appium-adb 14.1.0 → 14.1.2

package/lib/tools/apk-signing.ts

@@ -1,23 +1,13 @@
 import _ from 'lodash';
 import _fs from 'fs';
-import { exec, type ExecError } from 'teen_process';
+import {exec, type ExecError} from 'teen_process';
 import path from 'path';
-import { log } from '../logger.js';
-import { tempDir, system, mkdirp, fs, util, zip } from '@appium/support';
-import { LRUCache } from 'lru-cache';
-import {
-  getJavaForOs,
-  getJavaHome,
-  APKS_EXTENSION,
-  getResourcePath,
-} from '../helpers.js';
-import type { ADB } from '../adb.js';
-import type {
-  StringRecord,
-  SignedAppCacheValue,
-  CertCheckOptions,
-  KeystoreHash
-} from './types.js';
+import {log} from '../logger.js';
+import {tempDir, system, mkdirp, fs, util, zip} from '@appium/support';
+import {LRUCache} from 'lru-cache';
+import {getJavaForOs, getJavaHome, APKS_EXTENSION, getResourcePath} from '../helpers.js';
+import type {ADB} from '../adb.js';
+import type {StringRecord, SignedAppCacheValue, CertCheckOptions, KeystoreHash} from './types.js';
 
 const DEFAULT_PRIVATE_KEY = path.join('keys', 'testkey.pk8');
 const DEFAULT_CERTIFICATE = path.join('keys', 'testkey.x509.pem');
@@ -28,7 +18,7 @@ const SHA256 = 'sha256';
 const SHA512 = 'sha512';
 const MD5 = 'md5';
 const DEFAULT_CERT_HASH: KeystoreHash = {
-  [SHA256]: 'a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc'
+  [SHA256]: 'a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc',
 };
 const JAVA_PROPS_INIT_ERROR = 'java.lang.Error: Properties init';
 const SIGNED_APPS_CACHE = new LRUCache<string, SignedAppCacheValue>({
@@ -43,13 +33,9 @@ const SIGNED_APPS_CACHE = new LRUCache<string, SignedAppCacheValue>({
  * @throws If apksigner binary is not present on the local file system
  *                 or the return code is not equal to zero.
  */
-export async function executeApksigner (this: ADB, args: string[]): Promise<string> {
+export async function executeApksigner(this: ADB, args: string[]): Promise<string> {
   const apkSignerJar = await getApksignerForOs.bind(this)();
-  const fullCmd = [
-    await getJavaForOs(), '-Xmx1024M', '-Xss1m',
-    '-jar', apkSignerJar,
-    ...args
-  ];
+  const fullCmd = [await getJavaForOs(), '-Xmx1024M', '-Xss1m', '-jar', apkSignerJar, ...args];
   log.debug(`Starting apksigner: ${util.quote(fullCmd)}`);
   // It is necessary to specify CWD explicitly; see https://github.com/appium/appium/issues/14724#issuecomment-737446715
   const {stdout, stderr} = await exec(fullCmd[0], fullCmd.slice(1), {
@@ -57,14 +43,18 @@ export async function executeApksigner (this: ADB, args: string[]): Promise<stri
     // @ts-ignore This works
     windowsVerbatimArguments: system.isWindows(),
   });
-  for (const [name, stream] of [['stdout', stdout], ['stderr', stderr]] as const) {
+  for (const [name, stream] of [
+    ['stdout', stdout],
+    ['stderr', stderr],
+  ] as const) {
     if (!_.trim(stream)) {
       continue;
     }
 
     if (name === 'stdout') {
       // Make the output less talkative
-      const filteredStream = stream.split('\n')
+      const filteredStream = stream
+        .split('\n')
         .filter((line) => !line.includes('WARNING:'))
         .join('\n');
       log.debug(`apksigner ${name}: ${filteredStream}`);
@@ -81,7 +71,7 @@ export async function executeApksigner (this: ADB, args: string[]): Promise<stri
  * @param apk - The full path to the local apk file.
  * @throws If signing fails.
  */
-export async function signWithDefaultCert (this: ADB, apk: string): Promise<void> {
+export async function signWithDefaultCert(this: ADB, apk: string): Promise<void> {
   log.debug(`Signing '${apk}' with default cert`);
   if (!(await fs.exists(apk))) {
     throw new Error(`${apk} file doesn't exist.`);
@@ -89,16 +79,20 @@ export async function signWithDefaultCert (this: ADB, apk: string): Promise<void
 
