From 09d793d9cf1c1b9fd5240b1837ff78c337ffc812 Mon Sep 17 00:00:00 2001 From: Lucas Leblow Date: Mon, 25 Sep 2023 08:36:14 -0600 Subject: [PATCH 1/2] Backport .github changes from develop --- .github/dependabot.yml | 108 ++++++++++++++++++ .github/pull_request_template.md | 5 + .github/secrets/CI.mobileprovision.gpg | Bin 7821 -> 0 bytes .github/secrets/Certificates.p12.gpg | Bin 3272 -> 3303 bytes .github/secrets/decrypt_secrets.sh | 4 +- ...ppStore_comquietmobile.mobileprovision.gpg | Bin 0 -> 7879 bytes .github/workflows/build-release.yml | 4 +- .github/workflows/codeql.yml | 73 ++++++++++++ .github/workflows/depencency-review.yml | 22 ++++ .github/workflows/deploy-android.yaml | 18 ++- .github/workflows/e2e-linux.yml | 26 ++--- .github/workflows/e2e-win.yml | 2 + 12 files changed, 235 insertions(+), 27 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/pull_request_template.md delete mode 100644 .github/secrets/CI.mobileprovision.gpg create mode 100644 .github/secrets/match_AppStore_comquietmobile.mobileprovision.gpg create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/depencency-review.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..3ffaa8c891 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,108 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + + - package-ecosystem: docker + directory: /3rd-party/tor + schedule: + interval: weekly + + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + + - package-ecosystem: npm + directory: /packages/backend-bundle + schedule: + interval: weekly + + - package-ecosystem: docker + directory: /packages/backend + schedule: + interval: weekly + + - package-ecosystem: npm + directory: /packages/backend + schedule: + interval: weekly + + - package-ecosystem: npm + directory: /packages/common + schedule: + interval: weekly + + - package-ecosystem: npm + directory: /packages/desktop + schedule: + interval: weekly + + - package-ecosystem: docker + directory: /packages/e2e-tests/docker + schedule: + interval: weekly + + - package-ecosystem: npm + directory: /packages/e2e-tests + schedule: + interval: weekly + + - package-ecosystem: npm + directory: /packages/eslint-config-custom + schedule: + interval: weekly + + - package-ecosystem: npm + directory: /packages/identity + schedule: + interval: weekly + + # Currently, the integration tests pkg is waiting for a clean up. + # @SEE: https://github.com/TryQuiet/quiet/pull/1734#discussion_r1302831794 + # - package-ecosystem: docker + # directory: /packages/integration-tests + # schedule: + # interval: weekly + + # - package-ecosystem: npm + # directory: /packages/integration-tests + # schedule: + # interval: weekly + + - package-ecosystem: npm + directory: /packages/logger + schedule: + interval: weekly + + - package-ecosystem: bundler + directory: /packages/mobile + schedule: + interval: weekly + + - package-ecosystem: docker + directory: /packages/mobile/android-environment + schedule: + interval: weekly + + - package-ecosystem: npm + directory: /packages/mobile/nodejs-modules/builtin_modules/rn-bridge + schedule: + interval: weekly + + - package-ecosystem: npm + directory: /packages/mobile + schedule: + interval: weekly + + - package-ecosystem: npm + directory: /packages/state-manager + schedule: + interval: weekly + + - package-ecosystem: npm + directory: /packages/types + schedule: + interval: weekly \ No newline at end of file diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000000..1087841c9b --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,5 @@ + +### Pull Request Checklist + +- [ ] I have linked this PR to related GitHub issue. +- [ ] I have updated the CHANGELOG.md file with relevant changes (the file is located at the root of monorepo). \ No newline at end of file diff --git a/.github/secrets/CI.mobileprovision.gpg b/.github/secrets/CI.mobileprovision.gpg deleted file mode 100644 index fa7e8e7346fccd05f8de9cd75f0c2634626a78e4..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 7821 zcmV;89&+J~4Fm}T0>AJ)X2SG#?ex;>0WaYyycMQ`x#l}2B(tDgRZ&(} z_IjN$Wnep%ODMlKlxi+RvONw|tR@D2O^AqXYpicRV?nGeay+nG@c9xo{G&B4aE5tk zGP6w*(zT+*cOm5u8v*+rQJC98Rp5U}Kl=g}qac4(eEsLDb~KUWD=B8>``AiQ+>R#K z3}7fs+8jVP{S}+(|C|=deE>ZS=$(KtmXU8RO;zpL@Z+W`y+OxNpZoM7cBnfXG}Rt~ z#=l`0Mc_YuvJ^tvMo4aCZcYX0vA>#`In2G1He`MqU&_SWiO!!O=abux>r&TZ$aSb( zd3mBXM{y0V@?{mCa`X!ma&RgR%K z;Y!q6RJAI=RAc1Tj_e(SmBcQ|=hwXfIfVrTx`df05BYA(zxe)MJ-zdYj~S+gHUcVx zR*nvFkSJwYh^bBO;)j;YtMoOY1`R7g_5)73|8?B1=}kiEm*@zPe`|JSG!IzHjwwF}dNM z07LMaC@V3r>W4q^)-tW9lgnyKmL|Ed)8I<+t{!}m=H zCQOg{e_8s=Tr2ErXx5i<(<5&BkxFIjr`4l>CvotMvPYheSu{(~~3`e#|5fq{Aj&OAX^c2a`XP0zYOZM+1ZRTTfo_vJS9{ zF(r;AHTCX>;Pq%iD`*M4DOT7TECCUt!TXEJvb_n%WEBIA-~hbbYUo~!a4Z3+p+UsC z%6x0)UQsVjp(#dJJ(7x4ERCIN+5ydgaStY}ApSH!M~<#Y`(;IMwH1ZKH+vfA{dk-H zs98$*#Ia2Cq~1dAAyE~k^Nw;J+*lHY5vVQ{i7J%+}Q5#J**B^`y02$usq+X}+3Fs!WS-WrVS58KrR z+AvvYaq?j3u>Ll&iOXb})&X`(YZDlSG4=K(e`O4iRSHatVO3{{x(s!6fl{ROS?VO> z0jkoMgN|vT4ciCdR9%u4mA#_Uzin0Fedr4!{CbOH7RGC#YH>KPAcZj$+|$BN!Q7Xo z0JCTtL2Uzsnr-zWXR!w-Bemt_u+JnjlFhlx#rj(Z`hW->8mS)1+cXidw7qv0)9cKg zVKs%A*fc&jqh(14@-wqGVit*H81W}ww= zi(=9J?D*KmC{H=|rDFe-+&-!UjBwtDBpJ5kD^-=HPy0{VeX}Y{? zp7GXhW_DPIrY4Rx3ku>uFv6pXktL$%Vmh!HMQh$`mXfGBL}Bs}TYIJ;4>|eA25W&H z=pcaM-zAfyoG-VS^kJ`ks&mfaU9}sAUCQ^jbBXYU|38qPF6D>nU0o0P2TVNS*M!Nv z7T+Dg>4>5!jcUK{$P}Lugt*_|98@B&>^!p|6Jhz9A}+~`0=<1%+dv7x(9$YW zz-k>rt>tgBrAGv?!dKT~@SRka1-TWjP>-M&KSb*k3QjZm0*{SILnzl`f9$mH*z8$% zv4A0x5*4|--O6$u9N7CrEWZdB*byYvkb)2D&Zff3%~pTpgNNTbEFVr^w1g{-1Q?f* zCS@_D^ALwStI%~(1-bJ#c*3b7u~r^>)VsoGq<9fh^Lw)$C1y6B`g6uwAC8wZG-U;G z&VQJQJ+b5$NJI)Kc`!!h7|+!9mwIQ|5rM!U1O`EWIhy^NU6pyZ1CZ>8rC8f9?Sajt z_xdQta{=Hy!0}3+9E>aj6iU3zolu%)Z4a=FrEYSc%Qod}aCdb^D4J;Hwe4g}J>?T7 zvfw|TGa*?WHhAhZ7>gK>VExoL#ieotpexAhIL;UGN}2`<-VR4g&awX z+SN?yf|9#5&P>r;QD`};cpa>>j2Me5l!GcJuqu8gslake(E+U}I9g8;eymN8@d{kQ zvw4dF+GD9c8@nW~WTvx1!QnCwILj1k)wd~5?lm#&WN)x^Cy(@;`6!E$;)M^eJ<5_? z@GCoy6g76zX5N}yP?i&{*&j@7*|9CJxGDjWwMx8!kR7@}Ibxf&VN1{RQN43b8i{S_%IoPW_)`&-V z9~M_mwh&!9uP1}lqE5m1M#swGYrG+TQm<0t5Q1QP@Ku^YIsRq&Nrv z2SBv}Wdv2c_PXJF+jc!Gty|~8fjbe#qH)0^04u`z(xx6XE6Wf@D<=Z{w!`QGd;81u zN-6!ZpfZZq2INksSbe1@yXy`iE)k<8E)EdVOOOKm@rTrN)oK&d9au6#YbECQ1(QGL zUYE0@jB~A}VwjJ3>aN``E3D-OIQE{I6IGO+6vEL=c=%@*>1i}3)_Ubf{8#mZllUMf zEe`p5$tOEzNT7ZhPMf5m#F=y$pYQiVDYY7(=ZYn3@u>=O=yQzvw*`DcTeMiemB?dP zn&PC@vo!wZCT$#FYz9mWGhWdfq>FeU)I$nqT&GQdxq$pRy_M{7uIO=3FdY5w)^g8S zE*9A^QpmN7^XfUshks+3u~Vb?!Xc)ki#m^SJSw{R9`#ylnc?OV4M57Ry5aU!E7{2Q z;=9UukhKq|>EA6NCE`CbbHzEG9lKBACy0csaj3|}#k%pX2-|Pa1q=B`z69C<)%xE6`Z>kYt_!Tx^!G2LF4o?