app-info 3.3.1 → 3.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8e1a690f39cd0bfe4c6fe3f5eee14f3cd0af7a5be9635875bb6bda0ca7fa1e47
-  data.tar.gz: c07b7ae5e8d2d995a5c1d32cc7e0de1fb5e6680450936c3e08344687ed14669f
+  metadata.gz: 8240bf7236451c5971d0ee28d067689605f6470b0f64cd3ff21d54f3dac415c7
+  data.tar.gz: bb88f65d0f66be67b0f94ddfa4d1061346b974b1974eb36b7be7c2fbe8be3c73
 SHA512:
-  metadata.gz: b9f5504987f1173bc82880b974f735fba28d352223f8940aea3e497cf7c2ba9350481c52a9ca95cd9b5fdd3d68d273947e6e50201834c61210a153b8d7554cdb
-  data.tar.gz: c43deb531c6fa974a5da4f0816526c099e7bd20f1d7cde286cb941df596e84932cddc044e403f3737124f2ab6b43f2250c840b6fac3fc339bfd17c452d560315
+  metadata.gz: 9bea1da034bd88f84768c0d899cf5b03d4bc746e90fc1252d55e01d9006095287c83b23f3e5e865fb97386eb49d659f4ac475c8812c04bad30b39ee4b7a78f5a
+  data.tar.gz: 7ffeba0577eefc612f8963fd85005ecc763df7bf03f368807276a5537d00902e2ed2ce48da4297c331cc2b688c5e56024716c8a8ecf9fdbdc08f7167b1f809b2

data/.github/workflows/ci.yml

@@ -30,8 +30,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # https://endoflife.date/ruby
-        ruby: [ ruby-3.1, ruby-3.2, ruby-3.3 ]
+        ruby: [ ruby-3.1, ruby-3.2, ruby-3.3, ruby-3.4, ruby-4.0 ]
         experimental: [ false ]
         include:
           - ruby: head

data/.rubocop.yml

@@ -84,6 +84,15 @@ Style/Documentation:
 Style/ClassAndModuleChildren:
   Enabled: false
 
+Style/OneClassPerFile:
+  Exclude:
+    - 'lib/app_info/core_ext/object/try.rb'
+    - 'lib/app_info/core_ext/string/inflector.rb'
+
+Naming/PredicateMethod:
+  Exclude:
+    - 'lib/app_info/png_uncrush.rb'
+
 Style/PerlBackrefs:
   Exclude:
     - 'lib/app_info/core_ext/string/inflector.rb'

data/CHANGELOG.md

@@ -9,6 +9,25 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 > List all changes before release a new version.
 
+## [3.4.0] (2026-09-27)
+
+### Added
+
+- Add Android verify v2, v3 signatures and certificate lineage.
+- Add deeper HarmonyOS `.hap`/`.app` metadata parsing: `module_info`, `app_info`, `module_metadata`, `profiles`, `permissions`, `features`, device type detection and more.
+
+### Fixed
+
+- Upgrade rubyzip >= 3.4.0 to fix path traversal vulnerability issue.
+- Fix archive extraction with rubyzip 3.x by passing `destination_directory` instead of an absolute entry path.
+- Fix Android v2/v3 signature verification with rubyzip 3.x by parsing the end of central directory directly.
+
+## [3.3.2] (2025-05-23)
+
+### Added
+
+- Add determine mobile provision file content.
+
 ## [3.3.1] (2025-04-27)
 
 ### Fixed
@@ -71,7 +90,7 @@ Dropped Ruby 2.5 ~ 3.0 support (no changes required.).
 
 - Add `AppInfo::File` base class for all parsers.
 - Add `AppInfo::Certifiate` X509 certificate wrapped and apply in Android/MobileProvision.
-- Re-organize categories `.platform`  to `.manufacturer`, `.platform` and `.device` for all parsers.
+- Re-organize categories `.platform` to `.manufacturer`, `.platform` and `.device` for all parsers.
 - Remove `.sign_version` method in Android parser.
 - Rename `.file_type` to `.format` method in all parers and return a `AppInfo::Format` type.
 - Remove duplice `AppInfo::AndroidDevice` class.
@@ -215,6 +234,7 @@ Dropped Ruby 2.5 ~ 3.0 support (no changes required.).
 
