@dailephd/my-dev-kit-lab 0.3.4 → 0.4.1

package/dist/src/mobile/android/validation/checkResult.js

@@ -0,0 +1,58 @@
+import { ANDROID_ADVANCED_CHECK_CATEGORIES } from "../advancedSecurity/ruleIds.js";
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 1 — Android check-result and skip-representation contracts.
+//
+// Reuses SecurityFinding and CommandExecutionResult from the existing
+// security-validation types rather than duplicating a finding/command-result
+// schema. Android needs a wider status vocabulary than SecurityCheckStatus
+// ("passed"/"failed"/"skipped"/"warning") because static Android checks can
+// be genuinely inconclusive or unsupported on a given project, and
+// command-backed checks can error out before producing a verdict-relevant
+// result — none of those outcomes may ever be normalized as "passed".
+// ---------------------------------------------------------------------------
+export const ANDROID_CHECK_STATUSES = [
+    "passed",
+    "failed",
+    "skipped",
+    "inconclusive",
+    "unsupported",
+    "not-run",
+    "error",
+];
+// Statuses that must never be treated as a passing result by a verdict
+// calculator. Defined once here so later batches share one source of truth.
+export const ANDROID_NON_PASSING_STATUSES = [
+    "failed",
+    "skipped",
+    "inconclusive",
+    "unsupported",
+    "not-run",
+    "error",
+];
+// v0.4.0 Batch 3 — added "android-intent-filters" (additive) so the intent-
+// filter audit has its own category distinct from "android-components",
+// which covers exported-component evidence generally.
+// v0.4.0 Batch 5 — added "android-target-immutability" (additive) for the
+// required target mutation/immutability check (agents.txt Batch 5 section
+// 10.1).
+// v0.4.1 Batch 1 — added the advanced-security check-category families
+// (network/backup/release/secrets/signing/webview/file-provider/sensitive-
+// storage/sensitive-logging/clipboard/firebase/optional-tool) required by
+// later v0.4.1 batches. These categories are additive only: no check in this
+// batch is registered against them yet (see advancedSecurity/ruleIds.ts).
+export const ANDROID_CHECK_CATEGORIES = [
+    "android-detection",
+    "android-manifest",
+    "android-gradle",
+    "android-permissions",
+    "android-components",
+    "android-intent-filters",
+    "android-deep-links",
+    "android-release-metadata",
+    "android-play-readiness",
+    "android-target-immutability",
+    ...ANDROID_ADVANCED_CHECK_CATEGORIES,
+];
+export function isPassingAndroidStatus(status) {
+    return status === "passed";
+}

package/dist/src/mobile/android/validation/result.js

@@ -0,0 +1,25 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 1 — Android validation result contract.
+// v0.4.0 Batch 5 — narrow additive inherited-contract corrections needed to
+// carry a real verdict and rich release/Play-readiness data (see agents.txt
+// Batch 5 section 6.6):
+//   - `verdict` widened from the single placeholder literal to
+//     `AndroidVerdictValue` (ReleaseVerdict | "not-calculated"), reusing the
+//     existing security-validation ReleaseVerdict vocabulary instead of
+//     inventing a second one (Batch 1's own comment anticipated this: "this
+//     type grows without being a breaking change — the placeholder value
+//     remains valid"). Every existing "not-calculated" literal stays valid.
+//   - `releaseMetadataSummary`/`playReadinessSummary` (the Batch 1 {available,
+//     note} placeholders) are UNCHANGED in shape — existing object literals
+//     using them remain valid — with new sibling fields `releaseMetadata`/
+//     `playReadiness` added for the actual structured data, avoiding a
+//     breaking retype of the original fields.
+//   - `verdictReasons` and `targetMutationEvidence` are new optional fields.
+// ---------------------------------------------------------------------------
+export const ANDROID_VALIDATION_SCHEMA_VERSION = "android-validation-v1";
+export const ANDROID_VALIDATION_ARTIFACT_TYPE = "android-validation-result";
+// A single placeholder value: this batch and detection/manifest/gradle
+// batches must never assert release readiness. A concrete verdict policy is
+// introduced by a later batch, at which point this type grows without being
+// a breaking change (the placeholder value remains valid).
+export const ANDROID_VERDICT_NOT_CALCULATED = "not-calculated";

