search

NeoApplications / Neo-Store

An F-Droid client with modern UI and an arsenal of extra features.
GNU General Public License v3.0
2.79k stars 86 forks source link

Neo Store 1.0.1 not properly verifying F-Droid certificate #618

Open repomatt opened 2 months ago

repomatt commented 2 months ago

F-Droid recently had a certificate issue which has since been fixed. Accessing https://f-droid.org in a browser, and accessing the F-Droid repos in the official client, would fail with a certificate error. Neo Store, however, allowed access.

Did not test after clearing app cache and storage, or after app reinstall, as certificate issue itself was fixed by then

Version 1.0.1 (F-Droid build)

Steps to reproduce:

  1. Create scenario where https://f-droid.org fails with a certificate error ERR_CERT_DATE_INVALID (I did not recreate this, but this is the certificate error in Chromium when I observed the issue)
  2. Sync official F-Droid repo on Neo Store

Expected behavior: Neo Store falls to sync with a certificate error, same as the browser and official client

Observed behavior: Neo Store sync works without error

repomatt commented 2 months ago

https://github.com/NeoApplications/Neo-Store/assets/29217146/b16532cf-36df-4773-a674-92d04625a505

Screencast of issue, with official client and web browser for reference

machiav3lli commented 2 months ago

I guess NS falls back to http as the setup okhttp client allows it. I'll see if I'd add an option to enforce https