& zH!Diz3B`rGNc|^+4Q$trby|1ybKV9+3W$xlh6IX#RH`T50XoOl<;p>87v(8&o)4H( zfn5UBrrs0C9nhAM(uH1ot-}hen@oj$lOyf~-eInEsyIykSjnEBmQMBW*~ z;pUS_gvA^%w@h*)5wsl}pi^_aUFX3E=|GK_a%_h4TtcU*khy~FRsGIRkyH{9S(0XQ zs>c9YRz`?*Y!7o-WZL-#!GsGB)XZ}5m_C6@JRa)j;t|SsQa!GH%%`zaK&iaK^+lOIVU_fv{Aem_X8PNbTB5 zM~bT75gJWil8CE@!5nawpeopoD02D4CGlTMiyuZ^>rwTLhNzj=x7;v8DS!_YMVtZp*fBs)mTTkf4SzZy+*Fp zCvr)hn}e&i&Caa;7Io?d0Pj;q2vX{EiqO1AtMjc}v3sZqb_!OPUX`iiCOZ9gOJKG$yfj4mq54dtp5>|J_o}d4dvS;C{zKacB!+S$n*`*m; z#^_NwDgUC2ZnWxEfH#{Qj>F8>N>!i6Jg|e4Y-Z_Ce ziE-4a@*M;va;_YVf4@NYGjc-ZBU-7@SXb}E`G7grzc0={q&QA#8!g#vG|Ct(y=b+V zY7tA``$wkx&?QN&#o{GTXf?EZ9bRND=r(}UoH_1k6B*NLjoiRbjmBdOKpxH37Dt@b zj4Y0aP4QwmK0U}5l<}>+knA=h|8oHIM9`v1f+?1+&DH07r*iu)@bUQCA(DL%D^({UB+?j(4NJJ=J3# zCJS|Da=b8+_xQ%O`tYED|E?0*3A1eBJ&wgIllRaw(ocA}tXIf};?mJ&5{q3EUrT4b zzWj@MAVz9ptaqE-He>Z#<(A%1X8A}Lgm%3QMssa#v0+fk;Canix%{4m@PAj`7^IH8 zt=c!)#X4j0M98Q)Knrk&rc|5tKYpF}#SH<$eFGxQ`Va>rpokEfuJcbrd4LTOXNiN0 z_y0`gqSVUMAhA#m;-U{~M1z53&Dk_6n=}IZJ_pLWVP+m@a&wdZv%rWx^ zk;k{`RB>I*)r^YX)5e4~T{p;??b2jV0eNQV2mR=HN&gm>9}yC>5~chUT~dMVN9Hda zPaO}dM9kqMEJDqGO?ji#Sxr4%YB%fZ0|bYzl=xeysIi`e6d{d=z@M^u*Ae1bW9%Kg zzQ)e+4cso5Mqcx+Xb|a^WbeIdvK{0r^X7VLf9@}51zR~s5LAaS@7~dVZFIo`-ipyd zbq>QB#3|P)!^=1Gsd&Zh^%B6?qLS%`mxydcjO*o`Hhr5=0qSIB60~u?Eve3Vy#EPs zQHF-b(_OGqV`^7d6c|WR-?NcyA>R=d@b)j3Ut~;(1S0u}64!ytduv6=^PG@n|Nc8c zheXV7a!(MxGClGWP=au|J+KPhA*?6eb620F>wOc_=PfLps>yxKm7Hz4o2FOjH=8aa z_43-f@&#V8VC+Wwc_U0xWbOQdo6h!jKUXG{e7u=4m*V7*+1o&G49XixBvKLmVSn27 zHjO&ZGpST`3K4EY#QBgU1w&BS8(lMY0GDZRi$g~K-yed+MDD3LGY>v8AJM%#H&_QCaSTA!_y9q`*AAo|*^Q5~q2BZWE~V-`N=s=kzFx=*OuI|>Nk-IcprX{f*zwS2)Ww*f$Kq_y~> ztBW+J_ZkxUjG&FbfaS7n23v-P8eE!<3mGuR$guym|M}bh!P!yGA6@E3+?^9?|y+CgOtg`jfX7?iSA!zvpE3k#j)>wWqXXQ z*7o-q;MU^qL;yKRLw*{3u%q^xT{VjcD3C1XU9OE$6x*4@b#UIGM4iW)T%^YgR=ood zD2j=XvM8YPbub}j056D>0iGztUTau--BGX0V-DiwX9HrKbWjo0O&cT!b4$gx_<@rT zKeqf=AL7CY9>tm)hH0K!slEX`(I8g#t*9BMY-`4nvS`_C+ypNxCU!vE`bM3G6t}9$ zt|rKLourAxbxOW0FGu#^GY^+UKI#1r8#g>C5tK+!SLQ zAy)%1^Uw?klCscBEGF$-GDy9y| z<40a1v8ZoD4+Bb5uq%Z3ZieI7>COLrYOeQ z4EkbI0Glepci9KAEsk_lYP3eHQL9TWQYbKoW%MaZ9>Fap;&6;v$$yFUdlt3QojcL6N4pVTu zFmUb`-waFplBhAuG)Omr@P?ePIp+6bpPPThnrq`=)vQzQh#sF_Vwd4F{P0^>ZrFMv zo+{@mE1@4=?sr+s(L`w?)yk-0!cn{+MFt&Ms_xZfo&$px5}!8T1EFSp^-cOH zWi*epsxW##Z2ONTdHB1Fq5SUxGr4};xJ?X`#%NN6Fd6ECJP@Zk&&5F<#7LEwB%gO_ zuQCfp+48~%m3q)PbFNX%;M)ox08Z1y@7n+)&I9*&6TDAUu$^2d@dydHNs2bLr)y@U zHLx<<3puqofXYoQWZc-}BPr=a)l)LS(2`uIt%oCn&f89H>h4LX>ibe2)v8f8IED&h zFm$mG1UlB`P3j(O5q%@jQdVHLhXQrC6L8C)shv*Cnge)cC$;IW^{=yYwPs0Ra9j}{ zDCJq$_V3}gH6?q3s8lcFaZ}?uAAOOd z*_8~HJnxh*4IIkrC|{KND$L$->6)pzM|3zWBvV4qh}egTwRByYorLlDU{r|r1Ed?l zE0xCPwI(K}YtVvgq}<+LX2u-OL(bw)G5(yg<5&w;IJ^9E&lyEpO^Hc{*mj>Q9cB{& zQq`t;=`HBkhQ9D929a=R>oGyBJ-EX=qq>tgMDx~JX_Nni*sa88H7r02e6Ld)Y^$NX z3fbq9395MV5qX8mJhfm|15U7C4vcDO&;I@hEXYw62eJtBYs)~e4<@Nd0C@RW;dVMP z?Ot<~%s3x6?00JDSfq>~aB@W$%2#T3F%WM}z;Z2&G{2{<* z*`Wx0`$01HYdZs)q#AuhLLNChcE-v!iSOcNSCw_EVCY{++X919RKfDMkd5IU*OFNk zf^Z@p1!