mirrors/fdroidserver
1
0
Fork 0
mirror of https://github.com/f-droid/fdroidserver.git synced 2025-09-14 15:02:51 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

lint: blocklist known AOSP debug keys in AASK

Browse source
This commit is contained in:
linsui 2024-05-03 20:00:14 +08:00 • committed by Hans-Christoph Steiner
parent 08c553e1cb
commit d243cbd030
2 changed files with 26 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
fdroidserver/lint.py
View file

@ -722,7 +722,13 @@ def check_updates_ucm_http_aum_pattern(app): # noqa: D403
def check_certificate_pinned_binaries(app): def check_certificate_pinned_binaries(app):
if len(app.get('AllowedAPKSigningKeys')) > 0: keys = app.get('AllowedAPKSigningKeys')
known_keys = common.config.get('apk_signing_key_block_list', [])
if keys:
if known_keys:
for key in keys:
if key in known_keys:
yield _('Known debug key is used in AllowedAPKSigningKeys: ') + key
return return
if app.get('Binaries') is not None: if app.get('Binaries') is not None:
yield _( yield _(

19
tests/lint.TestCase
View file

@ -438,6 +438,25 @@ class LintTest(unittest.TestCase):
with self.assertRaises(TypeError): with self.assertRaises(TypeError):
fdroidserver.lint.lint_config('mirrors.yml') fdroidserver.lint.lint_config('mirrors.yml')
def test_lint_known_debug_keys(self):
config = dict()
fdroidserver.common.fill_config_defaults(config)
config['apk_signing_key_block_list'] = [
'a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc'
]
fdroidserver.common.config = config
fdroidserver.lint.config = config
app = fdroidserver.metadata.App()
app.AllowedAPKSigningKeys = [
'a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc'
]
for warn in fdroidserver.lint.check_certificate_pinned_binaries(app):
anywarns = True
logging.debug(warn)
self.assertTrue(anywarns)
class LintAntiFeaturesTest(unittest.TestCase): class LintAntiFeaturesTest(unittest.TestCase):
def setUp(self): def setUp(self):