kamp/fdroidserver
1
0
Fork 0
mirror of https://gitlab.com/fdroid/fdroidserver.git synced 2024-11-18 12:40:11 +01:00
Code Activity
8,630 Commits 1 Branch 59 Tags 43 MiB
12b816421f
Commit Graph

8630 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Hans-Christoph Steiner
39c339e5a1 jenkins: force local basebox, do not download from Vagrant Cloud 
Until we have a verification process for boxes downloaded from Vagrant
Cloud, the official setup uses a locally generated basebox.
 2018-09-19 16:48:00 +02:00
Hans-Christoph Steiner
ee509782a2 buildserver: apt-transport-https needs ca-certificates 
ca-certificates is set as Recommends: but for our use cases it is required
since without it, standard CA-signed certs fail to validate.
 2018-09-19 16:48:00 +02:00
Hans-Christoph Steiner
d9e9cc20aa gitlab-ci: install python3-defusedxml in debian_testing and ubuntu_lts 
fdroid/fdroidserver!578
 2018-09-19 16:48:00 +02:00
Hans-Christoph Steiner
ffcd8c3bd4 Merge branch 'gradle-4.10.1' into 'master' 
add gradle 4.10.1 to makebuildserver and gradlew-fdroid

Closes #569

See merge request fdroid/fdroidserver!579
 2018-09-19 06:30:11 +00:00
Michael Pöhn
7c9c1d4aaf add gradle 4.10.1 to makebuildserver and gradlew-fdroid 2018-09-19 00:03:01 +02:00
Hans-Christoph Steiner
d3bf347a97 Merge branch 'update-basebox-to-fdroid-basebox-stretch64' into 'master' 
update basebox to fdroid/basebox-stretch64

See merge request fdroid/fdroidserver!576
 2018-09-18 12:59:44 +00:00
Michael Pöhn
4af9199c92 update basebox to fdroid/basebox-stretch64 2018-09-18 12:50:22 +02:00
Michael Pöhn
4a69a37d8e Merge branch 'fix-aapt-28-scraping' into 'master' 
Fix aapt 28 scraping

Closes #568 and #565

See merge request fdroid/fdroidserver!575
 2018-09-18 09:38:13 +00:00
Hans-Christoph Steiner
4c4da3d176 update: remove 'SET' debug antifeature, closes #565 
oops, this slipped in in 3011953d0e

Bump the metadata version to purge the cache
 2018-09-18 10:57:10 +02:00
Hans-Christoph Steiner
92c4f048de update: test scan_apk() with both aapt and androguard 
#568
 2018-09-18 10:55:51 +02:00
Hans-Christoph Steiner
3e0d1beb09 update: finish porting permissions regex to remove group names 
Finish the job from 3011953d0e

closes #568
 2018-09-18 10:55:51 +02:00
Hans-Christoph Steiner
807bf3d26b build: reuse common methods for getting metadata from APKs 
This splits out the code that gets the list of native ABIs supported, then
uses the standard methods for the rest.
 2018-09-18 10:55:51 +02:00
Hans-Christoph Steiner
487c4d02f3 handle package: line output from aapt v28 
fdroid/fdroiddata!3484
fdroid/fdroiddata!3562
fdroid/fdroidserver!548
 2018-09-18 10:55:51 +02:00
Hans-Christoph Steiner
d1acef0405 tests: generate aapt output for every version to make tests easy 2018-09-18 10:55:51 +02:00
Michael Pöhn
c95cbfdf9c Merge branch 'use_available_buildserver_box' into 'master' 
vmtools: use whatever buildserver box is available

Closes #497

See merge request fdroid/fdroidserver!574
 2018-09-18 08:52:51 +00:00
Hans-Christoph Steiner
566bf7c776 Merge branch '482-upgrade-buildserver-to-stretch' into 'master' 
upgrade buildserver basebox to stretch

Closes #514 and #482

See merge request fdroid/fdroidserver!514
 2018-09-17 18:18:03 +00:00
Hans-Christoph Steiner
6f889a08d7 jenkins: switch to locally generated stretch64 basebox 2018-09-13 12:07:08 +02:00
Hans-Christoph Steiner
fd7cc2c954 document how to avoid downloading from vagrant cloud 2018-09-13 12:06:51 +02:00
Michael Pöhn
6d0797eb5e allow using remote boxes from vagrant cloud 2018-09-13 11:11:18 +02:00
Michael Pöhn
98806d7c01 configure headless openjdk to run without gtk accessability dependencies 2018-09-13 11:11:18 +02:00
Michael Pöhn
9136080def update default mirror to deb.debian.org 2018-09-13 11:11:18 +02:00
Michael Pöhn
5e4eb294c5 switch to fdroid-stretch64 basebox; remove baseboxurl form makebuildserver 2018-09-13 11:11:18 +02:00
Michael Pöhn
c005d8c5f4 more detailed error message and handling when fetching buildserverid in build.py 2018-09-13 11:11:18 +02:00
Michael Pöhn
a5ef08f57d more general regex for updating debian repo urls in buildserver provisions 2018-09-13 11:11:18 +02:00
Michael Pöhn
aa86e56338 updated buildserver provisions to stretch 2018-09-13 11:11:18 +02:00
Michael Pöhn
ba92623c1e Merge branch 'vmtools_561' into 'master' 
actually use the chosen vagrant provider

Closes #561

See merge request fdroid/fdroidserver!573
 2018-09-13 08:50:21 +00:00
Marcus Hoffmann
1b95452c14 vmtools: use whatever buildserver box is available 
When we don't have an already working builder/.vagrant directory
look for available buildserver vagrant boxes because we'll need to
import one.