 - Force write all icon data with `ASCII-8BIT`
 - Force convert developer cert name to `UTF-8`
+
 ## [2.6.1] (2021-08-26)
 
 ### Fixed
@@ -296,6 +316,7 @@ Dropped Ruby 2.5 ~ 3.0 support (no changes required.).
 ### Changed
 
 - Change `IPA::ExportType::INHOUSE` to `IPA::ExportType::ENTERPRISE` and change the value. #[24](https://github.com/icyleaf/app-info/pull/24)
+
 ### Added
 
 - Add `plugins`, `frameworks` to `AppInfo::IPA`. #[25](https://github.com/icyleaf/app-info/pull/25)
@@ -373,7 +394,10 @@ Dropped Ruby 2.5 ~ 3.0 support (no changes required.).
 
 - Updated dependency of CFPropertly list be a range between 2.3.4. (thanks @[cschroed](https://github.com/cschroed))
 
-[Unreleased]: https://github.com/icyleaf/app-info/compare/v3.3.0..HEAD
+[Unreleased]: https://github.com/icyleaf/app-info/compare/v3.4.0..HEAD
+[3.4.0]: https://github.com/icyleaf/app-info/compare/v3.3.2...v3.4.0
+[3.3.2]: https://github.com/icyleaf/app-info/compare/v3.3.1...v3.3.2
+[3.3.1]: https://github.com/icyleaf/app-info/compare/v3.3.0...v3.3.1
 [3.3.0]: https://github.com/icyleaf/app-info/compare/v3.2.0...v3.3.0
 [3.2.0]: https://github.com/icyleaf/app-info/compare/v3.1.4...v3.2.0
 [3.1.4]: https://github.com/icyleaf/app-info/compare/v3.1.2...v3.1.4
@@ -417,4 +441,3 @@ Dropped Ruby 2.5 ~ 3.0 support (no changes required.).
 [1.1.2]: https://github.com/icyleaf/app-info/compare/v1.0.5...v1.1.2
 [1.1.0]: https://github.com/icyleaf/app-info/compare/v1.0.5...v1.1.0
 [1.0.5]: https://github.com/icyleaf/app-info/compare/v0.9.0...v1.0.5
-

data/README.md

@@ -7,23 +7,23 @@
 
 Teardown tool for mobile app (iOS: ipa, Android: apk/aab, HarmonyOS: .hap/.app file), macOS app, dSYM.zip file and Windows PE file.
 
-Analysis metedata like version, name, icon etc.
+Analysis metadata like version, name, icon etc.
 
 ## Support
 
 - Android file
   - `.apk`
-  - `.aab` (Androld App Bundle)
+  - `.aab` (Android App Bundle)
 - iOS, Apple TV file
   - `.ipa`
   - `Info.plist` file
   - `.mobileprovision`/`.provisionprofile` file
-- HarmonyOS file (basic)
+- HarmonyOS file
   - `.hap`
   - `.app`
-- macOS App file (archived by starnd pkzip format)
+- macOS App file (archived by standard pkzip format)
   - `.app.zip`
-- dSYMs file (archived by starnd pkzip format)
+- dSYMs file (archived by standard pkzip format)
   - `.dSYM.zip`
 - Windows PE file
   - `.exe`
@@ -71,6 +71,8 @@ parser = AppInfo.parse('ipad.ipa')
 parser = AppInfo.parse('apple-tv.ipa')
 parser = AppInfo.parse('android.apk')
 parser = AppInfo.parse('android.aab')
+parser = AppInfo.parse('harmony.hap')
+parser = AppInfo.parse('harmony.app')
 parser = AppInfo.parse('u-u-i-d.mobileprovision')
 parser = AppInfo.parse('macOS.App.zip')
 parser = AppInfo.parse('App.dSYm.zip')
@@ -81,6 +83,8 @@ parser = AppInfo.parse('win.zip')
 parser = AppInfo::IPA.new('iphone-ipad-unversal-appletv.ipa')
 parser = AppInfo::APK.new('android.apk')
 parser = AppInfo::AAB.new('android.aab')
+parser = AppInfo::HAP.new('harmony.hap')
+parser = AppInfo::HAPP.new('harmony.app')
 parser = AppInfo::InfoPlist.new('Info.plist')
 parser = AppInfo::MobileProvision.new('uuid.mobileprovision')
 parser = AppInfo::Macos.new('App.dSYm.zip')
@@ -145,7 +149,7 @@ ipa.plugins
 ipa.url_schemes
 # => [{:name=>"Web", :role=>"Editor", :schemes=>["app-info", "app_info"]}]
 
