feat(security): implement SHA-256 verification for OTA updates and remove insecure proxy script

Author: NullCoreDeveloper

.github/workflows/android_build.yml

@@ -72,11 +72,18 @@ jobs:
           -Pandroid.injected.signing.key.password=${{ secrets.RELEASE_KEY_PASSWORD }}
       working-directory: V2rayNG
 
+    - name: Prepare Release Assets
+      run: |
+        mkdir -p release-apks
+        find V2rayNG/app/build/outputs/apk/ -name "*.apk" -type f -exec cp {} release-apks/ \;
+        cd release-apks
+        sha256sum *.apk > sha256sum.txt
+
     - name: Create Release and Upload APK
       uses: softprops/action-gh-release@v2
       with:
         prerelease: true
         files: |
-          V2rayNG/app/build/outputs/apk/*/release/*.apk
+          release-apks/*
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

V2rayNG/app/src/main/java/com/kiktor/v2whitelist/dto/CheckUpdateResult.kt

@@ -5,6 +5,8 @@ data class CheckUpdateResult(
     val latestVersion: String? = null,
     val releaseNotes: String? = null,
     val downloadUrl: String? = null,
+    val checksumUrl: String? = null,
+    val apkFileName: String? = null,
     val error: String? = null,
     val isPreRelease: Boolean = false
 )

V2rayNG/app/src/main/java/com/kiktor/v2whitelist/handler/UpdateCheckerManager.kt

@@ -50,11 +50,16 @@ object UpdateCheckerManager {
 
         return@withContext if (compareVersions(latestVersion, BuildConfig.VERSION_NAME) > 0) {
             val downloadUrl = getDownloadUrl(latestRelease, Build.SUPPORTED_ABIS[0])
+            val apkFileName = downloadUrl.substringAfterLast("/")
+            val checksumUrl = latestRelease.assets.firstOrNull { it.name == "sha256sum.txt" }?.browserDownloadUrl
+            
             CheckUpdateResult(
                 hasUpdate = true,
                 latestVersion = latestVersion,
                 releaseNotes = latestRelease.body,
                 downloadUrl = downloadUrl,
+                checksumUrl = checksumUrl,
+                apkFileName = apkFileName,
                 isPreRelease = latestRelease.prerelease
             )
         } else {
@@ -193,4 +198,43 @@ object UpdateCheckerManager {
         return asset?.browserDownloadUrl
             ?: throw IllegalStateException("No compatible APK found")
     }
+
+    suspend fun verifyChecksum(apkFile: File, checksumUrl: String, apkFileName: String): Boolean = withContext(Dispatchers.IO) {
+        try {
+            val isRunning = com.kiktor.v2whitelist.handler.V2RayServiceManager.isRunning()
+            val httpPort = if (isRunning) SettingsManager.getHttpPort() else 0
+            val response = HttpUtil.getUrlContent(checksumUrl, 5000, httpPort) ?: return@withContext false
+            
+            var expectedHash: String? = null
+            for (line in response.lines()) {
+                if (line.contains(apkFileName)) {
+                    expectedHash = line.substringBefore(" ").trim()
+                    break
+                }
+            }
+            
+            if (expectedHash == null) {
+                Log.e(AppConfig.TAG, "Checksum for $apkFileName not found in sha256sum.txt")
+                return@withContext false
+            }
+            
+            val digest = java.security.MessageDigest.getInstance("SHA-256")
+            val fis = java.io.FileInputStream(apkFile)
+            val buffer = ByteArray(8192)
+            var read: Int
+            while (fis.read(buffer).also { read = it } != -1) {
+                digest.update(buffer, 0, read)
+            }
+            fis.close()
+            
+            val hashBytes = digest.digest()
+            val actualHash = hashBytes.joinToString("") { "%02x".format(it) }
+            
+            Log.i(AppConfig.TAG, "Expected SHA-256: $expectedHash, Actual: $actualHash")
+            return@withContext expectedHash.equals(actualHash, ignoreCase = true)
+        } catch (e: Exception) {
+            Log.e(AppConfig.TAG, "Failed to verify checksum: ${e.message}", e)
+            return@withContext false
+        }
+    }
 }

