chunks: " + totalChunkCountLong);
+        }
+        int totalChunkCount = (int) totalChunkCountLong;
+
+        byte[][] digestsOfChunks = new byte[digestAlgorithms.length][];
+        for (int i = 0; i < digestAlgorithms.length; i++) {
+            int digestAlgorithm = digestAlgorithms[i];
+            int digestOutputSizeBytes = getContentDigestAlgorithmOutputSizeBytes(digestAlgorithm);
+            byte[] concatenationOfChunkCountAndChunkDigests =
+                    new byte[5 + totalChunkCount * digestOutputSizeBytes];
+            concatenationOfChunkCountAndChunkDigests[0] = 0x5a;
+            setUnsignedInt32LittleEndian(
+                    totalChunkCount,
+                    concatenationOfChunkCountAndChunkDigests,
+                    1);
+            digestsOfChunks[i] = concatenationOfChunkCountAndChunkDigests;
+        }
+
+        byte[] chunkContentPrefix = new byte[5];
+        chunkContentPrefix[0] = (byte) 0xa5;
+        int chunkIndex = 0;
+        MessageDigest[] mds = new MessageDigest[digestAlgorithms.length];
+        for (int i = 0; i < digestAlgorithms.length; i++) {
+            String jcaAlgorithmName =
+                    getContentDigestAlgorithmJcaDigestAlgorithm(digestAlgorithms[i]);
+            try {
+                mds[i] = MessageDigest.getInstance(jcaAlgorithmName);
+            } catch (NoSuchAlgorithmException e) {
+                throw new RuntimeException(jcaAlgorithmName + " digest not supported", e);
+            }
+        }
+        // TODO: Compute digests of chunks in parallel when beneficial. This requires some research
+        // into how to parallelize (if at all) based on the capabilities of the hardware on which
+        // this code is running and based on the size of input.
+        DataDigester digester = new MultipleDigestDataDigester(mds);
+        int dataSourceIndex = 0;
+        for (DataSource input : contents) {
+            long inputOffset = 0;
+            long inputRemaining = input.size();
+            while (inputRemaining > 0) {
+                int chunkSize = (int) Math.min(inputRemaining, CHUNK_SIZE_BYTES);
+                setUnsignedInt32LittleEndian(chunkSize, chunkContentPrefix, 1);
+                for (int i = 0; i < mds.length; i++) {
+                    mds[i].update(chunkContentPrefix);
+                }
+                try {
+                    input.feedIntoDataDigester(digester, inputOffset, chunkSize);
+                } catch (IOException e) {
+                    throw new DigestException(
+                            "Failed to digest chunk #" + chunkIndex + " of section #"
+                                    + dataSourceIndex,
+                            e);
+                }
+                for (int i = 0; i < digestAlgorithms.length; i++) {
+                    int digestAlgorithm = digestAlgorithms[i];
+                    byte[] concatenationOfChunkCountAndChunkDigests = digestsOfChunks[i];
+                    int expectedDigestSizeBytes =
+                            getContentDigestAlgorithmOutputSizeBytes(digestAlgorithm);
+                    MessageDigest md = mds[i];
+                    int actualDigestSizeBytes =
+                            md.digest(
+                                    concatenationOfChunkCountAndChunkDigests,
+                                    5 + chunkIndex * expectedDigestSizeBytes,
+                                    expectedDigestSizeBytes);
+                    if (actualDigestSizeBytes != expectedDigestSizeBytes) {
+                        throw new RuntimeException(
+                                "Unexpected output size of " + md.getAlgorithm() + " digest: "
+                                        + actualDigestSizeBytes);
+                    }
+                }
+                inputOffset += chunkSize;
+                inputRemaining -= chunkSize;
+                chunkIndex++;
+            }
+            dataSourceIndex++;
+        }
+
+        byte[][] result = new byte[digestAlgorithms.length][];
+        for (int i = 0; i < digestAlgorithms.length; i++) {
+            int digestAlgorithm = digestAlgorithms[i];
+            byte[] input = digestsOfChunks[i];
+            String jcaAlgorithmName = getContentDigestAlgorithmJcaDigestAlgorithm(digestAlgorithm);
+            MessageDigest md;
+            try {
+                md = MessageDigest.getInstance(jcaAlgorithmName);
+            } catch (NoSuchAlgorithmException e) {
+                throw new RuntimeException(jcaAlgorithmName + " digest not supported", e);
+            }
+            byte[] output = md.digest(input);
+            result[i] = output;
+        }
+        return result;
+    }
+
+    /**
+     * Returns the ZIP End of Central Directory (EoCD) and its offset in the file.
