Hans-Christoph Steiner
bde0558d82
update: reject APKs with invalid file sig, probably Janus exploits
...
This just checks the first four bytes of the APK file, aka the "file
signature", to make sure it is the ZIP signature and not the DEX signature.
This was checked against the test APK, and I ran it against some known
malware and all of f-droid.org to make sure it works.
All valid ZIP files (therefore APK files) should start with the ZIP
Local File Header of four bytes.
https://www.guardsquare.com/en/blog/new-android-vulnerability-allows-attackers-modify-apps-without-affecting-their-signatures
2017-12-14 16:57:22 +01:00
Hans-Christoph Steiner
ca50adb2e5
update: switch tests to using standardized setUp() method
2017-12-14 16:57:22 +01:00
Hans-Christoph Steiner
61aac0503a
Merge branch 'fixFlavor' into 'master'
...
Regex only for flavor blocks: flavor { ... }
See merge request fdroid/fdroidserver!407
2017-12-14 16:56:01 +01:00
Hans-Christoph Steiner
bec4f7d547
add Conversations as gradle flavor test case
2017-12-14 16:52:02 +01:00
Andrea Scarpino
19a83b6219
Add Liberapay support
2017-12-12 11:53:31 +01:00
Hans-Christoph Steiner
6228162cbd
handle jarsigner/apksigner output cleanly for rational logging
...
These were both spamming the output with lots of confusing messages, even
when --verbose was not used. Jarsigner especially has confusing messages,
since it has warnings that do not pertain to APK signatures at all, like
the ones about timestamps and missing Certificate Authority.
closes #405
2017-12-07 17:32:14 +01:00
Hans-Christoph Steiner
05abbfbabd
gitlab-ci: move sdist test run to new fedora job
...
A full run of the test suite takes quite a bit of time. This removes one
of the 3 runs from the main 'tests' job, and puts it into the Fedora job.
That test run is mostly to make sure the setup.py and source tarball are
correctly, so that doesn't affect merge requests very often.
This also tests `pip install --user`, which was not really being tested
before.
2017-12-06 20:20:17 +01:00
Marcus Hoffmann
bfe2c00834
common.testCase: fix find_sdk_tools when aapt is installed in /usr/bin
...
The testlogic was broken when having both aapt in /usr/bin and also as
part of the android sdk.
2017-12-06 12:30:47 +01:00
Hans-Christoph Steiner
1c3a4479ab
add common.sign_apk() for nighly as test for using in publish
...
Since the MD5 migration was quite a bit of work, it makes sense to start
on moving away from SHA1 as much as possible while it is easy to do. SHA256
will only work in APK signatures on android-18 (4.3) or newer. So if an
APK has a minSdkVersion of 18 or newer, then sign with SHA256.
https://issuetracker.google.com/issues/36956587
https://android-review.googlesource.com/c/platform/libcore/+/44491
2017-12-04 22:52:41 +01:00
Hans-Christoph Steiner
3f4e93bf86
Merge branch 'metadataFlavours' into 'master'
...
Add flavour to metadata
See merge request fdroid/fdroidserver!370
2017-12-02 20:51:24 +00:00
tobiasKaminsky
d5ecb34df7
add flavour to metadata
2017-12-01 15:25:00 +01:00
Hans-Christoph Steiner
5b22ff7dc6
tests: use standard dir setup so all tests start in same dir
2017-11-30 17:32:53 +01:00
Hans-Christoph Steiner
3ff4b656c6
tests: name temp test dir after test function that used it
2017-11-30 17:32:53 +01:00
Hans-Christoph Steiner
30b2f5a48a
build: sort fdroid build --all by most recently changed first
2017-11-30 17:32:53 +01:00
Hans-Christoph Steiner
c7c40cb59f
PEP8 fixes
2017-11-30 13:42:37 +01:00
tobiasKaminsky
33aee96ed9
added test case
2017-11-30 11:12:18 +01:00
Hans-Christoph Steiner
743ef9ba00
rename test files to work round filename length limits
...
It seems a lot of things like tar, Windows, some filesystems, etc. do not
handle long filenames. #416
2017-11-27 16:57:30 +01:00
Hans-Christoph Steiner
e33684fc9b
tests: new tests for stacktraces caused by translated help strings
2017-11-22 11:40:16 +01:00
Hans-Christoph Steiner
cbd9669105
rename test file to fit within eCryptfs filename limits ( closes #416 )
2017-11-22 11:40:16 +01:00
Hans-Christoph Steiner
cd3e763953
tests: only test fdroid build if the right build-tools is installed
2017-11-09 14:07:40 +01:00
Hans-Christoph Steiner
a14124955a
tests: fix fdroid build test with Debian gradle
2017-11-09 13:11:49 +01:00
Hans-Christoph Steiner
2ee32f3524
fix tests to work when only Debian Android SDK is installed
...
jenkins.debian.net only had `apt install android-sdk`, it does not have any
of Google's packages installed.
2017-11-08 14:05:17 +01:00
Hans-Christoph Steiner
17efa13183
tests: pre-set failfast as reminder of a handy time saver
2017-10-25 23:01:25 +02:00
Hans-Christoph Steiner
e0df6d2479
choose the most recent available version of Java
...
