From c9918952f4bb2363a4bb224b23ff4aec488ebe05 Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Sat, 11 Jul 2026 16:39:05 +0100 Subject: [PATCH] fix(keystore): resolve grant-domain attest key --- .../keystore/shim/KeyMintSecurityLevelInterceptor.kt | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt index 19e0933..db8f071 100644 --- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt +++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt @@ -892,7 +892,16 @@ class KeyMintSecurityLevelInterceptor( // signed by the attest key the caller chains to via getCertChain, never silently re-rooted // under the keybox (which double-roots the assembled chain and fails verification). val attestKeyAlias: String? = - attestationKey?.let { it.alias ?: findGeneratedAliasByKeyId(callingUid, it.nspace) } + attestationKey?.let { + if (it.domain == Domain.GRANT) + resolveGrant(it.nspace, callingUid)?.ownerKeyId?.alias + else it.alias ?: findGeneratedAliasByKeyId(callingUid, it.nspace) + } + if (attestationKey != null && attestationKey.domain == Domain.GRANT) { + SystemLogger.uidLog(callingUid, txId, "attest-grant") { + "grantId=${attestationKey.nspace} → signer=$attestKeyAlias" + } + } if (attestationKey != null && attestKeyAlias == null) { throw android.os.ServiceSpecificException( KEYMINT_INVALID_ARGUMENT,