mirror of
https://github.com/Novaloop-AG/element-x-android.git
synced 2026-11-02 21:32:34 +00:00
Merge branch 'develop' into renovate/maplibre.compose
This commit is contained in:
ganfra
GitHub
@@ -342,6 +342,9 @@ licensee {
|
|||||||
ignoreDependencies("com.github.matrix-org", "matrix-analytics-events")
|
ignoreDependencies("com.github.matrix-org", "matrix-analytics-events")
|
||||||
// Ignore dependency that are not third-party licenses to us.
|
// Ignore dependency that are not third-party licenses to us.
|
||||||
ignoreDependencies(groupId = "io.element.android")
|
ignoreDependencies(groupId = "io.element.android")
|
||||||
|
// The rustls-platform-verifier dependency does not provide a license file in their maven repo, but there are MIT and Apache licenses in
|
||||||
|
// the source code repo: see https://github.com/rustls/rustls-platform-verifier
|
||||||
|
ignoreDependencies(groupId = "org.rustls", artifactId = "rustls-platform-verifier")
|
||||||
}
|
}
|
||||||
|
|
||||||
fun Project.configureLicensesTasks(reportingExtension: ReportingExtension) {
|
fun Project.configureLicensesTasks(reportingExtension: ReportingExtension) {
|
||||||
|
|||||||
@@ -13,6 +13,7 @@ import android.system.Os
|
|||||||
import androidx.startup.Initializer
|
import androidx.startup.Initializer
|
||||||
import io.element.android.features.rageshake.api.logs.createWriteToFilesConfiguration
|
import io.element.android.features.rageshake.api.logs.createWriteToFilesConfiguration
|
||||||
import io.element.android.libraries.architecture.bindings
|
import io.element.android.libraries.architecture.bindings
|
||||||
|
import io.element.android.libraries.core.extensions.runCatchingExceptions
|
||||||
import io.element.android.libraries.featureflag.api.FeatureFlags
|
import io.element.android.libraries.featureflag.api.FeatureFlags
|
||||||
import io.element.android.libraries.matrix.api.tracing.TracingConfiguration
|
import io.element.android.libraries.matrix.api.tracing.TracingConfiguration
|
||||||
import io.element.android.x.di.AppBindings
|
import io.element.android.x.di.AppBindings
|
||||||
@@ -41,9 +42,18 @@ class PlatformInitializer : Initializer<Unit> {
|
|||||||
sdkSentryDsn = appBindings.sentrySdkDsn()?.value?.takeIf { it.isNotBlank() },
|
sdkSentryDsn = appBindings.sentrySdkDsn()?.value?.takeIf { it.isNotBlank() },
|
||||||
)
|
)
|
||||||
bugReporter.setCurrentTracingLogLevel(logLevel.name)
|
bugReporter.setCurrentTracingLogLevel(logLevel.name)
|
||||||
|
|
||||||
|
// Init the tracing service with the configuration so we have logging enabled as soon as possible
|
||||||
platformService.init(tracingConfiguration)
|
platformService.init(tracingConfiguration)
|
||||||
// Also set env variable for rust back trace
|
// Also set env variable for rust back trace
|
||||||
Os.setenv("RUST_BACKTRACE", "1", true)
|
Os.setenv("RUST_BACKTRACE", "1", true)
|
||||||
|
|
||||||
|
// Init the SDK with the Android Context, so it can be used with rustls and other Android specific features
|
||||||
|
runCatchingExceptions {
|
||||||
|
org.matrix.rustsdk.Android.init(context)
|
||||||
|
}.onFailure {
|
||||||
|
Timber.e(it, "Failed to init the SDK with an Android Context. The app probably won't work properly.")
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
override fun dependencies(): List<Class<out Initializer<*>>> = mutableListOf()
|
override fun dependencies(): List<Class<out Initializer<*>>> = mutableListOf()
|
||||||
|
|||||||
@@ -30,5 +30,384 @@
|
|||||||
<domain includeSubdomains="true">home</domain>
|
<domain includeSubdomains="true">home</domain>
|
||||||
<domain includeSubdomains="true">lan</domain>
|
<domain includeSubdomains="true">lan</domain>
|
||||||
<domain includeSubdomains="true">localdomain</domain>
|
<domain includeSubdomains="true">localdomain</domain>
|
||||||
|
|
||||||
|
<!-- Domains below are imported from rustls-platform-verifier 0.2.0 by tools/dependencies/update_rustls_platform_verifier.py -->
|
||||||
|
<!-- They are needed to fetch the certificate revocation lists over cleartext -->
|
||||||
|
<domain includeSubdomains="true">abitabdv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">abitabev.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">abitabov.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">alpiro.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">anticdv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">antrustovsslg2r30ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">autontrustprodvtlsg2r31ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">bitcert.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">btdvtlsr35g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">c.cf-b.ssl.com</domain>
|
||||||
|
<domain includeSubdomains="true">c.cf-i.ssl.com</domain>
|
||||||
|
<domain includeSubdomains="true">c.pki.goog</domain>
|
||||||
|
<domain includeSubdomains="true">ca1.agid.gov.it</domain>
|
||||||
|
<domain includeSubdomains="true">cdn.d-trust-cloudcrl.net</domain>
|
||||||
|
<domain includeSubdomains="true">cdp.disig.sk</domain>
|
||||||
|
<domain includeSubdomains="true">cdp.elektronicznypodpis.pl</domain>
|
||||||
|
<domain includeSubdomains="true">cdp.geotrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">cdp.rapidssl.com</domain>
|
||||||
|
<domain includeSubdomains="true">cdp.thawte.com</domain>
|
||||||
|
<domain includeSubdomains="true">cdp1.disig.sk</domain>
|
||||||
|
<domain includeSubdomains="true">cdp1.pca.dfn.de</domain>
|
||||||
|
<domain includeSubdomains="true">cdpa.digitalcertvalidation.com</domain>
|
||||||
|
<domain includeSubdomains="true">cdpb.digitalcertvalidation.com</domain>
|
||||||
|
<domain includeSubdomains="true">cdpc.digitalcertvalidation.com</domain>
|
||||||
|
<domain includeSubdomains="true">cdpd.digitalcertvalidation.com</domain>
|
||||||
|
<domain includeSubdomains="true">cdpe.digitalcertvalidation.com</domain>
|
||||||
|
<domain includeSubdomains="true">cdpf.digitalcertvalidation.com</domain>
|
||||||
|
<domain includeSubdomains="true">cdpg.digitalcertvalidation.com</domain>
|
||||||
|
<domain includeSubdomains="true">cdph.digitalcertvalidation.com</domain>
|
||||||
|
<domain includeSubdomains="true">cdpi.digitalcertvalidation.com</domain>
|
||||||
|
<domain includeSubdomains="true">certcloud.crl.trust-provider.com</domain>
|
||||||
|
<domain includeSubdomains="true">certdata.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">certera.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">certificates.godaddy.com</domain>
|
||||||
|
<domain includeSubdomains="true">certum-crl.wt.trustasia.com</domain>
|
||||||
|
<domain includeSubdomains="true">certum.crl.sheca.com</domain>
|
||||||
|
<domain includeSubdomains="true">certumdvtlsg2e39ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">certumdvtlsg2r39ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">certumevtlsg2e39ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">certumevtlsg2r39ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">certumovtlsg2e39ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">certumovtlsg2r39ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">cfcadveccca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">cfcadvrsaca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">cfcaeveccca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">cfcaevrsaca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">cfcaoveccca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">cfcaovrsaca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">cnssldvtlsg2r36ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">cnsslovtlsg2r36ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">crl-01.r1.ica.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl-01.r1.ica.amznts.eu</domain>
|
||||||
|
<domain includeSubdomains="true">crl-c.emsign.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl-pro.litessl.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.anf.es</domain>
|
||||||
|
<domain includeSubdomains="true">crl.apple.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.businessid.telesec.de</domain>
|
||||||
|
<domain includeSubdomains="true">crl.buypass.no</domain>
|
||||||
|
<domain includeSubdomains="true">crl.catrust.oemssl.cn</domain>
|
||||||
|
<domain includeSubdomains="true">crl.certigna.fr</domain>
|
||||||
|
<domain includeSubdomains="true">crl.certsign.ro</domain>
|
||||||
|
<domain includeSubdomains="true">crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">crl.cfca.com.cn</domain>
|
||||||
|
<domain includeSubdomains="true">crl.cntrus.oemssl.cn</domain>
|
||||||
|
<domain includeSubdomains="true">crl.cnwebtrust.oemssl.cn</domain>
|
||||||
|
<domain includeSubdomains="true">crl.comodoca.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.crlocsp.cn</domain>
|
||||||
|
<domain includeSubdomains="true">crl.cybertrust.ne.jp</domain>
|
||||||
|
<domain includeSubdomains="true">crl.d-trust.net</domain>
|
||||||
|
<domain includeSubdomains="true">crl.dhimyotis.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.digicert.cn</domain>
|
||||||
|
<domain includeSubdomains="true">crl.digicert.eu</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e2m01.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e2m01.eu.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e2m02.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e2m03.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e2m04.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e2s14.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e2s15.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e2s16.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e2s17.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e2s18.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e2s19.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e2s20.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e2s21.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e3m01.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e3m01.eu.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e3m02.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e3m03.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e3m04.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e3s22.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e3s23.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e3s24.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e3s25.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e3s26.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e3s27.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e3s28.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.e3s29.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.emsign.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.ensuredca.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.firmaprofesional.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.gdca.com.cn</domain>