-# get query schemes
+# get url schemes
 ipa.url_schemes
 # => ["twitter", "instagram", "www-x-callback"]
 
@@ -252,28 +256,129 @@ android.signatures
 
 ### HarmonyOS
 
-Accept `.hap` and `.app` HarmonyOS file. Only metabase, except resources mapping.
+Accept `.hap` and `.app` HarmonyOS file. Only metadata, except resources mapping.
 
 ```ruby
 hap = AppInfo.parse('app.hap')
 
 # get app file size
-android.size
-# => 2013213
+hap.size
+# => 142283
 
-# get app file size in human reable.
-android.size(human_size: true)
-# => 21 MB
+# get app file size in human readable.
+hap.size(human_size: true)
+# => "138.95 KB"
 
 # get app release version
-android.release_version
-# => 1.0
+hap.release_version
+# => "1.0.0"
 
-# get app package name
-android.bundle_id
-# => com.icyleaf.AppInfoDemo
+# get app build version
+hap.build_version
+# => 1000000
+
+# get app version (release_version, fallback to build_version)
+hap.version
+# => "1.0.0"
+
+# get app package name (alias: identifier, bundle_name)
+hap.bundle_id
+# => "com.example.myapplication"
+
+# get app display name (alias: name)
+hap.display_name
+# => "MyApplication"
+
+# get app icons
+hap.icons
+# => [{:name=>"app_icon.png", :file=>"/temp/dir/resources/base/media/app_icon.png", :dimensions=>[41, 41]}]
+
+# get the whole parsed module.json (alias: module_data)
+hap.module_info
+# => {"app" => {...}, "module" => {...}}
+
+# get app section of module.json
+hap.app_info
+# => {"minAPIVersion" => 50000012, "targetAPIVersion" => 50000012, "label" => "$string:app_name", "bundleName" => "com.example.myapplication", ...}
+
+# get module section of module.json
+hap.module_metadata
+# => {"mainElement" => "EntryAbility", "deviceTypes" => ["phone", "tablet", "2in1"], "abilities" => [...], ...}
+
+# get main entry ability name
+hap.main_element
+# => "EntryAbility"
+
+# get api version
+hap.min_api_version
+# => 50000012
+hap.target_api_version
+# => 50000012
+
+# get compile sdk version and release type
+hap.compile_sdk_version
+# => "5.0.0.25"
+hap.api_release_type
+# => "Beta1"
+
+# get resource profile files (name => parsed json)
+hap.profiles
+# => {"main_pages" => {"src" => ["pages/Index"]}, "backup_config" => {"allowToBackupRestore" => true}}
+
+# get requested permissions (alias: use_permissions)
+hap.permissions
+# => []
+
+# get supported device types (alias: features, use_features)
+hap.device_types
+# => ["phone", "tablet", "2in1"]
+
+# detect device type
+hap.phone?
+# => true
+hap.tablet?
+# => true
+hap.tv?
+# => false
+hap.wearable?
+# => false
+hap.car?
+# => false
+hap.two_in_one?
+# => true
+
+# get abilities and services
+hap.activities
+hap.services
+hap.components
+
+# get deep links host and schemes
+hap.deep_links
+hap.schemes
+
+# get native architectures (alias: architectures)
+hap.native_codes
+# => []
+```
+
+The `.app` file is a bundle that contains one or more `.hap` modules:
+
+```ruby
+app = AppInfo.parse('app.app')
+
+# get all hap modules
+app.modules
+# => [#<AppInfo::HAP:...>]
+
+# get the default (entry) module
+app.default_entry
+# => #<AppInfo::HAP:...>
+app.default_entry_name
+# => "entry-default"
 ```
 
