Skip to content

Commit e5b0413

Browse files
RawaRawa
committed
Merge branch 'rework-gradle-verification-lockfile'
2 parents 1cb7935 + 5436624 commit e5b0413

7 files changed

+2501
-2977
lines changed

‎.github/workflows/android-audit.yml

+22-8
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@ on:
55
paths:
66
- .github/workflows/android-audit.yml
77
- android/gradle/verification-metadata.xml
8-
- android/scripts/update-lockfile.sh
8+
- android/gradle/verification-metadata.keys.xml
9+
- android/gradle/verification-keyring.keys
10+
- android/scripts/lockfile
911
# libs.versions.toml and *.kts are necessary to ensure that the verification-metadata.xml is up-to-date
1012
# with our dependency usage due to the dependency verification not working as expected when keys are
1113
# specified for dependencies (DROID-1425).
@@ -59,19 +61,31 @@ jobs:
5961
- name: Fix HOME path
6062
run: echo "HOME=/root" >> $GITHUB_ENV
6163

62-
- name: Set locale
63-
run: echo "LC_ALL=C.UTF-8" >> $GITHUB_ENV
64-
6564
- uses: actions/checkout@v4
6665

66+
# Needed to run git diff later
6767
- name: Fix git dir
6868
run: git config --global --add safe.directory $(pwd)
6969

70-
- name: Create Android rustJniLibs dir
71-
run: mkdir -p android/app/build/rustJniLibs/android
72-
7370
- name: Re-generate lockfile
74-
run: android/scripts/update-lockfile.sh
71+
run: android/scripts/lockfile -u
7572

7673
- name: Ensure no changes
7774
run: git diff --exit-code
75+
76+
verify-lockfile-keys:
77+
needs: prepare
78+
name: Verify lockfile keys
79+
runs-on: ubuntu-latest
80+
container:
81+
image: ${{ needs.prepare.outputs.container_image }}
82+
steps:
83+
# Fix for HOME path overridden by GH runners when building in containers, see:
84+
# https://github.com/actions/runner/issues/863
85+
- name: Fix HOME path
86+
run: echo "HOME=/root" >> $GITHUB_ENV
87+
88+
- uses: actions/checkout@v4
89+
90+
- name: Verify lockfile keys metadata
91+
run: android/scripts/lockfile -v

‎.github/workflows/verify-locked-down-signatures.yml

+4
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ on:
44
pull_request:
55
paths:
66
- .github/workflows/verify-locked-down-signatures.yml
7+
- .github/workflows/android-audit.yml
78
- .github/workflows/unicop.yml
89
- .github/CODEOWNERS
910
- Cargo.toml
@@ -21,8 +22,11 @@ on:
2122
- android/gradlew
2223
- android/gradlew.bat
2324
- android/gradle/verification-metadata.xml
25+
- android/gradle/verification-metadata.keys.xml
26+
- android/gradle/verification-keyring.keys
2427
- android/gradle/wrapper/gradle-wrapper.jar
2528
- android/gradle/wrapper/gradle-wrapper.properties
29+
- android/scripts/lockfile
2630
- building/build-and-publish-container-image.sh
2731
- building/mullvad-app-container-signing.asc
2832
- building/linux-container-image.txt

‎android/gradle/verification-keyring.keys

+1,359-2,640
Large diffs are not rendered by default.

‎android/gradle/verification-metadata.keys.xml

+922
Large diffs are not rendered by default.

‎android/gradle/verification-metadata.xml

+1-229
Large diffs are not rendered by default.

