Upgrade to Android 10 APIs when available (#5821)

* Upgrade robolectric dependency

* cleanup

* Suppress animal sniffer checks on known classes

* Update build.gradle

* Update build.gradle

build.gradle

@@ -25,7 +25,7 @@ buildscript {
 
   ext.deps = [
       'picocli': "info.picocli:picocli:${versions.picocli}",
-      'android': "org.robolectric:android-all:9-robolectric-4913185-2",
+      'android': "org.robolectric:android-all:10-robolectric-5803371",
       'animalSniffer': "org.codehaus.mojo:animal-sniffer-annotations:${versions.animalSniffer}",
       'assertj': "org.assertj:assertj-core:${versions.assertj}",
       'bouncycastle': "org.bouncycastle:bcprov-jdk15on:${versions.bouncycastle}",
@@ -141,8 +141,11 @@ subprojects { project ->
     }
   }
 
-  // Animal Sniffer confirms we don't use APIs not on both Java 8 and Android 5.
+  // Animal Sniffer confirms we generally don't use APIs not on Java 8.
   animalsniffer {
+    // https://github.com/mojohaus/animal-sniffer/issues/70
+    excludeJars "android-all-*"
+    annotation "okhttp3.internal.SuppressSignatureCheck"
     sourceSets = [sourceSets.main]
   }
   dependencies {

okhttp-testing-support/src/main/java/okhttp3/CallEvent.kt

@@ -19,8 +19,10 @@ import java.io.IOException
 import java.net.InetAddress
 import java.net.InetSocketAddress
 import java.net.Proxy
+import okhttp3.internal.SuppressSignatureCheck
 
 /** Data classes that correspond to each of the methods of [EventListener]. */
+@SuppressSignatureCheck
 sealed class CallEvent {
   abstract val timestampNs: Long
   abstract val call: Call

okhttp/build.gradle

@@ -51,10 +51,6 @@ afterEvaluate { project ->
   }
 }
 
-animalsniffer {
-  ignore 'javax.net.ssl.SSLParameters', 'javax.net.ssl.SSLSocket'
-}
-
 task japicmp(type: me.champeau.gradle.japicmp.JapicmpTask, dependsOn: 'jar') {
   oldClasspath = files(baselineJar(project, baselineVersion))
   newClasspath = files(jar.archivePath)

okhttp/src/main/java/okhttp3/internal/SuppressSignatureCheck.kt

@@ -0,0 +1,12 @@
+package okhttp3.internal
+
+import java.lang.annotation.Documented
+import kotlin.annotation.AnnotationRetention.BINARY
+import kotlin.annotation.AnnotationTarget.CLASS
+import kotlin.annotation.AnnotationTarget.CONSTRUCTOR
+import kotlin.annotation.AnnotationTarget.FUNCTION
+
+@Retention(BINARY)
+@Documented
+@Target(CONSTRUCTOR, CLASS, FUNCTION)
+annotation class SuppressSignatureCheck

okhttp/src/main/java/okhttp3/internal/platform/Android10Platform.kt

@@ -15,13 +15,14 @@
  */
 package okhttp3.internal.platform
 
-import android.annotation.TargetApi
+import android.annotation.SuppressLint
 import android.os.Build
 import android.security.NetworkSecurityPolicy
 import javax.net.ssl.SSLSocket
 import javax.net.ssl.SSLSocketFactory
 import javax.net.ssl.X509TrustManager
 import okhttp3.Protocol
+import okhttp3.internal.SuppressSignatureCheck
 import okhttp3.internal.platform.AndroidPlatform.Companion.isAndroid
 import okhttp3.internal.platform.android.Android10CertificateChainCleaner
 import okhttp3.internal.platform.android.Android10SocketAdapter
@@ -31,6 +32,7 @@ import okhttp3.internal.platform.android.androidLog
 import okhttp3.internal.tls.CertificateChainCleaner
 
 /** Android 29+. */
+@SuppressSignatureCheck
 class Android10Platform : Platform() {
   private val socketAdapters = listOfNotNull(
       Android10SocketAdapter.buildIfSupported(),
@@ -56,7 +58,7 @@ class Android10Platform : Platform() {
     androidLog(level, message, t)
   }
 
-  @TargetApi(Build.VERSION_CODES.N)
+  @SuppressLint("NewApi")
   override fun isCleartextTrafficPermitted(hostname: String): Boolean =
       NetworkSecurityPolicy.getInstance().isCleartextTrafficPermitted(hostname)
 

okhttp/src/main/java/okhttp3/internal/platform/AndroidPlatform.kt

@@ -27,6 +27,7 @@ import javax.net.ssl.SSLSocket
 import javax.net.ssl.SSLSocketFactory
 import javax.net.ssl.X509TrustManager
 import okhttp3.Protocol
+import okhttp3.internal.SuppressSignatureCheck
 import okhttp3.internal.platform.android.AndroidCertificateChainCleaner
 import okhttp3.internal.platform.android.CloseGuard
 import okhttp3.internal.platform.android.ConscryptSocketAdapter
@@ -38,6 +39,7 @@ import okhttp3.internal.tls.CertificateChainCleaner
 import okhttp3.internal.tls.TrustRootIndex
 
 /** Android 5+. */
+@SuppressSignatureCheck
 class AndroidPlatform : Platform() {
   private val socketAdapters = listOfNotNull(
       StandardAndroidSocketAdapter.buildIfSupported(),

okhttp/src/main/java/okhttp3/internal/platform/Jdk9Platform.kt

@@ -19,9 +19,11 @@ import javax.net.ssl.SSLSocket
 import javax.net.ssl.SSLSocketFactory
 import javax.net.ssl.X509TrustManager
 import okhttp3.Protocol
+import okhttp3.internal.SuppressSignatureCheck
 
