mirrors/fdroidserver
1
0
Fork 0
mirror of https://github.com/f-droid/fdroidserver.git synced 2025-09-15 15:32:30 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch '697-verify-reproducible-apks-with-jarsigner' into 'master'

Browse source 
Use jarsigner to verify reproducible APKs

Closes #697

See merge request fdroid/fdroidserver!804
This commit is contained in:
Marcus 2020-09-29 12:18:57 +00:00
commit b5ce285f9f
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
fdroidserver/common.py
View file

@ -3178,7 +3178,14 @@ def verify_apks(signed_apk, unsigned_apk, tmp_dir):
return "duplicate filename found: " + info.filename return "duplicate filename found: " + info.filename
tmp.writestr(info, unsigned.read(info.filename)) tmp.writestr(info, unsigned.read(info.filename))
verified = verify_apk_signature(tmp_apk) # Use jarsigner to verify the v1 signature on the reproduced APK, as
# apksigner will reject the reproduced APK if the original also had a v2
# signature
try:
verify_jar_signature(tmp_apk)
verified = True
except Exception:
verified = False
if not verified: if not verified:
logging.info("...NOT verified - {0}".format(tmp_apk)) logging.info("...NOT verified - {0}".format(tmp_apk))