|
||||||
|
<domain includeSubdomains="true">crl.global.sheca.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.globalsign.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.globalsign.net</domain>
|
||||||
|
<domain includeSubdomains="true">crl.godaddy.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.harica.gr</domain>
|
||||||
|
<domain includeSubdomains="true">crl.izenpe.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.litessl.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.netsolssl.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.oem.trustca.net</domain>
|
||||||
|
<domain includeSubdomains="true">crl.pcsp.telesec.de</domain>
|
||||||
|
<domain includeSubdomains="true">crl.pki.goog</domain>
|
||||||
|
<domain includeSubdomains="true">crl.quovadisglobal.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r1001.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2001.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2m01.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2m01.eu.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2m02.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2m03.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2m04.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2s18.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2s19.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2s20.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2s21.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2s22.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2s23.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2s24.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r2s25.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r3001.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r4001.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r4m01.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r4m02.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r4m03.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.r4m04.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.root-e1.certainly.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.root-r1.certainly.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.rootca1.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.rootca2.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.rootca3.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.rootca4.amazontrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.rztrust.oemssl.cn</domain>
|
||||||
|
<domain includeSubdomains="true">crl.sbca.telesec.de</domain>
|
||||||
|
<domain includeSubdomains="true">crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.sectigochina.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.serverid.telesec.de</domain>
|
||||||
|
<domain includeSubdomains="true">crl.starfieldtech.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.swisssign.ch</domain>
|
||||||
|
<domain includeSubdomains="true">crl.trust-provider.cn</domain>
|
||||||
|
<domain includeSubdomains="true">crl.trust-provider.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.tuntrust.tn</domain>
|
||||||
|
<domain includeSubdomains="true">crl.usertrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.wt.trustasia.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl.xinchacha.oemssl.cn</domain>
|
||||||
|
<domain includeSubdomains="true">crl.zw.oemssl.cn</domain>
|
||||||
|
<domain includeSubdomains="true">crl05.actalis.it</domain>
|
||||||
|
<domain includeSubdomains="true">crl06.actalis.it</domain>
|
||||||
|
<domain includeSubdomains="true">crl09.actalis.it</domain>
|
||||||
|
<domain includeSubdomains="true">crl1.ecert.gov.hk</domain>
|
||||||
|
<domain includeSubdomains="true">crl13.actalis.it</domain>
|
||||||
|
<domain includeSubdomains="true">crl14.actalis.it</domain>
|
||||||
|
<domain includeSubdomains="true">crl15.actalis.it</domain>
|
||||||
|
<domain includeSubdomains="true">crl2.microsoft.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl3.digicert.com</domain>
|
||||||
|
<domain includeSubdomains="true">crl4.digicert.com</domain>
|
||||||
|
<domain includeSubdomains="true">crls.certainly.com</domain>
|
||||||
|
<domain includeSubdomains="true">crls.ssl.com</domain>
|
||||||
|
<domain includeSubdomains="true">cyberfolks2.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">depo.kamusm.gov.tr</domain>
|
||||||
|
<domain includeSubdomains="true">digitaltrust.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">dnencrypt.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">dvtlsca2025-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">dvtlsca2026-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">e5.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">e6.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">e7.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">e8.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">ec2ca2017-crl1.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ec2ca2017-crl2.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ec2ca2017-crl3.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ec2sslca2017-crl1.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ec2sslca2017-crl2.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ec2sslca2017-crl3.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ec3ca2017-crl1.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ec3ca2017-crl2.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ec3ca2017-crl3.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ec3sslca2017-crl1.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ec3sslca2017-crl2.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ec3sslca2017-crl3.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eca.hinet.net</domain>
|
||||||
|
<domain includeSubdomains="true">edvtlsca2023-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">edvtlsca2025-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">edvtlsca2026-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">emudhra.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">eosslca2017-crl1.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eosslca2017-crl2.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eosslca2017-crl3.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eovtlsca2023-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eovtlsca2025-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eovtlsca2026-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqca2017-crl1.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqca2017-crl2.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqca2017-crl3.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqcpca2017-crl1.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqcpca2017-crl2.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqcpca2017-crl3.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqoca2017-crl1.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqoca2017-crl2.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqoca2017-crl3.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqtlsca2018-crl1.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqtlsca2018-crl2.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqtlsca2018-crl3.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqtlsca2023-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqtlsca2025-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">eqtlsca2026-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">esafer.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">eue2m1.crl.root.amznts.eu</domain>
|
||||||
|
<domain includeSubdomains="true">eue3m1.crl.root.amznts.eu</domain>
|
||||||
|
<domain includeSubdomains="true">eur2m1.crl.root.amznts.eu</domain>
|
||||||
|
<domain includeSubdomains="true">eveccca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">evrsaca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">gdcadv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">gdcaev.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">gdcaov.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">gdcatrustauthdvtlsg3r31ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">gdcatrustauthevtlsg3r31ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">gdcatrustauthovtlsg3r31ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">geant.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">genious.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">geossldvtlsr34g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">geosslevtlsr34g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">geosslovtlsr34g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">globaltrust.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">globessl.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">gogetssldv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">gogetsslev.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">gogetsslov.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">homepldvtlsg2r35ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">homepldvtlsg2r36ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">homeplovtlsg2r35ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">homeplovtlsg2r36ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">httpcrl.trust.telia.com</domain>
|
||||||
|
<domain includeSubdomains="true">ica.navercloudtrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">ica.navercorp.com</domain>
|
||||||
|
<domain includeSubdomains="true">issauth.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">itrusdv2.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">itrusdvtlsr35g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">itrusov2.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">itrusovtlsr35g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">itso.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">joyssldvtlsg2r33ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">joysslovtlsg2r33ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">kingnettechdv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">kingnettechev.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">kingnettechov.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">kr.crl.digicert.com</domain>
|
||||||
|
