morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #4158] [MERGED] feat(apk): inspect signing declarations with retained fact queries #6097

New issue

Closed

opened 2026-10-31 01:11:50 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:11:50 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4158
Author: @FerroLx
Created: 10/15/2026
Status: ✅ Merged
Merged: 10/22/2026
Merged by: @gensokyo-dev

Base: main ← Head: feat/apk-signature

📝 Commits (10+)

f8ce23e feat(apk): locate and frame the APK Signing Block (v2+ foundation)
40df3ad feat(apk): decode v2/v3/v3.1 signer structures from the signing block
b2b95ab feat(apk): detect v1 (JAR) signing from the central directory
f160be6 feat(apk): public result schema and tamper-surface posture derivation
9cf1b9b feat(apk): provider, service and CLI/MCP/catalog wiring for inspect_apk_signature
da27214 feat(apk): recompute the v2/v3 content digest for self-consistency
23108ca feat(apk): decode the v3 rotation lineage; stop flagging rotation as tampering
f44068e test(apk): add the apksigner/aapt2 real-toolchain lane (verify:apk-signature)
023a838 test(apk): SDK-free provider tests for inspect_apk_signature
addf92a fix(apk): enforce the output budget and keep observed and declared facts apart

📊 Changes

66 files changed (+11735 additions, -18 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+8 -0)
📝 .agents/skills/reverse-engineer-anything/references/native-and-artifacts.md (+24 -0)
📝 .github/workflows/ci.yml (+13 -0)
➕ .github/workflows/real-apk-signature.yml (+97 -0)
📝 README.md (+1 -0)
➕ docs/apk-signature.md (+263 -0)
📝 docs/architecture.mermaid (+3 -0)
📝 docs/index.md (+13 -13)
➕ docs/specs/apk-signature/spec.md (+113 -0)
➕ docs/verification/apk-signature-2026-10-22.json (+1644 -0)
➕ docs/verification/apk-signature-2026-10-22.md (+188 -0)
📝 package.json (+1 -0)
📝 scripts/ci/scopes.mjs (+19 -0)
📝 scripts/lib/catalog-builders.mjs (+5 -0)
📝 scripts/lib/catalog-core.mjs (+3 -0)
📝 scripts/lib/test-projects.mjs (+1 -1)
➕ scripts/verify-apk-signature.mjs (+692 -0)
➕ src/apkSignature/ApkSignatureAdmission.test.ts (+42 -0)
➕ src/apkSignature/ApkSignatureAdmission.ts (+65 -0)
➕ src/apkSignature/ApkSignatureProvider.test.ts (+660 -0)

...and 46 more files

📄 Description

Summary

Closes #4537. Continue @FerroLx's existing PR with static APK signing inspection and retained fact queries through shared CLI/MCP workflows.

Report declared v1/v2/v3/v3.1 signers, raw algorithms, certificate fingerprints, SDK bounds, rotation, source stamp and content-digest equality. Cryptographic validity and authenticity remain unverified.
Retain complete Evidence while returning summaries or signer/digest/lineage pages with stable IDs, batch filters, selected fields, coverage and explicit unknowns. CLI compact delivery exports the same parent.
Canonical readers validate required framing and ZIP extents while retaining reader-compatible uninterpreted suffixes. Derived agreement and rotation share one set comparison; unknown current identity stays unknown. Immutable fact caches recheck parent identity.
One process-wide scan and eight pending requests bound whole-file materialization; cancellation reasons, capacity and close/drain are covered. A selected CI lane uses pinned official Android SDK oracles with required tools.

Existing read-only artifact authority; no target execution/injection/mutation/protection recovery is added.

Validation

Verification record pins current runtime 4fcbdf6fb78873b47f424c5e15ebda6af715befe, main 2c3dd946d59c870388b03c3417eeb5218af96eeb, commands, input digests, historical qualifications and limitations.