package/dist/src/mobile/index.js

@@ -0,0 +1,42 @@
+export { MOBILE_PLATFORMS, MOBILE_CONFIDENCE_LEVELS, MOBILE_VALIDATION_CAPABILITIES } from "./types.js";
+export { ANDROID_PLATFORM, ANDROID_PROFILE_ID, createAndroidProfile, isAndroidProfile } from "./android/profile.js";
+export { ANDROID_PROJECT_KINDS, ANDROID_UI_TOOLKITS } from "./android/detection.js";
+export { detectAndroidProject } from "./android/detect/detectAndroidProject.js";
+export { detectAndroidTarget } from "./android/detect/androidTargetDetection.js";
+export { parseDeclaredModules } from "./android/detect/settingsModules.js";
+export { extractBuildFileEvidence } from "./android/detect/buildFileEvidence.js";
+export { extractVersionCatalogEvidence } from "./android/detect/versionCatalogEvidence.js";
+export { classifyModule, classifyModuleUiToolkit, combineProjectKind, combineProjectUiToolkit, combineProjectConfidence, } from "./android/detect/classify.js";
+export { createAndroidTargetMetadata } from "./android/targetMetadata.js";
+export { parseAndroidManifestSource, parseAndroidManifestFile, parseAllAndroidManifests, } from "./android/manifest/parseAndroidManifest.js";
+export { parseXmlDocument, findChildren, getAttribute, ANDROID_NAMESPACE_URI } from "./android/manifest/xml/parseXml.js";
+export { parseWrapperProperties } from "./android/gradle/wrapperMetadata.js";
+export { parseVersionCatalog, resolveCatalogVersion, accessorSuffixToCatalogAlias } from "./android/gradle/versionCatalogMetadata.js";
+export { extractModuleGradleMetadata } from "./android/gradle/moduleMetadataExtractor.js";
+export { resolvePluginVersion } from "./android/gradle/pluginVersionExtractor.js";
+export { parseSettingsMetadata } from "./android/gradle/settingsMetadata.js";
+export { readAndroidGradleMetadata } from "./android/gradle/readAndroidGradleMetadata.js";
+export { buildAndroidGradleMetadataCheckResult } from "./android/gradle/gradleMetadataCheckResult.js";
+export { buildAndroidReleaseMetadataSummary } from "./android/gradle/releaseMetadataSummary.js";
+export { ALLOWLISTED_OPERATION_IDS, isAllowlistedOperationId, GRADLE_OPERATIONS } from "./android/gradle/validate/operations.js";
+export { buildGradleCommandPlan } from "./android/gradle/validate/planner.js";
+export { createRealGradleCommandExecutor } from "./android/gradle/validate/executor.js";
+export { parseGradleTaskNames, isGradleTaskAvailable } from "./android/gradle/validate/taskListParser.js";
+export { buildTargetMutationReport, isExpectedAndroidGeneratedPath, captureTargetSnapshot } from "./android/gradle/validate/targetMutation.js";
+export { buildGradleOperationCheckResult } from "./android/gradle/validate/operationCheckResult.js";
+export { runOptionalGradleValidation } from "./android/gradle/validate/runOptionalGradleValidation.js";
+export { ANDROID_CHECK_STATUSES, ANDROID_NON_PASSING_STATUSES, ANDROID_CHECK_CATEGORIES, isPassingAndroidStatus, } from "./android/validation/checkResult.js";
+export { ANDROID_VALIDATION_SCHEMA_VERSION, ANDROID_VALIDATION_ARTIFACT_TYPE, ANDROID_VERDICT_NOT_CALCULATED, } from "./android/validation/result.js";
+export { toAndroidReportModel, serializeAndroidReportModel } from "./android/report/model.js";
+export { renderAndroidTextReport } from "./android/report/renderAndroidReport.js";
+export { writeAndroidReportFiles } from "./android/report/writeAndroidReportFiles.js";
+export { makeAndroidFinding } from "./android/audit/androidFinding.js";
+export { buildAndroidManifestCheckResult } from "./android/audit/checkResultBuilder.js";
+export { auditAndroidPermissions } from "./android/audit/permissionAudit.js";
+export { auditAndroidExportedComponents } from "./android/audit/exportedComponentAudit.js";
+export { auditAndroidIntentFilters } from "./android/audit/intentFilterAudit.js";
+export { auditAndroidDeepLinks } from "./android/audit/deepLinkAudit.js";
+export { ANDROID_PLAY_READINESS_ITEM_STATUSES, buildAndroidPlayReadinessChecklist } from "./android/validate/playReadinessChecklist.js";
+export { calculateAndroidVerdict, androidVerdictToHumanLabel } from "./android/validate/androidVerdict.js";
+export { buildAndroidDetectionCheckResult, buildAndroidManifestParsingCheckResult, buildAndroidTargetImmutabilityCheckResult, } from "./android/validate/detectionAndImmutabilityCheckResults.js";
+export { validateAndroidTarget } from "./android/validate/validateAndroidTarget.js";