This came about testing on OSX, where there are often multiple versions of
the JDK installed. This was choosing the oldest version. It should
choose the most recent version.
2017-10-25 23:01:25 +02:00
Hans-Christoph Steiner
49bd5a6462
use Babel to compile localizations and include in source tarball
...
python3-babel was also included in the gitlab-ci docker image:
ffc08dbc1d
2017-10-19 23:28:13 +02:00
Hans-Christoph Steiner
7d4e354f25
FDroidException handle Exceptions that return things other than str
...
This is related to a4c4a16ed9
2017-10-19 20:38:43 +02:00
Hans-Christoph Steiner
af0d8ab84c
tests: make pip3 install quieter for shorter CI logs
2017-10-19 20:23:57 +02:00
Michael Pöhn
788c8f97fd
better error message in publish when repo_key is not set
2017-10-17 22:10:39 +02:00
Michael Pöhn
89d9d0c45b
use OrderedDict for localization data in index-v1
2017-09-26 14:15:48 +02:00
Michael Pöhn
26192a00e2
make sure all timestamps in index-v1 are utc
2017-09-26 14:15:27 +02:00
Michael Pöhn
a2d361dec8
add test for index-v1.json
2017-09-26 14:12:59 +02:00
Michael Pöhn
b6b79edf11
store fdroid signing-key-fp-list in stats dir
2017-09-26 14:11:09 +02:00
Michael Pöhn
6930edf889
sort index-v1; publish now creates and stores a list of signature fingerprints
2017-09-26 14:11:09 +02:00
Michael Pöhn
bca07f794f
added functions for storing/loading signer fingerprints to stats
2017-09-26 14:11:09 +02:00
Michael Pöhn
5a524d4d0c
added some developer-signing key metadata to tests
2017-09-26 14:11:09 +02:00
Michael Pöhn
6a4a78429f
add signer to index v1
2017-09-26 14:11:09 +02:00
Michael Pöhn
7c4b8bcac4
added parse release filename function
2017-09-26 14:11:09 +02:00
Michael Pöhn
04daa7a03a
test for common.get_app_id_aapt
2017-09-26 14:11:09 +02:00
Michael Pöhn
efb0bf6ee5
add common functions for dealing with apk signatures
2017-09-26 14:11:09 +02:00
Michael Pöhn
c196f7dd7a
common function for fetching sha256 signing-key fingerprint
2017-09-26 14:11:09 +02:00
Hans-Christoph Steiner
eaca20675c
tests: test setting up app git repo like fdroid build does
...
I wrote this to try to find #379 but this test didn't trigger that bug.
2017-09-25 16:35:18 +02:00
Hans-Christoph Steiner
cbf7ba0414
tests: add setUp() method to common to handle standard stuff
2017-09-25 16:35:18 +02:00
Hans-Christoph Steiner
2764c43fa2
tests: use ci-test-app with current Gradle Android Plugin
...
This works around the gradle 2.x bug where versions newer than 2.9 cannot
run things. This also then specifies the version of Gradle Android Plugin
that is included in Debian/stretch.
2017-09-19 20:16:08 +02:00
Hans-Christoph Steiner
dc569b9c18
tests: support Java setups where MD5 is not disabled by default
...
For platforms using Java < 1.8.0_133, MD5 is still enabled for JAR
signatures. Its just too painful to manage all this, so support this
in the tests.
2017-09-19 20:16:08 +02:00
Hans-Christoph Steiner
373b46ab3f
tests: don't run gpgsign tests on Travis CI's OSX, gpg always fails
2017-09-19 20:16:08 +02:00
Hans-Christoph Steiner
d1f6126dea
tests: support Ubuntu/trusty's python3.4-venv
2017-09-19 20:13:36 +02:00
Hans-Christoph Steiner
bc192b6be0
tests: prefer GNU sed on BSD/OSX, BSD's sed has lame syntax
...
https://blog.remibergsma.com/2012/09/18/sed-inline-editing-different-on-mac-osx/
2017-09-19 20:13:36 +02:00
Hans-Christoph Steiner
176f539647
allow spaces in filenames
...
This fixes all the bugs I could find that prevented fdroid from
handling files with spaces in them. This is more important now that
fdroid supports random media files, and Repomaker
2017-09-19 20:13:36 +02:00
Hans-Christoph Steiner
6adf309bef
tests: move test APK with bad unicode filename to separate test
...
This filename has some messed up bytes related to bi-directional script
that is included (Left-to-Right and Right-to-Left). GNU/Linux always
interprets filenames as pure byte sequences. Windows and OSX store
filenames as Unicode strings. So on OSX, the invalid filename gets
converted to a valid name. That works fine, but the test fails because it
is compared to a file generated on Ubuntu, where it preserves the byte
sequence.
This includes an APK with a valid Unicode filename that includes
bi-directional script.
2017-09-19 20:13:36 +02:00
Hans-Christoph Steiner
5dcb48831f
index: always use jarsigner for verifying JAR signatures
...
apksigner v0.7 (build-tools 26.0.1), Google made it require that the
AndroidManifest.xml was present in the archive before it verifies the
signature. So this needs to stick with the jarsigner hack for JARs.
2017-09-19 20:13:36 +02:00
