rustls/rustls-platform-verifier

Explicitly remove and/or verify Android mock test code in release builds

complexspaces opened this issue · 0 comments

In the Android verifier implementation, we have several class fields and conditionals that are solely in place to facilitate testing with mocked certificates and roots. While the use of said store is guarded, it would be better if it was provable these couldn't affect a production app, similar to #[cfg(debug_assertions)] in Rust.

I can think of two initial approaches for this:

  • Create custom Proguard rules that remove this code from anything but an explicit integration test build
  • Automatically verify that the code doesn't end up being loaded at runtime