+     *
+     * @throws IOException if an I/O error occurs while reading the file.
+     * @throws SignatureNotFoundException if the EoCD could not be found.
+     */
+    static Pair<ByteBuffer, Long> getEocd(RandomAccessFile apk)
+            throws IOException, SignatureNotFoundException {
+        Pair<ByteBuffer, Long> eocdAndOffsetInFile =
+                ZipUtils.findZipEndOfCentralDirectoryRecord(apk);
+        if (eocdAndOffsetInFile == null) {
+            throw new SignatureNotFoundException(
+                    "Not an APK file: ZIP End of Central Directory record not found");
+        }
+        return eocdAndOffsetInFile;
+    }
+
+    static long getCentralDirOffset(ByteBuffer eocd, long eocdOffset)
+            throws SignatureNotFoundException {
+        // Look up the offset of ZIP Central Directory.
+        long centralDirOffset = ZipUtils.getZipEocdCentralDirectoryOffset(eocd);
+        if (centralDirOffset > eocdOffset) {
+            throw new SignatureNotFoundException(
+                    "ZIP Central Directory offset out of range: " + centralDirOffset
+                    + ". ZIP End of Central Directory offset: " + eocdOffset);
+        }
+        long centralDirSize = ZipUtils.getZipEocdCentralDirectorySizeBytes(eocd);
+        if (centralDirOffset + centralDirSize != eocdOffset) {
+            throw new SignatureNotFoundException(
+                    "ZIP Central Directory is not immediately followed by End of Central"
+                    + " Directory");
+        }
+        return centralDirOffset;
+    }
+
+    private static long getChunkCount(long inputSizeBytes) {
+        return (inputSizeBytes + CHUNK_SIZE_BYTES - 1) / CHUNK_SIZE_BYTES;
+    }
+
+    private static final int CHUNK_SIZE_BYTES = 1024 * 1024;
+
+    static final int SIGNATURE_RSA_PSS_WITH_SHA256 = 0x0101;
+    static final int SIGNATURE_RSA_PSS_WITH_SHA512 = 0x0102;
+    static final int SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256 = 0x0103;
+    static final int SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512 = 0x0104;
+    static final int SIGNATURE_ECDSA_WITH_SHA256 = 0x0201;
+    static final int SIGNATURE_ECDSA_WITH_SHA512 = 0x0202;
+    static final int SIGNATURE_DSA_WITH_SHA256 = 0x0301;
+
+    static final int CONTENT_DIGEST_CHUNKED_SHA256 = 1;
+    static final int CONTENT_DIGEST_CHUNKED_SHA512 = 2;
+
+    static int compareSignatureAlgorithm(int sigAlgorithm1, int sigAlgorithm2) {
+        int digestAlgorithm1 = getSignatureAlgorithmContentDigestAlgorithm(sigAlgorithm1);
+        int digestAlgorithm2 = getSignatureAlgorithmContentDigestAlgorithm(sigAlgorithm2);
+        return compareContentDigestAlgorithm(digestAlgorithm1, digestAlgorithm2);
+    }
+
+    private static int compareContentDigestAlgorithm(int digestAlgorithm1, int digestAlgorithm2) {
+        switch (digestAlgorithm1) {
+            case CONTENT_DIGEST_CHUNKED_SHA256:
+                switch (digestAlgorithm2) {
+                    case CONTENT_DIGEST_CHUNKED_SHA256:
+                        return 0;
+                    case CONTENT_DIGEST_CHUNKED_SHA512:
+                        return -1;
+                    default:
+                        throw new IllegalArgumentException(
+                                "Unknown digestAlgorithm2: " + digestAlgorithm2);
+                }
+            case CONTENT_DIGEST_CHUNKED_SHA512:
+                switch (digestAlgorithm2) {
+                    case CONTENT_DIGEST_CHUNKED_SHA256:
+                        return 1;
+                    case CONTENT_DIGEST_CHUNKED_SHA512:
+                        return 0;
+                    default:
+                        throw new IllegalArgumentException(
+                                "Unknown digestAlgorithm2: " + digestAlgorithm2);
+                }
+            default:
+                throw new IllegalArgumentException("Unknown digestAlgorithm1: " + digestAlgorithm1);
+        }
+    }
+
+    static int getSignatureAlgorithmContentDigestAlgorithm(int sigAlgorithm) {
+        switch (sigAlgorithm) {
+            case SIGNATURE_RSA_PSS_WITH_SHA256:
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256:
