SHA256
Yuvomi Mobile Contributors
9088ee7e6a
Provide Android API 35/37 and Xcode jobs, dependency advisory checks, source invariants, and checksum-verified tools. Actions lint and available Linux static checks pass; hosted CI and all Apple-platform builds still require authorized runners. The manual release workflow never publishes and uses only owner-supplied signing credentials.
34 lines
1.9 KiB
Python
34 lines
1.9 KiB
Python
#!/usr/bin/env python3
|
|
"""Fail closed on OSV findings or unavailable advisory service. No app runtime use."""
|
|
import json
|
|
from pathlib import Path
|
|
import re
|
|
import urllib.request
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
coordinates = set()
|
|
lockfile = ROOT / "android/app/gradle.lockfile"
|
|
assert lockfile.is_file(), "Generate the reviewed Gradle dependency lockfile before scanning."
|
|
for source in [ROOT / "android/app/build.gradle.kts", ROOT / "android/build.gradle.kts", lockfile,
|
|
ROOT / "android/buildscript-gradle.lockfile"]:
|
|
if source.exists():
|
|
coordinates.update(re.findall(r'([\w.-]+:[\w.-]+:[\w.+-]+)(?:["=])', source.read_text()))
|
|
agp = re.search(r'id\("com.android.application"\) version "([^"]+)"', (ROOT / "android/build.gradle.kts").read_text())
|
|
assert agp, "Cannot determine Android build plugin version"
|
|
coordinates.add("com.android.tools.build:gradle:" + agp.group(1))
|
|
queries = [{"package": {"ecosystem": "Maven", "name": coordinate.rsplit(":", 1)[0]},
|
|
"version": coordinate.rsplit(":", 1)[1]} for coordinate in sorted(coordinates)]
|
|
request = urllib.request.Request("https://api.osv.dev/v1/querybatch", method="POST",
|
|
headers={"Content-Type": "application/json"},
|
|
data=json.dumps({"queries": queries}).encode())
|
|
with urllib.request.urlopen(request, timeout=60) as response:
|
|
results = json.load(response)["results"]
|
|
assert len(results) == len(queries)
|
|
findings = [(coordinate, [item["id"] for item in result.get("vulns", [])])
|
|
for coordinate, result in zip(sorted(coordinates), results) if result.get("vulns")]
|
|
if findings:
|
|
for coordinate, identifiers in findings:
|
|
print(coordinate, ", ".join(identifiers))
|
|
raise SystemExit("Dependency advisories require review and remediation before release.")
|
|
print(f"OSV: no listed advisories for {len(coordinates)} locked/direct Maven coordinates and build plugins.")
|