Feature/merge remove binary target by ivolz · Pull Request #9 · approov/approov-service-volley

ivolz · 2026-04-13T13:01:17Z

Resolves #10.

Related: approov/core-project-approov#428 — Standardize Volley Service Layer & Implement Message Signing / Mutators

…for service-layers; add testing dependency on mini-sdk and unit/integrations tests

… action rejection

Copilot

Pull request overview

Ports the service-layer mutator pattern and HTTP message signing support to the Volley integration, updates initialization semantics, and adds a mini-SDK based test harness with refreshed GitHub Actions workflows for CI validation.

Changes:

Introduces ApproovServiceMutator hooks across request processing, secure-string substitution, and direct-fetch helpers, plus new status-based exception types.
Adds HTTP message signing for Volley via ApproovDefaultMessageSigning and supporting Structured Field Values / signature utilities.
Integrates mini-SDK + Robolectric/Mockito test coverage and updates CI workflows/build configuration.

Reviewed changes

Copilot reviewed 62 out of 62 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
USAGE.md	Adds integration/customization guidance, including mutators and message signing usage.
settings.gradle	Adds mini-SDK/testing modules as sibling-project includes.
REFERENCE.md	Adds public API reference for new mutator/signing APIs and initialization semantics.
README.md	Links to changelog/usage/reference and documents included third-party sources.
CHANGELOG.md	Introduces 3.5.4 changelog entries describing new features/behavior changes.
approov-service/src/test/java/org/apache/http/StatusLine.java	Test stub for Apache HTTP types used by tests.
approov-service/src/test/java/org/apache/http/ProtocolVersion.java	Test stub for Apache HTTP protocol version.
approov-service/src/test/java/org/apache/http/message/BasicStatusLine.java	Test stub for Apache HTTP status line implementation.
approov-service/src/test/java/org/apache/http/message/BasicHttpResponse.java	Test stub for Apache HTTP response implementation.
approov-service/src/test/java/org/apache/http/message/BasicHeader.java	Test stub for Apache HTTP header implementation.
approov-service/src/test/java/org/apache/http/HttpResponse.java	Test stub for Apache HTTP response interface.
approov-service/src/test/java/org/apache/http/HttpEntity.java	Test stub for Apache HTTP entity interface.
approov-service/src/test/java/org/apache/http/Header.java	Test stub for Apache HTTP header interface.
approov-service/src/test/java/org/apache/http/entity/BasicHttpEntity.java	Test stub for Apache HTTP entity implementation.
approov-service/src/test/java/io/approov/util/sig/TestComponentProvider.java	Test component provider implementation for signature-base tests.
approov-service/src/test/java/io/approov/util/sig/SignatureParametersTest.java	Unit tests for signature-parameter serialization.
approov-service/src/test/java/io/approov/util/sig/SignatureBaseBuilderTest.java	Unit tests for signature base construction.
approov-service/src/test/java/io/approov/service/volley/ApproovTestSupport.java	Test utilities for resetting static state and building fixtures.
approov-service/src/test/java/io/approov/service/volley/ApproovServiceMiniSdkTest.java	Robolectric + mini-SDK contract tests exercising real request flow.
approov-service/src/test/java/io/approov/service/volley/ApproovServiceContractTest.java	Unit-level contract tests for `ApproovService` APIs and behaviors.
approov-service/src/test/java/io/approov/service/volley/ApproovHurlStackContractTest.java	Contract tests for header mutation / mutator interactions in stack.
approov-service/src/test/java/io/approov/service/volley/ApproovDefaultMessageSigningContractTest.java	Contract tests for signing behavior and header replacement.
approov-service/src/test/java/android/util/Base64.java	Test-only shim for `android.util.Base64` on JVM.
approov-service/src/main/java/io/approov/util/sig/SignatureParameters.java	Adds signature-parameter carrier/serialization logic.
approov-service/src/main/java/io/approov/util/sig/SignatureBaseBuilder.java	Adds signature-base construction logic.
approov-service/src/main/java/io/approov/util/sig/LICENSE	Adds MIT license for adapted signature utilities.
approov-service/src/main/java/io/approov/util/sig/ComponentProvider.java	Adds component-provider interface for signature inputs.
approov-service/src/main/java/io/approov/util/http/sfv/Utils.java	Adds structured-field helper utilities.
approov-service/src/main/java/io/approov/util/http/sfv/Type.java	Adds SFV type interface.
approov-service/src/main/java/io/approov/util/http/sfv/TokenItem.java	Adds SFV token item.
approov-service/src/main/java/io/approov/util/http/sfv/StringItem.java	Adds SFV string item.