<domain includeSubdomains="true">lh2.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">namecheap.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">nazwassldvtlsg2e29ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">nazwassldvtlsg2r29ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">netartcadv2.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">netartssldvtlsg2e31ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">nijimo.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">nyalabscadv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">nyatworkdv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">omitsecurity.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">onesign.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">osslca2016-crl1.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">osslca2016-crl2.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">osslca2016-crl3.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ovtlsca2025-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ovtlsca2026-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">pki-crl.atos.net</domain>
|
||||||
|
<domain includeSubdomains="true">pki.telesec.de</domain>
|
||||||
|
<domain includeSubdomains="true">pkipro.certsign.ro</domain>
|
||||||
|
<domain includeSubdomains="true">positiwise.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">psw.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">public.wisekey.com</domain>
|
||||||
|
<domain includeSubdomains="true">qiduodv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">qtlsca2018-crl1.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">qtlsca2018-crl2.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">qtlsca2018-crl3.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">qtlsca2026-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">r10.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">r11.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">r12.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">r13.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">rca.navercloudtrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">rca.navercorp.com</domain>
|
||||||
|
<domain includeSubdomains="true">repo.pubcert.jprs.jp</domain>
|
||||||
|
<domain includeSubdomains="true">repo1.secomtrust.net</domain>
|
||||||
|
<domain includeSubdomains="true">repository.secomtrust.net</domain>
|
||||||
|
<domain includeSubdomains="true">repository.tls.hinet.net</domain>
|
||||||
|
<domain includeSubdomains="true">rootca.twca.com.tw</domain>
|
||||||
|
<domain includeSubdomains="true">rootglobaldv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">rootnetworksdv2.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">shenzhendv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">shenzhenev.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">shenzhenov.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">shoperdvtlsg2r34ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">shuididv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">shuidiev.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">shuidiov.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">soomadv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">ssl2ca2016-crl1.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ssl2ca2016-crl2.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">ssl2ca2016-crl3.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">sslca2014-crl1.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">sslca2014-crl2.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">sslca2014-crl3.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">sslcom.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">ssllimiteddv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">sslserver.twca.com.tw</domain>
|
||||||
|
<domain includeSubdomains="true">subca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">titrust.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">tlcdvtlsr34g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">tlcevtlsr34g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">tlcovtlsr34g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">tlsrootca2025-crl.e-szigno.hu</domain>
|
||||||
|
<domain includeSubdomains="true">trustasia.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">trustasiadv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">trustasiadvtlsr35g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">trustasiaev.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">trustasiaevtlse35g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">trustasiaevtlsr35g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">trustasiaov.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">trustasiaovtlse35g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">trustasiaovtlsr35g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">trustocean.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">tstlser20.crl.telesec.de</domain>
|
||||||
|
<domain includeSubdomains="true">tstlsrr23.crl.telesec.de</domain>
|
||||||
|
<domain includeSubdomains="true">unitedtrustov.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">validation.identrust.com</domain>
|
||||||
|
<domain includeSubdomains="true">verokey.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">vtrusdvtlsg3r31ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">vtrusovtlsg3r31ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">webnic.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">whitessldvtlsg2e36ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">wosign.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">wotrus-dvca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">wotrus-evca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">wotrus-ovca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">wotrus.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">wtca-cafiles.itrus.com.cn</domain>
|
||||||
|
<domain includeSubdomains="true">wtca-crl.itrus.com.cn</domain>
|
||||||
|
<domain includeSubdomains="true">www.accv.es</domain>
|
||||||
|
<domain includeSubdomains="true">www.cert.fnmt.es</domain>
|
||||||
|
<domain includeSubdomains="true">www.d-trust.net</domain>
|
||||||
|
<domain includeSubdomains="true">www.microsoft.com</domain>
|
||||||
|
<domain includeSubdomains="true">x1.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">x2.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">xcctrustdvtlsg3r31ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">xcctrustevtlsg3r31ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">xcctrustovtlsg3r31ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">xinchacha2dv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">xinchacha2ov.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">xinchachatrustdvtlsg2r34ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">xinchachatrustevtlsg2r34ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">xinchachatrustovtlsg2r34ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">xinnetdvtlsr34g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">xinnetevtlsr34g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">xinnetovtlsr34g2ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">ye.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">ye1.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">ye2.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">yektadv.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">yektaov.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">yr.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">yr1.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">yr2.c.lencr.org</domain>
|
||||||
|
<domain includeSubdomains="true">zerossl.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">ziwit.crl.sectigo.com</domain>
|
||||||
|
<domain includeSubdomains="true">zycatrustdvtlsg3r31ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">zycatrustevtlsg3r31ca.crl.certum.pl</domain>
|
||||||
|
<domain includeSubdomains="true">zycatrustovtlsg3r31ca.crl.certum.pl</domain>
|
||||||
</domain-config>
|
</domain-config>
|
||||||
</network-security-config>
|
</network-security-config>
|
||||||
|
|||||||
@@ -0,0 +1,34 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<network-security-config xmlns:tools="http://schemas.android.com/tools">
|
||||||
|
<!-- Ref: https://developer.android.com/training/articles/security-config.html -->
|
||||||
|
<!-- By default, do not allow clearText traffic -->
|
||||||
|
<base-config cleartextTrafficPermitted="false">
|
||||||
|
<trust-anchors>
|
||||||
|
<certificates src="system" />
|
||||||
|
<certificates
|
||||||
|
src="user"
|
||||||
|
tools:ignore="AcceptsUserCertificates" />
|
||||||
|
</trust-anchors>
|
||||||
|
</base-config>
|
||||||
|
|
||||||
|
<!-- Allow clearText traffic on some specified host -->
|
||||||
|
<domain-config cleartextTrafficPermitted="true">
|
||||||
|
<!-- Localhost -->
|
||||||
|
<domain includeSubdomains="true">localhost</domain>
|
||||||
|
<domain includeSubdomains="true">127.0.0.1</domain>
|
||||||
|
<!-- Localhost for Android emulator -->
|
||||||
|
<domain includeSubdomains="true">10.0.2.2</domain>
|
||||||
|
<!-- Onion services -->
|
||||||
|
<domain includeSubdomains="true">onion</domain>
|
||||||
|
|
||||||
|
<!-- Domains that are used for LANs -->
|
||||||
|
<!-- These are IANA recognized special use domain names, see https://www.iana.org/assignments/special-use-domain-names/special-use-domain-names.xhtml -->
|
||||||
|
<domain includeSubdomains="true">home.arpa</domain>
|
||||||
|
<domain includeSubdomains="true">local</domain> <!-- Note this has been reserved for use with mDNS -->
|
||||||
|
<domain includeSubdomains="true">test</domain>
|
||||||
|
<!-- These are observed in the wild either by convention or RFCs that have not been accepted, and are not currently TLDs -->
|
||||||
|
<domain includeSubdomains="true">home</domain>
|
||||||
|
<domain includeSubdomains="true">lan</domain>
|
||||||
|
<domain includeSubdomains="true">localdomain</domain>
|
||||||
|
</domain-config>
|
||||||
|
</network-security-config>
|
||||||
@@ -182,7 +182,8 @@ test_detekt_test = { module = "io.gitlab.arturbosch.detekt:detekt-test", version
|
|||||||
# https://github.com/matrix-org/matrix-rust-components-kotlin/commits/main/sdk/sdk-android/src/main/kotlin/org/matrix/rustcomponents/sdk/matrix_sdk_ffi.kt
|
# https://github.com/matrix-org/matrix-rust-components-kotlin/commits/main/sdk/sdk-android/src/main/kotlin/org/matrix/rustcomponents/sdk/matrix_sdk_ffi.kt
