microg/GmsCore · error · StandardIntegrityException

DroidGuard token is empty.

Error message

DroidGuard token is empty.

What it means

ExpressIntegrityService.warmUpIntegrityToken throws with this message when the DroidGuard verification step returns an empty token, meaning device integrity attestation could not produce a usable credential for the express integrity session.

Source

Thrown at vending-app/src/main/kotlin/com/google/android/finsky/expressintegrityservice/ExpressIntegrityService.kt:162

                Log.d(TAG, "warmUpIntegrityToken authToken: $authToken")

                val expressFilePB = updateExpressAuthTokenWrapper(context, expressIntegritySession, authToken, clientKey)

                val tokenWrapper = expressFilePB.tokenWrapper ?: AuthTokenWrapper()
                val tokenClientKey = tokenWrapper.clientKey ?: ClientKey()
                val deviceIntegrityWrapper = tokenWrapper.deviceIntegrityWrapper ?: DeviceIntegrityWrapper()
                val creationTime = tokenWrapper.deviceIntegrityWrapper?.creationTime ?: Timestamp()
                val lastManualSoftRefreshTime = tokenWrapper.lastManualSoftRefreshTime ?: Timestamp()

                val deviceIntegrityAndExpiredKey = DeviceIntegrityAndExpiredKey(
                    deviceIntegrity = DeviceIntegrity(
                        tokenClientKey, deviceIntegrityWrapper.deviceIntegrityToken, creationTime, lastManualSoftRefreshTime
                    ), expressFilePB.expiredDeviceKey ?: ClientKey()
                )

                val deviceIntegrity = deviceIntegrityAndExpiredKey.deviceIntegrity
                if (deviceIntegrity.deviceIntegrityToken?.size == 0 || deviceIntegrity.clientKey?.keySetHandle?.size == 0) {
                    throw StandardIntegrityException("DroidGuard token is empty.")
                }

                val deviceKeyMd5 = Base64.encodeToString(
                    deviceIntegrity.clientKey?.keySetHandle?.md5()?.toByteArray(), Base64.NO_PADDING or Base64.NO_WRAP or Base64.URL_SAFE
                )
                if (deviceKeyMd5.isNullOrEmpty()) {
                    throw StandardIntegrityException("Null deviceKeyMd5.")
                }

                val deviceIntegrityResponse = DeviceIntegrityResponse(
                    deviceIntegrity, false, deviceKeyMd5, deviceIntegrityAndExpiredKey.expiredDeviceKey
                )

                val packageInfo = context.packageManager.getPackageInfoCompat(
                    expressIntegritySession.packageName, PackageManager.GET_SIGNING_CERTIFICATES or PackageManager.GET_SIGNATURES
                )
                val certificateSha256Hashes = packageInfo.signaturesCompat.map {
                    it.toByteArray().sha256().encodeBase64(noPadding = true, noWrap = true, urlSafe = true)

View on GitHub (pinned to 157c9d86ac)

Solutions

1. Retry warm-up so a fresh DroidGuard token is generated
2. Verify the DroidGuard flow executed successfully before requesting the integrity token

When it happens

Trigger: Thrown at vending-app/src/main/kotlin/com/google/android/finsky/expressintegrityservice/ExpressIntegrityService.kt:162 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of microg/GmsCore@157c9d86ac (2026-09-06). Data as JSON: /api/errors/bb4edf4cc877b7da. Report an issue: GitHub.