+All metadata methods above (such as `module_info`, `app_info`, `module_metadata`, `profiles`, `device_types`, ...) are also available on the `.app` parser and are delegated to its default entry module. The `module_data` alias is only defined for `.hap`.
+
 ### macOS
 
 Only accept zipped macOS file.
@@ -417,9 +522,9 @@ It is possible to use this gem as a command line interface to parse mobile app:
 ```
 > app-info
 
-app-info (2.7.0)> p = AppInfo.parse('/path/to/app')
+app-info (3.4.0)> p = AppInfo.parse('/path/to/app')
 => #<AppInfo::APK::......>
-app-info (2.7.0)> p.name
+app-info (3.4.0)> p.name
 => "AppName"
 ```
 

data/app_info.gemspec

@@ -25,8 +25,8 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'base64', '~> 0.2.0'
   spec.add_dependency 'image_size', '>= 1.5', '< 3.5'
   spec.add_dependency 'ruby-macho', '>= 1.4', '< 5'
-  spec.add_dependency 'android_parser', '>= 2.7', '< 3.0'
-  spec.add_dependency 'rubyzip', '>= 1.2', '< 3.0'
+  spec.add_dependency 'android_parser', '>= 2.7.1', '< 3.0'
+  spec.add_dependency "rubyzip", ">= 3.4.0"
   spec.add_dependency 'uuidtools', '>= 2.1.5', '< 2.3.0'
   spec.add_dependency 'icns', '~> 0.2.0'
   spec.add_dependency 'pedump', '~> 0.6.2'

data/lib/app_info/android/signature.rb

@@ -1,14 +1,9 @@
 # frozen_string_literal: true
 
+require 'digest'
+
 module AppInfo
   class Android < File
-    # Android Signature
-    #
-    # Support digest and length:
-    #
-    # RSA：1024、2048、4096、8192、16384
-    # EC：NIST P-256、P-384、P-521
-    # DSA：1024、2048、3072
     module Signature
       class VersionError < Error; end
       class SecurityError < Error; end
@@ -21,69 +16,36 @@ module AppInfo
         V4 = 4
       end
 
-      # All registerd verions to verify
-      #
-      # key is the version
-      # value is the class
       @versions = {}
 
       class << self
-        # Verify Android Signature
-        #
-        # @example Get unverified v1 certificates, verified v2 certificates,
-        #  and not found v3 certificate
-        #
-        #   signature.versions(parser)
-        #   # => [
-        #   #   {
-        #   #     version: 1,
-        #   #     verified: false,
-        #   #     certificates: [<AppInfo::Certificate>, ...],
-        #   #     verifier: AppInfo::Androig::Signature
-        #   #   },
-        #   #   {
-        #   #     version: 2,
-        #   #     verified: false,
-        #   #     certificates: [<AppInfo::Certificate>, ...],
-        #   #     verifier: AppInfo::Androig::Signature
-        #   #   },
-        #   #   {
-        #   #     version: 3
-        #   #   }
-        #   # ]
-        # @todo version 4 no implantation yet
-        # @param [AppInfo::File] parser
-        # @param [Version, Integer] min_version
-        # @return [Array<Hash>] versions
-        def verify(parser, min_version: Version::V4)
+        def verify(parser, min_version: Version::V4, sdk: nil)
           min_version = min_version.to_i if min_version.is_a?(String)
-          if min_version && min_version > Version::V4
+          if min_version > Version::V4
             raise VersionError,
                   "No signature found in #{min_version} scheme or newer for android file"
           end
-
           if min_version.zero?
             raise VersionError,
                   "Unkonwn version: #{min_version}, avaiables in 1/2/3 and 4 (no implantation yet)"
           end
 