|
||||||
# All new features should not be implemented in the pull request that upgrades the version, developers should
|
# All new features should not be implemented in the pull request that upgrades the version, developers should
|
||||||
# only fix API breaks and may add some TODOs.
|
# only fix API breaks and may add some TODOs.
|
||||||
matrix_sdk = "org.matrix.rustcomponents:sdk-android:26.09.26"
|
matrix_sdk = "org.matrix.rustcomponents:sdk-android:26.09.28"
|
||||||
|
rustls_platform_verifier = "org.rustls:rustls-platform-verifier:0.2.0"
|
||||||
|
|
||||||
# Others
|
# Others
|
||||||
coil = { module = "io.coil-kt.coil3:coil", version.ref = "coil" }
|
coil = { module = "io.coil-kt.coil3:coil", version.ref = "coil" }
|
||||||
|
|||||||
@@ -28,7 +28,7 @@ dependencies {
|
|||||||
} else {
|
} else {
|
||||||
debugImplementation(libs.matrix.sdk)
|
debugImplementation(libs.matrix.sdk)
|
||||||
}
|
}
|
||||||
implementation(projects.libraries.rustlsTls)
|
implementation(variantOf(libs.rustls.platform.verifier) { artifactType("aar") })
|
||||||
|
|
||||||
implementation(projects.appconfig)
|
implementation(projects.appconfig)
|
||||||
implementation(projects.features.enterprise.api)
|
implementation(projects.features.enterprise.api)
|
||||||
|
|||||||
+10
-15
@@ -7,11 +7,13 @@
|
|||||||
|
|
||||||
package io.element.android.libraries.matrix.impl.storage
|
package io.element.android.libraries.matrix.impl.storage
|
||||||
|
|
||||||
|
import android.util.Base64
|
||||||
import io.element.android.libraries.androidutils.crypto.ClientSecret
|
import io.element.android.libraries.androidutils.crypto.ClientSecret
|
||||||
import io.element.android.libraries.core.data.ByteUnit
|
import io.element.android.libraries.core.data.ByteUnit
|
||||||
import io.element.android.libraries.core.data.megaBytes
|
import io.element.android.libraries.core.data.megaBytes
|
||||||
import io.element.android.libraries.matrix.api.paths.SessionPaths
|
import io.element.android.libraries.matrix.api.paths.SessionPaths
|
||||||
import org.matrix.rustcomponents.sdk.ClientBuilder
|
import org.matrix.rustcomponents.sdk.ClientBuilder
|
||||||
|
import uniffi.matrix_sdk_sqlite.Base64Variant
|
||||||
import org.matrix.rustcomponents.sdk.SqliteStoreBuilder as SdkSqliteStoreBuilder
|
import org.matrix.rustcomponents.sdk.SqliteStoreBuilder as SdkSqliteStoreBuilder
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@@ -40,10 +42,15 @@ class RustSqliteStoreBuilder(
|
|||||||
override fun secret(clientSecret: ClientSecret?): SqliteStoreBuilder {
|
override fun secret(clientSecret: ClientSecret?): SqliteStoreBuilder {
|
||||||
when (clientSecret) {
|
when (clientSecret) {
|
||||||
null -> Unit
|
null -> Unit
|
||||||
is ClientSecret.Passphrase -> inner = inner.passphrase(clientSecret.value)
|
is ClientSecret.Passphrase -> {
|
||||||
|
// Use high entropy passphrase to migrate a passphrase to a raw key.
|
||||||
|
val base64Passphrase = Base64.decode(clientSecret.value, Base64.NO_WRAP or Base64.NO_PADDING)
|
||||||
|
inner = inner.highEntropyPassphrase(base64Passphrase, Base64Variant.UNPADDED)
|
||||||
|
// Once the passphrase is migrated, we can derive a raw key from it and use that for the SDK, replacing the line above.
|
||||||
|
// inner = inner.key(base64Passphrase)
|
||||||
|
}
|
||||||
is ClientSecret.RawKey -> {
|
is ClientSecret.RawKey -> {
|
||||||
// Ensure the key is 32 bytes long, as required by the SDK
|
inner = inner.key(clientSecret.bytes)
|
||||||
inner = inner.key(clientSecret.keyOfSize(32))
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
return this
|
return this
|
||||||
@@ -53,15 +60,3 @@ class RustSqliteStoreBuilder(
|
|||||||
return clientBuilder.sqliteStore(this.inner)
|
return clientBuilder.sqliteStore(this.inner)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
private fun ClientSecret.RawKey.keyOfSize(size: Int): ByteArray {
|
|
||||||
return if (bytes.size == 32) {
|
|
||||||
bytes
|
|
||||||
} else if (bytes.size < 32) {
|
|
||||||
// If the key is shorter than 32 bytes, pad it with zeros
|
|
||||||
bytes + ByteArray(32 - bytes.size)
|
|
||||||
} else {
|
|
||||||
// Otherwise, take the first 32 bytes of the key
|
|
||||||
bytes.copyOfRange(0, 32)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|||||||
@@ -0,0 +1,22 @@
|
|||||||
|
/*
|
||||||
|
* Copyright (c) 2026 Element Creations Ltd.
|
||||||
|
*
|
||||||
|
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial.
|
||||||
|
* Please see LICENSE files in the repository root for full details.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package org.matrix.rustsdk
|
||||||
|
|
||||||
|
import android.content.Context
|
||||||
|
|
||||||
|
/**
|
||||||
|
* This class is used to initialize the Rust SDK on Android and give it access to an Android [Context].
|
||||||
|
*/
|
||||||
|
object Android {
|
||||||
|
init {
|
||||||
|
System.loadLibrary("matrix_sdk_ffi")
|
||||||
|
}
|
||||||
|
|
||||||
|
@JvmStatic
|
||||||
|
external fun init(context: Context)
|
||||||
|
}
|
||||||
+4
@@ -40,6 +40,8 @@ internal fun aRustEventTimelineItem(
|
|||||||
canBeRepliedTo: Boolean = true,
|
canBeRepliedTo: Boolean = true,
|
||||||
reactions: List<Reaction> = emptyList(),
|
reactions: List<Reaction> = emptyList(),
|
||||||
lazyProvider: LazyTimelineItemProvider = FakeFfiLazyTimelineItemProvider(),
|
lazyProvider: LazyTimelineItemProvider = FakeFfiLazyTimelineItemProvider(),
|
||||||
|
editSendState: EventSendState? = null,
|
||||||
|
redactionSendState: EventSendState? = null,
|
||||||
) = EventTimelineItem(
|
) = EventTimelineItem(
|
||||||
isRemote = isRemote,
|
isRemote = isRemote,
|
||||||
eventOrTransactionId = eventOrTransactionId,
|
eventOrTransactionId = eventOrTransactionId,
|
||||||
@@ -59,4 +61,6 @@ internal fun aRustEventTimelineItem(
|
|||||||
canBeRepliedTo = canBeRepliedTo,
|
canBeRepliedTo = canBeRepliedTo,
|
||||||
reactions = reactions,
|
reactions = reactions,
|
||||||
lazyProvider = lazyProvider,
|
lazyProvider = lazyProvider,
|
||||||
|
editSendState = editSendState,
|
||||||
|
redactionSendState = redactionSendState,
|
||||||
)
|
)
|
||||||
|
|||||||
@@ -1,9 +0,0 @@
|
|||||||
This module is a wrapper for the Android code distributed in the rustls-platform-verifier-android crate.
|
|
||||||
|
|
||||||
To avoid the distribution mess that this library has (download a Rust crate, then search for it using Gradle and use it as local maven repo),
|
|
||||||
we previously just manually updated the AAR file instead using a script. This won't work for F-Droid because the AAR library is a black box with
|
|
||||||
no sources attached to it, so we can't use it like that.
|
|
||||||
|
|
||||||
Instead, for the time being, we're adding the single `CertificateVerifier.kt` class this AAR had in it as part of our sources.
|
|
||||||
|
|
||||||
When this file is updated, the [UPDATED.md](./UPDATED.md) file should be updated too with the commit SHA of the new version.