_1R*N`miYY=i=iGic_F+m@QH8vdg^|g3{+0byJNmQ*m;I)dGha}Lmwk@3~N|@+ckqQZAj!tDK1Ye>^OQ#rm>yD zGZXY>Le=1*=xqy<_^Yq#Lp>@&Nl@mCkh$Y~#&jZv91#jska+eI3Q}>qbs_`f~6cNs&(d%rmb;HSZk(Itp#BcT<;W zQq>Mqa?@;{wXKh!WmR5wg} z2l-u8xW{E<_Q3Mn5+Nx^Z#)_ov~AA4ZH0TSpR___Jb#31k*WU~7RKn-WNk>le4Dzr zE|jSPSdsA+E!6!{??LPmATVH(}L zNlFa>wdTe#sn-%zG-<^%hjqIRtQSnas^4sWn9d}vt!QR5R4EeA+3cB>(-6;ai2Uc; ztGN2W55XeZdvA&-rxu#RSbGSWATX$%YB!3326YMc4c$sDiHBK@;F@h*5Yu(H7n9F~g5t}w^FhI%i0Tz> z&mH)1LJ4NthC~l_3cntffddN9kSt1BM8}>f$@HI0Y$C{joO-_t`u=O&iC<;~t7T5V zU}rqQRKoN3n;nbacT;{a5QwVhh#loN+ySke_038(2*eNRKw5@(GWXXBPm-XSXD_Al za}c2MD0Pg!%~15;=jEInV{0CG5F0PAgL8t`3OBAdZ`0+QIeG+GOi8RqKxz&s0<}D< fM7Jfo_4Fm}T2+mG0`@#B1ZSvCU0j;4=Gck3;I>M)DatarwvsU~X;FQ}DOzH!U zo?U?V|Kk;3STs~|`r*4j6tV6Pma*uRnEhDk(?}J7P@)h)hRtCdx|7}1VP9MMSs8Vc z|1JdUZWw;HUroh^8a29mcKGhV8c|Z16npUptlCaV##K^?06J};Z0R5pvHV^^hEV_~ z;SCh^bn+&A@H9$NF??WtYos`*f(;K$i>$Gv#Lv$MM~ofE0j5$RyZA9*uN-p2B3|Hc z^hO-Hz<4;(7@DX4DX!?BEl|kSYl$sC@65 z>1%=?C;ECx`hNvlvP-Rdgayv2med9M)|6t=9Xwq&tuK${0O({=cBU6wml46b(wdyW z2Vu%QHxvka338tdB*cE&B?w!L&-4l$7jNAkj75hCmxC*NVSml77DldRH)~m=Otk|g zFWkwnA!!G;?C619T3@g@@6mrQytW~Q3X~@w_ZpxN>hDFcrVF6leo}WH`Z_CD;!xd` zYycLjd~VZ=8tOE6%-Zz^c5$(k=L_h7ej+EAhl&eYG(lHo?q%gjsGvQd%iiNtNG8M_ z`lPzs(XynX^TO9VMc^rGB096!`%9S|NUE0H1%}WpZULh$%2==*S4m^+JopAE#3rAM z!8rmSwKE{Ubz;b z%wA_^EcCTpmXU3prE?!~Di)pAZCcw2krluqv$z3sAS(3M~NU#JUEiKd8w+sjIVPK7Xfam>e(Y z!a=m5lLYg(h9Ed)*M^^m?+$-xfXeBZwF!iSTUg(q%$tp6X5_MR`!JN@gjMiDq*S++ zr@)DVR}c-f$cBTnd|@)_suUe!n*6IJr4}kmHK0l!Z{zZEWq@IjFbi@{CflWTvaK3h zgu@U>4hL9u6$6W1NYgPgJGfPw2wwsQg_4ZKcK{Om0H&PHTEc&)VR*oqz%1DAE=S&G zo~hC}`-xTxjXVw1j)Rd|s^Nl?$|*!6@i&SR7G@NLZ+<+V6YDTc`P)qhYYv}D=nzfu zNp)y6!j$<(>V%XB!e0q)PIVMbLe~pJC1--9;Ryf)RK}Kl2R3maIR-7DUFq=-vm!)FDBAYK zN!?$*9rz>Ca%$j(a7IBQ#m6okDBSBt2w4!UIc$$b`pZ-$s7l;4@dvICUdk#38TeH3 zV~2RYf##U;C~u9Mm7_mLEd$Oao5$cRv`p#^cU%{n^#wtOKgGtHdm^_3$lKpiFXs3Y zS|h$FHM+9jKj`dU3;ooe! ziVyv}_;_?IH6wm5@se$+B%EB+SLYvTh;2b4t?oiuh2V?pMy_Z5WVT8o>Zmrx))>PR zRry&#jh4Q6sBS}AcwQA^oub@JCOc+Z?8 zlQN(~lOl4XChsr`qFJ}^NbX8LT26!3lOHwqC88FIl~k_WE;y9hub~oc0hnr!Eao32 z%bMzLDuGTBUF_Y%tWm~3B7y$%N~(npS&#d7WU)rk?mPF@+Yi7ciKan)s}3nMeI$fU zkw`MeT$QGtx^iy+4Ywp_`=VBGn;9d+bDsd$-!%B1Rlu9FkMfefw|r%y;J%*abapeM zc5?#+s@|7JmjZYCQGd(KK|1h46au&(l_zVcsQ~?yiE6{pe+|xw-OzYGP$8C-m0UzCq zf_ujY)|cg{0FevoLQ~)lN3n;~k>pO(&!hbMg^fy)Kf2q$(?Gko;S~N#=He6$$ za*%ccsymBq{>RikQO$t-C;$kJh~QkaZ0>_U3870A=8Rs-ISkRn0xvmmd%8{YPwai7 z+;zP_b;y>bK&V`itM74Sx^BC1BqntO`5VuZOH7*j^p1!(tVy)4juMh2?WOSD6&T%< zxz6-I#)?h3fM*?}JWU`!n`;v!r~RG5v^`M02+GJfX6DO@LY+i>gz7mg=IWQTiaX?t zNZ5TYirPzQ)yJAtbc@@-pGS?fjH{dJM;~%fC%dOFZ_%U}4$h;z7N0w`cOgonE!eb2 zZkaLrjK*W-r++SB96ljTs5a*WY6>%Xtx4C6^Zy5O+^HmZ3TxIV?2N2JEG~a{0bp7} zE!B@`Pih|d5vY;jjr)f3y?faL*8+6l~(@ZAkCO{m-Ya=_> zQuLhWrk#ceAW+ksO;4CIpX*nrlwt7E^b8Xu7t0*HM09Q(*K+R^2?Dv)N3I>ah~YIbUdzL%EU?EB!Zqp9jJ_@Kq(Y4^-3$@bB{Wd>QQZGnb7`B~UxQC? zUzb8Kon{P(ORAn3Ne7Um8@w%smb?+b+f{<{fn~ZNCSuOvaD#{OY(RFI&9a9**wPcc zXgv+GP0iA0u0h+H#r_=uV+}r(N*XH~JerelE0DA3*Cj*&0o>sa>W%JF{^e5oZb*1=-K^%$QmfKCf%Mtsk2kjD*8C;3dnq%mUGh^1xoTOA6W2KV zKHpSJZMivxV;KyiT;>E?f%0k&nUGuY9QMMNH^H%vC5bF~K2d*`=#Fq&3K)@3048lX zeTqsPH4+zJx0%ih*lLLBzIkU=$cRNzoG-d!)