accrescent / devconsole

The web console for developers to manage their apps in Accrescent

Accrescent

A novel Android app store focused on security, privacy, and usability.

Currently in early alpha.

Screenshots

Home Page	App Details

Settings Menu	Material You

About

Accrescent is a private and secure Android app store built with modern features in mind. It aims to provide a developer-friendly platform and pleasant user experience while enforcing modern security and privacy practices and offering robust validity guarantees for installed apps. It does this through the following features:

• App signing key pinning
• Signed repository metadata
• Automatic, unprivileged, unattended updates (Android 12+)
• First-class support for split APKs
• No remote APK signing
• Meaningful quality control for submitted apps
• No account requirement for installing apps

...and more. See the features page on the website for details.

Accrescent currently runs on Android 10 and up.

Contributions are welcome! If you're interested in helping out, be sure to check out the contributing guidelines for tips on getting started.

Signing certificate hash

Accrescent's SHA-256 signing certificate hash is as follows:

067a40c4193aad51ac87f9ddfdebb15e24a1850babfa4821c28c5c25c3fdc071

Be sure to check it against the hashes on our website and Twitter to verify its legitimacy.

Translations

Accrescent has a project on Hosted Weblate if you would like to help translate.

Trademark

The name "Accrescent" and the Accrescent logo are common law trademarks owned by the Accrescent project. All other parties are forbidden from using Accrescent's name and branding, as are derivatives of Accrescent. Derivatives include, but are not limited to forks and unofficial builds.

devconsole's Issues

Redirect to login screen on HTTP 401

If the user is not authenticated, they should be redirected to the login screen. Ideally they should also be shown a snackbar telling them why they were redirected.

Implement submission process for app updates

Renovate can't resolve all artifacts

Since devconsole requires running go generate to generate protobuf code before compiling, Renovate has issues updating artifacts as seen in a recent dependency update. This may be why Renovate hasn't been updating packages such as golang.org/x/oauth2 and golang.org/x/exp lately.

Ideally this should be resolved without including the generated protobuf code in the repository.

Lazy load role-specific pages

Most users aren't reviewers or publishers and so don't need to load the review and publish components. These components should be split out into lazy-loaded feature modules to reduce load times for the majority of users who will never need them.

Relevant docs: https://angular.io/guide/lazy-loading-ngmodules

Add deployment script

This will most likely take the form of an Ansible playbook.

Add icon submission to app submission process

Reject apps signed with a debug certificate

As per https://developer.android.com/studio/publish/app-signing, debug certificates are insecure by design and should not be used for publishing. To reduce the risk of user error leading to a security compromise, we should reject all apps signed with a debug certificate and direct the developer to documentation explaining how to properly sign their app with a release certificate.

APK signature parsing should be implemented in apkstat as a prerequisite:

• accrescent/apkstat#5

As far as I know we could use Avast's apkverifier library without breaking the terms of the LGPL license but I need to look into it more to be sure (insight appreciated). Regardless, it would probably be better to implement signature parsing in apkstat so we can add newer features as we need them such as signature v3.1 parsing, so as of now that's the plan.

Enforce Trusted Types in dev environment

https://angular.io/guide/security#enforcing-trusted-types

Make session cookie SameSite=Strict

Currently it's Lax. If not feasible (it should be), ensure other sufficient CSRF protections are in place.

Require minimum bundletool version for uploaded APK sets

As bundletool adds more features (such as app archiving support), we want to ensure those features are available across all apps in
Accrescent. One way we can do this is limiting the minimum bundletool version allowed for generating APK sets.

For the implementation, each APK set contains a file called toc.pb which is a protocol buffer of the type BuildApksResult. This message contains a Bundletool message which in turn contains the version string of the bundletool used to generate the split APKs. We should check this against a configured minimum and reject APK sets using an older version.

Theoretically a developer could use an outdated bundletool and modify the version string in toc.pb before uploading the APK set, but there isn't incentive for them to do so and as of now there would be no security impact, so I don't think this is an issue.

I'm going to tentatively set an arbitrary policy that the minimum allowed bundletool version will be the latest stable version one month after its release.

Push published apps to repository server

Wrap errors from database drivers

Currently we return driver-specific errors from methods in our data.DB interface. This isn't ideal since the underlying database can't be swapped out without updating the calling code to handle different errors. Instead, we should wrap driver-specific errors in our own error types so that a driver change could theoretically be seamless.

As part of implementing this change, wrapcheck should be added to .golangci.yaml (with some configuration to ignore other packages that might trigger the lint).

Publish app icons

Add basic automated quality control

Relevant discussion to pull from: #1

Display errors in UI

Currently HTTP error codes are logged to the console without any UI indicator. We should show a somewhat pretty error dialog to the developer to let them know what went wrong.

Implement app submission approval

Relevant discussion to pull from: #1

Add systemd services

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

This repository currently has no open or pending branches.

Detected dependencies

docker-compose

docker-compose.yaml

dockerfile

devportal/Dockerfile

reposerver/Dockerfile

github-actions

.github/workflows/build.yaml

• actions/checkout v3
• actions/setup-go v3

.github/workflows/golangci-lint.yaml

• actions/checkout v3
• actions/setup-go v3
• golangci/golangci-lint-action v3
• golangci/golangci-lint-action v3

gomod

devportal/go.mod

• go 1.19
• github.com/accrescent/apkstat v0.1.2
• github.com/gin-gonic/gin v1.8.1
• github.com/google/go-github/v47 v47.0.0
• github.com/mattn/go-sqlite3 v1.14.15
• golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094@0ebed06d0094

reposerver/go.mod

• go 1.19
• github.com/gin-gonic/gin v1.8.1
• golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e@a9213eeb770e

---

• Check this box to trigger a request for Renovate to run again on this repository

Refactor codebase

While usable as a proof-of-concept, the current codebase has certain deficiencies that make it unsuitable as an MVP. This issue is for tracking all necessary changes to reach MVP status that aren't already tracked in another issue.

All changes for this issue are in the refactor branch. If you want to work on one of the below items, please submit a PR to the refactor branch instead of main.

• Give reviewers emails
• Add authorization checks for app updates
• Allow multiple updates to exist for a given app
  • Update API to better reflect this
• Tie staging apps to gh_id instead of session_id so they can be saved and returned to in a different login session
• Rewrite frontend
  • Remove redirect return values from web server (i.e. remove unneeded HTTP 3XX return codes)
  • Remove all uses of html/template (most if not all of devportal/page module)
  • Change all frontend code to use Angular
    • Landing page w/link to log in w/GitHub
    • Registration page
    • Dashboard page
    • New app submission page
    • App list page
    • App update submission page
    • Publishing page
• Always require review for new apps
• Assign reviews to individual reviewers
• Don't rely on usable_emails cache - it should be just that, a cache
• Abstract all DB queries outside of routes (create DB-agnostic *sql.DB wrapper for routes to use)
• Prevent data races of config & OAuth2 config shared between routes

Add styling to the UI

Only require review for new issues

If an app has a review issue (say it uses the READ_CONTACTS permission), subsequent updates still including READ_CONTACTS should not require review by default.

Add as-necessary manual review process to quality control pipeline

Implement app deletion process

Add method for reviewers to download apps in review

Implement simple account deletion

Right now I'd need to manually delete a developer's account from the user database at their request. They should be able to delete their account themselves through their account settings.

Implement app submission process