package/dist/src/mobile/types.js

@@ -0,0 +1,27 @@
+// Shared mobile-platform contracts for my-dev-kit-lab's mobile/Android
+// validation substrate (v0.4.0 Batch 1).
+//
+// Android is the only implemented platform. Additional platform ids may be
+// added to MOBILE_PLATFORMS in a future version once real detection and
+// validation exist for them — this file must never claim support for a
+// platform that has no implementation behind it.
+export const MOBILE_PLATFORMS = ["android"];
+// Confidence in a detection/classification/evidence claim. "unknown" is used
+// when confidence itself could not be determined (distinct from "low", which
+// asserts a deliberately weak but present signal).
+export const MOBILE_CONFIDENCE_LEVELS = ["unknown", "low", "medium", "high"];
+// Validation capabilities a profile can declare support for. This batch only
+// defines the vocabulary; no capability is exercised until its owning batch
+// implements it. Capabilities are declarative metadata, not proof of
+// execution — a profile listing a capability does not mean a check ran.
+export const MOBILE_VALIDATION_CAPABILITIES = [
+    "static-detection",
+    "manifest-analysis",
+    "gradle-metadata",
+    "gradle-task-execution",
+    "permission-audit",
+    "component-audit",
+    "deep-link-audit",
+    "release-metadata-summary",
+    "play-readiness-checklist",
+];

package/dist/src/securityValidation/attackScenarios/attackProfile.js

@@ -2,10 +2,12 @@ import { SECURITY_PROFILE_IDS } from "../validate/cliOptions.js";
 import { NODE_CLI_PACKAGE_PROFILE } from "./profiles/nodeCliPackageProfile.js";
 import { LOCAL_TOOL_PROFILE } from "./profiles/localToolProfile.js";
 import { NPM_PACKAGE_PROFILE } from "./profiles/npmPackageProfile.js";
+import { ANDROID_PROFILE } from "./profiles/androidProfile.js";
 const PROFILE_REGISTRY = {
     "node-cli-package": NODE_CLI_PACKAGE_PROFILE,
     "local-tool": LOCAL_TOOL_PROFILE,
     "npm-package": NPM_PACKAGE_PROFILE,
+    android: ANDROID_PROFILE,
 };
 // Resolves a profile id to its definition. Throws a clean, descriptive Error
 // for unknown ids (mirrors Batch 1's --profile validation error style).