=*I>H&``-tFa%gJIlsn-Zh_S)gP?QKLvF)`&6*dA2&Tgy=Z|&inG}wo5iJN9D zRR;~jl`ZAC__JUOywESdlP&P-`1H~I?DV7`hyuV8$)|}J@U~)xj2_cPXpP;Jd(Q z%}N7dw+v~xr+SC4M3bv9XW0ZNp9{VqXUyc`2>7fyWC_7K>zhG;GovtK6^K5U^BfK9 lL)f|Ir@nmCJG)u6IVqx|iTi!^f+>2zQg{GzZo*>^+A)_uQVak9 literal 3272 zcmV;(3^((P4Fm}T0&lgvSBW0vY4pG=b&ylC?B}Q5jM1ikg>6qiHPOhqjq8`AG<()&GOU2i;{@N9O z?g)`~GAgN7tYXXuasXhO)+4;$iIj@fBzC=F2|iAKq~o&lNNdHpTmErU9c68<9Eeuy zGt19;&n>d7vU=co^-T|IR+qd_VNQG-r9@?H5L;1G7{C5!B8b<~v<26b4&_W`)ARIe zZJ*B;AFz8m!tY>jvC33AJGg;o zRO-6S*uL8l)Z3P*Z!oM|h}HwN<#y(odIAst&|YV1RKj#0;mOeMphT`ksCu;6ngucR z0@ppdCNXV(MZ`CHaZl6rh}g{IwsYhHcLhT-PM;hx8DnU zKg(H41rx)j9GcH<50#NAyd9r^P_ zB?i~mPz`68Ul%#*f zFxnA~qC4Fn5V2^hSu(#qt9NOSm?>iI`;i=pSPVsikHXl?nOh#*n1g5=&K56k5}~O_ z6)5|Z3dSYkyoAo7V|d*qjyP96paFhd7E1YT5+8)tK+{2NvEZS@)t~ETI%@0(Kn9F{ zH)1>~Kd(v)s|4P)D%H_>AU$`)-tEM+#%JvR(Y&Z~;oTqvhc=b@qlfBfO2mZLT6Ohz z3;pL$R3(1D$^8jmO^vFe$WF^@A1DAK$zD4mJ)n+w{yRvFLCI#T0-7(pm4L7gZOF2ns|m7uqosUR;zF?~l8 zc1EByn4abI?Lk(HICK3tywYyDD1aZDjs{a2 zz=4QUi+~=DZnY)UHHDFLGTEJF!jaN*fTq~uu zq-hm_W(m)iWFlw zz2FNeR*@9UM9mrN?^_vF#<~+!52mT8ky8>JRr}9>%{~=}9b~=g31(gRX@08%^!=~7 zYLAf=xRDwK@%od;lvwBpYk6`2lUfaluR;A4a1zZFIN?%S${xiYQjDg?s>5 zvp5)hNNI8X(Eu8sy1a6FFdyK0Yow!>>)sLYHDpf)*Wthfbyu-|Vy^5*ehy9AR z+e5z(`Yrgt3;|v{eLIb!ZkbZq0ma$%n;v8rI~g3@%6IUW8wI^FeV#$f4$PuP4+5*5 zSL)lB{ut2tT+2?4nfUX>jifx7;v}xC7sr?MVAd2dZ>h3rEcCcf21`Y3XR*4UvPjn8 zuu(qTn1PQN4`Il1qp7a`Jk%Sv9Xgr^n-QNPKHVH;8TP>vQ9*zepzIZwDr)Q1;1S(N zJ*>;#?d!z`^aP0Z7G<-X<|v9^x&H-9z>_Z1!;-75E`1?sGoM`DhDyH0J^@up4qqr( zJtCS@8b(x4W&5nutLx#8WFZ6Vp4gU>_Jj6fOWK0To!>*!aSIG9T+!|a>#~5KqdscIUh1VUK5)Qq zqpn(Fc{L}WwUO5zcX2HQiYq*AGI-pQ;tPyCdwJM=Im0T!!N`>`U-HhPg-Q|oj7C-R z*6Z}l?NZbEiV6R>ba40f#B)POyHF!sF*`)eJc>5VeKU<#jaN#VzE8D`~Em#PtY|Z zz1Avt{fQub+B0)d!D(?HuOX{Nk?+C5Hrhe^GH!WkHvAfp(7hII!kyBdw6T=O9mfl$ zsrmfiq`5X+J@R#P<>x6DU zD3*pySm=&)oxI`!_po?vPYY>yCfXRNOt`1Zx@9-*_WpC z^dLO%m~m96)ABt!+FwiM(2^tVG7A6KgwXCmSn3BAU4wCm#A-7ZidWWYAQXd%IZ#0EQvJQ21uobw8 z-2$5wAIqqa@)8LK$*h7=Y_pivAw3xdi*E>rxj{`?ew>drPWX$Cu@;7`P<1i>9>VlK zIId;hw)w%!i57)F~dN10nX16H%Lsb8Kaz*8BpF6{i zZ#kYIU1pQN46S>@?!(0b0vl1t9A+WFFnP z57dgWhlop&wLaUQb6`o5sXVBQ`gIQg|%JM_N`mrm3D>}j;L7h>8W44!w3;JQ zbdER_)d-sIN2w<{6=|sbC4i&UFrD((Un$-4Nr%9)!v}iv`9}v@FzB_j!9kO0P6_XZ zts(v=8J2N;yM$G^UU?th1!(^!c?n*groOjroZELB7YzW(_4WA_fBL&f4LlyPy;IMt z=HAH&-hYreLWtKLiMAA$o_!qVrOKNNSiMvACMBkD`_1unW^-ZVe#$?kwSMb( zJ$qS59}g(~w{ZMx=Yx#n`OJ9bKRd>C@~G=U&uP3Lr6K-P#sB$+p{Z0kyN$QpuM??% zH^Bdvt}q5X7JyhhC|TP^3(L)MR$ZPz%?lE4XFs1q^)kUDRs7ID4yN6j*M0Dgebk?gs4xvG(R&B1+?#Ns? zoQOhtUe8gUz#viv;BoJl6+ohjP;MYAX<&hGOUvtuFRG%@V22Z+plFntq;SKEFx=$Q zwBveric`}HZc%q$NX{CZ+7`oaY zyUZlk9{3R;{J$;Nrc~DvY&`FHp^(1U5io~-eSXfnOr=dHhHUo-w5>*KR|&lc7ImTN z+i)JMWWS1dwHEszn8%G;D9U-x>Ly{B|LL#EymLn@MauWmI(PIRghq_9n>fixkwCIn za10DiL6rx8DIq~R(Pgn;jL_?#Q1-WZQA^AqOvwU4^o61QtbyI()L&r{jZ~awOm1NH zsLyW)4b_VXtpQegS>8LoC)Ure-?L`<5Y6PLPnYDiaN4-4Y-8d>PvksX4a4|)+@FofV21YUAU4HWWAXTBCSafRa+@GXrXrJ#^aKnU7*y*yJdKfMaGtEkmnW7s z$OnJKkLpy-ky(_)6VNEx$uGt;`>;XRp^@I$stJx*=m=f8)+81Non8nE)H}m?{$_F( zn$@2xV78HUWE&fq9HeG*Y5#JZmqw{s%XZa0r%F@$I7COGeW}}=b24ZUU&Z3{e{y0K zPpl{G^i={668r}kYWKu9Y1%0)vCqw0$U-U`$_-HB%G+LU02Mqlxrq@n`6zS z+c_=}41^Ymdt4ROr~QjkgYjdj#X^XUYFwn=`Q93d9te(f#6fBAzii(o@0G z@6qxm(*E9-6fJ2Y?W@R>)=hi_&%pKn-$g}gYdq-Y!