Comparing changes

Resolve the proxy's CA, inspect the presented chain, and pre-flight that the proxy signs with the chosen CA before installing the certificate into the guest trust store. - Proxy probe retrieves the CA and reads the chain through the shared OpenSSL helper, including the CA constraint extension. - The chain verdict is decided from the anchor comparison, and the chosen CA is decided once before the trust object is built. - Certificate record and install orchestration refuse a concurrent install, clean up the guest on failure, and drop the record when it cannot be written. - The injector factory selects the path from the session capability probe: a KernelSU module, or a writable system session with an optional shell-root ramdisk. Writable system sessions can pick the system image tag. - Trust store staging is kept out of later rebuilds, and the APEX store is probed from the zygote listing so apps see the injected entry. - Settings expose certificate import and install state, covered by unit tests, fixtures, an integration script, and documentation.

The adb shell in guest() inherited stdin, so it consumed the here-document that feeds run_commands: only the first install command ran and service.sh never executed, which made every install look broken. The removal drift guard also expected the module directory expanded into the entry path, while the removal script names the entry through $MODDIR. Accept either form after checking that MODDIR itself is the expected directory.

The acceptance run on the Play image with a shell-root ramdisk showed the bind into the init mount namespace failing while the shell's namespace and zygote64's accept it. Apps still trust the certificate, yet the claim that every namespace is rebound is too strong and the install ignores the one line of standard error. Record the measurement and the question it leaves.

…nce-stdin fix: stop adb shell from eating the acceptance commands

The KernelSU path now has runtime evidence: the acceptance script passes the install, namespace, reboot, rebuild and removal cycle, and a real app with a per-app proxy set through Mandroid was captured decrypted after installing a certificate file from Settings, having failed the TLS handshake before. Leave the writable-system path, the acceptance script's writable-system shape, and certificate pinning marked as unmeasured, and update the unit suite count.

Pasted PEM and Get from Proxy both complete an install against Reqable 3.3.1, joining the file picker already measured. The proxy path resolves through the issuer carried in the TLS chain, not through a download endpoint: mitm.it answers 404. That contradicts the earlier note that Reqable sends only the leaf, so record the version the measurement belongs to.

Navigation Menu

Repository navigation

Comparing changes

Open a pull request

Uh oh!

Commits on Oct 22, 2026

This comparison is taking too long to generate.

Uh oh!