@dailephd/my-dev-kit-lab 0.4.0 → 0.4.1

package/dist/src/mobile/android/report/renderAndroidReport.js

@@ -17,6 +17,27 @@ function formatDuration(ms) {
         return `${ms}ms`;
     return `${(ms / 1000).toFixed(1)}s`;
 }
+// v0.4.1 Batch 8 — shared per-check rendering for the new ADVANCED SECURITY
+// CHECKS and EXTERNAL TOOL RESULTS sections. Bounded: prints counts and
+// identifiers, never raw stdout/stderr/environment/complete source (that
+// bound is already enforced by each check builder before evidence reaches
+// this report — this function does not itself receive raw tool output).
+function renderCheckSummaryLines(lines, c) {
+    lines.push(`  ${c.id} [${c.status}] — ${sanitize(c.title)}`);
+    lines.push(`    category: ${c.category}  findings: ${c.findings.length}  candidates: ${c.candidateEvidence?.length ?? 0}`);
+    if (c.evidence.length > 0)
+        lines.push(`    evidence: ${c.evidence.map(sanitize).join(" | ")}`);
+    if (c.durationMs !== undefined)
+        lines.push(`    duration: ${formatDuration(c.durationMs)}`);
+    if (c.skipInfo)
+        lines.push(`    skip reason: ${sanitize(c.skipInfo.reason)}`);
+    for (const w of c.warnings)
+        lines.push(`    warning: ${sanitize(w)}`);
+    for (const e of c.errors)
+        lines.push(`    error: ${sanitize(e)}`);
+    if (c.environmentRequirements.length > 0)
+        lines.push(`    limitations: ${c.environmentRequirements.map(sanitize).join(" | ")}`);
+}
 export function renderAndroidTextReport(model) {
     const lines = [];
     // 1. Summary
@@ -143,6 +164,48 @@ export function renderAndroidTextReport(model) {
         }
     }
     lines.push("");
+    // 15b. Advanced security checks (v0.4.1 Batch 8)
+    lines.push(divider());
+    lines.push("ADVANCED SECURITY CHECKS");
+    lines.push(divider());
+    if (model.advancedSecurityChecks.length === 0) {
+        lines.push("(none ran — not applicable to this target)");
+    }
+    else {
+        for (const c of model.advancedSecurityChecks) {
+            renderCheckSummaryLines(lines, c);
+        }
+    }
+    lines.push("");
+    // 15c. External tool results (v0.4.1 Batch 8)
+    lines.push(divider());
+    lines.push("EXTERNAL TOOL RESULTS");
+    lines.push(divider());
+    lines.push(`Requested external tools: ${model.metadata.requestedExternalTools.length > 0 ? model.metadata.requestedExternalTools.join(", ") : "(none — zero external-tool process execution)"}`);
+    if (model.metadata.requestedExternalTools.length > 0) {
+        lines.push(`Effective network policy: ${model.metadata.externalNetworkPolicy}`);
+    }
+    if (model.externalToolChecks.length === 0) {
+        lines.push("No external tools were requested.");
+    }
+    else {
+        for (const c of model.externalToolChecks) {
+            renderCheckSummaryLines(lines, c);
+        }
+    }
+    lines.push("");
+    // 15d. Candidate evidence (review required, distinct from confirmed findings)
+    lines.push(divider());
+    lines.push("CANDIDATE EVIDENCE (REVIEW REQUIRED — NOT CONFIRMED FINDINGS)");
+    lines.push(divider());
+    lines.push(sanitize(model.candidateEvidenceSummary.summary));
+    for (const c of [...model.advancedSecurityChecks, ...model.externalToolChecks]) {
+        for (const candidate of c.candidateEvidence ?? []) {
+            lines.push(`  [${candidate.confidence}/${candidate.resolutionState}] ${candidate.ruleId} — ${sanitize(candidate.summary)}`);
+            lines.push(`    location: ${candidate.location.path}${candidate.location.line !== undefined ? `:${candidate.location.line}` : ""}`);
+        }
+    }
+    lines.push("");
     // 16. Release metadata
     lines.push(divider());
     lines.push("RELEASE METADATA");

