RCS: consolidated Constellation/Asterism hardening for #2994 - #2
Open
Chess-Debug wants to merge 78 commits into
Open
Chess-Debug wants to merge 78 commits into
Chess-Debug wants to merge 78 commits into
Conversation
InstanceID failures could be suppressed into an empty string. The empty credential was then exposed as a successful getIidToken response, signed, and included in a GetVerifiedPhoneNumbers request. Propagate InstanceID failures to the existing error handlers and reject empty credentials before reading the FID, signing, building IIDTokenAuth, or executing GPNV. Regression tests cover exceptions, empty credentials, and the valid request path. PR microg#3388 handles IID failures in a different Constellation implementation. This change applies equivalent error semantics plus explicit empty-token and GPNV guards to the microg#3359 architecture.
A regenerated EC key was allowed to inherit the previous key's server acknowledgement. Validate stored key material before reading that state, and reset it atomically whenever key material is generated. Add instrumentation coverage for corrupt and valid stored key pairs.
Align DG cache naming and VM keys with stock GMS, preserve partial init replies, and fall back to phone number hints during Constellation provisioning.
Introduce shared phone-number and VM cache utilities, wire them into Constellation and DroidGuard, and add offline JUnit coverage for provisioning and tachyon-related logic.
…ctory hasAccount in NetworkHandleProxyFactory.createRequest() was hardcoded to false. This reads the value dynamically from AccountManager for 'com.google' accounts, incorporating a SecurityException fallback to false.
…nsent request semantics Incorporates two commits from keeltrace that fix the automatic-consent fallback in VerifyPhoneNumber.kt: - fix(constellation): align automatic RCS consent request - test(constellation): cover automatic RCS consent semantics Co-Authored-By: keeltrace <keeltrace@users.noreply.github.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Assemble the ordered PDU parts from a single SMS_RECEIVED broadcast before matching and buffering the logical message. Reject missing parts and keep the first available sender. Co-authored-by: Codex <codex@openai.com>
Cover multipart ordering, invalid or missing parts, and single-part/null-sender behavior. Co-authored-by: Codex <codex@openai.com>
Assemble ordered PDU parts from a single SMS_RECEIVED broadcast into one logical message before buffering and matching. Previously each PDU was treated as a separate ReceivedSms, so a challenge split across segments could never satisfy a pending match as one body. Also rejects empty broadcasts and broadcasts with any missing body part. Single-part behavior is unchanged. Co-authored-by: HumbleDrummer <HumbleDrummer@users.noreply.github.com>
Transplant the exact file contents from Anusha0501's naormeit#4 onto the current integrated RCS base 276523b without replacing the multipart MT-SMS work already present there. Original-Commit: d2a6b75 Source-PR: naormeit#4 Authorship/implementation credit: Anusha0501 This is a provenance-preserving integration commit, not a re-claim of the contributor's work.
Port only the non-overlapping KeelTrace hardening exercised by the private Foundragon validator: explicit signing failure, null-or-empty Gaia ID recovery, and the follow-up Gaia logging repair. Original-Commits: - b0db179 - 57e43af - 3aacca3 Source-PR: naormeit#6 Authorship/implementation credit: KeelTrace Consent commits from that PR are intentionally not re-imported because the Anusha integration already supplies the overlapping consent resolver path.
Use the pre-API-23 AccountManager.get(Context) accessor and declare GET_ACCOUNTS in the DroidGuard core manifest, matching the permission contract already used by Constellation. Preserve the existing SecurityException fail-closed behavior.
…ening Promotes the exact Foundragon RC1 delta validated in private CI. Preserves prior contributor provenance and keeps Samsung CompositeToken compatibility separate from Google Constellation IID semantics.
A duplicate mapOf key caused the later Messages entry to replace the earlier one at runtime. Consolidate the four intended flags under one key and retain a JVM regression proving the complete flag set.
Keep the RCS-only consent-version classification in one place so the fast-path and client guard cannot silently drift. This also classifies the Samsung unfreeze version as RCS-only without enabling it as a generic fast path, and adds regression coverage for the complete RCS-only set.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Public review/evidence PR for the final Foundragon RCS source tree intended for upstream microg/GmsCore microg#2994.
This branch builds on the existing microg#3784 integration line and preserves contributor attribution while adding consent fail-closed semantics, RCS_CONSENT fast-path support, signature invariants, AppCert/Spatula, TS.43 correctness, MT-SMS fallback, RPC timeout parity, Samsung CompositeToken regression coverage, DroidGuard minSdk/lint correctness, and the final pre-PR Phenotype duplicate-key fix.
The branch has also been merged with current upstream
microg/GmsCore@4c74e5acb79479004428be755547432294639878; the only source overlap wasPhenotypeService.kt, where upstream Translate flags and the validated RCS/Messages flags were both retained. The resulting PR is mergeable against current master.Final pre-PR verification catch
The final integration sweep caught a duplicate Google Messages key in
PhenotypeService.kt. KotlinmapOfuses last-write-wins semantics, so one Messages flag group silently replaced the other at runtime. A BEFORE regression reproduced the loss (2 visible flags instead of 4); the entries were consolidated and the same regression passed afterward.Fix commit:
0e089118b7c247d0e6ecf37703d76b7350d7e0ff.BEFORE -> AFTER verification run:
35118311199(SUCCESS).Final source verification
Pre-upstream-sync exact post-fix tree: run
35137092919Upstream-sync merge commit:
6c22d11f91943d22119b87cafa875ecf86ab6093Final exact validation head:
77932be0fa7fae8b1958be9515489342399fe9faFinal upstream-synced matrix: run
35140936359— SUCCESSAttribution
Carries forward the microg#3784 line and its credited contributors: @opstic, @br413, @camilo-12ch, @paulcakeface, @nwinkelman2 and the @naormeit integration line.
Follow-up source used here includes @Anusha0501 (
d2a6b75bbcd79b7aa59dbbaa74953b375fd287d4) and @keeltrace (b0db17953aa29bc54a6301f8c3578801588579b0,57e43afce69618549ca65e764d939f5647eb415d,3aacca36dd887c396ef4fd2b65037a645c107c03), while retaining existing multipart MT-SMS work and the AppCert/Spatula Binder approach documented by @juliushill42 on upstream microg#3784.Not claimed
Locked-bootloader/no-root Google Messages RCS E2E, real-carrier TS.43, and physical Samsung RCS E2E remain physical acceptance boundaries and are not represented as completed by CI.