Julius Joska
ae127decd9
The libsignal Dart package downloads a prebuilt libsignal_frb from the GitHub releases of djx-y-z/libsignal_dart and only checks it against a checksum file from the same release. Keep our own pins in app/tool/native_libs.sha256 and verify the finished AAB/APK with app/tool/verify_native_libs.sh; any mismatch fails the release build. The pins cover the upstream archives and the library as packaged after the Android Gradle plugin strips it. `--from-upstream` re-derives the packaged hashes from the upstream archives with llvm-strip.
26 lines
1.6 KiB
Plaintext
26 lines
1.6 KiB
Plaintext
# Pinned native crypto library (libsignal_frb) shipped in the Android app.
|
|
#
|
|
# The Dart package `libsignal` downloads a prebuilt `libsignal_frb` from the
|
|
# GitHub releases of djx-y-z/libsignal_dart during the build. Its own check
|
|
# only compares against a checksum file from the same release, so a replaced
|
|
# release would go unnoticed. These pins live in our repository instead and
|
|
# tool/verify_native_libs.sh fails the release build on any mismatch.
|
|
#
|
|
# package = version of the `libsignal` Dart package in pubspec.lock
|
|
# archive = SHA-256 of the upstream release archive
|
|
# https://github.com/djx-y-z/libsignal_dart/releases/tag/libsignal_frb-4.0.9
|
|
# shipped = SHA-256 of liblibsignal_frb.so inside our AAB/APK. The Android
|
|
# Gradle plugin strips the library while packaging; the value equals
|
|
# `llvm-strip --strip-unneeded` (NDK 28) applied to the file from the
|
|
# archive. `verify_native_libs.sh --from-upstream` re-derives it.
|
|
#
|
|
# Updating libsignal = update every line here in the same commit.
|
|
|
|
package libsignal 5.0.9
|
|
archive android-arm64-v8a b03c1f47b07ded392a9a44b217b3d24470f0dce69901c67061c1f1295f96065f
|
|
archive android-armeabi-v7a 0dc16fbbfe2bf5b3e7758fd2b297c831fee296c55ac19b4f94a9e0086d26b9b0
|
|
archive android-x86_64 cdb1623a855fa508dd84c025b267eaac846f882637450f00a74199bdf2d85264
|
|
shipped arm64-v8a 39612f422ed1dc2c7576165c5c169d7911f64de093eeea4ee8d3047b884c1c0a
|
|
shipped armeabi-v7a b442795a864fe0ae15a1e04a151863244fedda3b8854b2d22ec9b23e59227e78
|
|
shipped x86_64 59e5925c2d6f5e9496cbe86d1a7d19965dc4060efe94cd452d58ba651fe7a122
|