package/dist/src/mobile/android/validate/validateAndroidTarget.js

@@ -18,6 +18,80 @@ import { buildAndroidPlayReadinessChecklist } from "./playReadinessChecklist.js"
 import { calculateAndroidVerdict } from "./androidVerdict.js";
 import { buildAndroidDetectionCheckResult, buildAndroidManifestParsingCheckResult, buildAndroidTargetImmutabilityCheckResult, } from "./detectionAndImmutabilityCheckResults.js";
 import { ANDROID_VALIDATION_ARTIFACT_TYPE, ANDROID_VALIDATION_SCHEMA_VERSION, } from "../validation/result.js";
+import { auditAndroidNetworkSecurity } from "../advancedSecurity/networkSecurity/checkResult.js";
+import { auditAndroidBackupConfiguration } from "../advancedSecurity/backupConfiguration/checkResult.js";
+import { auditAndroidReleaseConfiguration } from "../advancedSecurity/releaseConfiguration/checkResult.js";
+import { auditAndroidSecretCandidates } from "../advancedSecurity/secretCandidates/checkResult.js";
+import { auditAndroidSigningConfiguration } from "../advancedSecurity/signingConfiguration/checkResult.js";
+import { auditAndroidWebViewSecurity } from "../advancedSecurity/webview/checkResult.js";
+import { auditAndroidFileProviders } from "../advancedSecurity/fileProvider/checkResult.js";
+import { auditAndroidSensitiveStorage } from "../advancedSecurity/sensitiveStorage/checkResult.js";
+import { auditAndroidSensitiveLogging } from "../advancedSecurity/sensitiveLogging/checkResult.js";
+import { auditAndroidClipboardSecurity } from "../advancedSecurity/clipboard/checkResult.js";
+import { auditAndroidFirebaseGoogleServices } from "../advancedSecurity/firebaseGoogle/checkResult.js";
+import { runRequestedAndroidExternalTools } from "../advancedSecurity/externalTools/runRequestedAndroidExternalTools.js";
+import { createRealExternalToolExecutor } from "../advancedSecurity/externalTools/runBoundedExternalTool.js";
+import { createRealGradleCommandExecutor } from "../gradle/validate/executor.js";
+function runIsolatedCheck(descriptor) {
+    try {
+        return descriptor.run();
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            id: descriptor.id,
+            category: descriptor.category,
+            title: descriptor.title,
+            status: "error",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: false,
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [`Advanced check raised an unexpected error: ${message}`],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+}
+function buildAdvancedSecurityChecks(targetRoot, detection, manifestEntries, gradleModules) {
+    // Fixed order (agents.txt Batch 8 section 9.1) — never alphabetical, never
+    // derived from filesystem/object iteration.
+    const descriptors = [
+        { id: "android-network-security-audit", category: "android-network-security", title: "Android Network Security Config audit", run: () => auditAndroidNetworkSecurity(targetRoot, detection, manifestEntries) },
+        { id: "android-backup-configuration-audit", category: "android-backup-configuration", title: "Android backup configuration audit", run: () => auditAndroidBackupConfiguration(targetRoot, detection, manifestEntries) },
+        { id: "android-release-configuration-audit", category: "android-release-configuration", title: "Android release configuration audit", run: () => auditAndroidReleaseConfiguration(targetRoot, detection, manifestEntries, gradleModules) },
+        { id: "android-secret-candidates-audit", category: "android-secret-candidates", title: "Android hardcoded secret-candidate audit", run: () => auditAndroidSecretCandidates(targetRoot, detection) },
+        { id: "android-signing-configuration-audit", category: "android-signing-configuration", title: "Android signing configuration audit", run: () => auditAndroidSigningConfiguration(targetRoot, detection, gradleModules) },
+        { id: "android-webview-security-audit", category: "android-webview", title: "Android WebView security audit", run: () => auditAndroidWebViewSecurity(targetRoot, detection) },
+        { id: "android-file-provider-audit", category: "android-file-provider", title: "Android FileProvider security audit", run: () => auditAndroidFileProviders(targetRoot, detection, manifestEntries) },
+        { id: "android-sensitive-storage-audit", category: "android-sensitive-storage", title: "Android sensitive-storage audit", run: () => auditAndroidSensitiveStorage(targetRoot, detection) },
+        { id: "android-sensitive-logging-audit", category: "android-sensitive-logging", title: "Android sensitive-logging audit", run: () => auditAndroidSensitiveLogging(targetRoot, detection) },
+        { id: "android-clipboard-security-audit", category: "android-clipboard", title: "Android clipboard security audit", run: () => auditAndroidClipboardSecurity(targetRoot, detection) },
+        { id: "android-firebase-google-services-audit", category: "android-firebase-google-services", title: "Android Firebase/Google services audit", run: () => auditAndroidFirebaseGoogleServices(targetRoot, detection) },
+    ];
+    return descriptors.map(runIsolatedCheck);
+}
+// Memoizes by Gradle operation id: the fixed allowlist (operations.ts) maps
+// each operation id to fixed args, so within one validation run the same
+// operation id always means the same command — caching by id is safe and
+// prevents running `lintDebug` twice when both --android-gradle-operations
+// lint-debug and --android-external-tools android-lint are requested
+// together (agents.txt Batch 8 section 10.6).
+function createDedupingGradleExecutor(base) {
+    const cache = new Map();
+    return (plan) => {
+        const cached = cache.get(plan.operationId);
+        if (cached)
+            return cached;
+        const promise = base(plan);
+        cache.set(plan.operationId, promise);
+        return promise;
+    };
+}
