diff --git a/scripts/update-minimum-device.ps1 b/scripts/update-minimum-device.ps1 index 8a4f4e1c..f48eac10 100644 --- a/scripts/update-minimum-device.ps1 +++ b/scripts/update-minimum-device.ps1 @@ -358,8 +358,12 @@ function Find-ApkSignerInSdkRoots { function Parse-ApkSignerOutput { param([string]$Text) - $digests = @([regex]::Matches($Text, - '(?im)^Signer #\d+ certificate SHA-256 digest:\s*([0-9a-f]{64})\s*$') | + # PowerShell 7 wraps some extensionless native-command output as ErrorRecord text on Linux, + # which can prefix the original line. Strip terminal control sequences and locate the exact + # apksigner label without requiring it to begin the rendered PowerShell line. + $normalized = [regex]::Replace($Text, '\x1B\[[0-?]*[ -/]*[@-~]', '') + $digests = @([regex]::Matches($normalized, + '(?i)Signer #\d+ certificate SHA-256 digest:\s*([0-9a-f]{64})(?![0-9a-f])') | ForEach-Object { $_.Groups[1].Value.ToUpperInvariant() }) if ($digests.Count -eq 0) { Throw-UpdateError "APK_SIGNATURE_INVALID" "apksigner did not report a verified signing certificate." diff --git a/tests/update-minimum-device.Tests.ps1 b/tests/update-minimum-device.Tests.ps1 index acf697da..f2f1d91d 100644 --- a/tests/update-minimum-device.Tests.ps1 +++ b/tests/update-minimum-device.Tests.ps1 @@ -111,6 +111,9 @@ Test-Case "returning target switches to its correlated ADB port" { Test-Case "apksigner output parser requires verified signer digest" { $digest = "168F42ED412DA80ADAF27BED0984DBEE191168E9DF04F08AFA240A3F9DE45972" Assert-Equal $digest (Parse-ApkSignerOutput "Signer #1 certificate SHA-256 digest: $digest") "apksigner digest" + $escape = [char]27 + $linuxWrapped = "NativeCommandError: ${escape}[36mSigner #1 certificate SHA-256 digest: $($digest.ToLowerInvariant())${escape}[0m" + Assert-Equal $digest (Parse-ApkSignerOutput $linuxWrapped) "PowerShell Linux wrapped digest" Assert-ThrowsCode { Parse-ApkSignerOutput "DOES NOT VERIFY" } "APK_SIGNATURE_INVALID" "missing signer digest" }