From 3bc246ccad3169fc3662be9a206953de864bb21d Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Wed, 3 Jun 2020 14:34:21 +0200
Subject: [PATCH 1/9] scanner: ignore well known image types that are set
 executable

---
 fdroidserver/scanner.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fdroidserver/scanner.py b/fdroidserver/scanner.py
index 6560c4da..3ef9e06e 100644
--- a/fdroidserver/scanner.py
+++ b/fdroidserver/scanner.py
@@ -16,6 +16,7 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import imghdr
 import json
 import os
 import re
@@ -196,6 +197,8 @@ def scan_source(build_dir, build=metadata.Build()):
         for sp in safe_paths:
             if sp.match(path):
                 return True
+        if imghdr.what(path) is not None:
+            return True
         return False
 
     gradle_compile_commands = get_gradle_compile_commands(build)
@@ -277,7 +280,7 @@ def scan_source(build_dir, build=metadata.Build()):
 
             elif is_executable(filepath):
                 if is_binary(filepath) and not safe_path(path_in_build_dir):
-                    warnproblem('possible binary', path_in_build_dir)
+                    warnproblem('executable binary, possibly code', path_in_build_dir)
 
     for p in scanignore:
         if p not in scanignore_worked:

From d898ad04120ee466392682ea482dcc7a856d5645 Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Wed, 3 Jun 2020 15:12:04 +0200
Subject: [PATCH 2/9] scanner: make AARs and JARs trigger an error

refs #491
---
 fdroidserver/scanner.py | 7 +++----
 tests/build.TestCase    | 5 +++--
 tests/scanner.TestCase  | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/fdroidserver/scanner.py b/fdroidserver/scanner.py
index 3ef9e06e..93297ff7 100644
--- a/fdroidserver/scanner.py
+++ b/fdroidserver/scanner.py
@@ -232,6 +232,8 @@ def scan_source(build_dir, build=metadata.Build()):
                 count += handleproblem('shared library', path_in_build_dir, filepath)
             elif ext == 'a':
                 count += handleproblem('static library', path_in_build_dir, filepath)
+            elif ext == 'aar':
+                count += handleproblem(_('Android AAR library'), path_in_build_dir, filepath)
             elif ext == 'class':
                 count += handleproblem('Java compiled class', path_in_build_dir, filepath)
             elif ext == 'apk':
@@ -243,10 +245,7 @@ def scan_source(build_dir, build=metadata.Build()):
                 if curfile == 'gradle-wrapper.jar':
                     removeproblem('gradle-wrapper.jar', path_in_build_dir, filepath)
                 else:
-                    warnproblem('JAR file', path_in_build_dir)
-
-            elif ext == 'aar':
-                warnproblem('AAR file', path_in_build_dir)
+                    count += handleproblem('JAR file', path_in_build_dir, filepath)
 
             elif ext == 'java':
                 if not os.path.isfile(filepath):
diff --git a/tests/build.TestCase b/tests/build.TestCase
index 547c0b6e..033c6411 100755
--- a/tests/build.TestCase
+++ b/tests/build.TestCase
@@ -141,7 +141,8 @@ class BuildTest(unittest.TestCase):
         build = fdroidserver.metadata.Build()
         build.commit = '1.0'
         build.output = app.id + '.apk'
-        build.scanignore = ['baz.so']
+        build.scandelete = ['baz.so']
+        build.scanignore = ['foo.aar']
         build.versionCode = '1'
         build.versionName = '1.0'
         vcs = mock.Mock()
@@ -186,11 +187,11 @@ class BuildTest(unittest.TestCase):
                             force=False, onserver=False, refresh=False
                         )
 
-        self.assertTrue(os.path.exists('baz.so'))
         self.assertTrue(os.path.exists('foo.aar'))
         self.assertTrue(os.path.isdir('build'))
         self.assertTrue(os.path.isdir('reports'))
         self.assertTrue(os.path.isdir('target'))
+        self.assertFalse(os.path.exists('baz.so'))
         self.assertFalse(os.path.exists('bin'))
         self.assertFalse(os.path.exists('build/reports'))
         self.assertFalse(os.path.exists('gen'))
diff --git a/tests/scanner.TestCase b/tests/scanner.TestCase
index 4392664e..6bb74f9a 100755
--- a/tests/scanner.TestCase
+++ b/tests/scanner.TestCase
@@ -99,7 +99,7 @@ class ScannerTest(unittest.TestCase):
         build = fdroidserver.metadata.Build()
         build.commit = '1.0'
         build.output = app.id + '.apk'
-        build.scanignore = ['baz.so']
+        build.scanignore = ['baz.so', 'foo.aar']
         build.versionCode = '1'
         build.versionName = '1.0'
         vcs = mock.Mock()

From 84f225f2f2a9fd7c3d696ef69f9c5e710be2bdba Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Wed, 3 Jun 2020 15:25:26 +0200
Subject: [PATCH 3/9] scanner: make problem descriptions translationable

---
 fdroidserver/scanner.py | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/fdroidserver/scanner.py b/fdroidserver/scanner.py
index 93297ff7..a8d1449d 100644
--- a/fdroidserver/scanner.py
+++ b/fdroidserver/scanner.py
@@ -228,16 +228,16 @@ def scan_source(build_dir, build=metadata.Build()):
             path_in_build_dir = os.path.relpath(filepath, build_dir)
             _ignored, ext = common.get_extension(path_in_build_dir)
 
-            if ext == 'so':
-                count += handleproblem('shared library', path_in_build_dir, filepath)
-            elif ext == 'a':
-                count += handleproblem('static library', path_in_build_dir, filepath)
+            if ext == 'a':
+                count += handleproblem(_('static library'), path_in_build_dir, filepath)
             elif ext == 'aar':
                 count += handleproblem(_('Android AAR library'), path_in_build_dir, filepath)
             elif ext == 'class':
-                count += handleproblem('Java compiled class', path_in_build_dir, filepath)
+                count += handleproblem(_('Java compiled class'), path_in_build_dir, filepath)
+            elif ext == 'so':
+                count += handleproblem(_('shared library'), path_in_build_dir, filepath)
             elif ext == 'apk':
-                removeproblem('APK file', path_in_build_dir, filepath)
+                removeproblem(_('Android APK file'), path_in_build_dir, filepath)
 
             elif ext == 'jar':
                 for name in suspects_found(curfile):
@@ -279,16 +279,16 @@ def scan_source(build_dir, build=metadata.Build()):
 
             elif is_executable(filepath):
                 if is_binary(filepath) and not safe_path(path_in_build_dir):
-                    warnproblem('executable binary, possibly code', path_in_build_dir)
+                    warnproblem(_('executable binary, possibly code'), path_in_build_dir)
 
     for p in scanignore:
         if p not in scanignore_worked:
-            logging.error('Unused scanignore path: %s' % p)
+            logging.error(_('Unused scanignore path: %s') % p)
             count += 1
 
     for p in scandelete:
         if p not in scandelete_worked:
-            logging.error('Unused scandelete path: %s' % p)
+            logging.error(_('Unused scandelete path: %s') % p)
             count += 1
 
     return count

From 2f5d780c49e62950c3e8f8ec86a3429f593c66d6 Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Wed, 3 Jun 2020 15:45:39 +0200
Subject: [PATCH 4/9] scanner: always setup JSON data structure so functions
 work as API

---
 fdroidserver/scanner.py | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fdroidserver/scanner.py b/fdroidserver/scanner.py
index a8d1449d..f1cc171d 100644
--- a/fdroidserver/scanner.py
+++ b/fdroidserver/scanner.py
@@ -34,7 +34,8 @@ from .exception import BuildException, VCSException
 config = None
 options = None
 
-json_per_build = None
+DEFAULT_JSON_PER_BUILD = {'errors': [], 'warnings': [], 'infos': []}
+json_per_build = DEFAULT_JSON_PER_BUILD
 
 
 def get_gradle_compile_commands(build):
@@ -338,7 +339,7 @@ def main():
 
         if app.Disabled and not options.force:
             logging.info(_("Skipping {appid}: disabled").format(appid=appid))
-            json_per_appid = json_per_appid['infos'].append('Skipping: disabled')
+            json_per_appid['disabled'] = json_per_build['infos'].append('Skipping: disabled')
             continue
 
         try:
@@ -354,7 +355,7 @@ def main():
             else:
                 logging.info(_("{appid}: no builds specified, running on current source state")
                              .format(appid=appid))
-                json_per_build = {'errors': [], 'warnings': [], 'infos': []}
+                json_per_build = DEFAULT_JSON_PER_BUILD
                 json_per_appid['current-source-state'] = json_per_build
                 count = scan_source(build_dir)
                 if count > 0:
@@ -364,7 +365,7 @@ def main():
                 app.builds = []
 
             for build in app.builds:
-                json_per_build = {'errors': [], 'warnings': [], 'infos': []}
+                json_per_build = DEFAULT_JSON_PER_BUILD
                 json_per_appid[build.versionCode] = json_per_build
 
                 if build.disable and not options.force:

From 75acf63efa9e7d01397c3879e98720d17abc2edb Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Wed, 3 Jun 2020 16:55:43 +0200
Subject: [PATCH 5/9] scanner: remove all gradle wrapper files

---
 fdroidserver/scanner.py | 25 ++++++-------
 tests/scanner.TestCase  | 78 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 91 insertions(+), 12 deletions(-)

diff --git a/fdroidserver/scanner.py b/fdroidserver/scanner.py
index f1cc171d..034d4f3c 100644
--- a/fdroidserver/scanner.py
+++ b/fdroidserver/scanner.py
@@ -146,15 +146,17 @@ def scan_source(build_dir, build=metadata.Build()):
         return False
 
     def ignoreproblem(what, path_in_build_dir):
-        logging.info('Ignoring %s at %s' % (what, path_in_build_dir))
+        msg = ('Ignoring %s at %s' % (what, path_in_build_dir))
+        logging.info(msg)
         if json_per_build is not None:
-            json_per_build['infos'].append([what, path_in_build_dir])
+            json_per_build['infos'].append([msg, path_in_build_dir])
         return 0
 
     def removeproblem(what, path_in_build_dir, filepath):
-        logging.info('Removing %s at %s' % (what, path_in_build_dir))
+        msg = ('Removing %s at %s' % (what, path_in_build_dir))
+        logging.info(msg)
         if json_per_build is not None:
-            json_per_build['infos'].append([what, path_in_build_dir])
+            json_per_build['infos'].append([msg, path_in_build_dir])
         os.remove(filepath)
         return 0
 
@@ -229,7 +231,12 @@ def scan_source(build_dir, build=metadata.Build()):
             path_in_build_dir = os.path.relpath(filepath, build_dir)
             _ignored, ext = common.get_extension(path_in_build_dir)
 