approov-service/src/main/java/io/approov/util/http/sfv/ParseException.java	Adds SFV parse exception with diagnostics.
approov-service/src/main/java/io/approov/util/http/sfv/Parameters.java	Adds SFV parameters container implementation.
approov-service/src/main/java/io/approov/util/http/sfv/Parameterizable.java	Adds SFV parameterizable contract.
approov-service/src/main/java/io/approov/util/http/sfv/package-info.java	Adds SFV package docs and minimal example.
approov-service/src/main/java/io/approov/util/http/sfv/OuterList.java	Adds SFV outer list type.
approov-service/src/main/java/io/approov/util/http/sfv/NumberItem.java	Adds SFV number item contract.
approov-service/src/main/java/io/approov/util/http/sfv/ListElement.java	Adds SFV list-element marker.
approov-service/src/main/java/io/approov/util/http/sfv/LICENSE	Adds Apache 2.0 license for adapted SFV utilities.
approov-service/src/main/java/io/approov/util/http/sfv/Item.java	Adds SFV item interface and type conversion helpers.
approov-service/src/main/java/io/approov/util/http/sfv/IntegerItem.java	Adds SFV integer item.
approov-service/src/main/java/io/approov/util/http/sfv/InnerList.java	Adds SFV inner list type.
approov-service/src/main/java/io/approov/util/http/sfv/DisplayStringItem.java	Adds SFV display-string item.
approov-service/src/main/java/io/approov/util/http/sfv/Dictionary.java	Adds SFV dictionary type.
approov-service/src/main/java/io/approov/util/http/sfv/DecimalItem.java	Adds SFV decimal item.
approov-service/src/main/java/io/approov/util/http/sfv/DateItem.java	Adds SFV date item.
approov-service/src/main/java/io/approov/util/http/sfv/ByteSequenceItem.java	Adds SFV byte-sequence item (binary).
approov-service/src/main/java/io/approov/util/http/sfv/BooleanItem.java	Adds SFV boolean item.
approov-service/src/main/java/io/approov/service/volley/ApproovServiceMutator.java	Introduces mutator interface + default behaviors for statuses/substitutions.
approov-service/src/main/java/io/approov/service/volley/ApproovService.java	Refactors init/state, adds TraceID header support, mutator pipeline, and new helpers.
approov-service/src/main/java/io/approov/service/volley/ApproovRequestMutations.java	Adds mutation-tracking carrier for composed mutators (e.g., signing).
approov-service/src/main/java/io/approov/service/volley/ApproovNetworkException.java	Deprecates network exception in favor of fetch-status exception (compat kept).
approov-service/src/main/java/io/approov/service/volley/ApproovFetchStatusException.java	Adds typed exception carrying SDK fetch status.
approov-service/src/main/java/io/approov/service/volley/ApproovException.java	Improves exception wrapping/constructors for underlying causes.
approov-service/src/main/java/io/approov/service/volley/ApproovDefaultMessageSigning.java	Adds Volley message signing mutator (digest + signature headers).
approov-service/pom.xml	Adds BouncyCastle runtime dependency for message signing publishing.
approov-service/build.gradle	Adds test configuration, mini-SDK test deps, and signing-related dependencies.
.vscode/settings.json	Adds local VS Code Java build config setting.
.github/workflows/build_only.yml	Removes old “build only” workflow.
.github/workflows/build_and_test.yml	Adds new build+test workflow with mini-SDK checkout and worker probing/redeploy.
.github/workflows/build_and_publish.yml	Updates publish workflow to run tests and use repo subdirectory checkout.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…ropping

…o support empty-config bypass

…f disabled

Copilot

Pull request overview

Copilot reviewed 62 out of 62 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 62 out of 62 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

The test helpers duplicated the testing reply URL resolution including hardcoded workers.dev fallbacks, exposing the endpoints in this public repository and contradicting their removal from the CI workflow. The URLs are now obtained from the mini-sdk test controller, which already resolves the same environment variables privately. Live request tests also probe the worker once per class and convert connectivity failures into skipped assumptions so an unreachable worker no longer fails the suite. Requires core-service-layers-testing to provide AttesterProxyController.getTestingReplyURL[Unprotected]().

… stubs The android.util.Base64 stand-in ignored its flags and used the strict JDK decoder, so any future use of DEFAULT, URL_SAFE or NO_PADDING in library code would compile but silently misbehave in tests, and under Robolectric the stub can shadow the real framework class. Implement the flag semantics (wrapping, padding, alphabet, lenient decode) and the missing byte[] overloads, and explain in both places why the stubs exist and how they must be treated.

