JMR-dev
700ce071ae
Advances the client (app-repo) slice of the debug-report ingest pipeline: the existing opt-in ReportUploadWorker now runs a best-effort PII anonymization pass and seals each report with end-to-end (envelope) encryption to a maintainer public key BEFORE it leaves the device, and fails closed if it cannot. - ReportAnonymizer: pre-upload redaction of the free-text comment + log lines (emails, host:port, IPv4, JWTs, Bearer/Basic, key=value secrets). Re-scrubs the stack trace. Deliberately retains the user-supplied reply-to email (#159). - ReportPayloadEncryptor / HybridReportPayloadEncryptor: AES-256-GCM content key wrapped with RSA-OAEP-SHA256 to a public key; JSON envelope. JCA only, no new dependency, no GMS -> F-Droid-safe. Public key from BuildConfig DEBUG_REPORT_PUBLIC_KEY (empty default); private key stays with the maintainer. - ReportUploadWorker fails closed: uploads only when an endpoint AND a usable encryption key are configured; never transmits plaintext. PII-free AppLog at the anonymize/encrypt/upload lifecycle points. - Does NOT put R2/S3 credentials or SigV4 signing in the app (would violate the F-Droid + secrets-never-in-app constraints); the app POSTs the encrypted envelope to the ingest Worker, which holds the R2 secrets server-side (#11/#34). - Unit tests for anonymization, encryption round-trip, and the worker paths (success/retry/failure, fail-closed). docs/debug-report-privacy.md documents the data flow, anonymization, encryption scheme, and key custody (for #16/#20). Closes #34
26 lines
1.6 KiB
Plaintext
26 lines
1.6 KiB
Plaintext
# Copy this file to `secrets.properties` (which is git-ignored) and fill in the values you need.
|
|
# Every value below is optional — the build works with the defaults when this file is absent.
|
|
#
|
|
# Optional: Microsoft (Outlook) OAuth public client id. A working default ships with the build;
|
|
# set this only to use your own Azure app registration.
|
|
#OUTLOOK_OAUTH_CLIENT_ID=
|
|
|
|
# Optional: release signing. When these are set, release builds are signed with this keystore;
|
|
# otherwise they fall back to the debug key (installable for testing, but not publishable).
|
|
#RELEASE_STORE_FILE=/absolute/path/to/release.keystore
|
|
#RELEASE_STORE_PASSWORD=
|
|
#RELEASE_KEY_ALIAS=
|
|
#RELEASE_KEY_PASSWORD=
|
|
|
|
# Optional: debug-report ingest (issue #34). The debug reporter is strictly opt-in and transmits ONLY
|
|
# when the user taps Submit AND BOTH values below are set; leave them unset for a build that can never
|
|
# phone home. See docs/debug-report-privacy.md for the data flow, anonymization, and encryption scheme.
|
|
# DEBUG_REPORT_ENDPOINT HTTPS URL of the ingest Worker (separate server infrastructure, not this repo).
|
|
# DEBUG_REPORT_PUBLIC_KEY Single-line Base64 X.509/SPKI RSA public key. The app seals each report to
|
|
# it before upload; only the holder of the matching private key (the
|
|
# maintainer, never shipped in the app) can decrypt it. Generate with, e.g.:
|
|
# openssl genrsa -out report_key.pem 4096
|
|
# openssl rsa -in report_key.pem -pubout -outform DER | base64 -w0
|
|
#DEBUG_REPORT_ENDPOINT=
|
|
#DEBUG_REPORT_PUBLIC_KEY=
|