225 source tests, 11 focused public CLI/MCP tests and 23 real SDK cases passed. The preceding integration's 416 public/schema tests remain pinned to8f8541c; the latest change affects posture derivation and adds a public unknown-identity regression. Fast/CI static and docs checks passed.
SDK coverage includes RSA/EC v1, mixed schemes, rotation, v3.1, stamp, tamper and forged declared digests. Corrected regressions reproduce the review findings; unknown identity is checked through CLI, actual SDK summary and historical lineage queries after deletion.
Unchanged official F-Droid:12,569,951 bytes; separate generated/re-signed stress input:180,350,384 bytes. Tasks match SDK signer fingerprints and file SHA; stress calls also check digest equality. A512MiB+1 sparse file was refused before allocation.
Current complete→selected task: 5,246→4,230 tokenx estimates, 3.850→3.591s elapsed, 4.732→4.666 CPU s, 694,124,544→689,983,488 bytes peak family RSS. Used input advertisements and every call/reply/export are counted; whole-catalog estimates are separate. Three simultaneous180MB scans at35a9b13 measured 981,049,344→448,929,792 bytes peak RSS, with every identity/fingerprint/digest checked; this comparison retains its original commit pin.

Linux static-reader qualification. v1 entry coverage, cryptographic signatures/lineage trust and independent Windows/macOS behavior remain unverified. Selection changes delivery; hashing still reads the whole file. Performance observations use fresh processes with warm OS caches and do not establish statistical speedups or actual model-token usage. Current-head CI/review follows publication.

Author readiness

Human owner: @gensokyo-dev

The owner explicitly authorized continuing this contributor PR and opening it ready for initial review. Personal human-review declarations remain unchecked.