 function readToolPackageMetadata(toolRoot) {
     try {
         const pkgRaw = fs.readFileSync(path.join(toolRoot, "package.json"), "utf8");
@@ -75,6 +149,11 @@ export async function validateAndroidTarget(options) {
     // batch owner).
     const detectionCheck = buildAndroidDetectionCheckResult(detection);
     const manifestParsingCheck = buildAndroidManifestParsingCheckResult(detection, manifestEntries);
+    // Shared, deduping Gradle executor: reused for both --android-gradle-
+    // operations and (if android-lint is also externally requested) the
+    // Batch 7 Android Lint adapter, so `lintDebug` never runs twice for one
+    // validation run (agents.txt Batch 8 section 10.6).
+    const sharedGradleExecutor = createDedupingGradleExecutor(options.gradleExecutor ?? createRealGradleCommandExecutor());
     // 15-16. Optional Gradle operations — never run unless explicitly requested.
     const requestedOperationIds = options.requestedGradleOperationIds ?? [];
     const gradleOperationResults = requestedOperationIds.length > 0
@@ -83,17 +162,79 @@ export async function validateAndroidTarget(options) {
             targetRoot: resolvedTargetRoot,
             detection,
             operationIds: requestedOperationIds,
-            executor: options.gradleExecutor,
+            executor: sharedGradleExecutor,
             allowWithoutTaskDiscovery: options.allowGradleWithoutTaskDiscovery,
             platform: options.platform,
         })
         : [];
-    // 17. Target mutation evidence — captured regardless of whether Gradle ran,
+    // v0.4.1 Batch 8 — eleven internal advanced Android checks, active by
+    // default (agents.txt Batch 8 section 9.1). Sequential, fixed order,
+    // isolated per-check via runIsolatedCheck. Never executes a process or
+    // touches the network.
+    const advancedSecurityChecks = buildAdvancedSecurityChecks(resolvedTargetRoot, detection, manifestEntries, gradle.modules);
+    // v0.4.1 Batch 8 — optional external-tool integration. Never executes
+    // unless requestedExternalToolIds is non-empty (same "no request, no
+    // execution" convention as Gradle operations). Wrapped in try/catch so a
+    // dispatcher-level failure (e.g. an unknown tool id slipping past CLI
+    // validation in a programmatic caller) cannot discard the checks already
+    // gathered above.
+    const requestedExternalToolIds = options.requestedExternalToolIds ?? [];
+    let externalToolChecks = [];
+    if (requestedExternalToolIds.length > 0) {
+        try {
+            externalToolChecks = await runRequestedAndroidExternalTools({
+                request: {
+                    requestedTools: requestedExternalToolIds,
+                    targetRoot: resolvedTargetRoot,
+                    artifactRoot: options.externalToolArtifactRoot ?? path.join(options.toolRoot, "reports", "security", "external-tools"),
+                    networkPolicy: options.externalNetworkPolicy ?? "deny",
+                },
+                detection,
+                executors: {
+                    semgrep: options.externalToolExecutors?.semgrep ?? createRealExternalToolExecutor(),
+                    osv: options.externalToolExecutors?.osv ?? createRealExternalToolExecutor(),
+                    androidLint: options.externalToolExecutors?.androidLint ?? sharedGradleExecutor,
+                    dependencyCheck: options.externalToolExecutors?.dependencyCheck ?? createRealExternalToolExecutor(),
+                },
+                discover: options.externalToolDiscover,
+                javaAvailable: options.javaAvailable,
+                lintTaskAvailable: options.lintTaskAvailable,
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            externalToolChecks = [
+                {
+                    id: "android-external-tools-dispatch",
+                    category: "android-semgrep",
+                    title: "External security-tool dispatch",
+                    status: "error",
+                    requirementLevel: "optional",
+                    ran: false,
+                    skipped: false,
+                    evidence: [],
+                    findings: [],
+                    warnings: [],
+                    errors: [`External-tool dispatch raised an unexpected error: ${message}`],
+                    sourcePaths: [],
+                    confidence: "unknown",
+                    environmentRequirements: [],
+                    candidateEvidence: [],
+                },
+            ];
+        }
+    }
+    // 17. Target mutation evidence — captured after every process this run may
+    // have executed (Gradle operations, advanced checks, and external tools),
     // so the static-only path also proves it made no changes.
     const snapshotAfter = captureTargetSnapshot(resolvedTargetRoot, hasGit);
     const targetMutation = buildTargetMutationReport(snapshotBefore, snapshotAfter);
     const immutabilityCheck = buildAndroidTargetImmutabilityCheckResult(targetMutation);
-    // 18. Assemble checks/findings in deterministic order (agents.txt section 10.3).
+    // 18. Assemble checks/findings in deterministic order (agents.txt Batch 8
+    // section 11.1): the existing v0.4.0 check order is preserved exactly
+    // (ending with immutabilityCheck, as before), and the eleven advanced
+    // checks and any requested external tools are APPENDED after it — never
+    // interleaved into the existing order.
     const checks = [
         detectionCheck,
         manifestParsingCheck,
@@ -104,6 +245,8 @@ export async function validateAndroidTarget(options) {
         gradleMetadataCheck,
         ...gradleOperationResults,
         immutabilityCheck,
+        ...advancedSecurityChecks,
+        ...externalToolChecks,
     ];
     const findingsById = new Map();
     for (const check of checks) {