-            if ext == 'a':
+            if curfile in ('gradle-wrapper.jar', 'gradlew', 'gradlew.bat'):
+                removeproblem(curfile, path_in_build_dir, filepath)
+            elif ext == 'apk':
+                removeproblem(_('Android APK file'), path_in_build_dir, filepath)
+
+            elif ext == 'a':
                 count += handleproblem(_('static library'), path_in_build_dir, filepath)
             elif ext == 'aar':
                 count += handleproblem(_('Android AAR library'), path_in_build_dir, filepath)
@@ -237,16 +244,10 @@ def scan_source(build_dir, build=metadata.Build()):
                 count += handleproblem(_('Java compiled class'), path_in_build_dir, filepath)
             elif ext == 'so':
                 count += handleproblem(_('shared library'), path_in_build_dir, filepath)
-            elif ext == 'apk':
-                removeproblem(_('Android APK file'), path_in_build_dir, filepath)
-
             elif ext == 'jar':
                 for name in suspects_found(curfile):
                     count += handleproblem('usual suspect \'%s\'' % name, path_in_build_dir, filepath)
-                if curfile == 'gradle-wrapper.jar':
-                    removeproblem('gradle-wrapper.jar', path_in_build_dir, filepath)
-                else:
-                    count += handleproblem('JAR file', path_in_build_dir, filepath)
+                count += handleproblem(_('Java JAR file'), path_in_build_dir, filepath)
 
             elif ext == 'java':
                 if not os.path.isfile(filepath):
diff --git a/tests/scanner.TestCase b/tests/scanner.TestCase
index 6bb74f9a..fc10a8af 100755
--- a/tests/scanner.TestCase
+++ b/tests/scanner.TestCase
@@ -5,10 +5,12 @@ import inspect
 import logging
 import optparse
 import os
+import shutil
 import sys
 import tempfile
 import textwrap
 import unittest
+import uuid
 from unittest import mock
 
 localmodule = os.path.realpath(
@@ -80,6 +82,82 @@ class ScannerTest(unittest.TestCase):
                             i += 1
             self.assertEqual(count, i)
 
+    def test_scan_source_file_types(self):
+        """Build product files are not allowed, test they are detected"""
+        testdir = tempfile.mkdtemp(prefix=inspect.currentframe().f_code.co_name, dir=self.tmpdir)
+        os.chdir(testdir)
+
+        fdroidserver.scanner.config = None
+        fdroidserver.scanner.options = mock.Mock()
+        fdroidserver.scanner.options.json = True
+
+        keep = [
+            'arg.jar',
+            'ascii.out',
+            'baz.so',
+            'sqlcipher.aar',
+            'static.a',
+        ]
+        remove = [
+            'gradle-wrapper.jar',
+            'gradlew',
+            'gradlew.bat',
+        ]
+        for f in keep + remove:
+            with open(f, 'w') as fp:
+                fp.write('placeholder')
+            self.assertTrue(os.path.exists(f))
+        binaries = [
+            'binary.out',
+            'fake.png',
+            'snippet.png',
+        ]
+        with open('binary.out', 'wb') as fp:
+            fp.write(b'\x00\x00')
+            fp.write(uuid.uuid4().bytes)
+        shutil.copyfile('binary.out', 'fake.png')
+        os.chmod('fake.png', 0o755)
+        os.system('ls -l binary.out')
+        with open('snippet.png', 'wb') as fp:
+            fp.write(b'\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR\x00\x00\x000\x00\x00'
+                     b'\x000\x08\x06\x00\x00\x00W\x02\xf9\x87\x00\x00\x00\x04sB'
+                     b'IT\x08\x08\x08\x08|\x08d\x88\x00\x00\x00\tpHYs\x00\x00\n'
+                     b'a\x00\x00\na\x01\xfc\xccJ%\x00\x00\x00\x19tEXtSoftware')
+        os.chmod('snippet.png', 0o755)
+        os.system('ls -l fake.png')
+
+        count = fdroidserver.scanner.scan_source(testdir)
+        self.assertEqual(5, count, 'there should be this many errors')
+
+        for f in keep + binaries:
+            self.assertTrue(os.path.exists(f), f + ' should still be there')
+        for f in remove:
+            self.assertFalse(os.path.exists(f), f + ' should have been removed')
+
+        files = dict()
+        for section in ('errors', 'infos', 'warnings'):
+            files[section] = []
+            for msg, f in fdroidserver.scanner.json_per_build[section]:
+                files[section].append(f)
+
+        self.assertFalse('ascii.out' in files['errors'],
+                         'an ASCII .out file is not an error')
+        self.assertFalse('snippet.png' in files['errors'],
+                         'an executable valid image is not an error')
+
+        self.assertTrue('arg.jar' in files['errors'], 'all JAR files are errors')
+        self.assertTrue('baz.so' in files['errors'], 'all .so files are errors')
+        self.assertTrue('binary.out' in files['errors'], 'a binary .out file is an error')
+        self.assertTrue('sqlcipher.aar' in files['errors'], 'all AAR files are errors')
+        self.assertTrue('static.a' in files['errors'], 'all .a files are errors')
+
+        self.assertTrue('fake.png' in files['warnings'],
+                        'a random binary that is executable that is not an image is a warning')
+
+        for f in remove:
+            self.assertTrue(f in files['infos'],
+                            f + ' should be removed with an info message')
+
     def test_build_local_scanner(self):
         """`fdroid build` calls scanner functions, test them here"""
         testdir = tempfile.mkdtemp(prefix=inspect.currentframe().f_code.co_name, dir=self.tmpdir)

From ee54dbce87c6cab9d74f83a22131c0940814e485 Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Wed, 3 Jun 2020 18:34:26 +0200
Subject: [PATCH 6/9] scanner: safely check options, for things using this API

https://gitlab.com/fdroid/fdroidserver/-/issues/771#note_353495799
---
 fdroidserver/scanner.py | 4 ++--
 tests/build.TestCase    | 1 -
 tests/scanner.TestCase  | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/fdroidserver/scanner.py b/fdroidserver/scanner.py
index 034d4f3c..a5965b2c 100644
--- a/fdroidserver/scanner.py
+++ b/fdroidserver/scanner.py
@@ -172,9 +172,9 @@ def scan_source(build_dir, build=metadata.Build()):
             return ignoreproblem(what, path_in_build_dir)
         if todelete(path_in_build_dir):
             return removeproblem(what, path_in_build_dir, filepath)
-        if options.json:
+        if options and options.json:
             json_per_build['errors'].append([what, path_in_build_dir])
-        if not options.json or options.verbose:
+        if options and (options.verbose or not options.json):
             logging.error('Found %s at %s' % (what, path_in_build_dir))
         return 1
 
diff --git a/tests/build.TestCase b/tests/build.TestCase
index 033c6411..0495bb79 100755
--- a/tests/build.TestCase
+++ b/tests/build.TestCase
@@ -132,7 +132,6 @@ class BuildTest(unittest.TestCase):
         fdroidserver.common.fill_config_defaults(config)
         fdroidserver.common.config = config
         fdroidserver.build.options = mock.Mock()
-        fdroidserver.build.options.json = False
         fdroidserver.build.options.notarball = True
         fdroidserver.build.options.skipscan = False
 
diff --git a/tests/scanner.TestCase b/tests/scanner.TestCase
index fc10a8af..6612cb21 100755
--- a/tests/scanner.TestCase
+++ b/tests/scanner.TestCase
@@ -36,7 +36,7 @@ class ScannerTest(unittest.TestCase):
         os.chdir(self.basedir)
 
     def test_scan_source_files(self):
-        fdroidserver.scanner.options = type('', (), {})()
+        fdroidserver.scanner.options = mock.Mock()
         fdroidserver.scanner.options.json = False
         source_files = os.path.join(self.basedir, 'source-files')
         projects = {

From d7b3bca1e7fd20fb0a699bcee835ceedc19c01d0 Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Wed, 3 Jun 2020 18:34:47 +0200
Subject: [PATCH 7/9] build: pass --verbose flag through to scanner

---
 fdroidserver/build.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fdroidserver/build.py b/fdroidserver/build.py
index 13317701..922fe169 100644
--- a/fdroidserver/build.py
+++ b/fdroidserver/build.py
@@ -512,6 +512,7 @@ def build_local(app, build, vcs, build_dir, output_dir, log_dir, srclib_dir, ext
     else:
         # Scan before building...
         logging.info("Scanning source for common problems...")
+        scanner.options = options  # pass verbose through
         count = scanner.scan_source(build_dir, build)
         if count > 0:
             if force:

From 6590f3869e5f4ed231ad69343735250d46dc9833 Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Wed, 3 Jun 2020 21:26:03 +0200
Subject: [PATCH 8/9] scanner: error/warn on dex/gz/zip, closes #394

---
 fdroidserver/scanner.py | 11 ++++++++++-
 tests/scanner.TestCase  |  8 +++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/fdroidserver/scanner.py b/fdroidserver/scanner.py
index a5965b2c..9a74c6ca 100644
--- a/fdroidserver/scanner.py
+++ b/fdroidserver/scanner.py
@@ -162,16 +162,19 @@ def scan_source(build_dir, build=metadata.Build()):
 
     def warnproblem(what, path_in_build_dir):
         if toignore(path_in_build_dir):
-            return
+            return 0
         logging.warning('Found %s at %s' % (what, path_in_build_dir))
         if json_per_build is not None:
             json_per_build['warnings'].append([what, path_in_build_dir])
+        return 0
 
     def handleproblem(what, path_in_build_dir, filepath):
         if toignore(path_in_build_dir):
             return ignoreproblem(what, path_in_build_dir)
         if todelete(path_in_build_dir):
             return removeproblem(what, path_in_build_dir, filepath)
+        if 'src/test' in filepath or '/test/' in filepath:
+            return warnproblem(what, path_in_build_dir)
         if options and options.json:
             json_per_build['errors'].append([what, path_in_build_dir])
         if options and (options.verbose or not options.json):
@@ -242,8 +245,14 @@ def scan_source(build_dir, build=metadata.Build()):
                 count += handleproblem(_('Android AAR library'), path_in_build_dir, filepath)
             elif ext == 'class':
                 count += handleproblem(_('Java compiled class'), path_in_build_dir, filepath)
+            elif ext == 'dex':
+                count += handleproblem(_('Android DEX code'), path_in_build_dir, filepath)
+            elif ext == 'gz':
+                count += handleproblem(_('gzip file archive'), path_in_build_dir, filepath)
             elif ext == 'so':
                 count += handleproblem(_('shared library'), path_in_build_dir, filepath)
+            elif ext == 'zip':
+                count += handleproblem(_('ZIP file archive'), path_in_build_dir, filepath)
             elif ext == 'jar':
                 for name in suspects_found(curfile):
                     count += handleproblem('usual suspect \'%s\'' % name, path_in_build_dir, filepath)
diff --git a/tests/scanner.TestCase b/tests/scanner.TestCase
index 6612cb21..354c2f64 100755
--- a/tests/scanner.TestCase
+++ b/tests/scanner.TestCase
@@ -95,14 +95,17 @@ class ScannerTest(unittest.TestCase):
             'arg.jar',
             'ascii.out',
             'baz.so',
+            'classes.dex',
             'sqlcipher.aar',
             'static.a',
+            'src/test/resources/classes.dex',
         ]
         remove = [
             'gradle-wrapper.jar',
             'gradlew',
             'gradlew.bat',
         ]
+        os.makedirs('src/test/resources', exist_ok=True)
         for f in keep + remove:
             with open(f, 'w') as fp:
                 fp.write('placeholder')
@@ -127,7 +130,7 @@ class ScannerTest(unittest.TestCase):
         os.system('ls -l fake.png')
 