Install (ES256) signing failures skip signing and let the request proceed while account (HS256) failures abort the request; spell out the reasoning so the asymmetry is not mistaken for an oversight.

The workflow triggered on every push and on pull_request events, so any branch with an open PR built twice per push. Restrict the push trigger to main while keeping pull_request coverage for all PR branches.

The vendored structured-fields port replaced java.util.function types elsewhere because the library minSdk predates them, but Parameters still declared overrides using BiFunction/BiConsumer/Function and the API 24 Map methods. These overrides either threw UnsupportedOperationException or merely delegated, so the inherited Map default methods behave identically on devices that provide them; remove the overrides so the class no longer references API 24 types and no longer trips NewApi lint.

The .vscode/settings.json file carries a personal editor preference that does not belong in the repository.

The shadow jar is already on the compile classpath through its implementation declaration.

A remnant of the previous URL-typed parameter in substituteQueryParamInURLString.

ApproovRequestMutations exposed getAddedHeaderKeys but nothing ever populated it. The signing mutator now records the Signature, Signature-Input, Content-Digest and debug Signature-Base-Digest headers it adds so downstream hooks can see the full set of mutations.

Apache-2.0 section 4(b) asks for prominent notice of changes to redistributed files. State the upstream project, the license pointer and the modifications made during vendoring in the package documentation, and note the RFC 9651 additions the package description omitted.

The test asserts that repeated same-config initializations are each forwarded to the platform SDK, not that duplicates are ignored at the service layer.

Resolve the reply URLs from the environment first and look the mini-sdk accessors up reflectively, skipping the suite with a clear assumption message when neither source is available. This keeps the test suite compiling and green against mini-sdk revisions that predate the accessors, such as CI runs before the companion change merges.

charlesoj6205

LGTM

Preserve original placeholder when getSecureString() returns null or empty, instead of injecting null into headers, query params, or URLs. Applies to header substitution, query param substitution, and URL query substitution per TESTING_REQUIREMENTS §2 Missing Artifacts Fallback.

…lish - Enable BuildConfig generation (AGP 8 default off) - Add APPROOV_SERVICE_VERSION BuildConfig field from -PapproovServiceVersion - setUserProperty now reports 'approov-service-volley/X.Y.Z' (or 'dev') - Add CHANGELOG-vs-tag validation step in publish workflow - Pass -PapproovServiceVersion to assembleRelease in CI - Bump setup-java to v5 Mirrors the pattern established in approov-service-retrofit PR #23.

The setUserProperty call now includes BuildConfig.APPROOV_SERVICE_VERSION; update the two verify() assertions to match.

Copilot

Pull request overview

Copilot reviewed 65 out of 66 changed files in this pull request and generated 3 comments.

ivolz · 2026-06-13T17:47:14Z

All requested changes from the reviewer and inline Copilot comments have been addressed, verified by local tests, and resolved.

Copilot

Pull request overview

Copilot reviewed 65 out of 66 changed files in this pull request and generated 3 comments.

…build_and_test workflow comments

…ped error propagation M1 — account (HS256) signing now mirrors install (ES256) and the other service layers: - catches ApproovException from getAccountMessageSignature and proceeds unsigned when the SDK cannot provide an account signature (e.g. no mksid yet); - skips signing when the account signature is empty. M2 — genuine signing failures now surface as ApproovException (a Volley AuthFailureError/VolleyError) instead of unchecked exceptions escaping ApproovHurlStack.executeRequest: - unsupported algorithm and ASN.1/DER decode failures throw ApproovException directly; - a trailing catch converts unchecked failures from shared signing code (required body digest unavailable, missing signature-base component, serialization) into ApproovException. ApproovException is checked, so the silent-fallback and explicit-throw paths are unaffected. Tests: add accountSigningSkipsGracefullyWhenAccountSignatureUnavailable, accountSigningSkipsGracefullyWhenAccountSignatureEmpty, and requiredBodyDigestFailureSurfacesAsApproovException. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…g errors (§5)

ivo liondov added 12 commits April 3, 2026 09:40

Port mutators and message signing to Volley for 3.5.4

21a4c22

Align Volley initialization behavior with other service layers

9ec1cfe

Add empty service layer iniitialization option to match requirements …

2618d3f

…for service-layers; add testing dependency on mini-sdk and unit/integrations tests

chore: integrate mini-sdk testing and update github workflows

a86484d

fix: move core testing repo checkout into workspace to prevent github…

b3549c5

… action rejection

fix: migrate to okhttp sibling checkout pattern with PAT

e8a7562

Add github workflow for build and test

cacbbf4

chore: align documentation and interface with okhttp for empty config

bdaf78f

ci: bump actions to support Node 24

6af621e

fix(mutator): decouple mutator logic from legacy network fail variable

1c8d639

docs: update changelog for mutator decoupling

8266cb0

docs: mark setProceedOnNetworkFail as obsolete

5b58e0d

ivolz requested review from adriantuk, charlesoj6205 and Copilot April 13, 2026 13:01