   const args = [
     'sign',
-    '--key', await getResourcePath(DEFAULT_PRIVATE_KEY),
-    '--cert', await getResourcePath(DEFAULT_CERTIFICATE),
+    '--key',
+    await getResourcePath(DEFAULT_PRIVATE_KEY),
+    '--cert',
+    await getResourcePath(DEFAULT_CERTIFICATE),
     apk,
   ];
   try {
     await this.executeApksigner(args);
   } catch (e) {
     const err = e as ExecError;
-    throw new Error(`Could not sign '${apk}' with the default certificate. ` +
-      `Original error: ${err.stderr || err.stdout || err.message}`);
+    throw new Error(
+      `Could not sign '${apk}' with the default certificate. ` +
+        `Original error: ${err.stderr || err.stdout || err.message}`,
+    );
   }
 }
 
@@ -108,7 +102,7 @@ export async function signWithDefaultCert (this: ADB, apk: string): Promise<void
  * @param apk - The full path to the local apk file.
  * @throws If signing fails.
  */
-export async function signWithCustomCert (this: ADB, apk: string): Promise<void> {
+export async function signWithCustomCert(this: ADB, apk: string): Promise<void> {
   log.debug(`Signing '${apk}' with custom cert`);
   if (!(await fs.exists(this.keystorePath as string))) {
     throw new Error(`Keystore: ${this.keystorePath} doesn't exist.`);
@@ -118,31 +112,50 @@ export async function signWithCustomCert (this: ADB, apk: string): Promise<void>
   }
 
   try {
-    await this.executeApksigner(['sign',
-      '--ks', this.keystorePath as string,
-      '--ks-key-alias', this.keyAlias as string,
-      '--ks-pass', `pass:${this.keystorePassword}`,
-      '--key-pass', `pass:${this.keyPassword}`,
-      apk]);
+    await this.executeApksigner([
+      'sign',
+      '--ks',
+      this.keystorePath as string,
+      '--ks-key-alias',
+      this.keyAlias as string,
+      '--ks-pass',
+      `pass:${this.keystorePassword}`,
+      '--key-pass',
+      `pass:${this.keyPassword}`,
+      apk,
+    ]);
   } catch (err) {
     const error = err as ExecError;
-    log.warn(`Cannot use apksigner tool for signing. Defaulting to jarsigner. ` +
-      `Original error: ${error.stderr || error.stdout || error.message}`);
+    log.warn(
+      `Cannot use apksigner tool for signing. Defaulting to jarsigner. ` +
+        `Original error: ${error.stderr || error.stdout || error.message}`,
+    );
     try {
       if (await unsignApk(apk)) {
         log.debug(`'${apk}' has been successfully unsigned`);
       } else {
         log.debug(`'${apk}' does not need to be unsigned`);
       }
-      const jarsigner = path.resolve(await getJavaHome(), 'bin',
-        `jarsigner${system.isWindows() ? '.exe' : ''}`);
-      const fullCmd: string[] = [jarsigner,
-        '-sigalg', 'MD5withRSA',
-        '-digestalg', 'SHA1',
-        '-keystore', this.keystorePath as string,
-        '-storepass', this.keystorePassword as string,
-        '-keypass', this.keyPassword as string,
-        apk, this.keyAlias as string];
+      const jarsigner = path.resolve(
+        await getJavaHome(),
+        'bin',
+        `jarsigner${system.isWindows() ? '.exe' : ''}`,
+      );
+      const fullCmd: string[] = [
+        jarsigner,
+        '-sigalg',
+        'MD5withRSA',
+        '-digestalg',
+        'SHA1',
+        '-keystore',
+        this.keystorePath as string,
+        '-storepass',
+        this.keystorePassword as string,
+        '-keypass',
+        this.keyPassword as string,
+        apk,
+        this.keyAlias as string,
+      ];
       log.debug(`Starting jarsigner: ${util.quote(fullCmd)}`);
       await exec(fullCmd[0], fullCmd.slice(1), {
