[GH-ISSUE #8552] [Bug] ADB verifier cannot prove ownership of the APK lifecycle target #6644

New issue

Open

opened 2026-11-01 21:12:54 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:12:54 +00:00

Owner

Originally created by @morluto on GitHub (Nov 1, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8552

Area

Other — ADB verification script

Observed behavior

At revision 245a581818ab13694fa438a06e39898ce03ab206, npm run verify:adb -- --install-apk PATH installs the caller-selected APK, but then starts, stops and uninstalls the hardcoded package com.rea.adb.probe without establishing that the installed APK has that identity or that the verifier owns the existing package. A later thrown error can also leave the installed APK behind. The verifier source shows the independent identities and cleanup path.

Reproduction and evidence

On macOS arm64 with Node 24.22.1, an instrumented copy of the verifier using a fake device and service reproduced two scenarios: (1) installing a different package while a pre-existing com.rea.adb.probe was present caused the verifier to start and uninstall the pre-existing package; (2) an injected start failure after installation left the installed package behind. These are simulated device results; no Android device or real APK was used. Frequency on a real device is NOT_ENOUGH_INFO.

Expected behavior and impact

Lifecycle verification should act only on a package whose identity is bound to the exact privately acquired APK and whose installation and cleanup the verifier owns. It should retain and report ambiguous installation or cleanup outcomes rather than remove unrelated device state. The observed fake-device run demonstrates the unsafe decision path; real-device impact is not measured.

Follow-up

A local, uncommitted mitigation rejects --install-apk before provider construction and removes the unsafe lifecycle section. Restoring lifecycle verification needs an owner for package identity at the acquired APK boundary, a way to prove the pre-existing device state and installed package ownership, and cleanup/retry behavior for ambiguous failures. The existing install result reports a digest, not the APK package identity. No maintainer scope decision or real-device verification is implied.

Environment

REA source revision above; Node 24.22.1, macOS arm64; fake device/service. Interface: verifier script. Earliest stage: target identity and lifecycle ownership. Real-device behavior and APK format coverage: NOT_ENOUGH_INFO.

Originally created by @morluto on GitHub (Nov 1, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8552 ### Area Other — ADB verification script ### Observed behavior At revision `245a581818ab13694fa438a06e39898ce03ab206`, `npm run verify:adb -- --install-apk PATH` installs the caller-selected APK, but then starts, stops and uninstalls the hardcoded package `com.rea.adb.probe` without establishing that the installed APK has that identity or that the verifier owns the existing package. A later thrown error can also leave the installed APK behind. The [verifier source](https://github.com/morluto/rea/blob/245a581818ab13694fa438a06e39898ce03ab206/scripts/verify-adb.mjs#L359-L431) shows the independent identities and cleanup path. ### Reproduction and evidence On macOS arm64 with Node 24.22.1, an instrumented copy of the verifier using a fake device and service reproduced two scenarios: (1) installing a different package while a pre-existing `com.rea.adb.probe` was present caused the verifier to start and uninstall the pre-existing package; (2) an injected start failure after installation left the installed package behind. These are simulated device results; no Android device or real APK was used. Frequency on a real device is NOT_ENOUGH_INFO. ### Expected behavior and impact Lifecycle verification should act only on a package whose identity is bound to the exact privately acquired APK and whose installation and cleanup the verifier owns. It should retain and report ambiguous installation or cleanup outcomes rather than remove unrelated device state. The observed fake-device run demonstrates the unsafe decision path; real-device impact is not measured. ### Follow-up A local, uncommitted mitigation rejects `--install-apk` before provider construction and removes the unsafe lifecycle section. Restoring lifecycle verification needs an owner for package identity at the acquired APK boundary, a way to prove the pre-existing device state and installed package ownership, and cleanup/retry behavior for ambiguous failures. The existing install result reports a digest, not the APK package identity. No maintainer scope decision or real-device verification is implied. ### Environment REA source revision above; Node 24.22.1, macOS arm64; fake device/service. Interface: verifier script. Earliest stage: target identity and lifecycle ownership. Real-device behavior and APK format coverage: NOT_ENOUGH_INFO.

bsakaguchi added the

bug

label

2026-11-01 21:12:54 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6644

No description provided.

Rows
Columns