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
Below is the commit SHA in [rustls-platform-verifier](https://github.com/rustls/rustls-platform-verifier) library used to update the code in this module:
|
|
||||||
|
|
||||||
```
|
|
||||||
996b1c903491641b17b3c9afb65d1352f6fc6b76
|
|
||||||
```
|
|
||||||
|
|
||||||
Please update it after making manual changes.
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
import extension.buildConfigFieldBoolean
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Copyright (c) 2026 Element Creations Ltd.
|
|
||||||
*
|
|
||||||
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial.
|
|
||||||
* Please see LICENSE files in the repository root for full details.
|
|
||||||
*/
|
|
||||||
|
|
||||||
plugins {
|
|
||||||
id("io.element.android-library")
|
|
||||||
}
|
|
||||||
|
|
||||||
android {
|
|
||||||
namespace = "org.rustls.platformverifier"
|
|
||||||
|
|
||||||
buildFeatures {
|
|
||||||
buildConfig = true
|
|
||||||
}
|
|
||||||
|
|
||||||
defaultConfig {
|
|
||||||
buildConfigFieldBoolean("TEST", false)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
-398
@@ -1,398 +0,0 @@
|
|||||||
@file:SuppressLint("LogNotTimber", "ObsoleteSdkInt")
|
|
||||||
@file:Suppress("KotlinConstantConditions")
|
|
||||||
|
|
||||||
// IMPORTANT: this file comes from rustls-platform-verifier and should not be modified locally.
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Copyright (c) 2022 1Password
|
|
||||||
*
|
|
||||||
* SPDX-License-Identifier: MIT
|
|
||||||
*/
|
|
||||||
|
|
||||||
package org.rustls.platformverifier
|
|
||||||
|
|
||||||
import android.annotation.SuppressLint
|
|
||||||
import android.content.Context
|
|
||||||
import android.net.http.X509TrustManagerExtensions
|
|
||||||
import android.util.Log
|
|
||||||
import java.io.ByteArrayInputStream
|
|
||||||
import java.io.File
|
|
||||||
import java.security.KeyStore
|
|
||||||
import java.security.KeyStoreException
|
|
||||||
import java.security.MessageDigest
|
|
||||||
import java.security.PublicKey
|
|
||||||
import java.security.cert.CertificateException
|
|
||||||
import java.security.cert.CertificateExpiredException
|
|
||||||
import java.security.cert.CertificateFactory
|
|
||||||
import java.security.cert.CertificateNotYetValidException
|
|
||||||
import java.security.cert.CertificateParsingException
|
|
||||||
import java.security.cert.X509Certificate
|
|
||||||
import java.util.Date
|
|
||||||
import javax.net.ssl.TrustManagerFactory
|
|
||||||
import javax.net.ssl.X509TrustManager
|
|
||||||
import javax.security.auth.x500.X500Principal
|
|
||||||
|
|
||||||
// If this is updated, update the Rust definition too.
|
|
||||||
// Marked private as this is not meant to be used in Android code.
|
|
||||||
private enum class StatusCode(val value: Int) {
|
|
||||||
Ok(0),
|
|
||||||
Unavailable(1),
|
|
||||||
Expired(2),
|
|
||||||
UnknownCert(3),
|
|
||||||
Revoked(4),
|
|
||||||
InvalidEncoding(5),
|
|
||||||
InvalidExtension(6),
|
|
||||||
}
|
|
||||||
|
|
||||||
// Marked private as this is not meant to be used in Android code.
|
|
||||||
private class VerificationResult(
|
|
||||||
status: StatusCode,
|
|
||||||
@Suppress("unused") val message: String? = null
|
|
||||||
) {
|
|
||||||
@Suppress("unused")
|
|
||||||
private val code: Int = status.value
|
|
||||||
}
|
|
||||||
|
|
||||||
// NOTE: All TrustManager and certificate validation methods are not thread safe. These
|
|
||||||
// are all guarded by Kotlin's `Synchronized` accessors to prevent undefined behavior.
|
|
||||||
|
|
||||||
// Only JNI and test code calls this, so unused code warnings are suppressed.
|
|
||||||
// Internal for test code - no other Kotlin code should use this object directly.
|
|
||||||
@Suppress("unused")
|
|
||||||
// We want to show a difference between Kotlin-side logs and those in Rust code
|
|
||||||
@SuppressLint("LongLogTag")
|
|
||||||
internal object CertificateVerifier {
|
|
||||||
private const val TAG = "rustls-platform-verifier-android"
|
|
||||||
|
|
||||||
private fun createTrustManager(keystore: KeyStore?): X509TrustManagerExtensions? {
|
|
||||||
// This can never throw since the default algorithm is used.
|
|
||||||
val factory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
|
|
||||||
|
|
||||||
factory.init(keystore)
|
|
||||||
|
|
||||||
val availableTrustManagers = try {
|
|
||||||
factory.trustManagers
|
|
||||||
} catch (e: RuntimeException) {
|
|
||||||
Log.w(TAG, "exception thrown creating a TrustManager: $e")
|
|
||||||
return null
|
|
||||||
}
|
|
||||||
|
|
||||||
for (manager in availableTrustManagers) {
|
|
||||||
if (manager is X509TrustManager) {
|
|
||||||
// Kotlin ensures this can't throw at runtime since it knows that
|
|
||||||
// it must be the correct type by now.
|
|
||||||
return X509TrustManagerExtensions(manager)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
Log.e(TAG, "failed to find a usable trust manager")
|
|
||||||
return null
|
|
||||||
}
|
|
||||||
|
|
||||||
private fun makeLazyTrustManager(keystore: KeyStore?): Lazy<X509TrustManagerExtensions?> {
|
|
||||||
// Ensure the keystore is loaded. Since all of the trust managers are initialized in a
|
|
||||||
// `Lazy`, this will only run once.
|
|
||||||
keystore?.load(null)
|
|
||||||
|
|
||||||
return lazy { createTrustManager(keystore) }
|
|
||||||
}
|
|
||||||
|
|
||||||
// -- Test only --
|
|
||||||
// Ideally, all of this will be optimized out at compile time due to not being accessed
|
|
||||||
// in release builds.
|
|
||||||
|
|
||||||
@get:Synchronized
|
|
||||||
private val mockKeystore: KeyStore = KeyStore.getInstance(KeyStore.getDefaultType())
|
|
||||||
|
|
||||||
@get:Synchronized
|
|
||||||
private var mockTrustManager: Lazy<X509TrustManagerExtensions?> =
|
|
||||||
makeLazyTrustManager(mockKeystore)
|
|
||||||
|
|
||||||
@JvmStatic
|
|
||||||
private fun addMockRoot(root: ByteArray) {
|
|
||||||
if (!BuildConfig.TEST) {
|
|
||||||
throw Exception("attempted to add a mock root outside a test!")
|
|
||||||
}
|
|
||||||
|
|
||||||
val alias = "root_${mockKeystore.size()}"
|
|
||||||
// Throwing here is fine since test roots should always be well-formed
|
|
||||||
val cert = certFactory.generateCertificate(ByteArrayInputStream(root))
|
|
||||||
mockKeystore.setCertificateEntry(alias, cert)
|
|
||||||
|
|
||||||
reloadMockData()
|
|
||||||
}
|
|
||||||
|
|
||||||
@JvmStatic
|
|
||||||
private fun clearMockRoots() {
|
|
||||||
// Reload to get a completely fresh internal state
|
|
||||||
mockKeystore.load(null)
|
|
||||||
reloadMockData()
|
|
||||||
}
|
|
||||||
|
|
||||||
@JvmStatic
|
|
||||||
private fun reloadMockData() {
|
|
||||||
if (mockTrustManager.isInitialized()) {
|
|
||||||
mockTrustManager = makeLazyTrustManager(mockKeystore)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get a list of the system's root CAs.