+            case SIGNATURE_ECDSA_WITH_SHA256:
+            case SIGNATURE_DSA_WITH_SHA256:
+                return CONTENT_DIGEST_CHUNKED_SHA256;
+            case SIGNATURE_RSA_PSS_WITH_SHA512:
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512:
+            case SIGNATURE_ECDSA_WITH_SHA512:
+                return CONTENT_DIGEST_CHUNKED_SHA512;
+            default:
+                throw new IllegalArgumentException(
+                        "Unknown signature algorithm: 0x"
+                                + Long.toHexString(sigAlgorithm & 0xffffffff));
+        }
+    }
+
+    static String getContentDigestAlgorithmJcaDigestAlgorithm(int digestAlgorithm) {
+        switch (digestAlgorithm) {
+            case CONTENT_DIGEST_CHUNKED_SHA256:
+                return "SHA-256";
+            case CONTENT_DIGEST_CHUNKED_SHA512:
+                return "SHA-512";
+            default:
+                throw new IllegalArgumentException(
+                        "Unknown content digest algorthm: " + digestAlgorithm);
+        }
+    }
+
+    private static int getContentDigestAlgorithmOutputSizeBytes(int digestAlgorithm) {
+        switch (digestAlgorithm) {
+            case CONTENT_DIGEST_CHUNKED_SHA256:
+                return 256 / 8;
+            case CONTENT_DIGEST_CHUNKED_SHA512:
+                return 512 / 8;
+            default:
+                throw new IllegalArgumentException(
+                        "Unknown content digest algorthm: " + digestAlgorithm);
+        }
+    }
+
+    static String getSignatureAlgorithmJcaKeyAlgorithm(int sigAlgorithm) {
+        switch (sigAlgorithm) {
+            case SIGNATURE_RSA_PSS_WITH_SHA256:
+            case SIGNATURE_RSA_PSS_WITH_SHA512:
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256:
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512:
+                return "RSA";
+            case SIGNATURE_ECDSA_WITH_SHA256:
+            case SIGNATURE_ECDSA_WITH_SHA512:
+                return "EC";
+            case SIGNATURE_DSA_WITH_SHA256:
+                return "DSA";
+            default:
+                throw new IllegalArgumentException(
+                        "Unknown signature algorithm: 0x"
+                                + Long.toHexString(sigAlgorithm & 0xffffffff));
+        }
+    }
+
+    static Pair<String, ? extends AlgorithmParameterSpec>
+            getSignatureAlgorithmJcaSignatureAlgorithm(int sigAlgorithm) {
+        switch (sigAlgorithm) {
+            case SIGNATURE_RSA_PSS_WITH_SHA256:
+                return Pair.create(
+                        "SHA256withRSA/PSS",
+                        new PSSParameterSpec(
+                                "SHA-256", "MGF1", MGF1ParameterSpec.SHA256, 256 / 8, 1));
+            case SIGNATURE_RSA_PSS_WITH_SHA512:
+                return Pair.create(
+                        "SHA512withRSA/PSS",
+                        new PSSParameterSpec(
+                                "SHA-512", "MGF1", MGF1ParameterSpec.SHA512, 512 / 8, 1));
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA256:
+                return Pair.create("SHA256withRSA", null);
+            case SIGNATURE_RSA_PKCS1_V1_5_WITH_SHA512:
+                return Pair.create("SHA512withRSA", null);
+            case SIGNATURE_ECDSA_WITH_SHA256:
+                return Pair.create("SHA256withECDSA", null);
+            case SIGNATURE_ECDSA_WITH_SHA512:
+                return Pair.create("SHA512withECDSA", null);
+            case SIGNATURE_DSA_WITH_SHA256:
+                return Pair.create("SHA256withDSA", null);
+            default:
+                throw new IllegalArgumentException(
+                        "Unknown signature algorithm: 0x"
+                                + Long.toHexString(sigAlgorithm & 0xffffffff));
+        }
+    }
+
+    /**
+     * Returns new byte buffer whose content is a shared subsequence of this buffer's content
+     * between the specified start (inclusive) and end (exclusive) positions. As opposed to
+     * {@link ByteBuffer#slice()}, the returned buffer's byte order is the same as the source
+     * buffer's byte order.