package/dist/src/securityValidation/attackScenarios/profiles/androidProfile.js

@@ -0,0 +1,20 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 5 — registry placeholder for the "android" profile.
+//
+// Unlike the other three profiles, "android" does NOT route through the
+// classic check-group/attack-scenario pipeline that this definition
+// describes (src/mobile/android/validate/validateAndroidTarget.ts is an
+// entirely separate orchestrator — see agents.txt Batch 5 section 6.1). This
+// entry exists only so SECURITY_PROFILE_IDS including "android" satisfies
+// PROFILE_REGISTRY's Record<SecurityProfileId, AttackProfileDefinition> type;
+// its check-id lists are deliberately empty so nothing here ever appears to
+// select or gate a classic check group for the Android path.
+// ---------------------------------------------------------------------------
+export const ANDROID_PROFILE = {
+    id: "android",
+    label: "Android",
+    description: "Profile for an Android Gradle project, validated through a dedicated Android orchestrator (detection, manifest audits, Gradle metadata, optional Gradle operations) rather than the classic check-group/attack-scenario pipeline this definition otherwise describes.",
+    defaultCheckIds: [],
+    applicableCheckIds: [],
+    scenarioGroups: [],
+};

package/dist/src/securityValidation/commandRunner.js

@@ -8,11 +8,19 @@ export function resolveNpmCommand() {
 // Runs a security check command with an argument array (no shell interpolation).
 // npm audit returns exit code 1 on vulnerabilities; that is not treated as a
 // spawn failure here — the caller inspects the output and exit code separately.
+//
+// `env` is optional and additive (v0.4.1 Batch 7): omitted, it defaults to
+// `process.env` exactly as before this option existed, so every pre-existing
+// caller is unaffected. A caller that supplies a minimized environment (e.g.
+// the Batch 7 external-tool adapters, which must not propagate arbitrary
+// caller credentials to a spawned child process) gets that environment used
+// for both PATH resolution and the actual spawn.
 export async function runSecurityCommand(options) {
     const started = Date.now();
+    const env = options.env ?? process.env;
     const resolved = resolveCommand(options.command, {
         cwd: options.cwd,
-        env: process.env,
+        env,
         allowPowerShellShim: false,
     });
     const command = resolved.command;
@@ -48,6 +56,7 @@ export async function runSecurityCommand(options) {
                 cwd: options.cwd,
                 shell: false,
                 stdio: ["ignore", "pipe", "pipe"],
+                env,
             });
         }
         catch (spawnErr) {