|
|
||||||
// Function is public for testing only.
|
|
||||||
@JvmStatic
|
|
||||||
fun getSystemRootCAs(): List<X509Certificate> {
|
|
||||||
val rootCAs = mutableListOf<X509Certificate>()
|
|
||||||
|
|
||||||
val factory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
|
|
||||||
factory.init(systemKeystore)
|
|
||||||
|
|
||||||
val availableTrustManagers = try {
|
|
||||||
factory.trustManagers
|
|
||||||
} catch (e: RuntimeException) {
|
|
||||||
Log.w(TAG, "exception thrown creating a TrustManager: $e")
|
|
||||||
return rootCAs
|
|
||||||
}
|
|
||||||
|
|
||||||
availableTrustManagers.forEach { trustManager ->
|
|
||||||
if (trustManager is X509TrustManager) {
|
|
||||||
rootCAs.addAll(trustManager.acceptedIssuers)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return rootCAs
|
|
||||||
}
|
|
||||||
|
|
||||||
// -- End testing requirements --
|
|
||||||
|
|
||||||
private val certFactory: CertificateFactory = CertificateFactory.getInstance("X.509")
|
|
||||||
|
|
||||||
private var systemTrustAnchorCache = hashSetOf<Pair<X500Principal, PublicKey>>()
|
|
||||||
|
|
||||||
@get:Synchronized
|
|
||||||
private var systemCertificateDirectory: File? = System.getenv("ANDROID_ROOT")?.let { rootPath ->
|
|
||||||
File("$rootPath/etc/security/cacerts")
|
|
||||||
}
|
|
||||||
|
|
||||||
@get:Synchronized
|
|
||||||
private val systemKeystore: KeyStore? = try {
|
|
||||||
KeyStore.getInstance("AndroidCAStore")
|
|
||||||
} catch (_: KeyStoreException) {
|
|
||||||
null
|
|
||||||
}
|
|
||||||
|
|
||||||
@get:Synchronized
|
|
||||||
private val systemTrustManager: Lazy<X509TrustManagerExtensions?> =
|
|
||||||
makeLazyTrustManager(systemKeystore)
|
|
||||||
|
|
||||||
@JvmStatic
|
|
||||||
private fun verifyCertificateChain(
|
|
||||||
@Suppress("UNUSED_PARAMETER") context: Context,
|
|
||||||
serverName: String,
|
|
||||||
authMethod: String,
|
|
||||||
allowedEkus: Array<String>,
|
|
||||||
ocspResponse: ByteArray?,
|
|
||||||
time: Long,
|
|
||||||
certChain: Array<ByteArray>
|
|
||||||
): VerificationResult {
|
|
||||||
// Convert the array of (supposedly) DER bytes into certificates.
|
|
||||||
val certificateChain = mutableListOf<X509Certificate>()
|
|
||||||
certChain.forEach { certBytes ->
|
|
||||||
val certificate = try {
|
|
||||||
certFactory.generateCertificate(ByteArrayInputStream(certBytes))
|
|
||||||
} catch (e: CertificateException) {
|
|
||||||
return VerificationResult(StatusCode.InvalidEncoding)
|
|
||||||
}
|
|
||||||
certificateChain.add(certificate as X509Certificate)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Will never throw `ArrayIndexOutOfBoundsException` because `rustls`'s `ServerCertVerifier` trait
|
|
||||||
// has a mandatory `end_entity` parameter in `verify_server_cert`.
|
|
||||||
val endEntity = certificateChain[0]
|
|
||||||
|
|
||||||
// Check that the certificate is valid at the point of time provided by `rustls`.
|
|
||||||
try {
|
|
||||||
endEntity.checkValidity(Date(time))
|
|
||||||
} catch (e: CertificateExpiredException) {
|
|
||||||
return VerificationResult(StatusCode.Expired)
|
|
||||||
} catch (e: CertificateNotYetValidException) {
|
|
||||||
return VerificationResult(StatusCode.Expired)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Check that this certificate can be used in a TLS server.
|
|
||||||
if (!verifyCertUsage(endEntity, allowedEkus)) {
|
|
||||||
return VerificationResult(StatusCode.InvalidExtension)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Select the trust manager to use.
|
|
||||||
//
|
|
||||||
// We select them as follows:
|
|
||||||
// - If built for release, only use the system trust manager. This should let all test-related
|
|
||||||
// code be optimized out.
|
|
||||||
// - If built for tests:
|
|
||||||
// - If the mock CA store has any values, use the mock trust manager.
|
|
||||||
// - Otherwise, use the system trust manager.
|
|
||||||
val (trustManager, keystore) = if (!BuildConfig.TEST) {
|
|
||||||
val trustManager =
|
|
||||||
systemTrustManager.value ?: return VerificationResult(StatusCode.Unavailable)
|
|
||||||
Pair(trustManager, systemKeystore)
|
|
||||||
} else {
|
|
||||||
if (mockKeystore.size() != 0) {
|
|
||||||
val trustManager = mockTrustManager.value!!
|
|
||||||
Pair(trustManager, mockKeystore)
|
|
||||||
} else {
|
|
||||||
val trustManager =
|
|
||||||
systemTrustManager.value ?: return VerificationResult(StatusCode.Unavailable)
|
|
||||||
Pair(trustManager, systemKeystore)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Verify that the certificate chain is valid and correct, and nothing more.
|
|
||||||
//
|
|
||||||
// NOTE: This does not validate `serverName` is valid for the end-entity certificate.
|
|
||||||
// That is handled in Rust as Android/Java do not currently provide a RFC 6125 compliant
|
|
||||||
// hostname verifier. Additionally, even the RFC 2818 verifier is not available until API 24.
|
|
||||||
//
|
|
||||||
// `serverName` is only used for pinning/CT requirements.
|
|
||||||
//
|
|
||||||
// Returns the "the properly ordered chain used for verification as a list of X509Certificates.",
|
|
||||||
// meaning a list from end-entity certificate to trust-anchor.
|
|
||||||
val validChain = try {
|
|
||||||
trustManager.checkServerTrusted(certificateChain.toTypedArray(), authMethod, serverName)
|
|
||||||
} catch (e: CertificateException) {
|
|
||||||
// In test configurations we may see `checkServerTrusted` fail once vendored test
|
|
||||||
// certificates pass their expiry date. We try to avoid that by using a fixed
|
|
||||||
// verification time when calling `endEntity.checkValidity` above, however we can't
|
|
||||||
// fix the time for the `checkServerTrusted` call.
|
|
||||||
//
|
|
||||||
// To make diagnosing CI test failures easier we try to find the root cause of
|
|
||||||
// checkServerTrusted failing, returning a different `StatusCode` as appropriate.
|
|
||||||
if (BuildConfig.TEST) {
|
|
||||||
var rootCause: Throwable? = e
|
|
||||||
while (rootCause?.cause != null && rootCause.cause != rootCause) {
|
|
||||||
rootCause = rootCause.cause
|
|
||||||
}
|
|
||||||
return when (rootCause) {
|
|
||||||
is CertificateExpiredException, is CertificateNotYetValidException -> VerificationResult(
|
|
||||||
StatusCode.Expired,
|
|
||||||
rootCause.toString()
|
|
||||||
)
|
|
||||||
|
|
||||||
else -> VerificationResult(StatusCode.UnknownCert, rootCause.toString())
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// In non-test configurations we should have caught expiry errors earlier and
|
|
||||||
// can simply return an unknown cert error without digging through the exception
|
|
||||||
// cause chain.