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4158 **Author:** [@FerroLx](https://github.com/FerroLx) **Created:** 10/15/2026 **Status:** ✅ Merged **Merged:** 10/22/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `feat/apk-signature` --- ### 📝 Commits (10+) - [`f8ce23e`](https://github.com/morluto/rea/commit/f8ce23eddea2f73d9e9f84f03851fdae70f1442e) feat(apk): locate and frame the APK Signing Block (v2+ foundation) - [`40df3ad`](https://github.com/morluto/rea/commit/40df3adf8f6601b9319bc808b20299615a2fd434) feat(apk): decode v2/v3/v3.1 signer structures from the signing block - [`b2b95ab`](https://github.com/morluto/rea/commit/b2b95aba4e75e7e0e99062339356208a5d067fa1) feat(apk): detect v1 (JAR) signing from the central directory - [`f160be6`](https://github.com/morluto/rea/commit/f160be6dbb0213e37b71d190ac4bce6f34ab067a) feat(apk): public result schema and tamper-surface posture derivation - [`9cf1b9b`](https://github.com/morluto/rea/commit/9cf1b9b4865d92de57fe6be0162b50c610a50e12) feat(apk): provider, service and CLI/MCP/catalog wiring for inspect_apk_signature - [`da27214`](https://github.com/morluto/rea/commit/da272149bd7d7e58fb4f3609cae3a71f33676ffb) feat(apk): recompute the v2/v3 content digest for self-consistency - [`23108ca`](https://github.com/morluto/rea/commit/23108ca0a27b26622c5814ad7e349571d37fdf0b) feat(apk): decode the v3 rotation lineage; stop flagging rotation as tampering - [`f44068e`](https://github.com/morluto/rea/commit/f44068e46270e2761ba54a8c0d7e3f1c815cf102) test(apk): add the apksigner/aapt2 real-toolchain lane (verify:apk-signature) - [`023a838`](https://github.com/morluto/rea/commit/023a838c2cbd5706304b981ff7442d8621e5ebba) test(apk): SDK-free provider tests for inspect_apk_signature - [`addf92a`](https://github.com/morluto/rea/commit/addf92a9680677b223a9a537d654405f16435ec9) fix(apk): enforce the output budget and keep observed and declared facts apart ### 📊 Changes **66 files changed** (+11735 additions, -18 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+8 -0) 📝 `.agents/skills/reverse-engineer-anything/references/native-and-artifacts.md` (+24 -0) 📝 `.github/workflows/ci.yml` (+13 -0) ➕ `.github/workflows/real-apk-signature.yml` (+97 -0) 📝 `README.md` (+1 -0) ➕ `docs/apk-signature.md` (+263 -0) 📝 `docs/architecture.mermaid` (+3 -0) 📝 `docs/index.md` (+13 -13) ➕ `docs/specs/apk-signature/spec.md` (+113 -0) ➕ `docs/verification/apk-signature-2026-10-22.json` (+1644 -0) ➕ `docs/verification/apk-signature-2026-10-22.md` (+188 -0) 📝 `package.json` (+1 -0) 📝 `scripts/ci/scopes.mjs` (+19 -0) 📝 `scripts/lib/catalog-builders.mjs` (+5 -0) 📝 `scripts/lib/catalog-core.mjs` (+3 -0) 📝 `scripts/lib/test-projects.mjs` (+1 -1) ➕ `scripts/verify-apk-signature.mjs` (+692 -0) ➕ `src/apkSignature/ApkSignatureAdmission.test.ts` (+42 -0) ➕ `src/apkSignature/ApkSignatureAdmission.ts` (+65 -0) ➕ `src/apkSignature/ApkSignatureProvider.test.ts` (+660 -0) _...and 46 more files_ </details> ### 📄 Description ## Summary Closes #4537. Continue @FerroLx's existing PR with static APK signing inspection and retained fact queries through shared CLI/MCP workflows. - Report declared v1/v2/v3/v3.1 signers, raw algorithms, certificate fingerprints, SDK bounds, rotation, source stamp and content-digest equality. Cryptographic validity and authenticity remain unverified. - Retain complete Evidence while returning summaries or signer/digest/lineage pages with stable IDs, batch filters, selected fields, coverage and explicit unknowns. CLI compact delivery exports the same parent. - Canonical readers validate required framing and ZIP extents while retaining reader-compatible uninterpreted suffixes. Derived agreement and rotation share one set comparison; unknown current identity stays unknown. Immutable fact caches recheck parent identity. - One process-wide scan and eight pending requests bound whole-file materialization; cancellation reasons, capacity and close/drain are covered. A selected CI lane uses pinned official Android SDK oracles with required tools. Existing read-only artifact authority; no target execution/injection/mutation/protection recovery is added. ## Validation [Verification record](docs/verification/apk-signature-2026-10-22.md) pins current runtime `4fcbdf6fb78873b47f424c5e15ebda6af715befe`, main `2c3dd946d59c870388b03c3417eeb5218af96eeb`, commands, input digests, historical qualifications and limitations. - **225 source tests**, **11 focused public CLI/MCP tests** and **23 real SDK cases** passed. The preceding integration's **416 public/schema tests** remain pinned to8f8541c; the latest change affects posture derivation and adds a public unknown-identity regression. Fast/CI static and docs checks passed. - SDK coverage includes RSA/EC v1, mixed schemes, rotation, v3.1, stamp, tamper and forged declared digests. Corrected regressions reproduce the review findings; unknown identity is checked through CLI, actual SDK summary and historical lineage queries after deletion. - Unchanged official F-Droid:12,569,951 bytes; separate generated/re-signed stress input:180,350,384 bytes. Tasks match SDK signer fingerprints and file SHA; stress calls also check digest equality. A512MiB+1 sparse file was refused before allocation. - Current complete→selected task: **5,246→4,230 tokenx estimates**, **3.850→3.591s** elapsed, **4.732→4.666 CPU s**, **694,124,544→689,983,488 bytes** peak family RSS. Used input advertisements and every call/reply/export are counted; whole-catalog estimates are separate. Three simultaneous180MB scans at35a9b13 measured **981,049,344→448,929,792 bytes** peak RSS, with every identity/fingerprint/digest checked; this comparison retains its original commit pin. Linux static-reader qualification. v1 entry coverage, cryptographic signatures/lineage trust and independent Windows/macOS behavior remain unverified. Selection changes delivery; hashing still reads the whole file. Performance observations use fresh processes with warm OS caches and do not establish statistical speedups or actual model-token usage. Current-head CI/review follows publication. ## Author readiness Human owner: @gensokyo-dev The owner explicitly authorized continuing this contributor PR and opening it ready for initial review. Personal human-review declarations remain unchecked. - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:11:50 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:45:59 +00:00

[PR #6178] [CLOSED] test(fixtures): skip permission-denial tests when DAC-bypass caps keep files readable #7186

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6097

No description provided.

Rows
Columns