package/dist/src/securityValidation/validate/cliOptions.js

@@ -35,7 +35,15 @@ export const PLANNED_SECURITY_CHECK_IDS = [
     "network",
 ];
 export const DEFAULT_SECURITY_CHECKS = IMPLEMENTED_SECURITY_CHECK_IDS;
-export const SECURITY_PROFILE_IDS = ["node-cli-package", "local-tool", "npm-package"];
+// v0.4.0 Batch 5 — "android" added additively. Unlike the other three
+// profiles (which select --checks defaults for the classic
+// check-group/attack-scenario pipeline), "android" routes to an entirely
+// separate orchestrator (src/mobile/android/validate/validateAndroidTarget.ts)
+// because the Android check/finding/status vocabulary established in
+// Batches 1-4 does not fit SecurityCheckId/SecurityCheckResult — seeagents.txt
+// Batch 5 section 6.1-6.2. The CLI still exposes it through the same
+// --profile flag on the same security:validate command (no second CLI).
+export const SECURITY_PROFILE_IDS = ["node-cli-package", "local-tool", "npm-package", "android"];
 export const DEFAULT_SECURITY_PROFILE = "node-cli-package";
 export const SECURITY_OUTPUT_FORMATS = ["text", "json"];
 export const DEFAULT_SECURITY_OUTPUT_FORMATS = ["text", "json"];
@@ -52,14 +60,41 @@ const FLAGS_WITH_VALUE = {
     "--profile": "profile",
     "--format": "format",
     "--fail-on": "failOn",
+    "--android-gradle-operations": "androidGradleOperations",
+    "--android-external-tools": "androidExternalTools",
+    "--android-external-network": "androidExternalNetwork",
 };
+// v0.4.0 Batch 5 — the exact allowlisted optional Gradle operation ids
+// (agents.txt Batch 5 section 7.3). Deliberately re-declared here rather than
+// imported from src/mobile/android/gradle/validate/operations.ts: this keeps
+// the foundational CLI-parsing module free of a new securityValidation ->
+// mobile dependency direction for five short string literals. Both lists
+// must stay in sync; a regression test in tests/security/ asserts they do.
+export const ANDROID_GRADLE_OPERATION_IDS = ["wrapper-version", "tasks", "assemble-debug", "unit-test-debug", "lint-debug"];
+// v0.4.1 Batch 8 — the exact allowlisted external-tool ids (agents.txt Batch
+// 8 section 10.1). Deliberately re-declared here for the same reason
+// ANDROID_GRADLE_OPERATION_IDS is re-declared above: this module stays free
+// of a securityValidation -> mobile import for four short string literals.
+// Both lists must stay in sync; a regression test asserts they do.
+export const ANDROID_EXTERNAL_TOOL_CLI_IDS = ["semgrep", "osv", "android-lint", "dependency-check"];
+export const ANDROID_EXTERNAL_NETWORK_POLICIES = ["deny", "allow-requested"];
+export const DEFAULT_ANDROID_EXTERNAL_NETWORK_POLICY = "deny";
 export function parseSecurityValidateArgs(argv) {
     const result = {};
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         const key = FLAGS_WITH_VALUE[arg];
-        if (!key)
+        if (!key) {
+            // Keep the conventional argument separator harmless while rejecting
+            // misspelled or unsupported top-level options before any validation
+            // configuration, target resolution, or report work begins.
+            if (arg === "--")
+                continue;
+            if (arg.startsWith("-")) {
+                throw new Error(`Unknown option: ${arg}.`);
+            }
             continue;
+        }
         if (i + 1 >= argv.length) {
             throw new Error(`Missing value for ${arg}. Expected a value after ${arg}.`);
         }
@@ -73,6 +108,9 @@ export function normalizeSecurityValidateConfig(raw, toolRoot) {
     const formats = parseFormatOption(raw.format);
     const failOn = parseFailOnOption(raw.failOn);
     const out = raw.out !== undefined ? resolveOutDir(raw.out) : path.join(toolRoot, "reports", "security");
+    const androidGradleOperationIds = parseAndroidGradleOperationsOption(raw.androidGradleOperations, profile.value);
+    const androidExternalToolIds = parseAndroidExternalToolsOption(raw.androidExternalTools, profile.value);
+    const androidExternalNetworkPolicy = parseAndroidExternalNetworkOption(raw.androidExternalNetwork, profile.value);
     return {
         target: raw.target,
         out,