         // @ts-ignore This works
@@ -150,8 +163,10 @@ export async function signWithCustomCert (this: ADB, apk: string): Promise<void>
       });
     } catch (e) {
       const execErr = e as ExecError;
-      throw new Error(`Could not sign with custom certificate. ` +
-        `Original error: ${execErr.stderr || execErr.message}`);
+      throw new Error(
+        `Could not sign with custom certificate. ` +
+          `Original error: ${execErr.stderr || execErr.message}`,
+      );
     }
   }
 }
@@ -164,14 +179,16 @@ export async function signWithCustomCert (this: ADB, apk: string): Promise<void>
  * @param appPath - The full path to the local .apk(s) file.
  * @throws If signing fails.
  */
-export async function sign (this: ADB, appPath: string): Promise<void> {
+export async function sign(this: ADB, appPath: string): Promise<void> {
   if (appPath.endsWith(APKS_EXTENSION)) {
     let message = 'Signing of .apks-files is not supported. ';
     if (this.useKeystore) {
-      message += 'Consider manual application bundle signing with the custom keystore ' +
+      message +=
+        'Consider manual application bundle signing with the custom keystore ' +
         `like it is described at ${BUNDLETOOL_TUTORIAL}`;
     } else {
-      message += `Consider manual application bundle signing with the key at '${DEFAULT_PRIVATE_KEY}' ` +
+      message +=
+        `Consider manual application bundle signing with the key at '${DEFAULT_PRIVATE_KEY}' ` +
         `and the certificate at '${DEFAULT_CERTIFICATE}'. Read ${BUNDLETOOL_TUTORIAL} for more details.`;
     }
     log.warn(message);
@@ -197,7 +214,7 @@ export async function sign (this: ADB, appPath: string): Promise<void> {
  * or false if the apk has been already aligned.
  * @throws If zip-align fails.
  */
-export async function zipAlignApk (this: ADB, apk: string): Promise<boolean> {
+export async function zipAlignApk(this: ADB, apk: string): Promise<boolean> {
   await this.initZipAlign();
   try {
     await exec((this.binaries as StringRecord).zipalign as string, ['-c', '4', apk]);
@@ -209,25 +226,26 @@ export async function zipAlignApk (this: ADB, apk: string): Promise<boolean> {
   try {
     await fs.access(apk, _fs.constants.W_OK);
   } catch {
-    throw new Error(`The file at '${apk}' is not writeable. ` +
-      `Please grant write permissions to this file or to its parent folder '${path.dirname(apk)}' ` +
-      `for the Appium process, so it can zip-align the file`);
+    throw new Error(
+      `The file at '${apk}' is not writeable. ` +
+        `Please grant write permissions to this file or to its parent folder '${path.dirname(apk)}' ` +
+        `for the Appium process, so it can zip-align the file`,
+    );
   }
   const alignedApk = await tempDir.path({prefix: 'appium', suffix: '.tmp'});
   await mkdirp(path.dirname(alignedApk));
   try {
-    await exec(
-      (this.binaries as StringRecord).zipalign as string,
-      ['-f', '4', apk, alignedApk]
-    );
-    await fs.mv(alignedApk, apk, { mkdirp: true });
+    await exec((this.binaries as StringRecord).zipalign as string, ['-f', '4', apk, alignedApk]);
+    await fs.mv(alignedApk, apk, {mkdirp: true});
     return true;
   } catch (e) {
     const err = e as Error;
     if (await fs.exists(alignedApk)) {
       await fs.unlink(alignedApk);
     }
-    throw new Error(`zipAlignApk failed. Original error: ${err.message || (err as ExecError).stderr}`);
+    throw new Error(
+      `zipAlignApk failed. Original error: ${err.message || (err as ExecError).stderr}`,
+    );
   }
 }
 
