{"action":"created","issue":{"url":"https://api.github.com/repos/crosswalk-project/crosswalk/issues/2944","labels_url":"https://api.github.com/repos/crosswalk-project/crosswalk/issues/2944/labels{/name}","comments_url":"https://api.github.com/repos/crosswalk-project/crosswalk/issues/2944/comments","events_url":"https://api.github.com/repos/crosswalk-project/crosswalk/issues/2944/events","html_url":"https://github.com/crosswalk-project/crosswalk/pull/2944","id":65188026,"number":2944,"title":"[Android] Security check for shared mode","user":{"login":"lincsoon","id":1285835,"avatar_url":"https://avatars.githubusercontent.com/u/1285835?v=3","gravatar_id":"","url":"https://api.github.com/users/lincsoon","html_url":"https://github.com/lincsoon","followers_url":"https://api.github.com/users/lincsoon/followers","following_url":"https://api.github.com/users/lincsoon/following{/other_user}","gists_url":"https://api.github.com/users/lincsoon/gists{/gist_id}","starred_url":"https://api.github.com/users/lincsoon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lincsoon/subscriptions","organizations_url":"https://api.github.com/users/lincsoon/orgs","repos_url":"https://api.github.com/users/lincsoon/repos","events_url":"https://api.github.com/users/lincsoon/events{/privacy}","received_events_url":"https://api.github.com/users/lincsoon/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-03-30T11:07:13Z","updated_at":"2015-04-02T02:49:49Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/crosswalk-project/crosswalk/pulls/2944","html_url":"https://github.com/crosswalk-project/crosswalk/pull/2944","diff_url":"https://github.com/crosswalk-project/crosswalk/pull/2944.diff","patch_url":"https://github.com/crosswalk-project/crosswalk/pull/2944.patch"},"body":"Before the app loading Crosswalk library on device, it is necessary\r\nto make sure the library APK is not tampered and is exactly the one\r\nwe published.\r\n\r\nThe officially released library APK is signed with the signing key\r\nfrom codesign.intel.com. The foundation of this approach is that the\r\npackage manager is trustworthy and the fingerprinting algorithm is\r\nnot broken.\r\n\r\nThe verification process are:\r\n1. Get signatures of Crosswalk library via package manager\r\n2. Generate SHA1 fingerprint by the signature\r\n3. Check against the fingerprint from codesign.intel.com\r\n\r\nBUG=XWALK-3804"},"comment":{"url":"https://api.github.com/repos/crosswalk-project/crosswalk/issues/comments/88708092","html_url":"https://github.com/crosswalk-project/crosswalk/pull/2944#issuecomment-88708092","issue_url":"https://api.github.com/repos/crosswalk-project/crosswalk/issues/2944","id":88708092,"user":{"login":"lincsoon","id":1285835,"avatar_url":"https://avatars.githubusercontent.com/u/1285835?v=3","gravatar_id":"","url":"https://api.github.com/users/lincsoon","html_url":"https://github.com/lincsoon","followers_url":"https://api.github.com/users/lincsoon/followers","following_url":"https://api.github.com/users/lincsoon/following{/other_user}","gists_url":"https://api.github.com/users/lincsoon/gists{/gist_id}","starred_url":"https://api.github.com/users/lincsoon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lincsoon/subscriptions","organizations_url":"https://api.github.com/users/lincsoon/orgs","repos_url":"https://api.github.com/users/lincsoon/repos","events_url":"https://api.github.com/users/lincsoon/events{/privacy}","received_events_url":"https://api.github.com/users/lincsoon/received_events","type":"User","site_admin":false},"created_at":"2015-04-02T02:49:49Z","updated_at":"2015-04-02T02:49:49Z","body":"I confirmed that the fingerprint of Android signing key in codesign.intel.com is generated by SHA1. If I generate the digest of the signature of Crosswalk package by SHA256, the fingerprint doesn't match."}}