chenxiaolong / avbroot

Sign (and root) Android A/B OTAs with custom keys while preserving Android Verified Boot
GNU General Public License v3.0
436 stars 41 forks source link

tests: Remove all binary test data files #276

Closed chenxiaolong closed 2 months ago

chenxiaolong commented 2 months ago

In light of the recently discovered backdoor in the xz project where a part of the malicious code was distributed in the test files, let's remove all of our test files and generate them at runtime. While our test files are very simple and consist mostly of zeros, someone who is not very familiar with these binary formats would have a harder time examining them and making sure they aren't malicious. With this change, the data structures are now plainly visible in the test code.

The files generated at runtime are byte-for-byte identical to the test files being removed. One can verify by comparing the sha512 checksums of the files with the sha512 checksums hardcoded in the new test code.

Closes: #265