+     */
+    static ByteBuffer sliceFromTo(ByteBuffer source, int start, int end) {
+        if (start < 0) {
+            throw new IllegalArgumentException("start: " + start);
+        }
+        if (end < start) {
+            throw new IllegalArgumentException("end < start: " + end + " < " + start);
+        }
+        int capacity = source.capacity();
+        if (end > source.capacity()) {
+            throw new IllegalArgumentException("end > capacity: " + end + " > " + capacity);
+        }
+        int originalLimit = source.limit();
+        int originalPosition = source.position();
+        try {
+            source.position(0);
+            source.limit(end);
+            source.position(start);
+            ByteBuffer result = source.slice();
+            result.order(source.order());
+            return result;
+        } finally {
+            source.position(0);
+            source.limit(originalLimit);
+            source.position(originalPosition);
+        }
+    }
+
+    /**
+     * Relative <em>get</em> method for reading {@code size} number of bytes from the current
+     * position of this buffer.
+     *
+     * <p>This method reads the next {@code size} bytes at this buffer's current position,
+     * returning them as a {@code ByteBuffer} with start set to 0, limit and capacity set to
+     * {@code size}, byte order set to this buffer's byte order; and then increments the position by
+     * {@code size}.
+     */
+    static ByteBuffer getByteBuffer(ByteBuffer source, int size)
+            throws BufferUnderflowException {
+        if (size < 0) {
+            throw new IllegalArgumentException("size: " + size);
+        }
+        int originalLimit = source.limit();
+        int position = source.position();
+        int limit = position + size;
+        if ((limit < position) || (limit > originalLimit)) {
+            throw new BufferUnderflowException();
+        }
+        source.limit(limit);
+        try {
+            ByteBuffer result = source.slice();
+            result.order(source.order());
+            source.position(limit);
+            return result;
+        } finally {
+            source.limit(originalLimit);
+        }
+    }
+
+    static ByteBuffer getLengthPrefixedSlice(ByteBuffer source) throws IOException {
+        if (source.remaining() < 4) {
+            throw new IOException(
+                    "Remaining buffer too short to contain length of length-prefixed field."
+                            + " Remaining: " + source.remaining());
+        }
+        int len = source.getInt();
+        if (len < 0) {
+            throw new IllegalArgumentException("Negative length");
+        } else if (len > source.remaining()) {
+            throw new IOException("Length-prefixed field longer than remaining buffer."
