mirror of
https://github.com/Novaloop-AG/element-x-android.git
synced 2026-10-31 16:22:49 +00:00
Upgrade to rustls-platform-verifier:0.2.0 (#7791)
* Upgrade to `rustls-platform-verifier:0.2.0`. This re-enables certificate revocation checks, but v0.2.0 contains a list of CRL servers that can be accessed using clear text requests to check the validity of certain certificates, which should fix the issue that prevented us from using certificate revocation and at the same time strengthening the security of the client app. Since we already had some network configuration in Element X, and `network_security_config.xml` files can't be merged, what we can do is manually download and merge the XML contents using `tools/dependencies/update_rustls_platform_verifier.py` like this: ```sh ./update_rustls_platform_verifier.py 0.2.0 ``` It will automatically bump the Gradle dependency and merge the security config entries. * Bump SDK bindings to `v26.09.28`, containing the rustls bump on the SDK side * Fix unused resources caused by `app/src/main/res/xml/network_security_config_element.xml`
This commit is contained in:
committed by
GitHub
parent
0f98c5c0e0
commit
03fd288c47
@@ -342,6 +342,9 @@ licensee {
|
||||
ignoreDependencies("com.github.matrix-org", "matrix-analytics-events")
|
||||
// Ignore dependency that are not third-party licenses to us.
|
||||
ignoreDependencies(groupId = "io.element.android")
|
||||
// The rustls-platform-verifier dependency does not provide a license file in their maven repo, but there are MIT and Apache licenses in
|
||||
// the source code repo: see https://github.com/rustls/rustls-platform-verifier
|
||||
ignoreDependencies(groupId = "org.rustls", artifactId = "rustls-platform-verifier")
|
||||
}
|
||||
|
||||
fun Project.configureLicensesTasks(reportingExtension: ReportingExtension) {
|
||||
|
||||
Reference in New Issue
Block a user