[PR #6833] [CLOSED] fix(apk): bind certificate metadata to the carried DER bytes #7421

New issue

Closed

opened 2026-11-01 21:47:45 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:47:45 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6833
Author: @leeguooooo
Created: 10/23/2026
Status: ❌ Closed

Base: main ← Head: fix/6821-apk-certificate-identity

📝 Commits (1)

b513b99 fix(apk): 保证证书显示信息与携带的 DER 身份一致

📊 Changes

4 files changed (+165 additions, -1 deletions)

View changed files

➕ src/apkSignature/apkCertificateFacts.test.ts (+21 -0)
📝 src/apkSignature/apkCertificateFacts.ts (+6 -1)
➕ tests/acceptance/apkCertificateIdentityCliMcp.test.ts (+83 -0)
➕ tests/fixtures/apkSignature/embeddedPemCertificate.ts (+55 -0)

📄 Description

Superseded by upstream commit f783f0f1e, which fixes #6821 and adds exact-DER checks. Closing this PR to avoid duplicate integration.

Node can read PEM text inside a DER certificate's extension as a different certificate. Explicit outer PEM framing now binds APK signer metadata to the carried DER bytes and their existing fingerprint. Malformed DER keeps unknown metadata instead of borrowing the embedded certificate's facts.

Validation on macOS arm64 / Node 24.22.1: 38 tests, npm run check, and test discovery passed. CLI/stdio MCP v1/v2 regressions and the malformed-input test failed before the fix and pass afterward. LibreSSL's explicit DER reader independently confirms the outer subject, issuer and serial. Tests use generated APK containers; Android installation and a real APK corpus were not tested.

Author readiness

Human owner: @leeguooooo

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6833 **Author:** [@leeguooooo](https://github.com/leeguooooo) **Created:** 10/23/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/6821-apk-certificate-identity` --- ### 📝 Commits (1) - [`b513b99`](https://github.com/morluto/rea/commit/b513b993566597e05621874aeae45a5f1a35210d) fix(apk): 保证证书显示信息与携带的 DER 身份一致 ### 📊 Changes **4 files changed** (+165 additions, -1 deletions) <details> <summary>View changed files</summary> ➕ `src/apkSignature/apkCertificateFacts.test.ts` (+21 -0) 📝 `src/apkSignature/apkCertificateFacts.ts` (+6 -1) ➕ `tests/acceptance/apkCertificateIdentityCliMcp.test.ts` (+83 -0) ➕ `tests/fixtures/apkSignature/embeddedPemCertificate.ts` (+55 -0) </details> ### 📄 Description Superseded by upstream commit [f783f0f1e](https://github.com/morluto/rea/commit/f783f0f1e), which fixes #6821 and adds exact-DER checks. Closing this PR to avoid duplicate integration. Node can read PEM text inside a DER certificate's extension as a different certificate. Explicit outer PEM framing now binds APK signer metadata to the carried DER bytes and their existing fingerprint. Malformed DER keeps unknown metadata instead of borrowing the embedded certificate's facts. Validation on macOS arm64 / Node 24.22.1: 38 tests, `npm run check`, and test discovery passed. CLI/stdio MCP v1/v2 regressions and the malformed-input test failed before the fix and pass afterward. LibreSSL's explicit DER reader independently confirms the outer subject, issuer and serial. Tests use generated APK containers; Android installation and a real APK corpus were not tested. ## Author readiness Human owner: @leeguooooo - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:47:45 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7421

No description provided.

Rows
Columns