@@ -239,9 +257,14 @@ export async function zipAlignApk (this: ADB, apk: string): Promise<boolean> {
  * @param opts - Certificate checking options
  * @returns True if given application is already signed.
  */
-export async function checkApkCert (this: ADB, appPath: string, pkg: string, opts: CertCheckOptions = {}): Promise<boolean> {
+export async function checkApkCert(
+  this: ADB,
+  appPath: string,
+  pkg: string,
+  opts: CertCheckOptions = {},
+): Promise<boolean> {
   log.debug(`Checking app cert for ${appPath}`);
-  if (!await fs.exists(appPath)) {
+  if (!(await fs.exists(appPath))) {
     log.debug(`'${appPath}' does not exist`);
     return false;
   }
@@ -261,9 +284,7 @@ export async function checkApkCert (this: ADB, appPath: string, pkg: string, opt
     return false;
   };
 
-  const {
-    requireDefaultCert = true,
-  } = opts;
+  const {requireDefaultCert = true} = opts;
 
   const appHash = await fs.hash(actualAppPath);
   if (SIGNED_APPS_CACHE.has(appHash)) {
@@ -271,7 +292,7 @@ export async function checkApkCert (this: ADB, appPath: string, pkg: string, opt
     const cached = SIGNED_APPS_CACHE.get(appHash);
     if (cached) {
       const {keystorePath, output, expected} = cached;
-      if (this.useKeystore && this.keystorePath === keystorePath || !this.useKeystore) {
+      if ((this.useKeystore && this.keystorePath === keystorePath) || !this.useKeystore) {
         return (!this.useKeystore && !requireDefaultCert) || hashMatches(output, expected);
       }
     }
@@ -283,11 +304,15 @@ export async function checkApkCert (this: ADB, appPath: string, pkg: string, opt
     const output = await this.executeApksigner(['verify', '--print-certs', actualAppPath]);
     const hasMatch = hashMatches(output, expected);
     if (hasMatch) {
-      log.info(`'${actualAppPath}' is signed with the ` +
-        `${this.useKeystore ? 'keystore' : 'default'} certificate`);
+      log.info(
+        `'${actualAppPath}' is signed with the ` +
+          `${this.useKeystore ? 'keystore' : 'default'} certificate`,
+      );
     } else {
-      log.info(`'${actualAppPath}' is signed with a ` +
-        `non-${this.useKeystore ? 'keystore' : 'default'} certificate`);
+      log.info(
+        `'${actualAppPath}' is signed with a ` +
+          `non-${this.useKeystore ? 'keystore' : 'default'} certificate`,
+      );
     }
     const isSigned = (!this.useKeystore && !requireDefaultCert) || hasMatch;
     if (isSigned) {
@@ -319,8 +344,9 @@ export async function checkApkCert (this: ADB, appPath: string, pkg: string, opt
       log.warn(`Assuming '${actualAppPath}' is already signed and continuing anyway`);
       return true;
     }
-    throw new Error(`Cannot verify the signature of '${actualAppPath}'. ` +
-      `Original error: ${errMsg}`);
+    throw new Error(
+      `Cannot verify the signature of '${actualAppPath}'. ` + `Original error: ${errMsg}`,
+    );
   }
 }
 
@@ -330,18 +356,25 @@ export async function checkApkCert (this: ADB, appPath: string, pkg: string, opt
  * @returns
  * @throws If getting keystore hash fails.
  */
-export async function getKeystoreHash (this: ADB): Promise<KeystoreHash> {
+export async function getKeystoreHash(this: ADB): Promise<KeystoreHash> {
   log.debug(`Getting hash of the '${this.keystorePath}' keystore`);
-  const keytool = path.resolve(await getJavaHome(), 'bin',
-    `keytool${system.isWindows() ? '.exe' : ''}`);
-  if (!await fs.exists(keytool)) {
+  const keytool = path.resolve(
+    await getJavaHome(),
+    'bin',
+    `keytool${system.isWindows() ? '.exe' : ''}`,
+  );
+  if (!(await fs.exists(keytool))) {
     throw new Error(`The keytool utility cannot be found at '${keytool}'`);
   }
   const args: string[] = [
-    '-v', '-list',
-    '-alias', this.keyAlias as string,
-    '-keystore', this.keystorePath as string,
-    '-storepass', this.keystorePassword as string,
+    '-v',
+    '-list',
+    '-alias',
+    this.keyAlias as string,
+    '-keystore',
+    this.keystorePath as string,
+    '-storepass',
+    this.keystorePassword as string,
   ];
   log.info(`Running '${keytool}' with arguments: ${util.quote(args)}`);
   try {
@@ -366,8 +399,10 @@ export async function getKeystoreHash (this: ADB): Promise<KeystoreHash> {
     return result;
   } catch (e) {
     const err = e as ExecError;
-    throw new Error(`Cannot get the hash of '${this.keystorePath}' keystore. ` +
-      `Original error: ${err.stderr || err.message}`);
+    throw new Error(
+      `Cannot get the hash of '${this.keystorePath}' keystore. ` +
+        `Original error: ${err.stderr || err.message}`,
+    );
   }
 }
 
@@ -379,7 +414,7 @@ export async function getKeystoreHash (this: ADB): Promise<KeystoreHash> {
  * @returns An absolute path to apksigner tool.
  * @throws If the tool is not present on the local file system.
  */
-export async function getApksignerForOs (this: ADB): Promise<string> {
+export async function getApksignerForOs(this: ADB): Promise<string> {
   return await this.getBinaryFromSdkRoot('apksigner.jar');
 }
 
@@ -393,7 +428,7 @@ export async function getApksignerForOs (this: ADB): Promise<string> {
  * unsigned and overwritten
  * @throws if there was an error during the unsign operation
  */
-export async function unsignApk (apkPath: string): Promise<boolean> {
+export async function unsignApk(apkPath: string): Promise<boolean> {
   const tmpRoot = await tempDir.openDir();
   const metaInfFolderName = 'META-INF';
   try {
@@ -422,4 +457,3 @@ export async function unsignApk (apkPath: string): Promise<boolean> {
 }
 
 // #endregion
-