Microsoft and SanDisk sign APKs with a X.509 certificate chain of
trust, so there are actually three certificates included. apksigner
only cares about one certificate and ignores the other certificates in
the chain.
The correct values come from:
apksigner verify --print-certs 883cbdae7aeb2e4b122e8ee8d89966c7062d0d49107a130235fa220a5b994a79.apk
X.509 certificates are machine generated and just data, so are not
copyrightable. So I included SANAPPSI.* directly.
When troubleshooting things that are difficult to reproduce locally, like
different behaviors in the fedora_latest job, these changes make it easy to
keep the test files around after the tests run. For example, if PNGs are
processed differently by newer Python versions.
Apparently, the newest Python thingies strip the PNGs a tiny bit smaller,
so a fixed file size will lead to the test failing:
https://gitlab.com/fdroid/fdroidserver/-/jobs/6703386074
```
Traceback (most recent call last):
File "/builds/fdroid/fdroidserver/tests/index.TestCase", line 704, in test_package_metadata
self.assertEqual(36027, metadata['featureGraphic']['en-US']['size'])
AssertionError: 36027 != 35619
```
This also makes androguard a hard requirement, which has been true for a
while anyway. So the code that handles androguard as an optional
requirement is removed. androguard from Debian/buster is new enough, so
this does not seem like it will cause any problems.
This adds a check for "testOnly" to the existing "debuggable" check, since
they are very similar. We should really be refactoring all the checks into
a more reasonable setup. Since "debuggable" and "testOnly" are both set in
the same place (`<application>` in _AndroidManifest.xml_) and are both set
by the same process (running debug builds), I thought it would be OK to
include both in the same place. Plus it was a one-line change.
Since we have limited visibility into @CiaranG's signing server, it is hard
to make changes to the publishing process, especially ones that might break
@CiaranG's automation. So `fdroid publish` mostly reports success by
moving an APK from unsigned/ to repo/. In some cases, we want immediate
failure, like in CI. So this adds `--error-on-failed` for that purpose.
The existing logic from d1ddd525c in !1225 is confusing because it adds its
own retry loop on top of the retry mechanism that is built into requests.
So this test confirms that setting `download_file(retries=3)` actually
results in more than three retries.
This moves all of the serverwebroot: logic into a function, and adds tests.
I did this because I ran into issues in the logic in main():
Traceback (most recent call last):
File "/builds/eighthave/fdroidserver/fdroid", line 22, in <module>
fdroidserver.__main__.main()
File "/builds/eighthave/fdroidserver/fdroidserver/__main__.py", line 230, in main
raise e
File "/builds/eighthave/fdroidserver/fdroidserver/__main__.py", line 211, in main
mod.main()
File "/builds/eighthave/fdroidserver/fdroidserver/deploy.py", line 753, in main
s = serverwebroot.rstrip('/').split(':')
AttributeError: 'dict' object has no attribute 'rstrip'
Since update_serverwebroot() is part of the public API, this function should
work without setting `fdroidserver.deploy.options` or
`fdroidserver.deploy.config`.
FreeBSD, macOS, and others come with BSD sed, which does not support all
the things that GNU sed does. Also, BSD rmdir does not have any extended
options like --ignore-fail-on-non-empty.
Python 3.12 completely removed the builtin `distutils` module. This
commit replaces its use with the `packaging` package, which is an
external dependency, but maintained by the Python developers.
Signed-off-by: Andrew Gunnerson <accounts+gitlab@chiller3.com>
The mirrors: entry in config.yml is great for quick access and shorter
mirror lists. Now that we are adding a lot more metadata to the mirrors,
including potentially the full text of the privacy policy, having this
in its own file should make these cases easier to manage.
Before, lots of pieces of the Android SDK were required for fdroidserver to
operate, like aapt, zipalign, etc. Now, apksigner is the only requirement.
%"support APK Signature v2+"
!889
https://gitlab.com/fdroid/fdroidclient/-/issues/2619#note_1421280589
The test needed to change because the test index files contained category
definitions that were not ever used in the "copy tests/repo, generate java/gpg
keys, update, and gpgsign" test in tests/run-tests.
!1366 makes it so categories are now defined by the repo. Categories can be
defined in the config so that lint has a list of categories to enforce. This
also provides a place for localization and icons for the categories. The old
way of defining categories was just listing them in app metadata files. This
restores that way of functioning when using index-v2.
closes#1137
The bug fixed in !1370 was due to a reuse of the per app anti features
dictionary in the per version one and adding the per version anti
features into it. This was not caught by the test suite as the app
versions are processed from newest to oldest and the test data had only
anti features in the oldest version. This patch adds an anti feature to
a newest version so only those in between should not have it.
The type conversion should all happen in post_parse_yaml_metadata whenever
possible. Also, when `if` blocks end in `return`, it is clearer if no
`elif` or `else` is used.
These test cases were writing assuming they had to transform the data
format. That is no longer the case. Going forward, the parsing process
converts everything to a standardized format. That will hopefully be
enforceable by the JSON Schema in the future.
* The metadata.Builds() class initializes all possible flags, then the
flags with init values are filtered out when writing out YAML.
* TYPE_SCRIPT flags with one entry will be converted to a string.
This should reduce surprises when dealing with filenames in things like
`rm:`. So any float/int/bool value can be used directly, without quoting.
* A plain str/int/float value is interpreted as a list of one string.
* Dictionaries as values throws error.
* A set is treated like a list.
Even for people who know what the special floats not-a-number, infinity,
and negative infinity, they don't necessarily know the YAML 1.2 syntax for
these. I didn't. And I've spent some quality time fighting things with
those values. They are also easy to reliably convert to string values.
If the metadata file contains NoSourceSince:, it is added to the collection
of Anti-Features. When rewriting the .yml file, NoSourceSince should only
be written into the AntiFeatures: collection if there are manual changes,
e.g. the user had provided translations.