‎android/scripts/lockfile

+193
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
#!/usr/bin/env bash
2+
3+
set -eu
4+
5+
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
6+
cd "$SCRIPT_DIR"
7+
8+
# shellcheck disable=SC1091
9+
source ../../scripts/utils/log
10+
11+
print_usage() {
12+
log "Usage: lockfile <option>"
13+
log "Where option is one of the following flags:"
14+
log " -u, --update"
15+
log " Update the metadata files with new entries, and add new keys that may be used."
16+
log " -v, --verify"
17+
log " Verify all dependencies' signatures with the keys metadata file."
18+
log " -r, --renew-keys"
19+
log " Renew all keys, will remove all trusted keys and clear the keyring, allowing for old"
20+
log " keys to removed and key entries to be updated. This result is not reproducible since"
21+
log " entries may change depending on from which keyserver keys was fetched and how gradle"
22+
log " decides to create verification xml file. Also make sure to do an additional normal run"
23+
log " afterwards."
24+
log " -h, --help"
25+
log " Show this help page."
26+
}
27+
28+
function main {
29+
if [[ $# -eq 0 ]]; then
30+
print_usage
31+
exit 1
32+
fi
33+
34+
if [[ $# -gt 1 ]]; then
35+
log_error "Too many arguments"
36+
print_usage
37+
exit 1
38+
fi
39+
40+
cd ../gradle/
41+
trap cleanup EXIT
42+
43+
case "$1" in
44+
"-u"|"--update")
45+
setup_gradle
46+
update_checksums
47+
update_keys false
48+
;;
49+
"-v"|"--verifiy")
50+
setup_gradle
51+
verify
52+
;;
53+
"-r"|"--renew-keys")
54+
setup_gradle
55+
update_keys true
56+
# First run can produce a pgp entry in among the checksums, a second run clears this out.
57+
log_info "Running second time to flush out impurities"
58+
update_keys false
59+
;;
60+
"-h"|"--help")
61+
print_usage
62+
exit 0
63+
;;
64+
*)
65+
log_error "Invalid argument: \`$1\`"
66+
print_usage
67+
exit 1
68+
;;
69+
esac
70+
}
71+
72+
function cleanup {
73+
log "Cleaning up temp dirs..."
74+
rm -rf -- "$GRADLE_USER_HOME" "$TEMP_GRADLE_PROJECT_CACHE_DIR" verification-keyring.gpg
75+
}
76+
77+
function setup_gradle {
78+
# regardless if stopped.
79+
GRADLE_OPTS="-Dorg.gradle.daemon=false"
80+
# We must provide a template for mktemp to work properly on macOS.
81+
GRADLE_USER_HOME=$(mktemp -d -t gradle-home-XXX)
82+
TEMP_GRADLE_PROJECT_CACHE_DIR=$(mktemp -d -t gradle-cache-XXX)
83+
# Task list to discover all tasks and their dependencies since
84+
# just running the suggested 'help' task isn't sufficient.
85+
GRADLE_TASKS=(
86+
"lint"
87+
)
88+
89+
export GRADLE_OPTS
90+
export GRADLE_USER_HOME
91+
92+
log_header "Gradle Configuration"
93+
log_info "home: $GRADLE_USER_HOME"
94+
log_info "cache: $TEMP_GRADLE_PROJECT_CACHE_DIR"
95+
}
96+
97+
function update_checksums {
98+
log_header "Update checksums"
99+
100+
log "Removing old components..."
101+
sed -i '/<components>/,/<\/components>/d' verification-metadata.xml
102+
103+
log "Generating new components..."
104+
../gradlew -q -p .. --project-cache-dir "$TEMP_GRADLE_PROJECT_CACHE_DIR" -M sha256 "${GRADLE_TASKS[@]}"
105+
106+
log_success "Successfully updated checksums"
107+
}
108+
109+
function update_keys {
110+
local renew_keys=$1
111+
112+
if [ "$renew_keys" = true ]; then
113+
log_header "Renew keys"
114+
else
115+
log_header "Update keys"
116+
fi
117+
118+
activate_keys_metadata
119+
120+
log "Temporarily enabling key servers..."
121+
sed -Ei 's,key-servers enabled="[^"]+",key-servers enabled="true",' verification-metadata.xml
122+
123+
log "Removing old components..."
124+
sed -i '/<components>/,/<\/components>/d' verification-metadata.xml
125+
126+
if [ "$renew_keys" = true ]; then
127+
log_info "Renewing all keys"
128+
129+
log "Removing old trusted keys..."
130+
sed -i '/<trusted-keys>/,/<\/trusted-keys>/d' verification-metadata.xml
131+
132+
log "Removing old keyring..."
133+
rm verification-keyring.keys
134+
fi
135+
136+
log "Generating new trusted keys & updating keyring..."
137+
../gradlew -q -p .. --project-cache-dir "$TEMP_GRADLE_PROJECT_CACHE_DIR" -M pgp,sha256 "${GRADLE_TASKS[@]}" --export-keys
138+
139+
log "Sorting keyring and removing duplicates..."
140+
# Sort and unique the keyring
141+
# https://github.com/gradle/gradle/issues/20140
142+
# `sed 's/$/NEWLINE/g'` adds the word NEWLINE at the end of each line
143+
# `tr -d '\n'` deletes the actual newlines
144+
# `sed` again adds a newline at the end of each key, so each key is one line
145+
# `sort` orders the keys deterministically
146+
# `uniq` removes identical keys
147+
# `sed 's/NEWLINE/\n/g'` puts the newlines back
148+
< verification-keyring.keys \
149+
sed 's/$/NEWLINE/g' \
150+
| tr -d '\n' \
151+
| sed 's/\(-----END PGP PUBLIC KEY BLOCK-----\)/\1\n/g' \
152+
| grep "END PGP PUBLIC KEY BLOCK" \
153+
| sort \
154+
| uniq \
155+
| sed 's/NEWLINE/\n/g' \
156+
> verification-keyring.new.keys
157+
mv -f verification-keyring.new.keys verification-keyring.keys
158+
159+
log "Disabling key servers..."
160+
sed -Ezi 's,key-servers,key-servers enabled="false",' verification-metadata.xml
161+
162+
deactivate_keys_metadata
163+
164+
log_success "Successfully updated keys"
165+
}
166+
167+
function activate_keys_metadata {
168+
log_info "Activating keys metadata"
169+
mv verification-metadata.xml verification-metadata.checksums.xml
170+
mv verification-metadata.keys.xml verification-metadata.xml
171+
}
172+
173+
function deactivate_keys_metadata {
174+
log_info "Deactivating keys metadata"
175+
mv verification-metadata.xml verification-metadata.keys.xml
176+
mv verification-metadata.checksums.xml verification-metadata.xml
177+
}
178+
179+
function verify {
180+
log_header "Verify dependencies' signatures"
181+
182+
activate_keys_metadata
183+
184+
log "Verifying signatures..."
185+
../gradlew -q -p .. --project-cache-dir "$TEMP_GRADLE_PROJECT_CACHE_DIR" "${GRADLE_TASKS[@]}"
186+
187+
deactivate_keys_metadata
188+
189+
log_success "Verification successful"
190+
}
191+
192+
# Run script
193+
main "$@"

‎android/scripts/update-lockfile.sh

-100
This file was deleted.

0 commit comments

Comments
 (0)