+Lt#8!o4tOGIAf{>#2|z&Gu6 z?1lDo zOV?DcF}IVUwQaZ}i30^60W3#(ne!G$d-nn(KW_<~7_}@WltM$h>Y34$v(wl75%@}$ zz?2~I&t!>1uuCb7hZ(kJ7i~hDAB#;T2T5i$SG<~cdrPpL{F;a&OeT!IcPQ5aYQiJT z&~F$$t{MUg(Q}q^1RYd&G7wUQ#}f&9N0qd%aP76LDZNvH%Oh(Pi+6{qd@&Qm3IPlI5$!IJ49*bf&(C!42_^78N}24lf`!HyD-wt;np=@WBRzewlwH&;QPGnii9uU@ zK&jsgS|IJDs6K&Q*uFz0v{sjJ&+QK-e{we5P&%V4D?VIYT;mFh z7rvr2SwluS%3}MeLvxdd>2s%jufl?DIWjqlulc9Cnn#f?!WG8@Vur2EGR|rgVIi^o z30GHw)~G_cR;Lta`EGiNMV}uvqP0rio}@ z%3{45pr87={9BV-fv^#&b5c??lWlF86(VuLwE2P?A6x^yxA5BeD2F}b8zwAMm6v2S+P5;j4ffcP#^HJ?n(+6|+F7qmRaM@S`n*O+)@3QTxpvuSpirHXM5ns|$d^7uzqT zbApU(YCjq!DI5d=P`*}=5=|Qoe8)3S1?mSZ7znsEyFPG2s z3LVD2+{T!io^J(-%H;irXbj^0T0@lfxI;+6la>}$86qd2#fM~TyA0T~7N??n1gH(S zn}ylqi9w_+kKMKY1V^KSDBwQ>AC}Gi`G>I1d*}0kI3nJ>WIDPx|Q$9?>>&P>@{G>ny1kjQ_QTdHnnVbHG{+UU!VayYUrdMyT5e$% z+r~WWO^i)X$U*N!l6jsag+(UwkAT|iSXbf-6^DSPcaPqVuM93q`Kk~K~C`#M&ipTRx=FS`J~W7~$dZ-12~zcc{#r!9}WCnE9r zO*FvH9nTz1jjT8_Y}BAvcCmKgiL@TyTS_-}zxeBlO_DD~<9{j&D^8q&I(kLXKG|ok*i@xC0G9f4gFHEv{eOLdRZ*K#Skp zr=sl=(qZ~nL75eUqnAgYsmRq(pY2s2g9$?22AW|GI1;A%Xf3@G0A}X=E8i|yJ~WJce;N4{!q#Ruog<*D zSUG(f!w|yb^z2n-1;Jj*n>NoZGOWN{(3#UNMwY343s~j2!Cu*99m9DIsJVWEs*Yl_ z#r9HMN##Vf_6s*uX5;&ub{Y>?0MAF()OuR?y4T4WZ)s%wv`k8~R5UHEZaZ7l!Va`t zChm8Qts#pF=^}jjVx2u_(O#kEpu64up?>62qiy}5w$yE+@=YcH#r(XYEMATc4Hul7A zBsbjt&ij@d`=IQTh4+lzcKwfpX%*b>2E=XP+guDb2FZCkh&@hnh$bJHY_U=oO5ro5 zUOz3!%5lj~I)cTU3S(3CKXuEma^S9*shHUQg^{&}!UABJX+FVGh!2AjS9e)e&`0n5 ztCU1xVjZ~tQOP; z?NRk_z%lZj`0|;Qz#p2IEH#kJn=QXp@!~7jAcOlHnQ*w|Rr-21yN-mT?9@(uVA1!+ zq+?OCgBlA<+o4&DDiUOJp>SCwGU*YYb;4htK>V^l)u2JAhuXt}CQ)qGI%UkxLO0udj=Ah;Rv zfsV%!#0gp&^Sfj0(6fOnUG_%u3@1lPT?m`I{zE&QW*}MIi-jOA{jG5}(qvX;vE0}+ zY*_Vzl?zongJxIp83rkK-Lee(djhO5>OAKSz(gYJWsL(&lQdDqN3RH-=WsQ1b? z)aCfwIQAK}kdPuJaFNpVAJ}Y_R9sN?3>3K(s&g5t&tI+Ilq%?BKLRPWV!(ajF?3Li zBy|kje_!S`XGCLc-x5?dT<2G=@ERhap2XFQ71YCO z9B=gJg1x=CxZq|Cp)W0AdhEtgZjKn8zqabYV`si~W8O*yDF$(tNy)zJa!wt=M98X3 z>OJBjBRH>YJapi?>)4brxDG4P$klXx+}r1@#W9vK+gneqpWeqk{j-3cb-6W{1_zj6A8@h)s;hx&E1JBiRgx7Ng0)rM-l%Xn`@7^I z4>+J8p~~WG&nWEaUf(L)gA%6d-?V^f3rb;Y?HeTSr9^|*N~2tajc{2RUAa`_XAPZQ z;#E?Wdb#(}OpoVsa=$rfhx7eqC6ph$;!#i9+3~o{f&CI~@>H@6Py$u%<3}kw+nSAp zI(nKP>-ik7HvWsIwM=~X@tqyRfUf(`KfAQ5bCQU&IP6_Ap);|)kDglfcN%!d-u=-s zdK?jIOErB8y7>_s+I|Rdx3A&!7XZB?#x?3|<}^ZE&T_)3>o+jFW4M z5Kb__o1i)jsKR1t`H1MHV)Ku*r3*!oj$&+hKT=*9aL7t=!>i4{koqZzcH`Sfr3n=z z-`l)z#*D$5M+4%A;ss@ zILo4O0f4fZXq>Km#n7Cy}y0x=eQeneLJf8MeK z*KoXZU49fu8;vp%wMVNWlJU|c^uOfIh6~yQT^YJ@5BTO0drwc;k#1LRSIP}Y?LT+o zpiKa?F$5OEM{Vr&{C4ckz@t>9MOZ?tu!QLgo5ZL_#^}EqxN2%EeFV7PPEH?i090-t&82v2d7&^c`KWB0dcbo`sKJ|c;?qI z;Xt@Oe3*_8!j$qa5XC}9o)-JibJ{oYG`hneV^vN0&;&|hV&SSHb#EbCJJKiCWc}&y z7EFAM!9_R(wm*zQK&VcYWR^;aD_#E^GyT0BGwvfKp(68PkZAV^Eg7xKAN+c~gpe{c z3-k(B>`qjA*vqfF3al+{q7*vk^RjzRkZS3fN;tOJ#2Z3W%biHR5&;9{@hF2v*w`%M zOgG+!f+GDD&Ni!Jdz#Z(|7d(@;<#h{o{K3Ys!dW$#WY1#^M*)@TF-p+=N9DsHR?w! zj2w~$4P83XFVW0r&N(QC8spCxupx)V=c#%5?jm9{3SxR_{;3wbJ{on|1O)ZkPLm|< zeq~17lt%vT2lhheOhKM<4kW>wJEEBtyC8;sJ*RMINl5;P-BbGU9;iN5ZQ}yOH#sD1 zEjdcdw|+}%{vGaPSeke*;XbC3>nZG^kLWoQh%3EVsYZPQXH54ird($V4@QNY92D;z z`x$%Mmj*T`YEU=T<%eEo+zRCP<=+)xZcXPDkxPqGg%ha#8n_4_Pd?ATbToJCZ*utF zr=GkxCrSg3D&o$%(_#;~r0%|#oUue?$Uh69L<9&$_!zNQhMQBh%c%MBFb+@27+r}G; zLoHOV?-KU21~B$4r!FQsC!v5!v!