ober/jerboa-android
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Allow app-owned Gradle verification metadata #7

Merged
ober merged 1 commit from feat/app-verification-metadata into main 2026-09-21 17:40:29 -04:00
Conversation 0 Commits 1 Files changed 10 +63 -7
ober commented 2026-09-20 11:02:54 -04:00
Owner
Copy link

Apps that add verified Maven dependencies need checksums in Gradle's strict verification metadata, but the generator always copied its own manifest. This adds an optional app-owned verification-metadata path, confined to the app-spec directory and rejecting traversal, symlinks, duplicate declarations, and non-XML files. Apps without the field keep the pinned generator manifest.

Validation: make test, make binary, make binary-smoke, and git diff --check pass. The new fixture verifies byte-for-byte copying; security fixtures verify path escape and duplicate declarations are rejected.

Apps that add verified Maven dependencies need checksums in Gradle's strict verification metadata, but the generator always copied its own manifest. This adds an optional app-owned `verification-metadata` path, confined to the app-spec directory and rejecting traversal, symlinks, duplicate declarations, and non-XML files. Apps without the field keep the pinned generator manifest. Validation: `make test`, `make binary`, `make binary-smoke`, and `git diff --check` pass. The new fixture verifies byte-for-byte copying; security fixtures verify path escape and duplicate declarations are rejected.
Allow app-owned Gradle verification metadata
Some checks failed
required-ci / host-required (pull_request) Successful in 3m44s
Details
version-policy / required (pull_request) Successful in 3m46s
Details
required-ci / android-sdk (pull_request) Has been cancelled
Details
9006b5b7f5
ober force-pushed feat/app-verification-metadata from 9006b5b7f5
Some checks failed
required-ci / host-required (pull_request) Successful in 3m44s
Details
version-policy / required (pull_request) Successful in 3m46s
Details
required-ci / android-sdk (pull_request) Has been cancelled
Details
to 445861ca39
All checks were successful
required-ci / host-required (pull_request) Successful in 3m45s
Details
version-policy / required (pull_request) Successful in 3m45s
Details
required-ci / android-sdk (pull_request) Successful in 5m34s
Details
2026-09-21 17:29:13 -04:00 Compare
ober merged commit 778e67012e into main 2026-09-21 17:40:29 -04:00
ober referenced this pull request from a commit 2026-09-21 17:40:30 -04:00
Merge pull request #7
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
ober/jerboa-android!7
No description provided.