V2rayNG/app/src/main/java/com/kiktor/v2whitelist/ui/CheckUpdateActivity.kt

@@ -90,21 +90,31 @@ class CheckUpdateActivity : BaseActivity() {
         AlertDialog.Builder(this)
             .setView(dialogView)
             .setPositiveButton(R.string.update_now) { _, _ ->
-                result.downloadUrl?.let { url ->
-                    downloadAndInstall(url)
+                if (result.downloadUrl != null) {
+                    downloadAndInstall(result)
                 }
             }
             .setNegativeButton(android.R.string.cancel, null)
             .show()
     }
 
-    private fun downloadAndInstall(url: String) {
+    private fun downloadAndInstall(result: CheckUpdateResult) {
         showLoading()
         toast("Downloading update...")
         lifecycleScope.launch {
             try {
-                val apkFile = UpdateCheckerManager.downloadApk(this@CheckUpdateActivity, url)
+                val apkFile = UpdateCheckerManager.downloadApk(this@CheckUpdateActivity, result.downloadUrl!!)
                 if (apkFile != null && apkFile.exists()) {
+                    if (result.checksumUrl != null && result.apkFileName != null) {
+                        toast("Verifying security signature...")
+                        val isValid = UpdateCheckerManager.verifyChecksum(apkFile, result.checksumUrl, result.apkFileName)
+                        if (!isValid) {
+                            apkFile.delete()
+                            toastError("Security check failed! APK might be corrupted or compromised.")
+                            hideLoading()
+                            return@launch
+                        }
+                    }
                     installApk(apkFile)
                 } else {
                     toastError("Failed to download APK")

V2rayNG/app/src/main/java/com/kiktor/v2whitelist/ui/MainActivity.kt

@@ -214,15 +214,15 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
         androidx.appcompat.app.AlertDialog.Builder(this)
             .setView(dialogView)
             .setPositiveButton(R.string.update_now) { _, _ ->
-                result.downloadUrl?.let { url ->
-                    downloadAndInstall(url)
+                if (result.downloadUrl != null) {
+                    downloadAndInstall(result)
                 }
             }
             .setNegativeButton(android.R.string.cancel, null)
             .show()
     }
 
-    private fun downloadAndInstall(url: String) {
+    private fun downloadAndInstall(result: com.kiktor.v2whitelist.dto.CheckUpdateResult) {
         val progressBar = android.widget.ProgressBar(this, null, android.R.attr.progressBarStyleHorizontal).apply {
             max = 100
             val pad = (24 * resources.displayMetrics.density).toInt()
@@ -237,13 +237,22 @@ class MainActivity : HelperBaseActivity(), NavigationView.OnNavigationItemSelect
 
         lifecycleScope.launch {
             try {
-                val apkFile = com.kiktor.v2whitelist.handler.UpdateCheckerManager.downloadApk(this@MainActivity, url) { progress ->
+                val apkFile = com.kiktor.v2whitelist.handler.UpdateCheckerManager.downloadApk(this@MainActivity, result.downloadUrl!!) { progress ->
                     runOnUiThread {
                         progressBar.progress = progress
                     }
                 }
                 progressDialog.dismiss()
                 if (apkFile != null && apkFile.exists()) {
+                    if (result.checksumUrl != null && result.apkFileName != null) {
+                        toast("Verifying security signature...")
+                        val isValid = com.kiktor.v2whitelist.handler.UpdateCheckerManager.verifyChecksum(apkFile, result.checksumUrl, result.apkFileName)
+                        if (!isValid) {
+                            apkFile.delete()
+                            toast("Security check failed! APK might be corrupted or compromised.")
+                            return@launch
+                        }
+                    }
                     installApk(apkFile)
                 } else {
                     toast(R.string.toast_failure)