-          # try full version signatures if min_version is nil
           versions = min_version.downto(Version::V1).each_with_object([]) do |version, signatures|
             next unless kclass = fetch(version)
 
             data = { version: version }
             begin
-              verifier = kclass.verify(parser)
+              verifier = kclass.verify(parser, sdk: sdk)
               data[:verified] = verifier.verified
               data[:certificates] = verifier.certificates
               data[:verifier] = verifier
-            rescue SecurityError, NotFoundError
-              # not this version, try the low version
+              data[:verification_errors] = verifier.verification_errors
+            rescue SecurityError, NotFoundError => e
+              e
             ensure
               signatures << data
             end
           end
-
           versions.sort_by { |entry| entry[:version] }
         end
 
@@ -107,6 +69,63 @@ module AppInfo
       UINT32_MAX_VALUE = 2_147_483_647
       UINT32_SIZE = 4
       UINT64_SIZE = 8
+      CONTENT_CHUNK_SIZE = 1 << 20
+
+      class << self
+        def compute_content_digest(parser, digest_name)
+          info = Info.new(Version::V2, parser, parser.logger)
+          digest_class = Digest.const_get(digest_name)
+          chunks = content_chunks(parser, info, digest_class)
+          digest_class.digest("\x5a".b + [chunks.length].pack('V') + chunks.join)
+        end
+
+        private
+
+        def content_chunks(parser, info, digest_class)
+          chunks = []
+          pending = ''.b
+          add_chunk = lambda do |data|
+            pending << data
+            while pending.bytesize >= CONTENT_CHUNK_SIZE
+              chunks << chunk_digest(pending.slice!(0, CONTENT_CHUNK_SIZE), digest_class)
+            end
+          end
+          flush_chunk = lambda do
+            next if pending.empty?
+
+            chunks << chunk_digest(pending, digest_class)
+            pending = ''.b
+          end
+
+          ::File.open(parser.file, 'rb') do |file|
+            [[0, info.signing_block_offset],
+             [info.cdir_offset, info.eocd_offset]].each do |start, finish|
+              read_content(file, start, finish, add_chunk)
+              flush_chunk.call
+            end
+            file.seek(info.eocd_offset)
+            eocd = file.read(info.file_size - info.eocd_offset)
+            eocd[16, Signature::UINT32_SIZE] = [info.signing_block_offset].pack('V')
+            add_chunk.call(eocd)
+            flush_chunk.call
+          end
+          chunks
+        end
+
+        def read_content(file, start, finish, add_chunk)
+          file.seek(start)
+          remaining = finish - start
+          while remaining.positive?
+            length = [remaining, CONTENT_CHUNK_SIZE].min
+            add_chunk.call(file.read(length))
+            remaining -= length
+          end
+        end
+
+        def chunk_digest(chunk, digest_class)
+          digest_class.digest("\xa5".b + [chunk.bytesize].pack('V') + chunk)
+        end
+      end
     end
   end
 end

data/lib/app_info/android/signatures/base.rb

@@ -6,19 +6,26 @@ module AppInfo
   class Android < File
     module Signature
       class Base
-        def self.verify(parser)
+        def self.verify(parser, **options)
           instance = new(parser)
-          instance.verify
+          instance.verify(**options)
           instance
         end
 
         DESCRIPTION = 'APK Signature Scheme'
 
-        attr_reader :verified
+        attr_reader :verified, :verification_errors
 
         def initialize(parser)
           @parser = parser
           @verified = false
+          @verification_errors = []
+        end
+
+        def add_verification_error(code, message, signer: nil)
+          error = { code: code, message: message }
+          error[:signer] = signer unless signer.nil?
+          @verification_errors << error
         end
 
         # @abstract Subclass and override {#verify} to implement

data/lib/app_info/android/signatures/info.rb

@@ -29,6 +29,18 @@ module AppInfo
           0x6b, 0x20, 0x34, 0x32
         ].freeze
 