Abort if there's no buildserver box.

Fixes: #497
 2018-09-12 14:12:12 +02:00
Marcus Hoffmann
1e90b6118e vmtools: fix comment typos 2018-09-12 12:59:11 +02:00
Marcus Hoffmann
b0cce0b8c4 vmtools: actually use the chosen provider 
Fixes #561
 2018-09-12 12:59:11 +02:00
Hans-Christoph Steiner
ad9a07b47e Merge branch 'little-security-fixes' into 'master' 
Little security fixes

Closes #555

See merge request fdroid/fdroidserver!572
 2018-09-07 13:32:32 +00:00
Hans-Christoph Steiner
9d12b1dc61 add strict, tested validation of Android/F-Droid package names 
Android has stricter rules than Java for Package Names, but anything the
Python regex thinks is valid must be valid according to Java's rules too.

https://developer.android.com/studio/build/application-id
 2018-09-07 14:17:39 +02:00
Hans-Christoph Steiner
3ab66efcfe update: max image size of 16 mil pixels to stop image bomb attacks 
closes #555
 2018-09-07 10:34:56 +02:00
Hans-Christoph Steiner
0cd1e0b172 gitlab-ci: include fdroid in bandit scans 2018-09-07 10:34:56 +02:00
Hans-Christoph Steiner
8b17076525 jenkins-build-all: error msg when buildserver VM not found 2018-09-05 14:37:36 +02:00
Hans-Christoph Steiner
b254472a99 Merge branch 'exclude-filter' into 'master' 
build: replace exclude with filter during source tar creation

Closes #531

See merge request fdroid/fdroidserver!538
 2018-09-05 12:39:23 +00:00
Marcus
de5455e273 Merge branch 'minor-security-fixups' into 'master' 
Minor security fixups

Closes #163

See merge request fdroid/fdroidserver!570
 2018-09-04 11:05:25 +00:00
Hans-Christoph Steiner
8f48976cb9 Merge branch 'drop-pickle-for-json' into 'master' 
Drop pickle for json

Closes #163

See merge request fdroid/fdroidserver!568
 2018-09-03 21:10:26 +00:00
Hans-Christoph Steiner
9bccb2c73e temp fallback to built-in ElementTree if defusedxml is not there 2018-09-03 23:02:31 +02:00
Hans-Christoph Steiner
cf4c9cb4ee buildserver now needs python3-defusedxml 
4d13a904f3 means that defusedxml is required
to be installed on the buildserver guest.
 2018-09-03 22:56:08 +02:00
Hans-Christoph Steiner
11b3e5be3a update: throw exception for APKs with invalid Application ID 
Android Application IDs must be valid Java Package Names.  While the build
tools likely validate the Application ID, it is possible to manually create
a malicious APK.
 2018-09-03 22:56:08 +02:00
Hans-Christoph Steiner
5d161cc9fd validate appid when reading metadata files 
The metadata file must be named after the Application ID of the app it is
describing, and Android Application IDs must be valid Java Package Names.
 2018-09-03 22:56:08 +02:00
Hans-Christoph Steiner
3011953d0e convert apkcache from pickle to JSON 
pickle can serialize executable code, while JSON is only ever pure data.
The APK cache is only ever pure data, so no need for the security risks of
pickle.  For example, if some malicious thing gets write access on the
`fdroid update` machine, it can write out a custom tmp/apkcache which would
then be executed.  That is not possible with JSON.

This does just ignore any existing cache and rebuilds from scratch. That is
so we don't need to maintain pickle anywhere, and to ensure there are no
glitches from a conversion from pickle to JSON.

closes #163
 2018-09-03 18:07:40 +02:00
Marcus Hoffmann
74776e026f gradlew-fdroid: add gradle 4.10 2018-09-03 14:47:36 +02:00
Marcus Hoffmann
d7b249272a makebuildserver: add gradle 4.10 2018-09-03 14:44:33 +02:00
Hans-Christoph Steiner
c7d5050091 Merge branch 'bandit-scanner-and-fixes' into 'master' 
Bandit scanner and fixes

See merge request fdroid/fdroidserver!567
 2018-08-30 13:06:07 +00:00
Hans-Christoph Steiner
3ffe2860f3 gitlab-ci: add 'bandit' security scanner to all runs 
bandit is used by Radically Open Security and is part of the GitLab Ultimate
Static Application Security Testing (SAST) suite.

https://docs.gitlab.com/ee/user/project/merge_requests/sast.html
 2018-08-29 17:48:06 +02:00
Hans-Christoph Steiner
4d13a904f3 use defusedxml to avoid DoS attacks while loading XML 2018-08-29 17:44:54 +02:00
Hans-Christoph Steiner
cc94ebca30 use global constant for the 'xmlns:android' XML namespace 2018-08-29 17:44:54 +02:00
Hans-Christoph Steiner
3e1d313b7c mark manually sanitized input so bandit doesn't complain 2018-08-29 17:44:54 +02:00
Hans-Christoph Steiner
2edc68d6cd mark all required permissions so bandit doesn't complain 2018-08-29 17:44:54 +02:00