+                    + " Field length: " + len + ", remaining: " + source.remaining());
+        }
+        return getByteBuffer(source, len);
+    }
+
+    static byte[] readLengthPrefixedByteArray(ByteBuffer buf) throws IOException {
+        int len = buf.getInt();
+        if (len < 0) {
+            throw new IOException("Negative length");
+        } else if (len > buf.remaining()) {
+            throw new IOException("Underflow while reading length-prefixed value. Length: " + len
+                    + ", available: " + buf.remaining());
+        }
+        byte[] result = new byte[len];
+        buf.get(result);
+        return result;
+    }
+
+    static void setUnsignedInt32LittleEndian(int value, byte[] result, int offset) {
+        result[offset] = (byte) (value & 0xff);
+        result[offset + 1] = (byte) ((value >>> 8) & 0xff);
+        result[offset + 2] = (byte) ((value >>> 16) & 0xff);
+        result[offset + 3] = (byte) ((value >>> 24) & 0xff);
+    }
+
+    private static final long APK_SIG_BLOCK_MAGIC_HI = 0x3234206b636f6c42L;
+    private static final long APK_SIG_BLOCK_MAGIC_LO = 0x20676953204b5041L;
+    private static final int APK_SIG_BLOCK_MIN_SIZE = 32;
+
+    static Pair<ByteBuffer, Long> findApkSigningBlock(
+            RandomAccessFile apk, long centralDirOffset)
+                    throws IOException, SignatureNotFoundException {
+        // FORMAT:
+        // OFFSET       DATA TYPE  DESCRIPTION
+        // * @+0  bytes uint64:    size in bytes (excluding this field)
+        // * @+8  bytes payload
+        // * @-24 bytes uint64:    size in bytes (same as the one above)
+        // * @-16 bytes uint128:   magic
+
+        if (centralDirOffset < APK_SIG_BLOCK_MIN_SIZE) {
+            throw new SignatureNotFoundException(
+                    "APK too small for APK Signing Block. ZIP Central Directory offset: "
+                            + centralDirOffset);
+        }
+        // Read the magic and offset in file from the footer section of the block:
+        // * uint64:   size of block
+        // * 16 bytes: magic
+        ByteBuffer footer = ByteBuffer.allocate(24);
+        footer.order(ByteOrder.LITTLE_ENDIAN);
+        apk.seek(centralDirOffset - footer.capacity());
+        apk.readFully(footer.array(), footer.arrayOffset(), footer.capacity());
+        if ((footer.getLong(8) != APK_SIG_BLOCK_MAGIC_LO)
+                || (footer.getLong(16) != APK_SIG_BLOCK_MAGIC_HI)) {
+            throw new SignatureNotFoundException(
+                    "No APK Signing Block before ZIP Central Directory");
+        }
+        // Read and compare size fields
+        long apkSigBlockSizeInFooter = footer.getLong(0);
+        if ((apkSigBlockSizeInFooter < footer.capacity())
+                || (apkSigBlockSizeInFooter > Integer.MAX_VALUE - 8)) {
+            throw new SignatureNotFoundException(
+                    "APK Signing Block size out of range: " + apkSigBlockSizeInFooter);
+        }
+        int totalSize = (int) (apkSigBlockSizeInFooter + 8);
+        long apkSigBlockOffset = centralDirOffset - totalSize;
+        if (apkSigBlockOffset < 0) {
+            throw new SignatureNotFoundException(
+                    "APK Signing Block offset out of range: " + apkSigBlockOffset);
+        }
+        ByteBuffer apkSigBlock = ByteBuffer.allocate(totalSize);
+        apkSigBlock.order(ByteOrder.LITTLE_ENDIAN);
+        apk.seek(apkSigBlockOffset);
+        apk.readFully(apkSigBlock.array(), apkSigBlock.arrayOffset(), apkSigBlock.capacity());
+        long apkSigBlockSizeInHeader = apkSigBlock.getLong(0);
+        if (apkSigBlockSizeInHeader != apkSigBlockSizeInFooter) {
+            throw new SignatureNotFoundException(
+                    "APK Signing Block sizes in header and footer do not match: "
+                            + apkSigBlockSizeInHeader + " vs " + apkSigBlockSizeInFooter);
+        }
+        return Pair.create(apkSigBlock, apkSigBlockOffset);
+    }
+