package/dist/src/mobile/android/validation/checkResult.js

@@ -1,3 +1,4 @@
+import { ANDROID_ADVANCED_CHECK_CATEGORIES } from "../advancedSecurity/ruleIds.js";
 // ---------------------------------------------------------------------------
 // v0.4.0 Batch 1 — Android check-result and skip-representation contracts.
 //
@@ -34,6 +35,11 @@ export const ANDROID_NON_PASSING_STATUSES = [
 // v0.4.0 Batch 5 — added "android-target-immutability" (additive) for the
 // required target mutation/immutability check (agents.txt Batch 5 section
 // 10.1).
+// v0.4.1 Batch 1 — added the advanced-security check-category families
+// (network/backup/release/secrets/signing/webview/file-provider/sensitive-
+// storage/sensitive-logging/clipboard/firebase/optional-tool) required by
+// later v0.4.1 batches. These categories are additive only: no check in this
+// batch is registered against them yet (see advancedSecurity/ruleIds.ts).
 export const ANDROID_CHECK_CATEGORIES = [
     "android-detection",
     "android-manifest",
@@ -45,6 +51,7 @@ export const ANDROID_CHECK_CATEGORIES = [
     "android-release-metadata",
     "android-play-readiness",
     "android-target-immutability",
+    ...ANDROID_ADVANCED_CHECK_CATEGORIES,
 ];
 export function isPassingAndroidStatus(status) {
     return status === "passed";

