Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Verifier: google_1p_code only checks the pre-March log, and cache cleanup never deletes

Geschlossen
  • Stimmt etwas nicht?
#19 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
50/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
go
Bereich
security

Rechercherichtung

Read internal/checkpoint/checkpoint.go and internal/tiles/reader.go, then reproduce the verifier case and the stale-cache case described in the issue. Verify google1p covers both checkpoint logs, cache cleanup removes old files from the target directory, and the large package_info.txt download completes within the configured timeout. The payload mentions no test file, so use the stated commands and examples for validation.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

google_1p_code fails every entry in the current log. The target in cmd/verifier/verifier.go points only at developers.google.com/android/binary_transparency/google1p, whose checkpoint has been at size 134 since 2026-03-30. The README lists https://www.gstatic.com/android/binary_transparency/google1p/jwt/2026/01/ as the latest shard. It's at 226 entries with none shared with the old log (192 Messages, 20 as.oss, 7 contactkeys, 7 safetycore). For example, this payload returns FAILURE: payload not verified in any log:

4bc401f3273c355a06b44cf4c0fc91e2943b8cb9b8685f0f2fda1eb409b4d7c5
SHA256(Signed Code Transparency JWT)
com.google.android.apps.messaging
322660063

It verifies after three changes: add gstatic.com/android/binary_transparency/google1p/jwt/0 to the origins in internal/checkpoint/checkpoint.go, add a target for the new base URL with the same key under that name, and use tileHeight: 8 for it (1 gets a 404 on tile/1/7/000.p/1). Keeping the old log as a fallback target, the way google_1p_apk does, would cover both. The google1p log_details page also still points at the old checkpoint and package_info.txt.

Cache cleanup never removes anything. In internal/tiles/reader.go:264 the loop lists targetDir but builds the path to remove as filepath.Join(abtCacheDir, entry.Name()), so os.Remove targets a file that doesn't exist. I put an image_info.txt_1000 dated January into <cache>/pixel/, ran --log_type=pixel to download image_info.txt_1109, and the old file was still there. For google_1p_apk each change in the 2026/01 tree size leaves another 210 MB package_info.txt_<size> behind.

Smaller: the 30 second Timeout on httpClient (reader.go:123) covers reading the body, so fetching the 210 MB package_info.txt needs about 56 Mbps. It failed with context deadline exceeded here while another download shared the link, and passed in 11 seconds without one.

Vorherrschende Sprache
Python
Sterne
19
Forks
6
Ø Merge
2 Std. 32 Min.
Gemergte PRs (30 T.)
17

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus android/android-binary-transparency

Alle Issues in android/android-binary-transparency

Ähnliche Issues

Weitere Issues zu Python

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.