         count = fdroidserver.scanner.scan_source(testdir)
-        self.assertEqual(5, count, 'there should be this many errors')
+        self.assertEqual(6, count, 'there should be this many errors')
 
         for f in keep + binaries:
             self.assertTrue(os.path.exists(f), f + ' should still be there')
@@ -148,11 +151,14 @@ class ScannerTest(unittest.TestCase):
         self.assertTrue('arg.jar' in files['errors'], 'all JAR files are errors')
         self.assertTrue('baz.so' in files['errors'], 'all .so files are errors')
         self.assertTrue('binary.out' in files['errors'], 'a binary .out file is an error')
+        self.assertTrue('classes.dex' in files['errors'], 'all classes.dex files are errors')
         self.assertTrue('sqlcipher.aar' in files['errors'], 'all AAR files are errors')
         self.assertTrue('static.a' in files['errors'], 'all .a files are errors')
 
         self.assertTrue('fake.png' in files['warnings'],
                         'a random binary that is executable that is not an image is a warning')
+        self.assertTrue('src/test/resources/classes.dex' in files['warnings'],
+                        'suspicious file but in a test dir is a warning')
 
         for f in remove:
             self.assertTrue(f in files['infos'],

From 08372899354ef0b6b75996f6201d8e8456db3823 Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Wed, 3 Jun 2020 23:40:01 +0200
Subject: [PATCH 9/9] scanner: fix regex for matching URLs in gradle maven{}
 blocks

closes #465

This script generated gradle-maven-blocks.yaml:
```python
import os
import re
import yaml

pat = re.compile(r'\smaven\s*{[^}]+}')

finds = set()
for root, dirs, files in os.walk('.'):
    for f in files:
        if '.gradle' in f:
            with open(os.path.join(root, f), errors='surrogateescape') as fp:
                contents = fp.read()
            for m in pat.findall(contents):
                finds.add(m)

with open('finds.yaml', 'w') as fp:
    yaml.dump(sorted(finds), fp, default_flow_style=False)

```
---
 fdroidserver/scanner.py        |  10 +-
 tests/gradle-maven-blocks.yaml | 778 +++++++++++++++++++++++++++++++++
 tests/scanner.TestCase         |  36 ++
 3 files changed, 819 insertions(+), 5 deletions(-)
 create mode 100644 tests/gradle-maven-blocks.yaml

diff --git a/fdroidserver/scanner.py b/fdroidserver/scanner.py
index 9a74c6ca..1c30d189 100644
--- a/fdroidserver/scanner.py
+++ b/fdroidserver/scanner.py
@@ -37,6 +37,9 @@ options = None
 DEFAULT_JSON_PER_BUILD = {'errors': [], 'warnings': [], 'infos': []}
 json_per_build = DEFAULT_JSON_PER_BUILD
 
+MAVEN_URL_REGEX = re.compile(r"""\smaven\s*{.*?(?:setUrl|url)\s*=?\s*(?:uri)?\(?\s*["']?([^\s"']+)["']?[^}]*}""",
+                             re.DOTALL)
+
 
 def get_gradle_compile_commands(build):
     compileCommands = ['compile',
@@ -101,8 +104,6 @@ def scan_source(build_dir, build=metadata.Build()):
             if r.match(s) and not is_whitelisted(s):
                 yield n
 
-    gradle_mavenrepo = re.compile(r'maven *{ *(url)? *[\'"]?([^ \'"]*)[\'"]?')
-
     allowed_repos = [re.compile(r'^https://' + re.escape(repo) + r'/*') for repo in [
         'repo1.maven.org/maven2',  # mavenCentral()
         'jcenter.bintray.com',     # jcenter()
@@ -278,9 +279,8 @@ def scan_source(build_dir, build=metadata.Build()):
                             count += handleproblem("usual suspect \'%s\'" % (name),
                                                    path_in_build_dir, filepath)
                 noncomment_lines = [line for line in lines if not common.gradle_comment.match(line)]
-                joined = re.sub(r'[\n\r\s]+', ' ', ' '.join(noncomment_lines))
-                for m in gradle_mavenrepo.finditer(joined):
-                    url = m.group(2)
+                no_comments = re.sub(r'/\*.*?\*/', '', ''.join(noncomment_lines), flags=re.DOTALL)
+                for url in MAVEN_URL_REGEX.findall(no_comments):
                     if not any(r.match(url) for r in allowed_repos):
                         count += handleproblem('unknown maven repo \'%s\'' % url, path_in_build_dir, filepath)
 