Copilot started reviewing on behalf of ivolz April 13, 2026 13:01 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

ivo liondov added 4 commits April 13, 2026 14:08

test: remove obsolete reflection call targeting decoupled field

f2eea0c

build: conditionally include test framework paths

6c5c5d6

fix(sfv): return new item instance with params to prevent parameter d…

6790e33

…ropping

fix(volley): getBaseHttpStack returns null when Approov is disabled t…

756e31b

…o support empty-config bypass

ivolz requested a review from Copilot April 13, 2026 13:26

Copilot started reviewing on behalf of ivolz April 13, 2026 13:27 View session

ivo liondov added 2 commits April 13, 2026 14:29

fix(sig): correct loop comparison in containsComponentIdentifier

8354815

fix(volley): make createConnection safe for HTTP and bypass pinning i…

2b4ed4b

…f disabled

Copilot AI reviewed Apr 13, 2026

View reviewed changes

ivolz requested a review from Copilot April 13, 2026 13:37

Copilot started reviewing on behalf of ivolz April 13, 2026 13:37 View session

fix(log): correct typo in already initialized warning message

4d7996f

Copilot AI reviewed Apr 13, 2026

View reviewed changes

adriantuk added 13 commits June 10, 2026 11:23

Document the intentional failure asymmetry between signing algorithms

de66d64

Install (ES256) signing failures skip signing and let the request proceed while account (HS256) failures abort the request; spell out the reasoning so the asymmetry is not mistaken for an oversight.

Avoid duplicate CI runs for branches with open pull requests

4ca5c9a

The workflow triggered on every push and on pull_request events, so any branch with an open PR built twice per push. Restrict the push trigger to main while keeping pull_request coverage for all PR branches.

Remove editor settings from version control

5fa1b33

The .vscode/settings.json file carries a personal editor preference that does not belong in the repository.

Drop redundant compileOnly declaration of the shadow jar

69ce306

The shadow jar is already on the compile classpath through its implementation declaration.

Remove leftover toString call on a String parameter

098259d

A remnant of the previous URL-typed parameter in substituteQueryParamInURLString.

Rename initialization test to match the verified contract

cc618bd

The test asserts that repeated same-config initializations are each forwarded to the platform SDK, not that duplicates are ignored at the service layer.

Record review fixes in the changelog

790d061

charlesoj6205 approved these changes Jun 10, 2026

View reviewed changes

ivol and others added 4 commits June 12, 2026 22:37

fix: update contract test assertions for versioned setUserProperty

d673143

The setUserProperty call now includes BuildConfig.APPROOV_SERVICE_VERSION; update the two verify() assertions to match.

docs: complete version 3.5.5 documentation and changelog updates

f7ec5ec

ivolz requested a review from Copilot June 13, 2026 17:23

Copilot started reviewing on behalf of ivolz June 13, 2026 17:24 View session

Copilot AI reviewed Jun 13, 2026

View reviewed changes

Comment thread approov-service/build.gradle

Comment thread approov-service/src/test/java/android/util/Base64.java Outdated

Comment thread SECURITY.md Outdated

Fix reviewer feedback and resolve inline thread comments on PR 9

b9ca778

ivolz requested a review from Copilot June 13, 2026 17:48

Copilot started reviewing on behalf of ivolz June 13, 2026 17:48 View session

Copilot AI reviewed Jun 13, 2026

View reviewed changes

Comment thread SECURITY.md Outdated

Comment thread SECURITY.md Outdated

Comment thread .github/workflows/build_and_test.yml Outdated

ivolz and others added 4 commits June 13, 2026 18:55

Address Copilot PR review comments regarding SECURITY.md grammar and …

542e663

…build_and_test workflow comments

Implement message signing fail-open policy for decoding and formattin…

37caa5a

…g errors (§5)

Fix GitHub Actions secrets syntax error in step level if checks

915511e

Conversation

ivolz commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

charlesoj6205 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ivolz commented Jun 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ivolz commented Apr 13, 2026 •

edited

Loading