package/dist/src/securityValidation/commandRunner.js

@@ -8,11 +8,19 @@ export function resolveNpmCommand() {
 // Runs a security check command with an argument array (no shell interpolation).
 // npm audit returns exit code 1 on vulnerabilities; that is not treated as a
 // spawn failure here — the caller inspects the output and exit code separately.
+//
+// `env` is optional and additive (v0.4.1 Batch 7): omitted, it defaults to
+// `process.env` exactly as before this option existed, so every pre-existing
+// caller is unaffected. A caller that supplies a minimized environment (e.g.
+// the Batch 7 external-tool adapters, which must not propagate arbitrary
+// caller credentials to a spawned child process) gets that environment used
+// for both PATH resolution and the actual spawn.
 export async function runSecurityCommand(options) {
     const started = Date.now();
+    const env = options.env ?? process.env;
     const resolved = resolveCommand(options.command, {
         cwd: options.cwd,
-        env: process.env,
+        env,
         allowPowerShellShim: false,
     });
     const command = resolved.command;
@@ -48,6 +56,7 @@ export async function runSecurityCommand(options) {
                 cwd: options.cwd,
                 shell: false,
                 stdio: ["ignore", "pipe", "pipe"],
+                env,
             });
         }
         catch (spawnErr) {

package/dist/src/securityValidation/validate/cliOptions.js

@@ -61,6 +61,8 @@ const FLAGS_WITH_VALUE = {
     "--format": "format",
     "--fail-on": "failOn",
     "--android-gradle-operations": "androidGradleOperations",
+    "--android-external-tools": "androidExternalTools",
+    "--android-external-network": "androidExternalNetwork",
 };
 // v0.4.0 Batch 5 — the exact allowlisted optional Gradle operation ids
 // (agents.txt Batch 5 section 7.3). Deliberately re-declared here rather than
@@ -69,6 +71,14 @@ const FLAGS_WITH_VALUE = {
 // mobile dependency direction for five short string literals. Both lists
 // must stay in sync; a regression test in tests/security/ asserts they do.
 export const ANDROID_GRADLE_OPERATION_IDS = ["wrapper-version", "tasks", "assemble-debug", "unit-test-debug", "lint-debug"];
+// v0.4.1 Batch 8 — the exact allowlisted external-tool ids (agents.txt Batch
+// 8 section 10.1). Deliberately re-declared here for the same reason
+// ANDROID_GRADLE_OPERATION_IDS is re-declared above: this module stays free
+// of a securityValidation -> mobile import for four short string literals.
+// Both lists must stay in sync; a regression test asserts they do.
+export const ANDROID_EXTERNAL_TOOL_CLI_IDS = ["semgrep", "osv", "android-lint", "dependency-check"];
+export const ANDROID_EXTERNAL_NETWORK_POLICIES = ["deny", "allow-requested"];
+export const DEFAULT_ANDROID_EXTERNAL_NETWORK_POLICY = "deny";
 export function parseSecurityValidateArgs(argv) {
     const result = {};
     for (let i = 0; i < argv.length; i++) {
@@ -99,6 +109,8 @@ export function normalizeSecurityValidateConfig(raw, toolRoot) {
     const failOn = parseFailOnOption(raw.failOn);
     const out = raw.out !== undefined ? resolveOutDir(raw.out) : path.join(toolRoot, "reports", "security");
     const androidGradleOperationIds = parseAndroidGradleOperationsOption(raw.androidGradleOperations, profile.value);
+    const androidExternalToolIds = parseAndroidExternalToolsOption(raw.androidExternalTools, profile.value);
+    const androidExternalNetworkPolicy = parseAndroidExternalNetworkOption(raw.androidExternalNetwork, profile.value);
     return {
         target: raw.target,
         out,
@@ -115,6 +127,8 @@ export function normalizeSecurityValidateConfig(raw, toolRoot) {
         failOnThreshold: failOn.value,
