xockoandClaude Opus 5.5
b7e43d7d61
- Bundle current root certificates (Let's Encrypt, GTS, Sectigo, DigiCert G2, Amazon, ...) missing from Android 2.x's store (Roots.java, tools/gen_roots.py) - Ask once for unknown certificates, showing the SHA-256 fingerprint, and remember the answer; replaces "accept any certificate" (Trust*, Settings) - Local streaming proxy so Android 2.x's MediaPlayer can play https:// servers, with seeking and a fresh token per request (StreamProxy.java) - Tests over real TLS with good, expired, wrong-host, forged and self-signed certificates (test/make_pki.sh, TrustTest.java) - README: server setup for a legacy TLS 1.0 port Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
53 lines
2.0 KiB
Python
53 lines
2.0 KiB
Python
"""Generates src/com/miniabs/Roots.java: modern RSA root certificates that Android 2.3's
|
|
built-in list lacks (Let's Encrypt, Google Trust Services, Sectigo/ZeroSSL, ...).
|
|
|
|
Only RSA roots: Android 2.x's TLS 1.0 can't use ECDSA certificates anyway.
|
|
Run: python3 tools/gen_roots.py /etc/ssl/certs
|
|
"""
|
|
import base64
|
|
import hashlib
|
|
import os
|
|
import re
|
|
import sys
|
|
|
|
CERT_DIR = sys.argv[1] if len(sys.argv) > 1 else "/etc/ssl/certs"
|
|
NAMES = [
|
|
"ISRG_Root_X1", # Let's Encrypt
|
|
"GTS_Root_R1", # Google Trust Services (also Cloudflare)
|
|
"USERTrust_RSA_Certification_Authority", # Sectigo, ZeroSSL
|
|
"DigiCert_Global_Root_G2",
|
|
"Amazon_Root_CA_1",
|
|
"Microsoft_RSA_Root_Certificate_Authority_2017",
|
|
"SSL.com_Root_Certification_Authority_RSA",
|
|
"Buypass_Class_2_Root_CA",
|
|
"HARICA_TLS_RSA_Root_CA_2021",
|
|
"Certum_Trusted_Network_CA",
|
|
"Go_Daddy_Root_Certificate_Authority_-_G2",
|
|
"Starfield_Root_Certificate_Authority_-_G2",
|
|
]
|
|
|
|
out = []
|
|
for n in NAMES:
|
|
pem = open(os.path.join(CERT_DIR, n + ".pem")).read()
|
|
b64 = "".join(re.search(r"-----BEGIN CERTIFICATE-----(.*?)-----END CERTIFICATE-----", pem, re.S).group(1).split())
|
|
der = base64.b64decode(b64)
|
|
out.append((n, b64, hashlib.sha256(der).hexdigest()))
|
|
|
|
lines = [
|
|
"package com.miniabs;",
|
|
"",
|
|
"/** Generated by tools/gen_roots.py from the system CA store. Do not edit. */",
|
|
"final class Roots {",
|
|
" private Roots() {",
|
|
" }",
|
|
"",
|
|
" static final String[] DER_BASE64 = {",
|
|
]
|
|
for n, b64, sha in out:
|
|
lines.append(" // %s sha256=%s" % (n, sha))
|
|
chunks = [b64[i:i + 100] for i in range(0, len(b64), 100)]
|
|
lines.append(" " + "\n + ".join('"%s"' % c for c in chunks) + ",")
|
|
lines += [" };", "}", ""]
|
|
open(os.path.join(os.path.dirname(__file__), "..", "src", "com", "miniabs", "Roots.java"), "w").write("\n".join(lines))
|
|
print("%d roots written" % len(out))
|