Exercise authenticated Android credentials in coverage

.github/scripts/keyring-tester-coverage.sh

@@ -2,20 +2,15 @@
 # Runs keyring-tester on a coverage build and copies out keyring.profraw.
 set -euo pipefail
 
-.github/scripts/keyring-tester.sh
+source .github/scripts/keyring-tester.sh
 
-line=""
-for _ in $(seq 1 24); do
-  line=$(adb logcat -d -s unit-test | grep -E "Coverage profile written with status -?[0-9]+" | tail -1 || true)
-  [ -n "$line" ] && break
-  sleep 5
-done
+line=$(printf '%s\n' "$logs" | grep -E 'Coverage profile written with status -?[0-9]+' | tail -1 || true)
 if [ -z "$line" ]; then
-  echo "keyring-tester never reported writing its coverage profile" >&2
+  echo "the runner logs are missing the coverage profile line" >&2
   exit 1
 fi
 echo "$line"
 [[ "$line" =~ status\ 0$ ]]
 
-adb exec-out run-as com.brotsky.android.testing.keyring cat files/keyring.profraw > keyring.profraw
+device exec-out run-as "$package" cat files/keyring.profraw > keyring.profraw
 [ -s keyring.profraw ]

.github/scripts/keyring-tester-secure-lock.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# Collects coverage with a temporary test PIN on a disposable emulator.
+set -euo pipefail
+
+pin="4321"
+owned=0
+stayon=0
+
+device() { timeout 30 adb "$@"; }
+
+cleanup() {
+  local status=$?
+  local failed=0
+  if [ "$owned" = 1 ]; then
+    if ! device shell locksettings clear --old "$pin" > /dev/null; then
+      echo "failed to clear the test PIN from the emulator" >&2
+      failed=1
+    elif device shell locksettings verify --old "$pin" > /dev/null 2>&1; then
+      echo "the test PIN is still accepted after cleanup" >&2
+      failed=1
+    fi
+  fi
+  if [ "$stayon" = 1 ]; then
+    device shell svc power stayon false > /dev/null || true
+  fi
+  if [ "$failed" = 1 ]; then
+    if [ "$status" -eq 0 ]; then
+      exit 1
+    fi
+    echo "the PIN cleanup failed in addition to the test failure" >&2
+  fi
+  exit "$status"
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+qemu=$(device shell getprop ro.kernel.qemu)
+if [ "$qemu" != "1" ]; then
+  echo "refusing to change credentials on a non-emulator device (ro.kernel.qemu=${qemu:-unset})" >&2
+  exit 1
+fi
+
+# Without `--old`, `set-pin` refuses an existing lock credential.
+device shell locksettings set-pin "$pin"
+owned=1
+device shell locksettings verify --old "$pin"
+
+# Authenticate after configuring the credential and before starting the service.
+device shell input keyevent 26
+sleep 1
+device shell input keyevent 26
+sleep 1
+device shell input text "$pin"
+device shell input keyevent 66
+device shell wm dismiss-keyguard
+device shell svc power stayon true
+stayon=1
+
+source .github/scripts/keyring-tester-coverage.sh

.github/workflows/coverage.yml

@@ -44,7 +44,7 @@ jobs:
           CARGO_TARGET_X86_64_LINUX_ANDROID_RUSTFLAGS: -C instrument-coverage --cfg keyring_coverage
         run: |
           export CARGO_TARGET_X86_64_LINUX_ANDROID_LINKER="$ANDROID_HOME/ndk/28.2.13676358/toolchains/llvm/prebuilt/linux-x86_64/bin/x86_64-linux-android21-clang"
-          cargo build --target x86_64-linux-android --features compile-tests,android-log
+          cargo build --target x86_64-linux-android --features compile-tests,android-log,user-auth-tests
           mkdir -p keyring-tester/app/src/main/jniLibs/x86_64
           cp target/x86_64-linux-android/debug/libandroid_native_keyring_store.so keyring-tester/app/src/main/jniLibs/x86_64/
       - name: Build keyring-tester
@@ -55,7 +55,7 @@ jobs:
           api-level: 35
           arch: x86_64
           profile: pixel_6
-          script: .github/scripts/keyring-tester-coverage.sh
+          script: .github/scripts/keyring-tester-secure-lock.sh
       - name: Write the coverage report
         run: |
           bin="$(rustc --print sysroot)/lib/rustlib/x86_64-unknown-linux-gnu/bin"