diff --git a/tests/gradle-maven-blocks.yaml b/tests/gradle-maven-blocks.yaml
new file mode 100644
index 00000000..f6587f94
--- /dev/null
+++ b/tests/gradle-maven-blocks.yaml
@@ -0,0 +1,778 @@
+- "\tmaven {\n\t\t\turl \"$rootDir/../node_modules/react-native-background-fetch/android/libs\"\
+  \n\t\t}"
+- "\tmaven {\n\t\t\turl \"https://plugins.gradle.org/m2/\"\n\t\t}"
+- "\tmaven {\n\t\t\turl 'http://4thline.org/m2'\n\t\t}"
+- "\tmaven {\n\t\t\turl 'https://maven.google.com/'\n\t\t\tname 'Google'\n\t\t}"
+- "\tmaven {\n\t\turl \"file://$pwd/.m2repo\"\n\t}"
+- "\tmaven {\n\t\turl \"https://jitpack.io\"\n\t}"
+- "\tmaven {\n\t\turl 'https://maven.google.com/'\n\t\tname 'Google'\n\t}"
+- "\tmaven {\n\t    url 'https://maven.google.com'\n\t}"
+- "\tmaven { url \"http://JRAF.org/static/maven/2\" }"
+- "\tmaven { url \"http://dl.bintray.com/populov/maven\" }"
+- "\tmaven { url \"https://jitpack.io\" }"
+- "\tmaven { url 'http://maven.ghostscript.com/' }"
+- "\tmaven { url 'https://jitpack.io' }"
+- "\tmaven { url 'https://maven.fabric.io/public' }"
+- "\tmaven { url MAVEN_REPO }"
+- " maven {\n\t    url 'https://jitpack.io'\n        }"
+- " maven {\n                    url rootProject.ext.mavenRepo\n                 \
+  \   if (!rootProject.ext.mavenRepo.startsWith(\"file\")) {\n                   \
+  \     credentials {\n                            username rootProject.ext.mavenUser\n\
+  \                            password rootProject.ext.mavenPassword\n          \
+  \              }"
+- " maven {\n                // All of React Native (JS, Obj-C sources, Android binaries)\
+  \ is installed from npm\n                url \"$rootDir/libs/gutenberg-mobile/node_modules/react-native/android\"\
+  \n            }"
+- " maven {\n                url \"file:~/.m2/\"\n                artifactUrls \"\
+  file:~/.m2/\"\n            }"
+- " maven {\n                url \"https://maven-central-asia.storage-download.googleapis.com/repos/central/data/\"\
+  \n                content {\n                    excludeGroup(\"Kotlin/Native\"\
+  )\n                }"
+- " maven {\n                url \"https://maven-central-asia.storage-download.googleapis.com/repos/central/data/\"\
+  \n            }"
+- " maven {\n                url \"https://plugins.gradle.org/m2/\"\n            }"
+- " maven {\n                url \"https://repo.commonsware.com.s3.amazonaws.com\"\
+  \n            }"
+- " maven {\n                url 'https://maven.fabric.io/public'\n            }"
+- " maven {\n            // All of React Native (JS, Android binaries) is installed\
+  \ from npm\n            url \"$rootDir/react/node_modules/react-native/android\"\
+  \n        }"
+- " maven {\n            // All of React Native (JS, Obj-C sources, Android binaries)\
+  \ is installed from npm\n            // url \"$rootDir/../node_modules/react-native/android\"\
+  \n\n            // Replace AAR from original RN with AAR from react-native-v8\n\
+  \            url(\"$rootDir/../node_modules/react-native-v8/dist\")\n        }"
+- " maven {\n            // All of React Native (JS, Obj-C sources, Android binaries)\
+  \ is installed from npm\n            url \"$rootDir/../node_modules/react-native/android\"\
+  \n        }"
+- " maven {\n            // All of React Native (JS, Obj-C sources, Android binaries)\
+  \ is installed from npm\n            url(\"$rootDir/../node_modules/react-native/android\"\
+  )\n        }"
+- " maven {\n            // Android JSC is installed from npm\n            url(\"\
+  $rootDir/../node_modules/jsc-android/dist\")\n        }"
+- " maven {\n            // Android JSC is installed from npm\n            url(\"\
+  $rootDir/react/node_modules/jsc-android/dist\")\n        }"
+- " maven {\n            // Local Maven repo containing AARs with JSC library built\
+  \ for Android\n            // url \"$rootDir/../node_modules/jsc-android/dist\"\n\
+  \n            // prebuilt libv8android.so\n            url(\"$rootDir/../node_modules/v8-android/dist\"\
+  )\n        }"
+- " maven {\n            // Local Maven repo containing AARs with JSC library built\
+  \ for Android\n            url \"$rootDir/../node_modules/jsc-android/dist\"\n \
+  \       }"
+- " maven {\n            //noinspection GroovyAssignabilityCheck\n            url\
+  \ 'https://jitpack.io'\n        }"
+- " maven {\n            //noinspection GroovyAssignabilityCheck\n            url\
+  \ 'https://s3.amazonaws.com/moat-sdk-builds'\n        }"
+- " maven {\n            //url 'https://maven.google.com/'\n            url 'https://jitpack.io'\n\
+  \            name 'Google'\n        }"
+- " maven {\n            name 'glide-snapshot'\n            url 'http://oss.sonatype.org/content/repositories/snapshots'\n\
+  \        }"
+- " maven {\n            name 'glide-snapshot'\n            url 'https://oss.sonatype.org/content/repositories/snapshots'\n\
+  \        }"
+- " maven {\n            name = \"sonatype\"\n\n            def releasesRepoUrl =\
+  \ \"https://oss.sonatype.org/service/local/staging/deploy/maven2/\"\n          \
+  \  def snapshotsRepoUrl = \"https://oss.sonatype.org/content/repositories/snapshots/\"\
+  \n            url = version.endsWith('SNAPSHOT') ? snapshotsRepoUrl : releasesRepoUrl\n\
+  \n            credentials {\n                username ossrhUsername\n          \
+  \      password ossrhPassword\n            }"
+- " maven {\n            url \"http://developer.huawei.com/repo/\"\n        }"
+- " maven {\n            url \"http://dl.bintray.com/dasar/maven\"\n        }"
+- " maven {\n            url \"http://dl.bintray.com/jenzz/maven\"\n        }"
+- " maven {\n            url \"http://dl.bintray.com/journeyapps/maven\"\n       \
+  \ }"
+- " maven {\n            url \"http://dl.bintray.com/lukaville/maven\"\n        }"
+- " maven {\n            url \"http://dl.bintray.com/ona/kujaku\"\n        }"
+- " maven {\n            url \"http://dl.bintray.com/piasy/maven\"\n            content\
+  \ {\n                includeGroupByRegex \"com\\\\.github\\\\.piasy\"\n        \
+  \    }"
+- " maven {\n            url \"http://kotlin.bintray.com/kotlin-dev\"\n          \
+  \  content {\n                excludeGroup(\"Kotlin/Native\")\n            }"
+- " maven {\n            url \"http://oss.sonatype.org/content/repositories/snapshots\"\
+  \n        }"
+- " maven {\n            url \"https://clojars.org/repo/\"\n        }"
+- " maven {\n            url \"https://dl.bintray.com/kotlin/ktor\"\n            content\
+  \ {\n                excludeGroup(\"Kotlin/Native\")\n            }"
+- " maven {\n            url \"https://dl.bintray.com/soywiz/soywiz\"\n          \
+  \  content {\n                excludeGroup(\"Kotlin/Native\")\n            }"
+- " maven {\n            url \"https://dl.bintray.com/wire-android/third-party\"\n\
+  \        }"
+- " maven {\n            url \"https://github.com/vector-im/jitsi_libre_maven/raw/master/releases\"\
+  \n        }"
+- " maven {\n            url \"https://jitpack.io\"\n\n        }"
+- " maven {\n            url \"https://jitpack.io\"\n            content {\n     \
+  \           // For some reason gradle attempts to get bugsnag from here, which returns\
+  \ 522\n                // after which gradle just drops jitpack. Exclude so it doesn't\
+  \ bother trying.\n                excludeGroupByRegex \".*bugsnag.*\"\n        \
+  \    }"
+- " maven {\n            url \"https://jitpack.io\"\n            content {\n     \
+  \           excludeGroup(\"Kotlin/Native\")\n            }"
+- " maven {\n            url \"https://jitpack.io\"\n        }"
+- " maven {\n            url \"https://jitpack.io/\"\n        }"
+- " maven {\n            url \"https://kotlin.bintray.com/kotlinx\"\n            content\
+  \ {\n                excludeGroup(\"Kotlin/Native\")\n            }"
+- " maven {\n            url \"https://maven-central-asia.storage-download.googleapis.com/repos/central/data/\"\
+  \n        }"
+- " maven {\n            url \"https://maven.fabric.io/public\"\n        }"
+- " maven {\n            url \"https://maven.google.com\"\n            name 'Google'\n\
+  \        }"
+- " maven {\n            url \"https://maven.google.com\"\n        }"
+- " maven {\n            url \"https://maven.google.com/\"\n        }"
+- " maven {\n            url \"https://maven.mozilla.org/maven2\"\n        }"
+- " maven {\n            url \"https://oss.sonatype.org/content/repositories/snapshots\"\
+  \n        }"
+- " maven {\n            url \"https://oss.sonatype.org/content/repositories/snapshots/\"\
+  \n        }"
+- " maven {\n            url \"https://plugins.gradle.org/m2/\"\n        }"
+- " maven {\n            url \"https://repo1.maven.org/maven2\"\n            jcenter()\n\
+  \        }"
+- " maven {\n            url \"https://s3.amazonaws.com/repo.commonsware.com\"\n \
+  \           }"
+- " maven {\n            url \"https://s3.amazonaws.com/repo.commonsware.com\"\n \
+  \       }"
+- " maven {\n            url \"https://snapshots.maven.mozilla.org/maven2\"\n    \
+  \    }"
+- " maven {\n            url '${mavenUrl}"
+- " maven {\n            url 'http://maven.aliyun.com/nexus/content/repositories/releases/'\n\
+  \        }"
+- " maven {\n            url 'http://oss.sonatype.org/content/repositories/snapshots'\n\
+  \        }"
+- " maven {\n            url 'http://oss.sonatype.org/content/repositories/snapshots/'\n\
+  \        }"
+- " maven {\n            url 'http://www.idescout.com/maven/repo/'\n            name\
+  \ 'IDEScout, Inc.'\n        }"
+- " maven {\n            url 'http://www.idescout.com/maven/repo/'\n        }"
+- " maven {\n            url 'https://clojars.org/repo'\n        }"
+- " maven {\n            url 'https://dl.bintray.com/alexeydanilov/maven'\n      \
+  \  }"
+- " maven {\n            url 'https://dl.bintray.com/drummer-aidan/maven'\n      \
+  \  }"
+- " maven {\n            url 'https://dl.bintray.com/kotlin/kotlin-eap'\n        \
+  \    content {\n                excludeGroup(\"Kotlin/Native\")\n            }"
+- " maven {\n            url 'https://github.com/suckgamony/RapidDecoder/raw/master/repository'\n\
+  \        }"
+- " maven {\n            url 'https://github.com/uPhyca/stetho-realm/raw/master/maven-repo'\n\
+  \        }"
+- " maven {\n            url 'https://jitpack.io'\n            content {\n       \
+  \         // Use this repo only for matrix SDK library\n                includeGroupByRegex\
+  \ \"com\\\\.github\\\\.Bubu\"\n                // Also add subgroups, due to SDK\
+  \ split into modules\n                includeGroupByRegex \"com\\\\.github\\\\.Bubu\\\
+  \\.matrix-android-sdk\"\n                // And Olm library\n                includeGroupByRegex\
+  \ \"org\\\\.matrix\\\\.gitlab\\\\.matrix-org\"\n                // And PhotoView\n\
+  \                includeGroupByRegex \"com\\\\.github\\\\.chrisbanes\"\n       \
+  \     }"
+- " maven {\n            url 'https://jitpack.io'\n            content {\n       \
+  \         // Use this repo only for olm library\n                includeGroupByRegex\
+  \ \"org\\\\.matrix\\\\.gitlab\\\\.matrix-org\"\n                // And also for\
+  \ FilePicker\n                includeGroupByRegex \"com\\\\.github\\\\.jaiselrahman\"\
+  \n                // And monarchy\n                includeGroupByRegex \"com\\\\\
+  .github\\\\.Zhuinden\"\n                // And ucrop\n                includeGroupByRegex\
+  \ \"com\\\\.github\\\\.yalantis\"\n                // JsonViewer\n             \
+  \   includeGroupByRegex 'com\\\\.github\\\\.BillCarsonFr'\n            }"
+- " maven {\n            url 'https://jitpack.io'\n        }"
+- " maven {\n            url 'https://jitpack.io/'\n        }"
+- " maven {\n            url 'https://maven.aliyun.com/repository/google'\n      \
+  \      name 'replace google()'\n        }"
+- " maven {\n            url 'https://maven.aliyun.com/repository/jcenter'\n     \
+  \       name 'replace jcenter()'\n        }"
+- " maven {\n            url 'https://maven.aliyun.com/repository/public'\n      \
+  \      name 'replace jcenter() and mavenCentral()'\n        }"
+- " maven {\n            url 'https://maven.fabric.io/public'\n        }"
+- " maven {\n            url 'https://maven.google.com'\n            // Alternative\
+  \ URL is 'https://dl.google.com/dl/android/maven2/'\n        }"
+- " maven {\n            url 'https://maven.google.com'\n        }"
+- " maven {\n            url 'https://maven.google.com/'\n            name 'Google'\n\
+  \        }"