+    static ByteBuffer findApkSignatureSchemeBlock(ByteBuffer apkSigningBlock, int blockId)
+            throws SignatureNotFoundException {
+        checkByteOrderLittleEndian(apkSigningBlock);
+        // FORMAT:
+        // OFFSET       DATA TYPE  DESCRIPTION
+        // * @+0  bytes uint64:    size in bytes (excluding this field)
+        // * @+8  bytes pairs
+        // * @-24 bytes uint64:    size in bytes (same as the one above)
+        // * @-16 bytes uint128:   magic
+        ByteBuffer pairs = sliceFromTo(apkSigningBlock, 8, apkSigningBlock.capacity() - 24);
+
+        int entryCount = 0;
+        while (pairs.hasRemaining()) {
+            entryCount++;
+            if (pairs.remaining() < 8) {
+                throw new SignatureNotFoundException(
+                        "Insufficient data to read size of APK Signing Block entry #" + entryCount);
+            }
+            long lenLong = pairs.getLong();
+            if ((lenLong < 4) || (lenLong > Integer.MAX_VALUE)) {
+                throw new SignatureNotFoundException(
+                        "APK Signing Block entry #" + entryCount
+                                + " size out of range: " + lenLong);
+            }
+            int len = (int) lenLong;
+            int nextEntryPos = pairs.position() + len;
+            if (len > pairs.remaining()) {
+                throw new SignatureNotFoundException(
+                        "APK Signing Block entry #" + entryCount + " size out of range: " + len
+                                + ", available: " + pairs.remaining());
+            }
+            int id = pairs.getInt();
+            if (id == blockId) {
+                return getByteBuffer(pairs, len - 4);
+            }
+            pairs.position(nextEntryPos);
+        }
+
+        throw new SignatureNotFoundException(
+                "No block with ID " + blockId + " in APK Signing Block.");
+    }
+
+    private static void checkByteOrderLittleEndian(ByteBuffer buffer) {
+        if (buffer.order() != ByteOrder.LITTLE_ENDIAN) {
+            throw new IllegalArgumentException("ByteBuffer byte order must be little endian");
+        }
+    }
+
+    /**
+     * {@link DataDigester} that updates multiple {@link MessageDigest}s whenever data is fed.
+     */
+    private static class MultipleDigestDataDigester implements DataDigester {
+        private final MessageDigest[] mMds;
+
+        MultipleDigestDataDigester(MessageDigest[] mds) {
+            mMds = mds;
+        }
+
+        @Override
+        public void consume(ByteBuffer buffer) {
+            buffer = buffer.slice();
+            for (MessageDigest md : mMds) {
+                buffer.position(0);
+                md.update(buffer);
+            }
+        }
+
+        @Override
+        public void finish() {}
+    }
+
+}
diff --git a/android/util/apk/SignatureNotFoundException.java b/android/util/apk/SignatureNotFoundException.java
new file mode 100644
index 00000000..9c7c7600
--- /dev/null
+++ b/android/util/apk/SignatureNotFoundException.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.util.apk;
+
+/**
+ * Indicates that the APK is missing a signature.
+ *
+ * @hide
+ */
+public class SignatureNotFoundException extends Exception {
+    private static final long serialVersionUID = 1L;
+
+    public SignatureNotFoundException(String message) {
+        super(message);
+    }
+
+    public SignatureNotFoundException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}
diff --git a/android/util/apk/VerbatimX509Certificate.java b/android/util/apk/VerbatimX509Certificate.java
new file mode 100644
index 00000000..9984c6d2
--- /dev/null
+++ b/android/util/apk/VerbatimX509Certificate.java
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.util.apk;
+
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.X509Certificate;
+
+/**
+ * For legacy reasons we need to return exactly the original encoded certificate bytes, instead
+ * of letting the underlying implementation have a shot at re-encoding the data.
