update: reject APKs with invalid file sig, probably Janus exploits

[fdroidserver.git] / tests / run-tests

diff --git a/tests/run-tests b/tests/run-tests
index 0ce5e69eb38dae827a6b61a7fab490156c6e2b20..af29f471eeb186a5480815658759b206b16afc5a 100755 (executable)
--- a/tests/run-tests
+++ b/tests/run-tests
@@ -9,7 +9,7 @@ echo_header() {
 copy_apks_into_repo() {
     set +x
     find $APKDIR -type f -name '*.apk' -print0 | while IFS= read -r -d '' f; do
-        echo $f | grep -F -v -e unaligned -e unsigned -e badsig -e badcert -e bad-unicode || continue
+        echo $f | grep -F -v -e unaligned -e unsigned -e badsig -e badcert -e bad-unicode -e janus.apk || continue
         apk=`$aapt dump badging "$f" | sed -n "s,^package: name='\(.*\)' versionCode='\([0-9][0-9]*\)' .*,\1_\2.apk,p"`
         test "$f" -nt repo/$apk && rm -f repo/$apk  # delete existing if $f is newer
         if [ ! -e repo/$apk ] && [ ! -e archive/$apk ]; then
@@ -46,6 +46,11 @@ have_git_2_3() {
     python3 -c "import sys; from distutils.version import LooseVersion as V; sys.exit(V(sys.argv[3]) < V('2.3'))" `git --version`
 }
 
+is_MD5_disabled() {
+    javac $WORKSPACE/tests/IsMD5Disabled.java && java -cp $WORKSPACE/tests IsMD5Disabled
+    return $?
+}
+
 #------------------------------------------------------------------------------#
 # "main"
 
@@ -172,23 +177,23 @@ $fdroid update
 
 
 #------------------------------------------------------------------------------#
-echo_header 'run `fdroid build` in fresh git checkout from import.TestCase'
+echo_header 'run "fdroid build" in fresh git checkout from import.TestCase'
 
 cd $WORKSPACE/tests/tmp/importer
 git remote update -p
 git clean -fdx
 # stick with known working commit, in case future commits break things for this code
-git reset --hard cecf00c08aec56ae7a5eba444150c4d1ae868814
-if [ -d $ANDROID_HOME/platforms/android-23 ]; then
+git reset --hard fea54e1161d5eb9eb1a54e26253ef84d3ab63705
+if [ -d $ANDROID_HOME/platforms/android-23 && -d $ANDROID_HOME/build-tools/23.0.3 ]; then
     echo "build_tools = '`ls -1 $ANDROID_HOME/build-tools/ | sort -n | tail -1`'" > config.py
     echo "force_build_tools = True" >> config.py
     $fdroid build --verbose org.fdroid.ci.test.app:300
 else
-    echo 'WARNING: Skipping `fdroid build` test since android-23 is missing!'
+    echo 'WARNING: Skipping "fdroid build" test since android-23 is missing!'
 fi
 
 #------------------------------------------------------------------------------#
-echo_header 'copy git import and run `fdroid scanner` on it'
+echo_header 'copy git import and run "fdroid scanner" on it'
 
 REPOROOT=`create_test_dir`
 cd $REPOROOT
@@ -235,17 +240,22 @@ test -e repo/index-v1.jar
 grep -F '<application id=' repo/index.xml > /dev/null
 grep -F '<install packageName=' repo/index.xml > /dev/null
 grep -F '<uninstall packageName=' repo/index.xml > /dev/null
-$fdroid gpgsign --verbose
-$fdroid gpgsign --verbose
-test -e repo/obb.mainpatch.current_1619.apk.asc
-test -e repo/obb.main.twoversions_1101617_src.tar.gz.asc
-! test -e repo/obb.mainpatch.current_1619.apk.asc.asc
-! test -e repo/obb.main.twoversions_1101617_src.tar.gz.asc.asc
-! test -e repo/index.xml.asc
+# OSX tests are run on Travis-CI, and gpg fails to launch gpg-agent there
+if [ "$TRAVIS_OS_NAME" != "osx" ]; then
+    $fdroid gpgsign --verbose
+    $fdroid gpgsign --verbose
+    test -e repo/obb.mainpatch.current_1619.apk.asc
+    test -e repo/obb.main.twoversions_1101617_src.tar.gz.asc
+    ! test -e repo/obb.mainpatch.current_1619.apk.asc.asc
+    ! test -e repo/obb.main.twoversions_1101617_src.tar.gz.asc.asc
+    ! test -e repo/index.xml.asc
+fi
 
 # we can't easily reproduce the timestamps for things, so just hardcode them
 $sed -i.tmp -e 's,timestamp="[0-9]*",timestamp="1480431575",' repo/index.xml
 diff -uw $WORKSPACE/tests/repo/index.xml repo/index.xml
+sed -i --expression='s,"timestamp": [0-9]*,"timestamp": 1502845383782,' repo/index-v1.json
+diff -uw $WORKSPACE/tests/repo/index-v1.json repo/index-v1.json
 
 
 #------------------------------------------------------------------------------#