+- " maven {\n            url 'https://maven.google.com/'\n        }"
+- " maven {\n            url 'https://oss.sonatype.org/content/groups/public'\n  \
+  \      }"
+- " maven {\n            url 'https://oss.sonatype.org/content/repositories/snapshots'\n\
+  \        }"
+- " maven {\n            url 'https://oss.sonatype.org/content/repositories/snapshots/'\n\
+  \            content {\n                excludeGroup(\"Kotlin/Native\")\n      \
+  \      }"
+- " maven {\n            url 'https://oss.sonatype.org/content/repositories/snapshots/'\n\
+  \        }"
+- " maven {\n            url 'https://plugins.gradle.org/m2'\n        }"
+- " maven {\n            url 'https://plugins.gradle.org/m2/'\n        }"
+- " maven {\n            url 'https://www.jitpack.io'\n        }"
+- " maven {\n            url rootProject.ext.mavenRepo\n            if (!rootProject.ext.mavenRepo.startsWith(\"\
+  file\")) {\n                credentials {\n                    username rootProject.ext.mavenUser\n\
+  \                    password rootProject.ext.mavenPassword\n                }"
+- " maven {\n           url 'https://maven.fabric.io/public'\n        }"
+- " maven {\n           url 'https://maven.google.com/'\n       }"
+- " maven {\n          credentials {\n            username System.env.ANDVIANE_USERNAME\n            password System.env.ANDVIANE_PASSWORD\n          }\n          //url 'https://oss.sonatype.org/content/repositories/snapshots'\n          url 'https://oss.sonatype.org/service/local/staging/deploy/maven2'\n        }"
+- " maven {\n        // CUTR Releases\n        url \"https://github.com/CUTR-at-USF/cutr-mvn-repo/raw/master/snapshots\"\
+  \n    }"
+- " maven {\n        // Git project library as local library project (ucrop) - see\
+  \ https://jitpack.io/docs/\n        url 'https://jitpack.io'\n    }"
+- " maven {\n        // Need manual cleanup for new SNAPSHOT update if same name with\
+  \ date change only:\n        // Smack official SNAPSHOT repository accepted by F-Droid\n\
+  \        url 'https://oss.sonatype.org/content/repositories/snapshots'\n\n     \
+  \   // Smack custom library for org.igniterealtime - not recognize by F-Droid\n\
+  \        // url 'https://igniterealtime.org/repo/'\n\n        // Custom library\
+  \ for org.jitsi - maven-metadata.xml not compatible\n        // Unable to load Maven\
+  \ meta-data from https://github.com/jitsi/jitsi-maven-repository/tree/master/snapshots/org/jitsi/ice4j/2.0.0-SNAPSHOT/maven-metadata.xml.\n\
+  \        // org.xml.sax.SAXParseException; lineNumber: 44; columnNumber: 91; Attribute\
+  \ name \"data-pjax-transient\" associated with an element type \"meta\" must be\
+  \ followed by the ' = ' character.\n        // url 'https://github.com/jitsi/jitsi-maven-repository/tree/master/snapshots'\n\
+  \    }"
+- " maven {\n        // OBA Releases - for comparator to sort alphanumeric routes\n\
+  \        url \"http://nexus.onebusaway.org/nexus/content/repositories/releases\"\
+  \n    }"
+- " maven {\n        // TODO: Remove this after support library v24 public release.\n\
+  \        url \"$rootDir/prebuilts/fullsdk/extras/android/m2repository\"\n    }"
+- " maven {\n        // This maven repo contains artifacts for Flutter's Android embedding.\n\
+  \        url 'http://download.flutter.io'\n    }"
+- " maven {\n        // This maven repo is created when you run `flutter build aar`.\
+  \ It contains compiled code\n        // and resources for flutter_module itself.\n\
+  \        url '../../flutter_module/build/host/outputs/repo'\n    }"
+- " maven {\n        // Used only for PhotoView\n        url \"https://jitpack.io\"\
+  \n        name 'JitPack Github wrapper'\n    }"
+- " maven {\n        // for Amazon Maps\n        url uri('../.m2/repository')\n  \
+  \  }"
+- " maven {\n        // for testlib\n        url \"http://dl.bintray.com/acrowntest/ES_SDK\"\
+  \n    }"
+- " maven {\n        //url 'https://maven.google.com/'\n        url 'https://jitpack.io'\n\
+  \        name 'Google'\n    }"
+- " maven {\n        url \"http://4thline.org/m2\"\n    }"
+- " maven {\n        url \"http://maven.chunyu.mobi/content/groups/public/\"\n   \
+  \     credentials {\n            username maven_user\n            password maven_password\n\
+  \        }"
+- " maven {\n        url \"https://dl.google.com/dl/android/maven2/\"\n    }"
+- " maven {\n        url \"https://jitpack.io\"\n    }"
+- " maven {\n        url \"https://maven.fabric.io/public\"\n    }"
+- " maven {\n        url \"https://maven.google.com\"\n    }"
+- " maven {\n        url \"https://oss.sonatype.org/content/repositories/releases\"\
+  \n    }"
+- " maven {\n        url \"https://oss.sonatype.org/content/repositories/snapshots\"\
+  \n    }"
+- " maven {\n        url \"https://repo.eclipse.org/content/repositories/paho-releases/\"\
+  \n    }"
+- " maven {\n        url '../..'\n    }"
+- " maven {\n        url 'https://dl.bintray.com/amulyakhare/maven'\n    }"
+- " maven {\n        url 'https://github.com/Goddchen/mvn-repo/raw/master/'\n    }"
+- " maven {\n        url 'https://jitpack.io'\n    }"
+- " maven {\n        url 'https://maven.fabric.io/public'\n    }"
+- " maven {\n        url 'https://maven.google.com'\n        // Alternative URL is\
+  \ 'https://dl.google.com/dl/android/maven2/'\n        url \"https://jitpack.io\"\
+  \n    }"
+- " maven {\n        url 'https://maven.google.com'\n    }"
+- " maven {\n        url 'https://maven.google.com/'\n        name 'Google'\n    }"
+- " maven {\n        url 'https://oss.sonatype.org/content/repositories/snapshots'\n\
+  \    }"
+- " maven {\n        url 'https://oss.sonatype.org/content/repositories/snapshots/'\n\
+  \    }"
+- " maven {\n        url 'https://raw.githubusercontent.com/felixb/mvn-repo/master'\n\
+  \    }"
+- " maven {\n        url 'third_party/m2'\n    }"
+- " maven {\n        url xwalkMavenRepo\n      }"
+- " maven {\n        url(\"https://maven.fabric.io/public\")\n    }"
+- " maven {\n        url(\"https://oss.sonatype.org/content/repositories/snapshots\"\
+  )\n    }"
+- " maven {\n      url \"$buildDir/repo\"\n    }"
+- " maven {\n      url \"https://jitpack.io\"\n    }"
+- " maven {\n      url \"https://maven.google.com\"\n    }"
+- " maven {\n      url \"https://oss.sonatype.org/content/repositories/snapshots/\"\
+  \n    }"
+- " maven {\n      url \"https://plugins.gradle.org/m2/\"\n    }"
+- " maven {\n      url 'http://download.crashlytics.com/maven'\n    }"
+- " maven {\n      url 'https://clojars.org/repo/'\n    }"
+- " maven {\n      url 'https://maven.fabric.io/public'\n    }"
+- " maven {\n      url 'https://oss.sonatype.org/content/repositories/snapshots/'\n\
+  \    }"
+- " maven {\n      url 'https://raw.github.com/ark/ark/master/releases/'\n    }"
+- " maven {\n      url 'https://raw.github.com/iFixit/ark/master/releases/'\n   }"
+- " maven {\n    setUrl(\"https://plugins.gradle.org/m2/\")\n  }"
+- " maven {\n    url 'https://maven.google.com'\n  }"
+- ' maven {
+
+  //            url "https://jitpack.io"
+
+  //            url "https://maven-central.storage.googleapis.com"
+
+  //            url "http://repo.spring.io/plugins-release/"
+
+  //        }'
+- ' maven {   url "https://maven.google.com"  }'
+- ' maven { setUrl("https://www.jitpack.io") }'
+- ' maven { url  "https://dl.bintray.com/bjoernq/maven" }'
+- ' maven { url  "https://dl.bintray.com/ligi/maven" }'
+- ' maven { url  "https://dl.bintray.com/lukaville/maven" }'
+- ' maven { url  "https://jetbrains.bintray.com/trove4j" }'
+- ' maven { url "$rootDir/../node_modules/react-native/android" }'
+- ' maven { url "file:///home/snowdream/workspace/git/mvn-repo/releases/" }'
+- ' maven { url "file:///home/snowdream/workspace/git/mvn-repo/snapshots/" }'
+- ' maven { url "http://dl.bintray.com/arturbosch/code-analysis" }'
+- ' maven { url "http://dl.bintray.com/countly/maven" }'
+- ' maven { url "http://dl.bintray.com/drummer-aidan/maven" }'
+- ' maven { url "http://dl.bintray.com/drummer-aidan/maven/com/afollestad" }'
+- ' maven { url "http://dl.bintray.com/lukaville/maven" }'
+- ' maven { url "http://dl.bintray.com/mobisystech/maven" }'
+- ' maven { url "http://dl.bintray.com/populov/maven" }'
+- ' maven { url "http://kotlin.bintray.com/kotlin-dev" }'
+- ' maven { url "http://maven.batch.com/release" }'
+- ' maven { url "http://objectbox.net/beta-repo/" }'
+- ' maven { url "http://oss.sonatype.org/content/repositories/snapshots/" }'
+- ' maven { url "http://repo.commonsware.com.s3.amazonaws.com" }'
+- ' maven { url "http://repo1.maven.org/maven2" }'
+- ' maven { url "http://repository.apache.org/snapshots/" }'
+- ' maven { url "http://snowdream.github.io/mvn-repo/releases/" }'
+- ' maven { url "http://snowdream.github.io/mvn-repo/snapshots/" }'
+- ' maven { url "http://storage.googleapis.com/r8-releases/raw/master" }'
+- ' maven { url "https://clojars.org/repo" }'
+- ' maven { url "https://clojars.org/repo/" }'
+- ' maven { url "https://dl.bintray.com/acra/maven" }'
+- ' maven { url "https://dl.bintray.com/asf/asf" }'
+- ' maven { url "https://dl.bintray.com/badoo/maven" }'
+- ' maven { url "https://dl.bintray.com/dasar/maven" }'
+- ' maven { url "https://dl.bintray.com/drummer-aidan/maven" }'
+- ' maven { url "https://dl.bintray.com/florent37/maven" }'
+- ' maven { url "https://dl.bintray.com/gericop/maven" }'
+- ' maven { url "https://dl.bintray.com/kotlin/ktor" }'
+- ' maven { url "https://dl.bintray.com/markusamshove/maven" }'
+- ' maven { url "https://dl.bintray.com/mockito/maven" }'
+- ' maven { url "https://dl.bintray.com/robstoll/tutteli-jars" }'
+- ' maven { url "https://dl.bintray.com/videolan/Android" }'
+- ' maven { url "https://dl.bintray.com/wire-android/releases" }'
+- ' maven { url "https://dl.bintray.com/wire-android/releases/" }'
+- ' maven { url "https://dl.bintray.com/wire-android/snapshots" }'
+- ' maven { url "https://dl.bintray.com/wire-android/snapshots/" }'
+- ' maven { url "https://dl.bintray.com/wire-android/third-party" }'
+- ' maven { url "https://dl.bintray.com/wire-android/third-party/" }'
+- ' maven { url "https://dl.bintray.com/wordpress-mobile/maven" }'
+- ' maven { url "https://dl.bintray.com/wordpress-mobile/react-native-mirror/" }'
+- ' maven { url "https://fusesource.github.io/jansi/" }'
+- ' maven { url "https://giphy.bintray.com/giphy-sdk" }'
+- ' maven { url "https://github.com/jitsi/jitsi-maven-repository/raw/master/releases"
+  }'
+- ' maven { url "https://jcenter.bintray.com" }'
+- " maven { url \"https://jitpack.io\"\n    }"
+- ' maven { url "https://jitpack.io" }'
+- ' maven { url "https://jitpack.io"}'
+- ' maven { url "https://kotlin.bintray.com/kotlinx" }'
+- ' maven { url "https://mapbox.bintray.com/mapbox" }'
+- ' maven { url "https://maven-central-asia.storage-download.googleapis.com/repos/central/data/"
+  }'
+- ' maven { url "https://maven.fabric.io/public" }'
+- " maven { url \"https://maven.google.com\"\n    }"
+- ' maven { url "https://maven.google.com" }'
+- ' maven { url "https://maven.google.com"}'
+- ' maven { url "https://maven.google.com/" }'
+- ' maven { url "https://oss.sonatype.org/content/groups/public" }'
+- ' maven { url "https://oss.sonatype.org/content/groups/public/" }'
+- ' maven { url "https://oss.sonatype.org/content/repositories/releases/" }'
+- ' maven { url "https://oss.sonatype.org/content/repositories/snapshots" }'
+- ' maven { url "https://oss.sonatype.org/content/repositories/snapshots/" }'
+- ' maven { url "https://plugins.gradle.org/m2" }'
+- ' maven { url "https://plugins.gradle.org/m2/" }'
+- ' maven { url "https://plugins.gradle.org/m2/"}'
+- ' maven { url "https://raw.githubusercontent.com/guardianproject/gpmaven/master"
+  }'
+- ' maven { url "https://repo.commonsware.com.s3.amazonaws.com" }'
+- ' maven { url "https://repo.eclipse.org/content/groups/releases" }'
+- ' maven { url "https://repo.maven.apache.org/maven2" }'
+- ' maven { url "https://repo1.maven.org/maven2/" }'
+- ' maven { url "https://s3.amazonaws.com/moat-sdk-builds" }'
+- ' maven { url "https://s3.amazonaws.com/repo.commonsware.com" }'
+- ' maven { url "https://www.jitpack.io" }'
+- ' maven { url ''file:///usr/share/maven-repo'' }'
+- ' maven { url ''http://dl.bintray.com/amulyakhare/maven'' }'
+- ' maven { url ''http://download.crashlytics.com/maven'' }'
+- ' maven { url ''http://guardian.github.com/maven/repo-releases'' }'
+- ' maven { url ''http://igniterealtime.org/repo'' }'
+- ' maven { url ''http://maven.ghostscript.com/'' }'
+- ' maven { url ''http://nexus.testobject.org/nexus/content/repositories/testobject-public-alpha-repo''