+ */
+class VerbatimX509Certificate extends WrappedX509Certificate {
+    private final byte[] mEncodedVerbatim;
+
+    VerbatimX509Certificate(X509Certificate wrapped, byte[] encodedVerbatim) {
+        super(wrapped);
+        this.mEncodedVerbatim = encodedVerbatim;
+    }
+
+    @Override
+    public byte[] getEncoded() throws CertificateEncodingException {
+        return mEncodedVerbatim;
+    }
+}
diff --git a/android/util/apk/WrappedX509Certificate.java b/android/util/apk/WrappedX509Certificate.java
new file mode 100644
index 00000000..fdaa4202
--- /dev/null
+++ b/android/util/apk/WrappedX509Certificate.java
@@ -0,0 +1,175 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.util.apk;
+
+import java.math.BigInteger;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.Principal;
+import java.security.PublicKey;
+import java.security.SignatureException;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateExpiredException;
+import java.security.cert.CertificateNotYetValidException;
+import java.security.cert.X509Certificate;
+import java.util.Date;
+import java.util.Set;
+
+class WrappedX509Certificate extends X509Certificate {
+    private final X509Certificate mWrapped;
+
+    WrappedX509Certificate(X509Certificate wrapped) {
+        this.mWrapped = wrapped;
+    }
+
+    @Override
+    public Set<String> getCriticalExtensionOIDs() {
+        return mWrapped.getCriticalExtensionOIDs();
+    }
+
+    @Override
+    public byte[] getExtensionValue(String oid) {
+        return mWrapped.getExtensionValue(oid);
+    }
+
+    @Override
+    public Set<String> getNonCriticalExtensionOIDs() {
+        return mWrapped.getNonCriticalExtensionOIDs();
+    }
+
+    @Override
+    public boolean hasUnsupportedCriticalExtension() {
+        return mWrapped.hasUnsupportedCriticalExtension();
+    }
+
+    @Override
+    public void checkValidity()
+            throws CertificateExpiredException, CertificateNotYetValidException {
+        mWrapped.checkValidity();
+    }
+
+    @Override
+    public void checkValidity(Date date)
+            throws CertificateExpiredException, CertificateNotYetValidException {
+        mWrapped.checkValidity(date);
+    }
+
+    @Override
+    public int getVersion() {
+        return mWrapped.getVersion();
+    }
+
+    @Override
+    public BigInteger getSerialNumber() {
+        return mWrapped.getSerialNumber();
+    }
+
+    @Override
+    public Principal getIssuerDN() {
+        return mWrapped.getIssuerDN();
+    }
+
+    @Override
+    public Principal getSubjectDN() {
+        return mWrapped.getSubjectDN();
+    }
+
+    @Override
+    public Date getNotBefore() {
+        return mWrapped.getNotBefore();
+    }
+
+    @Override
+    public Date getNotAfter() {
+        return mWrapped.getNotAfter();
+    }
+
+    @Override
+    public byte[] getTBSCertificate() throws CertificateEncodingException {
+        return mWrapped.getTBSCertificate();
+    }
+
+    @Override
+    public byte[] getSignature() {
+        return mWrapped.getSignature();
+    }
+
+    @Override
+    public String getSigAlgName() {
+        return mWrapped.getSigAlgName();
+    }
+
+    @Override
+    public String getSigAlgOID() {
+        return mWrapped.getSigAlgOID();
+    }
+
+    @Override
+    public byte[] getSigAlgParams() {
+        return mWrapped.getSigAlgParams();
+    }
+
+    @Override
+    public boolean[] getIssuerUniqueID() {
+        return mWrapped.getIssuerUniqueID();
+    }
+
+    @Override
+    public boolean[] getSubjectUniqueID() {
+        return mWrapped.getSubjectUniqueID();
+    }
+
+    @Override
+    public boolean[] getKeyUsage() {
+        return mWrapped.getKeyUsage();
+    }
+
+    @Override
+    public int getBasicConstraints() {
+        return mWrapped.getBasicConstraints();
+    }
+
+    @Override
+    public byte[] getEncoded() throws CertificateEncodingException {
+        return mWrapped.getEncoded();
+    }
+
+    @Override
+    public void verify(PublicKey key) throws CertificateException, NoSuchAlgorithmException,
+            InvalidKeyException, NoSuchProviderException, SignatureException {
+        mWrapped.verify(key);
+    }
+
+    @Override
+    public void verify(PublicKey key, String sigProvider)
