build(security): pin release verification - #6546
Open
SeniorZhai wants to merge 2 commits into
Open
Conversation
- Pin build tooling and the Android container image to immutable versions. - Verify trusted signing identity and compare complete release APK contents.
Contributor
There was a problem hiding this comment.
Pull request overview
Strengthens release APK verification and build reproducibility.
Changes:
- Pins build tooling to immutable versions.
- Adds signing-certificate validation.
- Makes APK-content mismatches fail closed.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
verify-mixin-apk.sh |
Tightens certificate and APK-content verification. |
build.gradle.kts |
Pins the Bugsnag plugin version. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+43
to
+46
| docker run --rm \ | ||
| -v $(pwd):/project \ | ||
| -v $(pwd)/output-apk:/home/gradle/app/build/outputs/apk/release \ | ||
| mingc/android-build-box bash -c 'cd /project; ./gradlew :app:assembleRelease' | ||
| -v "$repo_root":/project \ | ||
| mingc/android-build-box@sha256:de4a27cbc13a22563f82e93fde01c7366a5cda2c8ff113353d3e24e75c9ae8b6 \ | ||
| bash -c 'cd /project; ./gradlew :app:assembleGooglePlayRelease' |
|
|
||
| # Remove the signature since OSS users won't have Mixin private signing key | ||
| rm -r "$tmp"/{to_verify,baseline}/{META-INF,resources.arsc} | ||
| rm -rf "$tmp/to_verify/META-INF" "$tmp/baseline/META-INF" |
|
|
||
| adb pull $(adb shell pm path one.mixin.messenger | grep "/base.apk" | sed 's/^package://') mixin-store.apk | ||
| wait | ||
| device_apk=$(adb shell pm path one.mixin.messenger | sed -n 's/^package:\\(.*\\/base\\.apk\\)$/\\1/p' | tr -d '\r' | head -1) |
Build device-specific APKs from the release bundle so verification matches Google Play delivery. Preserve non-signature metadata and fail closed when any installed split differs.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
verify-mixin-apk.sh:24
sort -Vis a GNU extension and is unsupported by the BSDsortshipped with macOS. Withset -euo pipefail, the script exits here before verification on a standard macOS Android development environment, even when Build Tools are correctly installed. Please select the newest Build Tools version using a portable method (or document and check for GNU coreutils).
apksigner_bin=$(find "${ANDROID_HOME:?ANDROID_HOME is required}/build-tools" -type f -name apksigner | sort -V | tail -1)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
Google Play generates device-specific split APKs from the uploaded app bundle.
Comparing only the installed
base.apkwith a standalone release APK does notrepresent the artifact delivered to users. The previous verification also
relied on mutable tooling and excluded more metadata than the signing process
requires.
Impact
There is no runtime app behavior change. The verification workflow now checks
the same base and ABI split layout used by Google Play and requires
EXPECTED_CERT_SHA256before running.Validation
bash -n verify-mixin-apk.shMETA-INFdifferences fail verification../gradlew help --task :app:bundleGooglePlayRelease --no-daemonapp-googlePlay-release.aablocally; the later Crashlytics mappingupload stopped on an external TLS handshake.