+  }'
+- ' maven { url ''http://oss.sonatype.org/content/repositories/snapshots'' }'
+- ' maven { url ''http://repo1.maven.org/maven2'' }'
+- ' maven { url ''http://wordpress-mobile.github.io/WordPress-Android'' }'
+- ' maven { url ''https://dl.bintray.com/badoo/maven'' }'
+- ' maven { url ''https://dl.bintray.com/content/simonpoole/android'' }'
+- ' maven { url ''https://dl.bintray.com/content/simonpoole/div'' }'
+- ' maven { url ''https://dl.bintray.com/content/simonpoole/osm'' }'
+- ' maven { url ''https://dl.bintray.com/florent37/maven'' }'
+- ' maven { url ''https://dl.bintray.com/intercom/intercom-maven'' }'
+- ' maven { url ''https://dl.bintray.com/jenly/maven'' }'
+- ' maven { url ''https://dl.bintray.com/jetbrains/anko'' }'
+- ' maven { url ''https://dl.bintray.com/kotlin/kotlin-eap'' }'
+- ' maven { url ''https://dl.bintray.com/twofortyfouram/maven'' }'
+- ' maven { url ''https://dl.bintray.com/umsdk/release'' }'
+- ' maven { url ''https://dl.google.com/dl/android/maven2/'' }'
+- ' maven { url ''https://github.com/FireZenk/maven-repo/raw/master/'' }'
+- ' maven { url ''https://github.com/uPhyca/stetho-realm/raw/master/maven-repo'' }'
+- ' maven { url ''https://guardian.github.com/maven/repo-releases'' }'
+- ' maven { url ''https://igniterealtime.org/repo'' }'
+- ' maven { url ''https://jitpack.io'' }'
+- ' maven { url ''https://jitpack.io/'' }'
+- ' maven { url ''https://maven.fabric.io/public'' }'
+- ' maven { url ''https://maven.fabric.io/repo'' }'
+- ' maven { url ''https://maven.google.com'' }'
+- ' maven { url ''https://maven.google.com/'' }'
+- ' maven { url ''https://oss.jfrog.org/artifactory/oss-snapshot-local/'' }'
+- ' maven { url ''https://oss.sonatype.org/content/repositories/releases/'' }'
+- ' maven { url ''https://oss.sonatype.org/content/repositories/snapshots'' }'
+- ' maven { url ''https://oss.sonatype.org/content/repositories/snapshots/'' }'
+- ' maven { url ''https://plugins.gradle.org/m2/'' }'
+- ' maven { url ''https://plugins.gradle.org/m2/''}'
+- ' maven { url ''https://repo1.maven.org/maven2'' }'
+- ' maven { url ''https://repos.zeroturnaround.com/nexus/content/repositories/zt-public-releases''
+  }'
+- ' maven { url ''https://repository-achartengine.forge.cloudbees.com/snapshot/''
+  }'
+- ' maven { url ''https://s3.amazonaws.com/repo.commonsware.com'' }'
+- ' maven { url ''https://www.jitpack.io'' }'
+- ' maven { url ''https://zendesk.jfrog.io/zendesk/repo'' }'
+- ' maven { url ''libs'' }'
+- ' maven { url = "https://storage.googleapis.com/r8-releases/raw" }'
+- ' maven { url = uri("https://jitpack.io") }'
+- ' maven { url = uri("https://maven.fabric.io/public") }'
+- ' maven { url MAVEN_REPO_CACHE }'
+- ' maven { url(''http://releases.marmeladburk.fidesmo.com/'') }'
+- ' maven {url "http://dl.bintray.com/tbruyelle/tbruyelle" }'
+- ' maven {url "https://jitpack.io"}'
+- ' maven {url ''http://maven.aliyun.com/nexus/content/groups/public/''}'
+- " maven{\n            url 'https://maven.fabric.io/public'\n        }"
+- " maven{\n            url'https://plugins.gradle.org/m2/'\n        }"
+- " maven{\n        url \"https://maven.google.com\"\n    }"
+- " maven{\n        url 'https://maven.google.com'\n    }"
+- ' maven{ url "https://oss.sonatype.org/content/repositories/releases/" }'
+- ' maven{ url "https://oss.sonatype.org/content/repositories/snapshots/" }'
+- ' maven{ url ''http://maven.aliyun.com/nexus/content/groups/public/''}'
+- ' maven{ url ''https://jitpack.io'' }'
+- ' maven{ url ''https://maven.aliyun.com/repository/google'' }'
+- ' maven{ url ''https://maven.aliyun.com/repository/google''}'
+- ' maven{ url ''https://maven.aliyun.com/repository/gradle-plugin''}'
+- ' maven{ url ''https://maven.aliyun.com/repository/jcenter'' }'
+- ' maven{ url ''https://maven.aliyun.com/repository/jcenter''}'
+- ' maven{ url ''https://maven.aliyun.com/repository/public''}'
+- ' maven{url "https://plugins.gradle.org/m2/"}'
+- ' maven{url ''http://maven.aliyun.com/nexus/content/groups/public''}'
+- "\tmaven {\n\t\t\t\turl \"https://oss.sonatype.org/content/repositories/snapshots\"\
+  \n\t\t\t}"
+- "\tmaven {\n\t\t\turl \"$rootDir/../node_modules/react-native-background-fetch/android/libs\"\
+  \n\t\t}"
+- "\tmaven {\n\t\t\turl \"https://jitpack.io\"\n\t\t}"
+- "\tmaven {\n\t\t\turl \"https://plugins.gradle.org/m2/\"\n\t\t}"
+- "\tmaven {\n\t\t\turl 'http://4thline.org/m2'\n\t\t}"
+- "\tmaven {\n\t\t\turl 'https://maven.google.com/'\n\t\t\tname 'Google'\n\t\t}"
+- "\tmaven {\n\t\t\turl 'https://plugins.gradle.org/m2/'\n\t\t}"
+- "\tmaven {\n\t\turl \"file://$pwd/.m2repo\"\n\t}"
+- "\tmaven {\n\t\turl \"https://jitpack.io\"\n\t}"
+- "\tmaven {\n\t\turl 'https://maven.google.com/'\n\t\tname 'Google'\n\t}"
+- "\tmaven {\n            // Google Maven Repository\n            url 'https://maven.google.com'\n\
+  \        }"
+- "\tmaven { url \"http://dl.bintray.com/populov/maven\" }"
+- "\tmaven { url \"https://jitpack.io\" }"
+- "\tmaven { url 'http://download.crashlytics.com/maven' }"
+- "\tmaven { url 'http://maven.ghostscript.com/' }"
+- "\tmaven { url 'https://jitpack.io' }"
+- "\tmaven { url 'https://maven.fabric.io/public' }"
+- "\tmaven { url MAVEN_REPO }"
+- ' maven  { url "http://repo1.maven.org/maven2" }'
+- " maven {\n\t    url 'https://jitpack.io'\n        }"
+- " maven {\n\t  url System.getenv()['ANDROID_HOME'] + \"/extras/android/m2repository\"\
+  \n    }"
+- " maven {\n                url \"$buildDir/repo\"\n            }"
+- " maven {\n                url \"file:~/.m2/\"\n                artifactUrls \"\
+  file:~/.m2/\"\n            }"
+- " maven {\n                url \"https://oss.sonatype.org/content/repositories/snapshots\"\
+  \n            }"
+- " maven {\n                url \"https://plugins.gradle.org/m2/\"\n            }"
+- " maven {\n                url 'https://maven.fabric.io/public'\n            }"
+- " maven {\n                url repository\n            }"
+- " maven {\n            // All of React Native (JS, Obj-C sources, Android binaries)\
+  \ is installed from npm\n            // url \"$rootDir/../node_modules/react-native/android\"\
+  \n\n            // Replace AAR from original RN with AAR from react-native-v8\n\
+  \            url(\"$rootDir/../node_modules/react-native-v8/dist\")\n        }"
+- " maven {\n            // All of React Native (JS, Obj-C sources, Android binaries)\
+  \ is installed from npm\n            url \"$projectDir/../../node_modules/react-native/android\"\
+  \n        }"
+- " maven {\n            // All of React Native (JS, Obj-C sources, Android binaries)\
+  \ is installed from npm\n            url \"$projectDir/../../tests/react-test-app/node_modules/react-native/android\"\
+  \n        }"
+- " maven {\n            // All of React Native (JS, Obj-C sources, Android binaries)\
+  \ is installed from npm\n            url \"$rootDir/../node_modules/react-native/android\"\
+  \n        }"
+- " maven {\n            // All of React Native (JS, Obj-C sources, Android binaries)\
+  \ is installed from npm\n            url(\"$rootDir/../node_modules/react-native/android\"\
+  )\n        }"
+- " maven {\n            // Android JSC is installed from npm\n            url(\"\
+  $rootDir/../node_modules/jsc-android/dist\")\n        }"
+- " maven {\n            // Local Maven repo containing AARs with JSC library built\
+  \ for Android\n            // url \"$rootDir/../node_modules/jsc-android/dist\"\n\
+  \n            // prebuilt libv8android.so\n            url(\"$rootDir/../node_modules/v8-android/dist\"\
+  )\n        }"
+- " maven {\n            //noinspection GroovyAssignabilityCheck\n            url\
+  \ 'https://jitpack.io'\n        }"
+- " maven {\n            //noinspection GroovyAssignabilityCheck\n            url\
+  \ 'https://s3.amazonaws.com/moat-sdk-builds'\n        }"
+- " maven {\n            //url 'https://maven.google.com/'\n            url 'https://jitpack.io'\n\
+  \            name 'Google'\n        }"
+- " maven {\n            name 'glide-snapshot'\n            url 'http://oss.sonatype.org/content/repositories/snapshots'\n\
+  \        }"
+- " maven {\n            url  \"http://dl.bintray.com/countly/maven\"\n        }"
+- " maven {\n            url \"./maven_repository/\"\n        }"
+- " maven {\n            url \"http://dl.bintray.com/dasar/maven\"\n        }"
+- " maven {\n            url \"http://dl.bintray.com/jenzz/maven\"\n        }"
+- " maven {\n            url \"http://dl.bintray.com/journeyapps/maven\"\n       \
+  \ }"
+- " maven {\n            url \"http://dl.bintray.com/lukaville/maven\"\n        }"
+- " maven {\n            url \"https://clojars.org/repo/\"\n        }"
+- " maven {\n            url \"https://dl.bintray.com/videolan/Android\"\n       \
+  \ }"
+- " maven {\n            url \"https://github.com/jitsi/jitsi-maven-repository/raw/master/releases\"\
+  \n        }"
+- " maven {\n            url \"https://github.com/vector-im/jitsi_libre_maven/raw/master/releases\"\
+  \n        }"
+- " maven {\n            url \"https://jcenter.bintray.com\"\n        }"
+- " maven {\n            url \"https://jitpack.io\"\n\n        }"
+- " maven {\n            url \"https://jitpack.io\"\n            content {\n     \
+  \           // For some reason gradle attempts to get bugsnag from here, which returns\
+  \ 522\n                // after which gradle just drops jitpack. Exclude so it doesn't\
+  \ bother trying.\n                excludeGroupByRegex \".*bugsnag.*\"\n        \
+  \    }"
+- " maven {\n            url \"https://jitpack.io\"\n        }"
+- " maven {\n            url \"https://jitpack.io/\"\n        }"
+- " maven {\n            url \"https://maven.fabric.io/public\"\n        }"
+- " maven {\n            url \"https://maven.google.com\"\n            name 'Google'\n\
+  \        }"
+- " maven {\n            url \"https://maven.google.com\"\n        }"
+- " maven {\n            url \"https://maven.google.com/\"\n            name 'Google'\n\
+  \        }"
+- " maven {\n            url \"https://maven.mozilla.org/maven2\"\n        }"
+- " maven {\n            url \"https://oss.sonatype.org/content/repositories/snapshots\"\
+  \n        }"
+- " maven {\n            url \"https://oss.sonatype.org/content/repositories/snapshots/\"\
+  \n        }"
+- " maven {\n            url \"https://plugins.gradle.org/m2/\"\n        }"
+- " maven {\n            url \"https://repo1.maven.org/maven2\"\n            jcenter()\n\
+  \        }"
+- " maven {\n            url \"https://repo1.maven.org/maven2\"\n        }"
+- " maven {\n            url \"https://s3.amazonaws.com/repo.commonsware.com\"\n \
+  \           }"
+- " maven {\n            url \"https://s3.amazonaws.com/repo.commonsware.com\"\n \
+  \       }"
+- " maven {\n            url 'http://oss.sonatype.org/content/repositories/snapshots'\n\
+  \        }"
+- " maven {\n            url 'http://oss.sonatype.org/content/repositories/snapshots/'\n\
+  \        }"
+- " maven {\n            url 'http://www.idescout.com/maven/repo/'\n            name\
+  \ 'IDEScout, Inc.'\n        }"
+- " maven {\n            url 'https://github.com/suckgamony/RapidDecoder/raw/master/repository'\n\
+  \        }"
+- " maven {\n            url 'https://jitpack.io'\n            content {\n       \
+  \         // Use this repo only for matrix SDK library\n                includeGroupByRegex\
+  \ \"com\\\\.github\\\\.Bubu\"\n                // Also add subgroups, due to SDK\
+  \ split into modules\n                includeGroupByRegex \"com\\\\.github\\\\.Bubu\\\
+  \\.matrix-android-sdk\"\n                // And Olm library\n                includeGroupByRegex\
+  \ \"org\\\\.matrix\\\\.gitlab\\\\.matrix-org\"\n                // And PhotoView\n\
+  \                includeGroupByRegex \"com\\\\.github\\\\.chrisbanes\"\n       \
+  \     }"
+- " maven {\n            url 'https://jitpack.io'\n            content {\n       \
+  \         // Use this repo only for matrix SDK library\n                includeGroupByRegex\
+  \ \"com\\\\.github\\\\.matrix-org\"\n                // Also add subgroups, due\
+  \ to SDK split into modules\n                includeGroupByRegex \"com\\\\.github\\\
+  \\.matrix-org\\\\.matrix-android-sdk\"\n                // And Olm library\n   \
+  \             includeGroupByRegex \"org\\\\.matrix\\\\.gitlab\\\\.matrix-org\"\n\
+  \                // And PhotoView\n                includeGroupByRegex \"com\\\\\
+  .github\\\\.chrisbanes\"\n            }"
