julius.joska/sepot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

build: pin the native libsignal library by SHA-256

Browse Source 
The libsignal Dart package downloads a prebuilt libsignal_frb from the
GitHub releases of djx-y-z/libsignal_dart and only checks it against a
checksum file from the same release. Keep our own pins in
app/tool/native_libs.sha256 and verify the finished AAB/APK with
app/tool/verify_native_libs.sh; any mismatch fails the release build.

The pins cover the upstream archives and the library as packaged after
the Android Gradle plugin strips it. `--from-upstream` re-derives the
packaged hashes from the upstream archives with llvm-strip.
This commit is contained in:
Julius Joska
2026-10-23 09:15:15 +02:00
parent ab0e35ddf4
commit ae127decd9
2 changed files with 112 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/tool/native_libs.sha256
+25
View File
@@ -0,0 +1,25 @@
# Pinned native crypto library (libsignal_frb) shipped in the Android app.
#
# The Dart package `libsignal` downloads a prebuilt `libsignal_frb` from the
# GitHub releases of djx-y-z/libsignal_dart during the build. Its own check
# only compares against a checksum file from the same release, so a replaced
# release would go unnoticed. These pins live in our repository instead and
# tool/verify_native_libs.sh fails the release build on any mismatch.
#
# package = version of the `libsignal` Dart package in pubspec.lock
# archive = SHA-256 of the upstream release archive
# https://github.com/djx-y-z/libsignal_dart/releases/tag/libsignal_frb-4.0.9
# shipped = SHA-256 of liblibsignal_frb.so inside our AAB/APK. The Android
# Gradle plugin strips the library while packaging; the value equals
# `llvm-strip --strip-unneeded` (NDK 28) applied to the file from the
# archive. `verify_native_libs.sh --from-upstream` re-derives it.
#
# Updating libsignal = update every line here in the same commit.
package libsignal 5.0.9
archive android-arm64-v8a b03c1f47b07ded392a9a44b217b3d24470f0dce69901c67061c1f1295f96065f
archive android-armeabi-v7a 0dc16fbbfe2bf5b3e7758fd2b297c831fee296c55ac19b4f94a9e0086d26b9b0
archive android-x86_64 cdb1623a855fa508dd84c025b267eaac846f882637450f00a74199bdf2d85264
shipped arm64-v8a 39612f422ed1dc2c7576165c5c169d7911f64de093eeea4ee8d3047b884c1c0a
shipped armeabi-v7a b442795a864fe0ae15a1e04a151863244fedda3b8854b2d22ec9b23e59227e78
shipped x86_64 59e5925c2d6f5e9496cbe86d1a7d19965dc4060efe94cd452d58ba651fe7a122