From f826312fc48b8b07747a09061a33d049413c1f29 Mon Sep 17 00:00:00 2001
From: Enginex0 <enginex0@users.noreply.github.com>
Date: Thu, 4 Jun 2026 13:58:43 +0100
Subject: [PATCH] fix(pki): log keybox serial on every fetch

The serial log added previously lived in parseKeysFromXml, which
getAttestationKey runs only on a cache miss -- so it emitted at most
once per boot and scrolled off the buffer before it could be read.
Move it into getAttestationKey so the keybox attestation cert serials
are logged on every fetch, on the live native cert-gen path.

Verified on device: "Using RSA keybox keybox.xml; attestation cert
serials (hex): ..." now prints on each forge.
---
 .../matrix/TEESimulator/pki/KeyBoxManager.kt  | 28 ++++++++++---------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/app/src/main/java/org/matrix/TEESimulator/pki/KeyBoxManager.kt b/app/src/main/java/org/matrix/TEESimulator/pki/KeyBoxManager.kt
index 8ea3e48..079befd 100644
--- a/app/src/main/java/org/matrix/TEESimulator/pki/KeyBoxManager.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/pki/KeyBoxManager.kt
@@ -54,10 +54,21 @@ object KeyBoxManager {
         // If it's not in the cache, the `getOrPut` block is executed to parse and store it.
         val keyMap =
             keyStoreCache.getOrPut(keyStoreFileName) { parseKeyStoreFile(keyStoreFileName) }
-        SystemLogger.verbose(
-            "Fetching attestation key in $keyStoreFileName with $algorithm algorithm."
-        )
-        return keyMap[algorithm]
+        val keyBox = keyMap[algorithm]
+        if (keyBox != null) {
+            // Surface attestation cert serials on every fetch so a revoked/leaked keybox is
+            // obvious from logcat alone -- Google's CRL and Duck's "mass abuse" check both match
+            // by certificate serial (lowercase hex). Logged here rather than at parse time because
+            // the parse is cached and would emit at most once per boot.
+            val serials =
+                keyBox.certificates.joinToString(", ") { cert ->
+                    (cert as? X509Certificate)?.serialNumber?.toString(16) ?: "?"
+                }
+            SystemLogger.info(
+                "Using $algorithm keybox $keyStoreFileName; attestation cert serials (hex): $serials"
+            )
+        }
+        return keyBox
     }
 
     /**
@@ -233,15 +244,6 @@ object KeyBoxManager {
             eventType = parser.next()
         }
         SystemLogger.info("Finished parsing, found ${foundKeys.size} valid keys.")
-        // Surface attestation cert serials so a revoked/leaked keybox is obvious from
-        // logcat alone -- Google's CRL and Duck's "mass abuse" check both match by serial.
-        foundKeys.forEach { (alg, keyBox) ->
-            val serials =
-                keyBox.certificates.joinToString(", ") { cert ->
-                    (cert as? X509Certificate)?.serialNumber?.toString(16) ?: "?"
-                }
-            SystemLogger.info("$alg keybox attestation cert serials (hex): $serials")
-        }
         return foundKeys
     }
 }