+- " maven {\n            url 'https://jitpack.io'\n        }"
+- " maven {\n            url 'https://maven.fabric.io/public'\n        }"
+- " maven {\n            url 'https://maven.google.com'\n        }"
+- " maven {\n            url 'https://maven.google.com/'\n            name 'Google'\n\
+  \        }"
+- " maven {\n            url 'https://maven.google.com/'\n        }"
+- " maven {\n            url 'https://mint.splunk.com/gradle/'\n        }"
+- " maven {\n            url 'https://oss.sonatype.org/content/groups/public'\n  \
+  \      }"
+- " maven {\n            url 'https://oss.sonatype.org/content/repositories/snapshots'\n\
+  \        }"
+- " maven {\n            url 'https://oss.sonatype.org/content/repositories/snapshots/'\n\
+  \        }"
+- " maven {\n            url 'https://plugins.gradle.org/m2/'\n        }"
+- " maven {\n            url 'https://www.jitpack.io'\n        }"
+- " maven {\n            url = \"${project.buildDir}"
+- " maven {\n            url(\"$rootDir/../node_modules/jsc-android/dist\")\n    \
+  \    }"
+- " maven {\n            url(\"$rootDir/../node_modules/react-native/android\")\n\
+  \        }"
+- " maven {\n        // For the latest version of GeckoView (moving target!) use:\n\
+  \        //   https://index.taskcluster.net/v1/task/gecko.v2.mozilla-central.nightly.latest.mobile.android-api-16-opt/artifacts/public/android/maven\n\
+  \        //\n        // For discovering available versions go to:\n        //  \
+  \ https://tools.taskcluster.net/index/gecko.v2.mozilla-central.nightly\n\n     \
+  \   // ARM GeckoView builds\n        url \"https://index.taskcluster.net/v1/task/gecko.v2.mozilla-central.nightly\"\
+  \ +\n                \".${geckoview_nightly_date}"
+- " maven {\n        // Replace snapshots by releases for releases !\n        url\
+  \ \"https://linphone.org/snapshots/maven_repository\"\n    }"
+- " maven {\n        // Switch to release for releases !\n        url \"https://gitlab.linphone.org/BC/public/maven_repository/raw/master\"\
+  \n    }"
+- " maven {\n        // TODO: Remove this after support library v24 public release.\n\
+  \        url \"$rootDir/prebuilts/fullsdk/extras/android/m2repository\"\n    }"
+- " maven {\n        // Used only for PhotoView\n        url \"https://jitpack.io\"\
+  \n        name 'JitPack Github wrapper'\n    }"
+- " maven {\n        // aarch64 builds\n        url \"https://index.taskcluster.net/v1/task/gecko.v2.mozilla-central.nightly\"\
+  \ +\n                \".${geckoview_nightly_date}"
+- " maven {\n        // x86 GeckoView builds\n        url \"https://index.taskcluster.net/v1/task/gecko.v2.mozilla-central.nightly\"\
+  \ +\n                \".${geckoview_nightly_date}"
+- " maven {\n        //url 'https://maven.google.com/'\n        url 'https://jitpack.io'\n\
+  \        name 'Google'\n    }"
+- " maven {\n        url \"http://4thline.org/m2\"\n    }"
+- " maven {\n        url \"http://dl.bintray.com/lukaville/maven\"\n    }"
+- " maven {\n        url \"https://dl.google.com/dl/android/maven2/\"\n    }"
+- " maven {\n        url \"https://jitpack.io\"\n    }"
+- " maven {\n        url \"https://linphone.org/maven_repository\"\n    }"
+- " maven {\n        url \"https://maven.fabric.io/public\"\n    }"
+- " maven {\n        url \"https://maven.google.com\"\n    }"
+- " maven {\n        url \"https://oss.sonatype.org/content/repositories/snapshots\"\
+  \n    }"
+- " maven {\n        url \"https://repo.commonsware.com.s3.amazonaws.com\"\n    }"
+- " maven {\n        url \"https://repo1.maven.org/maven2/\"\n    }"
+- " maven {\n        url 'http://4thline.org/m2'\n    }"
+- " maven {\n        url 'http://dl.bintray.com/amulyakhare/maven'\n    }"
+- " maven {\n        url 'https://dl.bintray.com/amulyakhare/maven'\n    }"
+- " maven {\n        url 'https://github.com/Goddchen/mvn-repo/raw/master/'\n    }"
+- " maven {\n        url 'https://github.com/toxbee/mvn-repo/raw/master/maven-deploy'\n\
+  \    }"
+- " maven {\n        url 'https://jitpack.io'\n    }"
+- " maven {\n        url 'https://maven.fabric.io/public'\n    }"
+- " maven {\n        url 'https://maven.google.com'\n        // Alternative URL is\
+  \ 'https://dl.google.com/dl/android/maven2/'\n        url \"https://jitpack.io\"\
+  \n    }"
+- " maven {\n        url 'https://maven.google.com'\n    }"
+- " maven {\n        url 'https://maven.google.com/'\n        name 'Google'\n    }"
+- " maven {\n        url 'https://oss.sonatype.org/content/repositories/snapshots'\n\
+  \    }"
+- " maven {\n        url 'https://oss.sonatype.org/content/repositories/snapshots/'\n\
+  \    }"
+- " maven {\n        url 'https://raw.github.com/nicolasjafelle/maven-repo/master/'\n\
+  \    }"
+- " maven {\n        url 'https://raw.githubusercontent.com/felixb/mvn-repo/master'\n\
+  \    }"
+- " maven {\n        url xwalkMavenRepo\n      }"
+- " maven {\n      url \"https://github.com/Goddchen/mvn-repo/raw/master/\"\n    }"
+- " maven {\n      url \"https://github.com/dahlgren/abs-aar/raw/master\"\n    }"
+- " maven {\n      url \"https://jcenter.bintray.com\"\n    }"
+- " maven {\n      url \"https://repo.commonsware.com.s3.amazonaws.com\"\n    }"
+- " maven {\n      url 'http://download.crashlytics.com/maven'\n    }"
+- " maven {\n      url 'https://maven.google.com/'\n      name 'Google'\n    }"
+- " maven {\n      url 'https://raw.github.com/ark/ark/master/releases/'\n    }"
+- " maven {\n      url 'https://raw.github.com/iFixit/ark/master/releases/'\n   }"
+- " maven {\n    setUrl(\"https://plugins.gradle.org/m2/\")\n  }"
+- " maven {\n    url 'https://maven.google.com'\n  }"
+- ' maven {
+
+  //            url "https://jitpack.io"
+
+  //            url "https://maven-central.storage.googleapis.com"
+
+  //            url "http://repo.spring.io/plugins-release/"
+
+  //        }'
+- ' maven {   url "https://maven.google.com"  }'
+- ' maven { setUrl("https://plugins.gradle.org/m2/") }'
+- ' maven { setUrl("https://www.jitpack.io") }'
+- ' maven { url  "http://dl.bintray.com/dasar/maven" }'
+- ' maven { url  "https://dl.bintray.com/bjoernq/maven" }'
+- ' maven { url  "https://dl.bintray.com/ligi/maven" }'
+- ' maven { url  "https://dl.bintray.com/lukaville/maven" }'
+- ' maven { url  "https://jetbrains.bintray.com/trove4j" }'
+- ' maven { url "$rootDir/../node_modules/react-native/android" }'
+- ' maven { url "file:${rootProject.projectDir}'
+- ' maven { url "http://dl.bintray.com/amulyakhare/maven" }'
+- ' maven { url "http://dl.bintray.com/arturbosch/code-analysis" }'
+- ' maven { url "http://dl.bintray.com/countly/maven" }'
+- ' maven { url "http://dl.bintray.com/davideas/maven" }'
+- ' maven { url "http://dl.bintray.com/drummer-aidan/maven" }'
+- ' maven { url "http://dl.bintray.com/drummer-aidan/maven/com/afollestad" }'
+- ' maven { url "http://dl.bintray.com/lukaville/maven" }'
+- ' maven { url "http://dl.bintray.com/populov/maven" }'
+- ' maven { url "http://objectbox.net/beta-repo/" }'
+- ' maven { url "http://repo.commonsware.com.s3.amazonaws.com" }'
+- ' maven { url "http://repo.maven.apache.org/maven2" }'
+- ' maven { url "https://clojars.org/repo" }'
+- ' maven { url "https://clojars.org/repo/" }'
+- ' maven { url "https://dl.bintray.com/android/android-tools/" }'
+- ' maven { url "https://dl.bintray.com/drummer-aidan/maven" }'
+- ' maven { url "https://dl.bintray.com/markusamshove/maven" }'
+- ' maven { url "https://dl.bintray.com/mockito/maven/" }'
+- ' maven { url "https://dl.bintray.com/osborn/Android" }'
+- ' maven { url "https://github.com/jitsi/jitsi-maven-repository/raw/master/releases"
+  }'
+- ' maven { url "https://jcenter.bintray.com" }'
+- " maven { url \"https://jitpack.io\"\n    }"
+- ' maven { url "https://jitpack.io" }'
+- ' maven { url "https://jitpack.io"}'
+- ' maven { url "https://kotlin.bintray.com/kotlinx" }'
+- ' maven { url "https://maven.fabric.io/public" }'
+- " maven { url \"https://maven.google.com\"\n    }"
+- ' maven { url "https://maven.google.com" }'
+- ' maven { url "https://maven.google.com"}'
+- ' maven { url "https://maven.google.com/" }'
+- ' maven { url "https://oss.sonatype.org/content/groups/public" }'
+- ' maven { url "https://oss.sonatype.org/content/groups/public/" }'
+- ' maven { url "https://oss.sonatype.org/content/repositories/releases/" }'
+- ' maven { url "https://oss.sonatype.org/content/repositories/snapshots" }'
+- ' maven { url "https://oss.sonatype.org/content/repositories/snapshots/" }'
+- ' maven { url "https://plugins.gradle.org/m2" }'
+- ' maven { url "https://plugins.gradle.org/m2/" }'
+- ' maven { url "https://plugins.gradle.org/m2/"}'
+- ' maven { url "https://repo.commonsware.com.s3.amazonaws.com" }'
+- ' maven { url "https://repo.commonsware.com.s3.amazonaws.com"}'
+- ' maven { url "https://repo.eclipse.org/content/groups/releases" }'
+- ' maven { url "https://repo.maven.apache.org/maven2" }'
+- ' maven { url "https://repository.aspose.com/repo/" }'
+- ' maven { url "https://s3.amazonaws.com/repo.commonsware.com" }'
+- ' maven { url "https://www.jitpack.io" }'
+- ' maven { url ''../../prebuilts/gradle-plugin'' }'
+- ' maven { url ''../../prebuilts/tools/common/m2/internal'' }'
+- ' maven { url ''../../prebuilts/tools/common/m2/repository'' }'
+- ' maven { url ''file:///usr/share/maven-repo'' }'
+- ' maven { url ''http://dl.bintray.com/amulyakhare/maven'' }'
+- ' maven { url ''http://download.crashlytics.com/maven'' }'
+- ' maven { url ''http://guardian.github.com/maven/repo-releases'' }'
+- ' maven { url ''http://igniterealtime.org/repo'' }'
+- ' maven { url ''http://repo1.maven.org/maven2'' }'
+- ' maven { url ''http://wordpress-mobile.github.io/WordPress-Android'' }'
+- ' maven { url ''https://dl.bintray.com/content/simonpoole/android'' }'
+- ' maven { url ''https://dl.bintray.com/content/simonpoole/div'' }'
+- ' maven { url ''https://dl.bintray.com/content/simonpoole/osm'' }'
+- ' maven { url ''https://dl.bintray.com/twofortyfouram/maven'' }'
+- ' maven { url ''https://dl.google.com/dl/android/maven2/'' }'
+- ' maven { url ''https://guardian.github.com/maven/repo-releases'' }'
+- ' maven { url ''https://igniterealtime.org/repo'' }'
+- ' maven { url ''https://jitpack.io'' }'
+- ' maven { url ''https://jitpack.io/'' }'
+- ' maven { url ''https://maven.fabric.io/public'' }'
+- ' maven { url ''https://maven.fabric.io/repo'' }'
+- ' maven { url ''https://maven.google.com'' }'
+- ' maven { url ''https://maven.google.com''}'
+- ' maven { url ''https://maven.google.com/'' }'
+- ' maven { url ''https://oss.jfrog.org/artifactory/oss-snapshot-local/'' }'
+- ' maven { url ''https://oss.sonatype.org/content/repositories/snapshots'' }'
+- ' maven { url ''https://oss.sonatype.org/content/repositories/snapshots/'' }'
+- ' maven { url ''https://plugins.gradle.org/m2/'' }'
+- ' maven { url ''https://repo1.maven.org/maven2'' /*maven-central with HTTPS*/}'
+- ' maven { url ''https://repo1.maven.org/maven2'' }'
+- ' maven { url ''https://repository-achartengine.forge.cloudbees.com/snapshot/''
+  }'
+- ' maven { url ''https://s3.amazonaws.com/repo.commonsware.com'' }'
+- ' maven { url ''https://www.jitpack.io'' }'
+- ' maven { url ''libs'' }'
+- ' maven { url = uri("https://jitpack.io") }'
+- ' maven { url = uri("https://maven.fabric.io/public") }'
+- ' maven { url MAVEN_REPO_CACHE }'
+- ' maven { url(''http://releases.marmeladburk.fidesmo.com/'') }'
+- ' maven {url "http://dl.bintray.com/tbruyelle/tbruyelle" }'
+- ' maven {url "https://clojars.org/repo/"}'
+- ' maven {url "https://jitpack.io"}'
+- " maven{\n            url 'https://maven.fabric.io/public'\n        }"
+- " maven{\n            url'https://plugins.gradle.org/m2/'\n        }"
+- " maven{\n        url \"https://maven.google.com\"\n    }"
+- ' maven{ url "https://oss.sonatype.org/content/repositories/releases/" }'
+- ' maven{ url "https://oss.sonatype.org/content/repositories/snapshots/" }'
+- ' maven{ url ''https://jitpack.io'' }'
+- ' maven{ url ''https://maven.aliyun.com/repository/google''}'
+- ' maven{ url ''https://maven.aliyun.com/repository/gradle-plugin''}'
+- ' maven{ url ''https://maven.aliyun.com/repository/jcenter''}'
+- ' maven{ url ''https://maven.aliyun.com/repository/public''}'
+- ' maven{url "https://jitpack.io"}'
+- ' maven{url "https://plugins.gradle.org/m2/"}'
diff --git a/tests/scanner.TestCase b/tests/scanner.TestCase
index 354c2f64..67cef2fd 100755
--- a/tests/scanner.TestCase
+++ b/tests/scanner.TestCase
@@ -11,6 +11,7 @@ import tempfile
 import textwrap
 import unittest
 import uuid
+import yaml
 from unittest import mock
 