|
|
||||||
return VerificationResult(StatusCode.UnknownCert, e.toString())
|
|
||||||
}
|
|
||||||
|
|
||||||
// TEST ONLY: Mock test suite cannot attempt to check revocation status if no OSCP data has been stapled,
|
|
||||||
// because Android requires certificates to an specify OCSP responder for network fetch in this case.
|
|
||||||
// If in testing w/o OCSP stapled, short-circuit here - only prior checks apply.
|
|
||||||
if (BuildConfig.TEST && (mockKeystore.size() != 0) && (ocspResponse == null)) {
|
|
||||||
return VerificationResult(StatusCode.Ok)
|
|
||||||
}
|
|
||||||
|
|
||||||
// =================================================================================================
|
|
||||||
// IMPORTANT! DIFF WITH THE ORIGINAL SOURCES HERE:
|
|
||||||
//
|
|
||||||
// We removed the cert revocation checks because Android won't do them by default
|
|
||||||
// and supporting them would be quite difficult given CRLs won't work out of the box.
|
|
||||||
//
|
|
||||||
// See https://github.com/rustls/rustls-platform-verifier/issues/221 for more info.
|
|
||||||
// =================================================================================================
|
|
||||||
|
|
||||||
return VerificationResult(StatusCode.Ok)
|
|
||||||
}
|
|
||||||
|
|
||||||
private fun verifyCertUsage(certificate: X509Certificate, allowedEkus: Array<String>): Boolean {
|
|
||||||
val ekus = try {
|
|
||||||
certificate.extendedKeyUsage
|
|
||||||
}
|
|
||||||
// This should be unreachable, but could happen.
|
|
||||||
catch (_: CertificateParsingException) {
|
|
||||||
return false
|
|
||||||
} catch (_: NullPointerException) {
|
|
||||||
// According to Chromium's implementation, this can crash when the EKU data is malformed.
|
|
||||||
Log.w(TAG, "exception handling certificate EKU")
|
|
||||||
return false
|
|
||||||
} ?: return true // If the list is empty, we have nothing to do.
|
|
||||||
|
|
||||||
return ekus.any { allowedEkus.contains(it) }
|
|
||||||
}
|
|
||||||
|
|
||||||
// Android hashes a principal using the first four bytes of its MD5 digest, encoded in
|
|
||||||
// lowercase hex and reversed.
|
|
||||||
//
|
|
||||||
// Ref: https://source.chromium.org/chromium/chromium/src/+/main:net/android/java/src/org/chromium/net/X509Util.java;l=339
|
|
||||||
private fun hashPrincipal(principal: X500Principal): String {
|
|
||||||
val hexDigits = "0123456789abcdef".toCharArray()
|
|
||||||
val digest = MessageDigest.getInstance("MD5").digest(principal.encoded)
|
|
||||||
val hexChars = CharArray(8)
|
|
||||||
|
|
||||||
for (i in 0..3) {
|
|
||||||
// Kotlin doesn't support bitwise operators for bytes, only Int and Long.
|
|
||||||
val digestByte = digest[3 - i].toInt()
|
|
||||||
hexChars[2 * i] = hexDigits[(digestByte shr 4) and 0xf]
|
|
||||||
hexChars[2 * i + 1] = hexDigits[digestByte and 0xf]
|
|
||||||
}
|
|
||||||
|
|
||||||
return String(hexChars)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Check if CA root is known or not.
|
|
||||||
// Known means installed in root CA store, either a preset public CA or a custom one installed by an enterprise/user.
|
|
||||||
//
|
|
||||||
// Ref: https://source.chromium.org/chromium/chromium/src/+/main:net/android/java/src/org/chromium/net/X509Util.java;l=351
|
|
||||||
fun isKnownRoot(root: X509Certificate): Boolean {
|
|
||||||
// System keystore and cert directory must be non-null to perform checking
|
|
||||||
systemKeystore?.let { loadedSystemKeystore ->
|
|
||||||
systemCertificateDirectory?.let { loadedSystemCertificateDirectory ->
|
|
||||||
|
|
||||||
// Check the in-memory cache first
|
|
||||||
val key = Pair(root.subjectX500Principal, root.publicKey)
|
|
||||||
if (systemTrustAnchorCache.contains(key)) {
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
|
|
||||||
// System trust anchors are stored under a hash of the principal.
|
|
||||||
// In case of collisions, append number.
|
|
||||||
val hash = hashPrincipal(root.subjectX500Principal)
|
|
||||||
var i = 0
|
|
||||||
while (true) {
|
|
||||||
val alias = "$hash.$i"
|
|
||||||
|
|
||||||
if (!File(loadedSystemCertificateDirectory, alias).exists()) {
|
|
||||||
break
|
|
||||||
}
|
|
||||||
|
|
||||||
val anchor = loadedSystemKeystore.getCertificate("system:$alias")
|
|
||||||
|
|
||||||
// It's possible for `anchor` to be `null` if the user deleted a trust anchor.
|
|
||||||
// Continue iterating as there may be further collisions after the deleted anchor.
|
|
||||||
if (anchor == null) {
|
|
||||||
continue
|
|
||||||
// This should never happen
|
|
||||||
} else if (anchor !is X509Certificate) {
|
|
||||||
// SAFETY: This logs a unique identifier (hash value) only in cases where a file within the
|
|
||||||
// system's root trust store is not a valid X509 certificate (extremely unlikely error).
|
|
||||||
// The hash doesn't tell us any sensitive information about the invalid cert or reveal any of
|
|
||||||
// its contents - it just lets us ID the bad file if a user is having TLS failure issues.
|
|
||||||
Log.e(TAG, "anchor is not a certificate, alias: $alias")
|
|
||||||
continue
|
|
||||||
// If subject and public key match, it's a system root.
|
|
||||||
} else {
|
|
||||||
if ((root.subjectX500Principal == anchor.subjectX500Principal) && (root.publicKey == anchor.publicKey)) {
|
|
||||||
systemTrustAnchorCache.add(key)
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
i += 1
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Not found in cache or store: non-public
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -43,7 +43,6 @@ val excludedKoverSubProjects = listOf(
|
|||||||
":libraries:core",
|
":libraries:core",
|
||||||
":libraries:coroutines",
|
":libraries:coroutines",
|
||||||
":libraries:di",
|
":libraries:di",
|
||||||
":libraries:rustls-tls",
|
|
||||||
":tests:detekt-rules",
|
":tests:detekt-rules",
|
||||||
":tests:konsist",
|
":tests:konsist",
|
||||||
":tests:testutils",
|
":tests:testutils",
|
||||||
|
|||||||
@@ -17,6 +17,16 @@ pluginManagement {
|
|||||||
dependencyResolutionManagement {
|
dependencyResolutionManagement {
|
||||||
repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
|
repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
|
||||||
repositories {
|
repositories {
|
||||||
|
exclusiveContent {
|
||||||
|
forRepository {
|
||||||
|
maven {
|
||||||
|
url = uri("https://github.com/rustls/rustls-platform-verifier/raw/maven-archive/android-release-support/maven/")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
filter {
|
||||||
|
includeModule("org.rustls", "rustls-platform-verifier")
|
||||||
|
}
|
||||||
|
}
|
||||||
maven {
|
maven {
|
||||||
url = uri("https://www.jitpack.io")
|
url = uri("https://www.jitpack.io")
|
||||||
content {
|
content {
|
||||||
|
|||||||
+128
@@ -0,0 +1,128 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
|
||||||
|
# Copyright (c) 2026 Element Creations Ltd.
|
||||||
|
#
|
||||||
|
# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial.
|
||||||
|
# Please see LICENSE files in the repository root for full details.
|
||||||
|
|
||||||
|
"""
|
||||||
|
Update the rustls-platform-verifier dependency to the given version and regenerate
|
||||||
|
app/src/main/res/xml/network_security_config.xml.