+        # End of central directory record signature: PK\x05\x06
+        EOCD_SIGNATURE = "PK\x05\x06".b.freeze
+        # Zip64 end of central directory record and locator signatures.
+        ZIP64_END_OF_CD_SIGNATURE = "PK\x06\x06".b.freeze
+        ZIP64_EOCD_LOCATOR_SIGNATURE = "PK\x06\x07".b.freeze
+        # Static size of the end of central directory record.
+        STATIC_EOCD_SIZE = 22
+        # Maximum size of the end of central directory search window.
+        MAX_END_OF_CD_SIZE = 65_557
+        # Offset of the central directory offset field within the EOCD record.
+        EOCD_CDIR_OFFSET_FIELD = 16
+
         attr_reader :total_size, :pairs, :magic, :logger
 
         def initialize(version, parser, logger)
@@ -87,7 +99,36 @@ module AppInfo
         end
 
         def zip64?
-          zip_io.zip64_file?(start_buffer)
+          return @zip64 unless @zip64.nil?
+
+          tail = ::File.open(@parser.file, 'rb') do |file|
+            size = file_size
+            file.seek(size - [size, MAX_END_OF_CD_SIZE].min)
+            file.read
+          end
+
+          @zip64 = tail.include?(ZIP64_END_OF_CD_SIGNATURE) &&
+                   tail.include?(ZIP64_EOCD_LOCATOR_SIGNATURE)
+        end
+
+        def signing_block_offset
+          cdir_offset - signature_block.size - SIG_SIZE_OF_BLOCK_SIZE
+        end
+
+        def file_size
+          ::File.size(@parser.file)
+        end
+
+        def eocd_offset
+          tail_size = [file_size, MAX_END_OF_CD_SIZE].min
+          ::File.open(@parser.file, 'rb') do |file|
+            file.seek(file_size - tail_size)
+            tail = file.read(tail_size)
+            index = tail.rindex(EOCD_SIGNATURE)
+            raise NotFoundError, 'End of central directory not found' unless index
+
+            file_size - tail_size + index
+          end
         end
 
         def pares_signatures_pairs
@@ -135,18 +176,11 @@ module AppInfo
         end
 
         def cdir_offset
-          @cdir_offset ||= lambda {
-            eocd_buffer = zip_io.get_e_o_c_d(start_buffer)
-            eocd_buffer[12..16].unpack1('V')
-          }.call
-        end
-
-        def start_buffer
-          @start_buffer ||= zip_io.start_buf(file_io)
-        end
-
-        def zip_io
-          @zip_io ||= @parser.zip
+          @cdir_offset ||= ::File.open(@parser.file, 'rb') do |file|
+            file.seek(eocd_offset)
+            eocd = file.read(STATIC_EOCD_SIZE)
+            eocd[EOCD_CDIR_OFFSET_FIELD, UINT32_SIZE].unpack1('V')
+          end
         end
 
         def file_io

data/lib/app_info/android/signatures/v1.rb

@@ -19,7 +19,7 @@ module AppInfo
           DESCRIPTION
         end
 
-        def verify
+        def verify(**_options)
           @signatures = fetch_signatures
           @certificates = fetch_certificates
 

data/lib/app_info/android/signatures/v2.rb

@@ -33,10 +33,19 @@ module AppInfo
 
         # Verify
         # @todo verified signatures
-        def verify
+        def verify(**_options)
           signers_block = singers_block(BLOCK_ID)
           @certificates, @digests = verified_certs(signers_block, verify: true)
-          # @verified = true
+          @verified = true
+        rescue SecurityError => e
+          @certificates ||= []
+          @digests ||= {}
+          code = if e.message.include?('content digest')
+                   :content_digest_mismatch
+                 else
+                   :signature_invalid
+                 end
+          add_verification_error(code, e.message)
         end
 
         private
@@ -92,12 +101,8 @@ module AppInfo
                   'Signature algorithms don\'t match between digests and signatures records'
           end
 
-          previous_digest = content_digests.fetch(algorithems_digest)
+          verify_content_digest(content_digests, algorithems_digest)
           content_digests[algorithems_digest] = content_digest
-          if previous_digest && previous_digest[:content] != content_digest
-            raise SecurityError,
-                  'Signature algorithms don\'t match between digests and signatures records'
-          end
 
           certificates = length_prefix_block(signed_data)
           certs = signed_data_certs(certificates)