 localmodule = os.path.realpath(
@@ -82,6 +83,27 @@ class ScannerTest(unittest.TestCase):
                             i += 1
             self.assertEqual(count, i)
 
+    def test_scan_source_files_sneaky_maven(self):
+        """Check for sneaking in banned maven repos"""
+        testdir = tempfile.mkdtemp(prefix=inspect.currentframe().f_code.co_name, dir=self.tmpdir)
+        os.chdir(testdir)
+        fdroidserver.scanner.config = None
+        fdroidserver.scanner.options = mock.Mock()
+        fdroidserver.scanner.options.json = True
+        with open('build.gradle', 'w') as fp:
+            fp.write(textwrap.dedent("""
+                 maven {
+                    "https://jitpack.io"
+                    url 'https://maven.fabric.io/public'
+                 }
+                 maven {
+                    "https://maven.google.com"
+                    setUrl('https://evilcorp.com/maven')
+                 }
+            """))
+        count = fdroidserver.scanner.scan_source(testdir)
+        self.assertEqual(2, count, 'there should be this many errors')
+
     def test_scan_source_file_types(self):
         """Build product files are not allowed, test they are detected"""
         testdir = tempfile.mkdtemp(prefix=inspect.currentframe().f_code.co_name, dir=self.tmpdir)
@@ -221,6 +243,20 @@ class ScannerTest(unittest.TestCase):
         self.assertTrue(os.path.exists('foo.aar'))
         self.assertFalse(os.path.exists('gradle-wrapper.jar'))
 
+    def test_gradle_maven_url_regex(self):
+        """Check the regex can find all the cases"""
+        with open(os.path.join(self.basedir, 'gradle-maven-blocks.yaml')) as fp:
+            data = yaml.safe_load(fp)
+
+        urls = []
+        for entry in data:
+            found = False
+            for m in fdroidserver.scanner.MAVEN_URL_REGEX.findall(entry):
+                urls.append(m)
+                found = True
+            self.assertTrue(found, 'this block should produce a URL:\n' + entry)
+        self.assertEqual(len(data), len(urls), 'each data example should produce a URL')
+
 
 if __name__ == "__main__":
     os.chdir(os.path.dirname(__file__))