|
||||||
|
|
||||||
|
The rustls-platform-verifier AAR ships a network_security_config.xml allowing cleartext traffic
|
||||||
|
to the domains used by certificate authorities to publish their CRLs. Since the app has its own
|
||||||
|
network security config, those domains are merged into a copy of network_security_config_element.xml.
|
||||||
|
|
||||||
|
Usage: ./tools/dependencies/update_rustls_platform_verifier.py <version>
|
||||||
|
"""
|
||||||
|
|
||||||
|
import io
|
||||||
|
import os
|
||||||
|
import re
|
||||||
|
import sys
|
||||||
|
import urllib.request
|
||||||
|
import xml.etree.ElementTree as ET
|
||||||
|
import zipfile
|
||||||
|
|
||||||
|
ROOT_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", ".."))
|
||||||
|
LIBS_VERSIONS_TOML = os.path.join(ROOT_DIR, "gradle", "libs.versions.toml")
|
||||||
|
XML_DIR = os.path.join(ROOT_DIR, "app", "src", "main", "res", "xml")
|
||||||
|
SOURCE_CONFIG = os.path.join(XML_DIR, "network_security_config_element.xml")
|
||||||
|
TARGET_CONFIG = os.path.join(XML_DIR, "network_security_config.xml")
|
||||||
|
|
||||||
|
AAR_URL = (
|
||||||
|
"https://raw.githubusercontent.com/rustls/rustls-platform-verifier/maven-archive/android-release-support/"
|
||||||
|
"maven/org/rustls/rustls-platform-verifier/{version}/rustls-platform-verifier-{version}.aar"
|
||||||
|
)
|
||||||
|
AAR_CONFIG_PATH = "res/xml/network_security_config.xml"
|
||||||
|
|
||||||
|
CLEARTEXT_DOMAIN_CONFIG_REGEX = re.compile(
|
||||||
|
r'(<domain-config\s+cleartextTrafficPermitted="true"\s*>.*?)(\n?[ \t]*</domain-config>)',
|
||||||
|
re.DOTALL,
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
def update_libs_versions(version):
|
||||||
|
with open(LIBS_VERSIONS_TOML, "r") as f:
|
||||||
|
content = f.read()
|
||||||
|
new_content, count = re.subn(
|
||||||
|
r'^(rustls_platform_verifier\s*=\s*"org\.rustls:rustls-platform-verifier:)[^"]+(")',
|
||||||
|
rf"\g<1>{version}\g<2>",
|
||||||
|
content,
|
||||||
|
flags=re.MULTILINE,
|
||||||
|
)
|
||||||
|
if count != 1:
|
||||||
|
sys.exit(f"Error: could not find the rustls_platform_verifier dependency in {LIBS_VERSIONS_TOML}")
|
||||||
|
with open(LIBS_VERSIONS_TOML, "w") as f:
|
||||||
|
f.write(new_content)
|
||||||
|
print(f"Updated rustls_platform_verifier to {version} in {os.path.relpath(LIBS_VERSIONS_TOML, ROOT_DIR)}")
|
||||||
|
|
||||||
|
|
||||||
|
def download_aar(version):
|
||||||
|
url = AAR_URL.format(version=version)
|
||||||
|
print(f"Downloading {url}")
|
||||||
|
try:
|
||||||
|
with urllib.request.urlopen(url) as response:
|
||||||
|
return response.read()
|
||||||
|
except urllib.error.HTTPError as e:
|
||||||
|
sys.exit(f"Error: could not download the AAR for version {version} ({e.code} {e.reason})")
|
||||||
|
|
||||||
|
|
||||||
|
def extract_cleartext_domains(aar_bytes):
|
||||||
|
with zipfile.ZipFile(io.BytesIO(aar_bytes)) as aar:
|
||||||
|
try:
|
||||||
|
config = aar.read(AAR_CONFIG_PATH)
|
||||||
|
except KeyError:
|
||||||
|
sys.exit(f"Error: {AAR_CONFIG_PATH} not found in the AAR")
|
||||||
|
root = ET.fromstring(config)
|
||||||
|
domains = []
|
||||||
|
for domain_config in root.iter("domain-config"):
|
||||||
|
if domain_config.get("cleartextTrafficPermitted") != "true":
|
||||||
|
continue
|
||||||
|
for domain in domain_config.findall("domain"):
|
||||||
|
domains.append((domain.get("includeSubdomains"), domain.text.strip()))
|
||||||
|
if not domains:
|
||||||
|
sys.exit("Error: no cleartext domains found in the AAR network_security_config.xml")
|
||||||
|
return domains
|
||||||
|
|
||||||
|
|
||||||
|
def write_network_security_config(domains, version):
|
||||||
|
with open(SOURCE_CONFIG, "r") as f:
|
||||||
|
content = f.read()
|
||||||
|
|
||||||
|
lines = [
|
||||||
|
"",
|
||||||
|
"",
|
||||||
|
f" <!-- Domains below are imported from rustls-platform-verifier {version} by tools/dependencies/update_rustls_platform_verifier.py -->",
|
||||||
|
" <!-- They are needed to fetch the certificate revocation lists over cleartext -->",
|
||||||
|
]
|
||||||
|
for include_subdomains, name in domains:
|
||||||
|
attributes = f' includeSubdomains="{include_subdomains}"' if include_subdomains is not None else ""
|
||||||
|
lines.append(f" <domain{attributes}>{name}</domain>")
|
||||||
|
extra = "\n".join(lines)
|
||||||
|
|
||||||
|
new_content, count = CLEARTEXT_DOMAIN_CONFIG_REGEX.subn(lambda m: m.group(1) + extra + m.group(2), content, count=1)
|
||||||
|
if count != 1:
|
||||||
|
sys.exit(f'Error: could not find <domain-config cleartextTrafficPermitted="true"> in {SOURCE_CONFIG}')
|
||||||
|
|
||||||
|
with open(TARGET_CONFIG, "w") as f:
|
||||||
|
f.write(new_content)
|
||||||
|
print(f"Wrote {os.path.relpath(TARGET_CONFIG, ROOT_DIR)} with {len(domains)} extra domains")
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
if len(sys.argv) != 2:
|
||||||
|
sys.exit(f"Usage: {sys.argv[0]} <version>")
|
||||||
|
version = sys.argv[1].strip()
|
||||||
|
if not re.fullmatch(r"[0-9A-Za-z.\-]+", version):
|
||||||
|
sys.exit(f"Error: invalid version '{version}'")
|
||||||
|
|
||||||
|
# Download first, so nothing is modified if the version does not exist
|
||||||
|
aar_bytes = download_aar(version)
|
||||||
|
domains = extract_cleartext_domains(aar_bytes)
|
||||||
|
update_libs_versions(version)
|
||||||
|
write_network_security_config(domains, version)
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
main()
|
||||||
@@ -42,6 +42,8 @@
|
|||||||
<ignore path="**/src/debug/**" />
|
<ignore path="**/src/debug/**" />
|
||||||
<!-- Ignore unused resources in designsystem since they're imported elsewhere through aliases and can't be properly detected -->
|
<!-- Ignore unused resources in designsystem since they're imported elsewhere through aliases and can't be properly detected -->
|
||||||
<ignore path="**/libraries/designsystem/src/main/res/**" />
|
<ignore path="**/libraries/designsystem/src/main/res/**" />
|
||||||
|
<!-- Ignore the network security config template: this will be merged with rustls's security config -->
|
||||||
|
<ignore path="**/src/main/res/xml/network_security_config_element.xml" />
|
||||||
</issue>
|
</issue>
|
||||||
|
|
||||||
<!-- UX -->
|
<!-- UX -->
|
||||||
|
|||||||
Reference in New Issue
Block a user