+!xy*BFT+w!OD5Qf~dJ%ZdE%;wXo4+W75PtY)4mOPmE~OS1XBzP}hD8)Z;9)TAhf znD_q3X$SzKzpVB~-c>%^M7(OxnsU~ee{{?&mkd8*{EXPZz79xgzE^dtFy8yIx;aPg z!bS@lt;OAwxsH3#b0nm-H~A&OCXJFjsF=02{C3K01-CMCH4M_JaCS`1=iX=CH)rzt zi)a|K$|`0>g}_SJ9vN$bw;MVJ@3b6b4HBk0_}}V;yHXNuf8*z{Bk468i4rXYnLwx) zr$B!2-i++=zL*=YSF$5~^7-C$y^)LCPEf4X$&=#Z|HR-wRL}-w$yjWYYGyT$3?bdk zJ2C8M`l>UC0@z_9ud$ECx{6Lr0^hG^CKNEEnU9^NDw ze_G;u>=)mX?!ZZ97|j|e0};{CVhbT*TbQ~NUn?hiDNK{i&rdxzSX7XmUN=TyPopX& zvja{}$h3sCW~%fSV-y7tCSD0OOcrk(IoE)}sEs-K4}Q&u{Dk>yw$lI2{o#xh{njJgGF@U{IUToM%N7^N#l*9)PrR&$B&UDZ>zBfHLY$6mU~ zRYAUD_ut*+JvD}HPFQqzJ_az)0qI=zSsdgU+CT9_P%+;mr|on9QcXUE{KIxOY*-TOom1 zAL6e;d&rd!7$7MgBN-9#HL%RO95m)++#v?R?1_Bjj>hK}yqjiOBIa(V0jo4aXe2la zR0InKE=4V7Pu$xV7)R}JkcMB?^XC#gxiD)Y(&li@ z^#!N(ZzeL4c&A=^sO`kjJX~C9Q8J_FQK5~@LHQ~m_H}1ORnnnh+{4S`3FVzKA?Ri% zUs}xlh0k#r4<8buk zllNrJ;L#$?>GHH^xg#NPYFYty_0^bw|1ZXv@-4NNU46Cau*dWKP92UB;-%af4zt<4 zv&2RGVEZfl%smKsR=tD)M}vMVPr zuelv7C}ff5VEiIg$7v^l(m@BzI0r0Woq&cePK>PixD#z=!t6$m^adp|IiXZ>-@8v` zYjA53ueMptv6*YYTg))G<2aY@RXPV*Kwko<>9);Z%g08*0ZFOMy?!_}T6s)%Amgh=SWc z9rVb=U+m&U0vuYOtYCc9#~)D_(nyFW9ZHitAh_8&Je$CS@R-~@++jL;J@SeTwAx{Y zK&cc<4=DIBYVeje@T{aFzf%NF=v?g0ilhq19;Cmh9)1#v;KQ-Cij|)!(E>)9+XVOa zwR5FR=Wu99MeTMe1;1T?g`KMDe`xQUNSbx|vpZkVc(=xgtr0f#2)vw*JhrbSt2}~T zb|g~1Jkijf6Gtagtj7N4G!}wW)1W(#^O(OB_K0HeJdwrM7VSIaCOFZ*nQ1^vEO4#0 z%Bv!9bl>MZrlhf_6JoGWDQ(c}&u-El#v`2&G^byL41Cst59YZHsU@`}z=^feNS^Tz zcJAEdkLy!Ezc=i1nkE}r)FIy1E`uUmWMG{nKNmJ)L+5`!Q!^Rh9;@O^3x{w+Bh4 z4YW{VE(c<>P>yb(>jp8FY$WcMO<0tp7`q5q{5kZmm}-Lu9kTsSe%{fg5Al~Wa%;MV z?C`X?ExttG-_4LZf8`xU$c0OrkfED=Tn)-#Dow+hW>0UwvJ=;p80kaJD4O#O{#`eu zBbF)5=qy>6!O-`jtfJfg+l6AE0!s8w+B7jkGSGPzhY;#cmqqg{U)4Z1m4`_wFT)6@ zvB0r(LUK6zdPP%6B7~D-cnViBHxV&m2EaTAr+kB@?|+594=-Jq5-)K0T_jNrlw0r5 zO|Y&fHB>qyzs&x8EBi27W#hMEgO1YELfpv6vAxsL3vjPLWPtJuHZ_Z6d;IBXNpcVnfqjV}YoN`;NCp_W1a; zb#3~tPT{YAu9zaA;B=APXVv{Hanme@5AF#y<@&^~(~+^PD2?gYzDcCCwojyn#*_9E z+k1#OT6Xr8u+wy^;80e3LA@Bul9||@_cjdH@T%b68`zB;nD) google-play.json - name: "Upload to Google Play" - uses: r0adkll/upload-google-play@v1.0.17 + uses: r0adkll/upload-google-play@v1.1.2 with: serviceAccountJson: google-play.json packageName: com.quietmobile @@ -87,4 +86,3 @@ jobs: status: completed track: internal whatsNewDirectory: distribution/whatsnew - changesNotSentForReview: true diff --git a/.github/workflows/e2e-linux.yml b/.github/workflows/e2e-linux.yml index 1756069a6c..e2dd29f39a 100644 --- a/.github/workflows/e2e-linux.yml +++ b/.github/workflows/e2e-linux.yml @@ -64,20 +64,20 @@ jobs: uses: nick-fields/retry@v2 with: timeout_minutes: 25 - max_attempts: 3 + max_attempts: 1 command: cd packages/e2e-tests && npm run test invitationLink.test.ts - # - name: Download App Image 1.2.0 - # working-directory: ./packages/e2e-tests/Quiet - # run: curl -LO https://github.com/TryQuiet/quiet/releases/download/quiet%401.2.0/Quiet-1.2.0.AppImage + - name: Download App Image 1.2.0 + working-directory: ./packages/e2e-tests/Quiet + run: curl -LO https://github.com/TryQuiet/quiet/releases/download/quiet%401.2.0/Quiet-1.2.0.AppImage - # - name: Chmod App Image 1.2.0 - # working-directory: ./packages/e2e-tests/Quiet - # run: chmod +x Quiet-1.2.0.AppImage + - name: Chmod App Image 1.2.0 + working-directory: ./packages/e2e-tests/Quiet + run: chmod +x Quiet-1.2.0.AppImage - # - name: Run Backwards Compatibility test - # uses: nick-fields/retry@v2 - # with: - # timeout_minutes: 15 - # max_attempts: 3 - # command: cd packages/e2e-tests && npm run test backwardsCompatibility.test.ts \ No newline at end of file + - name: Run Backwards Compatibility test + uses: nick-fields/retry@v2 + with: + timeout_minutes: 15 + max_attempts: 3 + command: cd packages/e2e-tests && npm run test backwardsCompatibility.test.ts \ No newline at end of file diff --git a/.github/workflows/e2e-win.yml b/.github/workflows/e2e-win.yml index d03967a883..9f3fa52e37 100644 --- a/.github/workflows/e2e-win.yml +++ b/.github/workflows/e2e-win.yml @@ -4,7 +4,9 @@ on: [workflow_call] jobs: windows: runs-on: windows-2019 + timeout-minutes: 180 + env: ELECTRON_CUSTOM_VERSION: 23.0.0 TEST_MODE: true From 03105fe934df93d639accc1c64cd0f1996b45e07 Mon Sep 17 00:00:00 2001 From: Lucas Leblow Date: Mon, 25 Sep 2023 10:24:10 -0600 Subject: [PATCH 2/2] Hotfix for file download vulnerability A malicious user can overwrite another user's files if they supply a filename that escapes the download directory (e.g. ../../../profile.sh). Prevent this by using UUIDs for filenames for now and revisit this in the future. --- .../ipfs-file-manager.service.ts | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/packages/backend/src/nest/ipfs-file-manager/ipfs-file-manager.service.ts b/packages/backend/src/nest/ipfs-file-manager/ipfs-file-manager.service.ts index 31c5a9a538..b8cb12a034 100644 --- a/packages/backend/src/nest/ipfs-file-manager/ipfs-file-manager.service.ts +++ b/packages/backend/src/nest/ipfs-file-manager/ipfs-file-manager.service.ts @@ -2,6 +2,7 @@ import { Inject, Injectable } from '@nestjs/common' import { EventEmitter, setMaxListeners } from 'events' import fs from 'fs' import path from 'path' +import crypto from 'crypto' import PQueue, { AbortError } from 'p-queue' import { decode, PBNode } from '@ipld/dag-pb' import * as base58 from 'multiformats/bases/base58' @@ -433,13 +434,20 @@ export class IpfsFileManagerService extends EventEmitter { private async assemblyFile(fileMetadata: FileMetadata) { const _CID = CID.parse(fileMetadata.cid) - const downloadDirectory = path.join(this.quietDir, 'downloads', fileMetadata.cid) + const downloadDirectory = path.join(this.quietDir, 'downloads') createPaths([downloadDirectory]) - const fileName = fileMetadata.name + fileMetadata.ext - const filePath = `${path.join(downloadDirectory, fileName)}` - - const writeStream = fs.createWriteStream(filePath) + // As a quick fix, using a UUID for filename ensures that we never + // save a file with a malicious filename. Perhaps it's also + // possible to use the CID, however let's verify that first. + let fileName: string + let filePath: string + do { + fileName = crypto.randomUUID() + filePath = `${path.join(downloadDirectory, fileName)}` + } while (fs.existsSync(filePath)) + + const writeStream = fs.createWriteStream(filePath, { flags: 'wx' }) const entries = this.ipfs.cat(_CID)