 /** OpenJDK 9+. */
 open class Jdk9Platform : Platform() {
+  @SuppressSignatureCheck
   override fun configureTlsExtensions(
     sslSocket: SSLSocket,
     hostname: String?,
@@ -36,6 +38,7 @@ open class Jdk9Platform : Platform() {
     sslSocket.sslParameters = sslParameters
   }
 
+  @SuppressSignatureCheck
   override fun getSelectedProtocol(sslSocket: SSLSocket): String? {
     // SSLSocket.getApplicationProtocol returns "" if application protocols values will not
     // be used. Observed if you didn't specify SSLParameters.setApplicationProtocols

okhttp/src/main/java/okhttp3/internal/platform/android/Android10CertificateChainCleaner.kt

@@ -22,6 +22,7 @@ import java.security.cert.CertificateException
 import java.security.cert.X509Certificate
 import javax.net.ssl.SSLPeerUnverifiedException
 import javax.net.ssl.X509TrustManager
+import okhttp3.internal.SuppressSignatureCheck
 import okhttp3.internal.tls.CertificateChainCleaner
 
 /**
@@ -37,6 +38,7 @@ internal class Android10CertificateChainCleaner(
 ) : CertificateChainCleaner() {
   @Suppress("UNCHECKED_CAST")
   @Throws(SSLPeerUnverifiedException::class)
+  @SuppressSignatureCheck
   override
   fun clean(chain: List<Certificate>, hostname: String): List<Certificate> {
     val certificates = (chain as List<X509Certificate>).toTypedArray()
@@ -54,6 +56,7 @@ internal class Android10CertificateChainCleaner(
   override fun hashCode(): Int = System.identityHashCode(trustManager)
 
   companion object {
+    @SuppressSignatureCheck
     fun buildIfSupported(trustManager: X509TrustManager): Android10CertificateChainCleaner? {
       val extensions = try {
         X509TrustManagerExtensions(trustManager)

okhttp/src/main/java/okhttp3/internal/platform/android/Android10SocketAdapter.kt

@@ -16,7 +16,7 @@
 package okhttp3.internal.platform.android
 
 import android.annotation.SuppressLint
-import android.net.SSLCertificateSocketFactory
+import android.net.ssl.SSLSockets
 import android.os.Build
 import java.io.IOException
 import java.lang.IllegalArgumentException
@@ -24,22 +24,21 @@ import javax.net.ssl.SSLSocket
 import javax.net.ssl.SSLSocketFactory
 import javax.net.ssl.X509TrustManager
 import okhttp3.Protocol
+import okhttp3.internal.SuppressSignatureCheck
 import okhttp3.internal.platform.AndroidPlatform.Companion.isAndroid
 import okhttp3.internal.platform.Platform
 
 /**
  * Simple non-reflection SocketAdapter for Android Q.
  */
+@SuppressLint("NewApi")
+@SuppressSignatureCheck
 class Android10SocketAdapter : SocketAdapter {
-  private val socketFactory =
-      SSLCertificateSocketFactory.getDefault(10000) as SSLCertificateSocketFactory
-
   override fun trustManager(sslSocketFactory: SSLSocketFactory): X509TrustManager? = null
 
   override fun matchesSocketFactory(sslSocketFactory: SSLSocketFactory): Boolean = false
 
-  override fun matchesSocket(sslSocket: SSLSocket): Boolean = sslSocket.javaClass.name.startsWith(
+  override fun matchesSocket(sslSocket: SSLSocket): Boolean = SSLSockets.isSupportedSocket(sslSocket)
-      "com.android.org.conscrypt")
 
   override fun isSupported(): Boolean = Companion.isSupported()
 
@@ -57,7 +56,7 @@ class Android10SocketAdapter : SocketAdapter {
     protocols: List<Protocol>
   ) {
     try {
-      socketFactory.setUseSessionTickets(sslSocket, true)
+      SSLSockets.setUseSessionTickets(sslSocket, true)
 
       val sslParameters = sslSocket.sslParameters
 
@@ -71,6 +70,7 @@ class Android10SocketAdapter : SocketAdapter {
     }
   }
 
+  @SuppressSignatureCheck
   companion object {
     fun buildIfSupported(): SocketAdapter? =
         if (isSupported()) Android10SocketAdapter() else null

okhttp/src/main/java/okhttp3/internal/platform/android/AndroidCertificateChainCleaner.kt

@@ -21,6 +21,7 @@ import java.security.cert.Certificate
 import java.security.cert.X509Certificate
 import javax.net.ssl.SSLPeerUnverifiedException
 import javax.net.ssl.X509TrustManager
+import okhttp3.internal.SuppressSignatureCheck
 import okhttp3.internal.tls.CertificateChainCleaner
 
 /**
@@ -38,6 +39,7 @@ internal class AndroidCertificateChainCleaner(
 
   @Suppress("UNCHECKED_CAST") // Reflection on List<Certificate>
   @Throws(SSLPeerUnverifiedException::class)
+  @SuppressSignatureCheck
   override
   fun clean(chain: List<Certificate>, hostname: String): List<Certificate> = try {
     val certificates = (chain as List<X509Certificate>).toTypedArray()

okhttp/src/main/java/okhttp3/internal/platform/android/util.kt

@@ -16,10 +16,12 @@
 package okhttp3.internal.platform.android
 
 import android.util.Log
+import okhttp3.internal.SuppressSignatureCheck
 import okhttp3.internal.platform.Platform
 
 private const val MAX_LOG_LENGTH = 4000
 
+@SuppressSignatureCheck
 internal fun androidLog(level: Int, message: String, t: Throwable?) {
   var logMessage = message
   val logLevel = when (level) {