Upgrade to rustls-platform-verifier:0.2.0 (#7791)

* Upgrade to `rustls-platform-verifier:0.2.0`.

This re-enables certificate revocation checks, but v0.2.0 contains a list of CRL servers that can be accessed using clear text requests to check the validity of certain certificates, which should fix the issue that prevented us from using certificate revocation and at the same time strengthening the security of the client app.

Since we already had some network configuration in Element X, and `network_security_config.xml` files can't be merged, what we can do is manually download and merge the XML contents using `tools/dependencies/update_rustls_platform_verifier.py` like this:

```sh
./update_rustls_platform_verifier.py 0.2.0
```

It will automatically bump the Gradle dependency and merge the security config entries.

* Bump SDK bindings to `v26.09.28`, containing the rustls bump on the SDK side

* Fix unused resources caused by `app/src/main/res/xml/network_security_config_element.xml`
This commit is contained in:
Jorge Martin Espinosa
2026-09-28 17:35:33 +02:00
committed by GitHub
parent 0f98c5c0e0
commit 03fd288c47
16 changed files with 595 additions and 441 deletions
+3
View File
@@ -342,6 +342,9 @@ licensee {
ignoreDependencies("com.github.matrix-org", "matrix-analytics-events")
// Ignore dependency that are not third-party licenses to us.
ignoreDependencies(groupId = "io.element.android")
// The rustls-platform-verifier dependency does not provide a license file in their maven repo, but there are MIT and Apache licenses in
// the source code repo: see https://github.com/rustls/rustls-platform-verifier
ignoreDependencies(groupId = "org.rustls", artifactId = "rustls-platform-verifier")
}
fun Project.configureLicensesTasks(reportingExtension: ReportingExtension) {