@@ -88,8 +126,60 @@ export function normalizeSecurityValidateConfig(raw, toolRoot) {
         formatsWereDefault: formats.wasDefault,
         failOnThreshold: failOn.value,
         failOnWasDefault: failOn.wasDefault,
+        androidGradleOperationIds,
+        androidExternalToolIds,
+        androidExternalNetworkPolicy,
     };
 }
+// Parses --android-gradle-operations. Absent by default (empty array — zero
+// Gradle execution). Rejects unknown operation ids and non-"android"-profile
+// usage before any validation work begins (agents.txt Batch 5 section 7.3).
+function parseAndroidGradleOperationsOption(raw, profile) {
+    if (raw === undefined)
+        return [];
+    if (profile !== "android") {
+        throw new Error(`--android-gradle-operations requires --profile android (got --profile ${profile}).`);
+    }
+    const parts = splitAndNormalizeList(raw, "--android-gradle-operations");
+    const invalid = parts.filter((p) => !ANDROID_GRADLE_OPERATION_IDS.includes(p));
+    if (invalid.length > 0) {
+        throw new Error(`Invalid --android-gradle-operations value(s): ${invalid.join(", ")}. Valid values are: ${ANDROID_GRADLE_OPERATION_IDS.join(", ")}.`);
+    }
+    const unique = new Set(parts);
+    return ANDROID_GRADLE_OPERATION_IDS.filter((id) => unique.has(id));
+}
+// Parses --android-external-tools. Absent by default (empty array — zero
+// external-tool execution). Rejects unknown tool ids and non-"android"-
+// profile usage before any validation work begins (agents.txt Batch 8
+// section 10.1) — same shape as parseAndroidGradleOperationsOption.
+function parseAndroidExternalToolsOption(raw, profile) {
+    if (raw === undefined)
+        return [];
+    if (profile !== "android") {
+        throw new Error(`--android-external-tools requires --profile android (got --profile ${profile}).`);
+    }
+    const parts = splitAndNormalizeList(raw, "--android-external-tools");
+    const invalid = parts.filter((p) => !ANDROID_EXTERNAL_TOOL_CLI_IDS.includes(p));
+    if (invalid.length > 0) {
+        throw new Error(`Invalid --android-external-tools value(s): ${invalid.join(", ")}. Valid values are: ${ANDROID_EXTERNAL_TOOL_CLI_IDS.join(", ")}.`);
+    }
+    const unique = new Set(parts);
+    return ANDROID_EXTERNAL_TOOL_CLI_IDS.filter((id) => unique.has(id));
+}
+// Parses --android-external-network. Defaults to "deny" (agents.txt Batch 8
+// section 10.2) — network is never authorized unless explicitly requested.
+function parseAndroidExternalNetworkOption(raw, profile) {
+    if (raw === undefined)
+        return DEFAULT_ANDROID_EXTERNAL_NETWORK_POLICY;
+    if (profile !== "android") {
+        throw new Error(`--android-external-network requires --profile android (got --profile ${profile}).`);
+    }
+    const value = raw.trim();
+    if (!ANDROID_EXTERNAL_NETWORK_POLICIES.includes(value)) {
+        throw new Error(`Invalid --android-external-network value: "${raw}". Valid values are: ${ANDROID_EXTERNAL_NETWORK_POLICIES.join(", ")}.`);
+    }
+    return value;
+}
 // ---------------------------------------------------------------------------
 // v0.2.2 Batch 5 — profile-aware default checks
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.3.4",
+  "version": "0.4.1",
   "type": "module",
   "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
   "bin": {
@@ -71,6 +71,7 @@
     "test:plots": "vitest run tests/plots tests/commands/generateExperimentPlotsCommand.spec.ts",
     "test:visualization-demos": "vitest run tests/visualizationDemos tests/commands/runVisualizationDemosCommand.spec.ts",
     "verify:benchmarks": "tsx scripts/verify-benchmarks.ts",
+    "docs:check": "node scripts/check-docs.mjs",
     "verify": "npm run build && npm run test && npm run test:benchmarks && npm run test:report && npm run test:screenshot && npm run test:evaluation && npm run test:agents && npm run test:experiments && npm run test:plots && npm run test:visualization-demos && npm run test:gallery && npm run test:demo && npm run test:integration && npm run test:e2e && npm run verify:benchmarks",
     "security:deps": "tsx scripts/security/runDependencyChecks.ts",
     "security:package": "tsx scripts/security/runPackageChecks.ts",