+            throws CertificateException, NoSuchAlgorithmException, InvalidKeyException,
+            NoSuchProviderException, SignatureException {
+        mWrapped.verify(key, sigProvider);
+    }
+
+    @Override
+    public String toString() {
+        return mWrapped.toString();
+    }
+
+    @Override
+    public PublicKey getPublicKey() {
+        return mWrapped.getPublicKey();
+    }
+}
diff --git a/android/util/jar/StrictJarVerifier.java b/android/util/jar/StrictJarVerifier.java
index debc170f..45254908 100644
--- a/android/util/jar/StrictJarVerifier.java
+++ b/android/util/jar/StrictJarVerifier.java
@@ -18,6 +18,8 @@
 package android.util.jar;
 
 import android.util.apk.ApkSignatureSchemeV2Verifier;
+import android.util.apk.ApkSignatureSchemeV3Verifier;
+
 import java.io.IOException;
 import java.io.OutputStream;
 import java.nio.charset.StandardCharsets;
@@ -36,6 +38,7 @@ import java.util.Map;
 import java.util.StringTokenizer;
 import java.util.jar.Attributes;
 import java.util.jar.JarFile;
+
 import sun.security.jca.Providers;
 import sun.security.pkcs.PKCS7;
 import sun.security.pkcs.SignerInfo;
@@ -56,6 +59,15 @@ import sun.security.pkcs.SignerInfo;
  */
 class StrictJarVerifier {
     /**
+     * {@code .SF} file header section attribute indicating that the APK is signed not just with
+     * JAR signature scheme but also with APK Signature Scheme v2 or newer. This attribute
+     * facilitates v2 signature stripping detection.
+     *
+     * <p>The attribute contains a comma-separated set of signature scheme IDs.
+     */
+    private static final String SF_ATTRIBUTE_ANDROID_APK_SIGNED_NAME = "X-Android-APK-Signed";
+
+    /**
      * List of accepted digest algorithms. This list is in order from most
      * preferred to least preferred.
      */
@@ -373,17 +385,17 @@ class StrictJarVerifier {
             return;
         }
 
-        // If requested, check whether APK Signature Scheme v2 signature was stripped.
+        // If requested, check whether a newer APK Signature Scheme signature was stripped.
         if (signatureSchemeRollbackProtectionsEnforced) {
             String apkSignatureSchemeIdList =
-                    attributes.getValue(
-                            ApkSignatureSchemeV2Verifier.SF_ATTRIBUTE_ANDROID_APK_SIGNED_NAME);
+                    attributes.getValue(SF_ATTRIBUTE_ANDROID_APK_SIGNED_NAME);
             if (apkSignatureSchemeIdList != null) {
                 // This field contains a comma-separated list of APK signature scheme IDs which
                 // were used to sign this APK. If an ID is known to us, it means signatures of that
                 // scheme were stripped from the APK because otherwise we wouldn't have fallen back
                 // to verifying the APK using the JAR signature scheme.
                 boolean v2SignatureGenerated = false;
+                boolean v3SignatureGenerated = false;
                 StringTokenizer tokenizer = new StringTokenizer(apkSignatureSchemeIdList, ",");
                 while (tokenizer.hasMoreTokens()) {
                     String idText = tokenizer.nextToken().trim();
@@ -402,6 +414,12 @@ class StrictJarVerifier {
                         v2SignatureGenerated = true;
                         break;
                     }
+                    if (id == ApkSignatureSchemeV3Verifier.SF_ATTRIBUTE_ANDROID_APK_SIGNED_ID) {
+                        // This APK was supposed to be signed with APK Signature Scheme v3 but no
+                        // such signature was found.
+                        v3SignatureGenerated = true;
+                        break;
+                    }
                 }
 
                 if (v2SignatureGenerated) {
@@ -409,6 +427,11 @@ class StrictJarVerifier {
                             + " is signed using APK Signature Scheme v2, but no such signature was"
                             + " found. Signature stripped?");
                 }
+                if (v3SignatureGenerated) {
+                    throw new SecurityException(signatureFile + " indicates " + jarName
+                            + " is signed using APK Signature Scheme v3, but no such signature was"
+                            + " found. Signature stripped?");
+                }
             }
         }