         failOnWasDefault: failOn.wasDefault,
         androidGradleOperationIds,
+        androidExternalToolIds,
+        androidExternalNetworkPolicy,
     };
 }
 // Parses --android-gradle-operations. Absent by default (empty array — zero
@@ -134,6 +148,38 @@ function parseAndroidGradleOperationsOption(raw, profile) {
     const unique = new Set(parts);
     return ANDROID_GRADLE_OPERATION_IDS.filter((id) => unique.has(id));
 }
+// Parses --android-external-tools. Absent by default (empty array — zero
+// external-tool execution). Rejects unknown tool ids and non-"android"-
+// profile usage before any validation work begins (agents.txt Batch 8
+// section 10.1) — same shape as parseAndroidGradleOperationsOption.
+function parseAndroidExternalToolsOption(raw, profile) {
+    if (raw === undefined)
+        return [];
+    if (profile !== "android") {
+        throw new Error(`--android-external-tools requires --profile android (got --profile ${profile}).`);
+    }
+    const parts = splitAndNormalizeList(raw, "--android-external-tools");
+    const invalid = parts.filter((p) => !ANDROID_EXTERNAL_TOOL_CLI_IDS.includes(p));
+    if (invalid.length > 0) {
+        throw new Error(`Invalid --android-external-tools value(s): ${invalid.join(", ")}. Valid values are: ${ANDROID_EXTERNAL_TOOL_CLI_IDS.join(", ")}.`);
+    }
+    const unique = new Set(parts);
+    return ANDROID_EXTERNAL_TOOL_CLI_IDS.filter((id) => unique.has(id));
+}
+// Parses --android-external-network. Defaults to "deny" (agents.txt Batch 8
+// section 10.2) — network is never authorized unless explicitly requested.
+function parseAndroidExternalNetworkOption(raw, profile) {
+    if (raw === undefined)
+        return DEFAULT_ANDROID_EXTERNAL_NETWORK_POLICY;
+    if (profile !== "android") {
+        throw new Error(`--android-external-network requires --profile android (got --profile ${profile}).`);
+    }
+    const value = raw.trim();
+    if (!ANDROID_EXTERNAL_NETWORK_POLICIES.includes(value)) {
+        throw new Error(`Invalid --android-external-network value: "${raw}". Valid values are: ${ANDROID_EXTERNAL_NETWORK_POLICIES.join(", ")}.`);
+    }
+    return value;
+}
 // ---------------------------------------------------------------------------
 // v0.2.2 Batch 5 — profile-aware default checks
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "type": "module",
   "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
   "bin": {

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/debug/res/xml/ambiguous_backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="sharedpref" path="." />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/ambiguous_backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <exclude domain="database" path="fake.db" />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/backup_rules.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="sharedpref" path="." />
+    <exclude domain="database" path="fake-cache.db" />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/broad_backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="root" path="." />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/data_extraction_rules.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<data-extraction-rules>
+    <cloud-backup disableIfNoEncryptionCapabilities="true">
+        <include domain="sharedpref" path="." />
+        <exclude domain="database" path="fake-secrets.db" />
+    </cloud-backup>
+    <device-transfer>
+        <include domain="root" path="." />
+    </device-transfer>
+</data-extraction-rules>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-a/src/main/res/xml/unsupported_domain_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="not-a-real-domain" path="." />
+</full-backup-content>