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/debug/res/xml/ambiguous_backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="sharedpref" path="." />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/ambiguous_backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <exclude domain="database" path="fake.db" />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/backup_rules.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="sharedpref" path="." />
+    <exclude domain="database" path="fake-cache.db" />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/broad_backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="root" path="." />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/data_extraction_rules.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<data-extraction-rules>
+    <cloud-backup disableIfNoEncryptionCapabilities="true">
+        <include domain="sharedpref" path="." />
+        <exclude domain="database" path="fake-secrets.db" />
+    </cloud-backup>
+    <device-transfer>
+        <include domain="root" path="." />
+    </device-transfer>
+</data-extraction-rules>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/unsupported_domain_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="not-a-real-domain" path="." />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-b/src/main/res/xml/malformed_backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="sharedpref" path="." />
+    <!-- missing closing tag on purpose -->

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-b/src/main/res/xml/unsupported_root.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="not_backup_rules">true</string>
+</resources>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/debug/res/xml/ambiguous_config.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true" />
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/ambiguous_config.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false" />
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/base_cleartext_false.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false">
+        <trust-anchors>
+            <certificates src="system" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/broad_and_duplicate_domains.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <domain-config>
+        <domain>ab</domain>
+        <domain>Example.COM.</domain>
+        <domain>example.com</domain>
+    </domain-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/empty_domain.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <domain-config>
+        <domain includeSubdomains="true"></domain>
+    </domain-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/malformed_pin.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <domain-config>
+        <domain>example.org</domain>
+        <pin-set expiration="not-a-date">
+            <pin>MISSING_DIGEST_ATTRIBUTE_FAKE_PIN=</pin>
+            <pin digest="SHA-1">UNSUPPORTED_DIGEST_FAKE_PIN=</pin>
+            <pin digest="SHA-256"></pin>
+        </pin-set>
+    </domain-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="user" />
+        </trust-anchors>
+    </base-config>
+    <domain-config cleartextTrafficPermitted="true">
+        <domain includeSubdomains="true">example.com</domain>
+        <pin-set expiration="2030-01-01">
+            <pin digest="SHA-256">FAKEPINHASHFAKEPINHASHFAKEPINHASHFAKEPINHASH=</pin>
+        </pin-set>
+        <domain-config>
+            <domain includeSubdomains="false">nested.example.com</domain>
+            <trust-anchors>
+                <certificates src="@raw/my_custom_ca" />
+            </trust-anchors>
+        </domain-config>
+    </domain-config>
+    <debug-overrides>
+        <trust-anchors>
+            <certificates src="user" overridePins="true" />
+        </trust-anchors>
+    </debug-overrides>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-b/src/main/res/xml/malformed_network_security_config.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+    <!-- missing closing tags on purpose -->

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-b/src/main/res/xml/unsupported_root.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="not_a_network_security_config">true</string>
+</resources>

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/groovy-release-debuggable-dynamic.gradle

@@ -0,0 +1,7 @@
+android {
+    buildTypes {
+        release {
+            debuggable rootProject.ext.fakeIsDebugFlag
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/groovy-release-debuggable-false.gradle

@@ -0,0 +1,9 @@
+android {
+    buildTypes {
+        release {
+            debuggable false
+            minifyEnabled true
+            shrinkResources true
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/groovy-release-debuggable-true.gradle

@@ -0,0 +1,13 @@
+android {
+    buildTypes {
+        release {
+            debuggable true
+            minifyEnabled true
+            shrinkResources true
+            signingConfig signingConfigs.release
+        }
+        debug {
+            debuggable true
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/kotlin-release-debuggable-false.gradle.kts

@@ -0,0 +1,7 @@
+android {
+    buildTypes {
+        getByName("release") {
+            isDebuggable = false
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/kotlin-release-debuggable-true.gradle.kts

@@ -0,0 +1,10 @@
+android {
+    buildTypes {
+        getByName("release") {
+            isDebuggable = true
+            isMinifyEnabled = true
+            isShrinkResources = true
+            signingConfig = signingConfigs.getByName("release")
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/missing-release-build-type.gradle.kts

@@ -0,0 +1,7 @@
+android {
+    buildTypes {
+        debug {
+            isDebuggable = true
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-a/src/debug/res/xml/network_security_config.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <debug-overrides>
+        <trust-anchors>
+            <certificates src="user" />
+        </trust-anchors>
+    </debug-overrides>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-a/src/main/res/xml/backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <exclude domain="sharedpref" path="fake-secrets.xml" />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-a/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false">
+        <trust-anchors>
+            <certificates src="system" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-b/src/main/res/xml/malformed_network_security_config.xml

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false">
+        <trust-anchors>
+            <certificates src="system" />
+        </trust-anchors>
+    <!-- missing closing tag for base-config and network-security-config on purpose -->