1442-Add_Null_check_on_signature_check (a1e2eaa7) · Commits · e / os / App Lounge

app/src/main/java/foundation/e/apps/MainActivity.kt

+1 −1

Original line number	Diff line number	Diff line
		@@ -54,12 +54,12 @@ import foundation.e.apps.ui.setup.signin.SignInViewModel
		import foundation.e.apps.utils.SystemInfoProvider
		import foundation.e.apps.utils.eventBus.AppEvent
		import foundation.e.apps.utils.eventBus.EventBus
		import javax.inject.Inject
		import kotlinx.coroutines.flow.collectLatest
		import kotlinx.coroutines.flow.distinctUntilChanged
		import kotlinx.coroutines.flow.filter
		import kotlinx.coroutines.launch
		import timber.log.Timber
		import javax.inject.Inject

		@AndroidEntryPoint
		class MainActivity : AppCompatActivity() {

app/src/main/java/foundation/e/apps/data/cleanapk/ApkSignatureManager.kt

+12 −9

Original line number	Diff line number	Diff line
		@@ -34,13 +34,14 @@ import java.io.InputStream
		import java.security.Security

		object ApkSignatureManager {
		fun verifyFdroidSignature(context: Context, apkFilePath: String, signature: String): Boolean {
		fun verifyFdroidSignature(context: Context, apkFilePath: String, signature: String, packageName: String): Boolean {
		Security.addProvider(BouncyCastleProvider())
		try {
		return verifyAPKSignature(
		BufferedInputStream(FileInputStream(apkFilePath)),
		signature.byteInputStream(Charsets.UTF_8),
		context.assets.open("f-droid.org-signing-key.gpg")
		context.assets.open("f-droid.org-signing-key.gpg"),
		packageName
		)
		} catch (e: Exception) {
		Timber.e(e)
		@@ -51,10 +52,11 @@ object ApkSignatureManager {
		private fun verifyAPKSignature(
		apkInputStream: BufferedInputStream,
		apkSignatureInputStream: InputStream,
		publicKeyInputStream: InputStream
		publicKeyInputStream: InputStream,
		packageName: String
		): Boolean {
		try {
		val signature = extractSignature(apkSignatureInputStream)
		val signature = extractSignature(apkSignatureInputStream) ?: return false
		val pgpPublicKeyRingCollection =
		PGPPublicKeyRingCollection(
		PGPUtil.getDecoderStream(publicKeyInputStream),
		@@ -66,7 +68,7 @@ object ApkSignatureManager {
		updateSignature(apkInputStream, signature)
		return signature.verify()
		} catch (e: Exception) {
		e.printStackTrace()
		Timber.e(e, "Signature verification failed for: $packageName")
		} finally {
		apkInputStream.close()
		apkSignatureInputStream.close()
		@@ -76,20 +78,21 @@ object ApkSignatureManager {
		return false
		}

		private fun extractSignature(apkSignatureInputStream: InputStream): PGPSignature {
		private fun extractSignature(apkSignatureInputStream: InputStream): PGPSignature? {
		var jcaPGPObjectFactory =
		JcaPGPObjectFactory(PGPUtil.getDecoderStream(apkSignatureInputStream))
		val pgpSignatureList: PGPSignatureList

		val pgpObject = jcaPGPObjectFactory.nextObject()
		val pgpObject = jcaPGPObjectFactory.nextObject() ?: return null

		if (pgpObject is PGPCompressedData) {
		jcaPGPObjectFactory = JcaPGPObjectFactory(pgpObject.dataStream)
		pgpSignatureList = jcaPGPObjectFactory.nextObject() as PGPSignatureList
		} else {
		pgpSignatureList = pgpObject as PGPSignatureList
		}
		val signature = pgpSignatureList.get(0)
		return signature

		return pgpSignatureList.get(0)
		}

		private fun updateSignature(

app/src/main/java/foundation/e/apps/data/fdroid/FdroidRepository.kt

+1 −1

Original line number	Diff line number	Diff line
		@@ -56,7 +56,7 @@ class FdroidRepository @Inject constructor(

		override suspend fun isFdroidApplicationSigned(context: Context, packageName: String, apkFilePath: String, signature: String): Boolean {
		if (isFdroidApplication(packageName)) {
		return ApkSignatureManager.verifyFdroidSignature(context, apkFilePath, signature)
		return ApkSignatureManager.verifyFdroidSignature(context, apkFilePath, signature, packageName)
		}
		return false
		}

app/src/main/java/foundation/e/apps/data/gplay/utils/GPlayHttpClient.kt

+2 −1

Original line number	Diff line number	Diff line
		@@ -174,6 +174,7 @@ class GPlayHttpClient @Inject constructor(
		when (e) {
		is UnknownHostException,
		is SocketTimeoutException -> handleExceptionOnGooglePlayRequest(e)

		else -> handleExceptionOnGooglePlayRequest(e)
		}
		} finally {

app/src/main/java/foundation/e/apps/data/login/LoginViewModel.kt

+1 −1

Original line number	Diff line number	Diff line
		@@ -24,8 +24,8 @@ import dagger.hilt.android.lifecycle.HiltViewModel
		import foundation.e.apps.data.enums.User
		import foundation.e.apps.ui.parentFragment.LoadingViewModel
		import kotlinx.coroutines.launch
		import javax.inject.Inject
		import okhttp3.Cache
		import javax.inject.Inject

		/**
		* ViewModel to handle all login related operations.