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-b/src/main/res/xml/malformed_backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <include domain="sharedpref" path="." />
+    <!-- missing closing tag on purpose -->

package/tests/fixtures/android/advanced-security-fixtures/backup-configuration/module-b/src/main/res/xml/unsupported_root.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="not_backup_rules">true</string>
+</resources>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/debug/res/xml/ambiguous_config.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true" />
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/ambiguous_config.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false" />
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/base_cleartext_false.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false">
+        <trust-anchors>
+            <certificates src="system" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/broad_and_duplicate_domains.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <domain-config>
+        <domain>ab</domain>
+        <domain>Example.COM.</domain>
+        <domain>example.com</domain>
+    </domain-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/empty_domain.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <domain-config>
+        <domain includeSubdomains="true"></domain>
+    </domain-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/malformed_pin.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <domain-config>
+        <domain>example.org</domain>
+        <pin-set expiration="not-a-date">
+            <pin>MISSING_DIGEST_ATTRIBUTE_FAKE_PIN=</pin>
+            <pin digest="SHA-1">UNSUPPORTED_DIGEST_FAKE_PIN=</pin>
+            <pin digest="SHA-256"></pin>
+        </pin-set>
+    </domain-config>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-a/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="user" />
+        </trust-anchors>
+    </base-config>
+    <domain-config cleartextTrafficPermitted="true">
+        <domain includeSubdomains="true">example.com</domain>
+        <pin-set expiration="2030-01-01">
+            <pin digest="SHA-256">FAKEPINHASHFAKEPINHASHFAKEPINHASHFAKEPINHASH=</pin>
+        </pin-set>
+        <domain-config>
+            <domain includeSubdomains="false">nested.example.com</domain>
+            <trust-anchors>
+                <certificates src="@raw/my_custom_ca" />
+            </trust-anchors>
+        </domain-config>
+    </domain-config>
+    <debug-overrides>
+        <trust-anchors>
+            <certificates src="user" overridePins="true" />
+        </trust-anchors>
+    </debug-overrides>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-b/src/main/res/xml/malformed_network_security_config.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+    <!-- missing closing tags on purpose -->

package/tests/fixtures/android/advanced-security-fixtures/network-security/module-b/src/main/res/xml/unsupported_root.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="not_a_network_security_config">true</string>
+</resources>

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/groovy-release-debuggable-dynamic.gradle

@@ -0,0 +1,7 @@
+android {
+    buildTypes {
+        release {
+            debuggable rootProject.ext.fakeIsDebugFlag
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/groovy-release-debuggable-false.gradle

@@ -0,0 +1,9 @@
+android {
+    buildTypes {
+        release {
+            debuggable false
+            minifyEnabled true
+            shrinkResources true
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/groovy-release-debuggable-true.gradle

@@ -0,0 +1,13 @@
+android {
+    buildTypes {
+        release {
+            debuggable true
+            minifyEnabled true
+            shrinkResources true
+            signingConfig signingConfigs.release
+        }
+        debug {
+            debuggable true
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/kotlin-release-debuggable-false.gradle.kts

@@ -0,0 +1,7 @@
+android {
+    buildTypes {
+        getByName("release") {
+            isDebuggable = false
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/kotlin-release-debuggable-true.gradle.kts

@@ -0,0 +1,10 @@
+android {
+    buildTypes {
+        getByName("release") {
+            isDebuggable = true
+            isMinifyEnabled = true
+            isShrinkResources = true
+            signingConfig = signingConfigs.getByName("release")
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/release-configuration/missing-release-build-type.gradle.kts

@@ -0,0 +1,7 @@
+android {
+    buildTypes {
+        debug {
+            isDebuggable = true
+        }
+    }
+}

package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-a/src/debug/res/xml/network_security_config.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <debug-overrides>
+        <trust-anchors>
+            <certificates src="user" />
+        </trust-anchors>
+    </debug-overrides>
+</network-security-config>

package/tests/fixtures/android/advanced-security-fixtures/resource-resolution/module-a/src/main/res/xml/backup_rules.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<full-backup-content>
+    <exclude domain="sharedpref" path="fake-secrets.xml" />
+</full-backup-content>