[WIP] fix: Security audit

.env.secret.example

@@ -0,0 +1,11 @@
+FERAL_FILE_SECRET_KEY_TESTNET=
+FERAL_FILE_SECRET_KEY_MAINNET=
+CHAT_SERVER_HMAC_KEY=
+AU_CLAIM_SECRET_KEY=
+MIXPANEL_KEY=
+METRIC_SECRET_KEY=
+BRANCH_KEY=
+SENTRY_DSN=
+ONESIGNAL_APP_ID=
+METRIC_ENDPOINT=
+WEB3_RPC_MAINNET_URL=

.github/workflows/android-release-appcenter.yaml

@@ -35,6 +35,8 @@ jobs:
           echo "FLUTTER_VERSION_CODE=${{ github.event.inputs.build-number }}" >> $GITHUB_ENV
           echo "BRANCH_KEY=${{ secrets.BRANCH_KEY }}" >> $GITHUB_ENV
           echo "BRANCH_KEY_TEST=${{ secrets.BRANCH_KEY_TEST }}" >> $GITHUB_ENV
+          echo "SIGNATURE_HASH=${{ secrets.SIGNATURE_HASH }}" >> $GITHUB_ENV
+          echo "SIGNATURE_HASH_INHOUSE=${{ secrets.SIGNATURE_HASH_INHOUSE }}" >> $GITHUB_ENV
           ${{ github.event.inputs.testnet == 'true' }} && echo APPCENTER_APP_ID=support-zzd0-28/Autonomy-Android-Test >> $GITHUB_ENV || echo APPCENTER_APP_ID=support-zzd0-28/Autonomy-Android-1 >> $GITHUB_ENV
           ${{ github.event.inputs.testnet == 'true' }} && echo NAME_SUFFIX=test-${{ github.event.inputs.build-number }} >> $GITHUB_ENV || echo NAME_SUFFIX=main-${{ github.event.inputs.build-number }} >> $GITHUB_ENV
 
@@ -45,13 +47,25 @@ jobs:
       - name: Create env file
         run: |
           touch .env
-          ${{ inputs.testnet == true }} && echo -e "${{ secrets.DEV_ENV }}" | sed 's/\\n/\n/g' >> .env || echo -e "${{ secrets.STAGING_ENV }}" | sed 's/\\n/\n/g' >> .env
+          ${{ inputs.testnet == true }} && echo -e "${{ secrets.DEV_ENV_VARS }}" | sed 's/\\n/\n/g' >> .env || echo -e "${{ secrets.STAGING_ENV_VARS }}" | sed 's/\\n/\n/g' >> .env
           cat .env
 
+      - name: Create env secret file
+        run: |
+          touch .env.secret
+          ${{ inputs.testnet == true }} && echo -e "${{ secrets.DEV_ENV_SECRET }}" | sed 's/\\n/\n/g' >> .env.secret || echo -e "${{ secrets.STAGING_ENV_SECRET }}" | sed 's/\\n/\n/g' >> .env.secret
+          cat .env.secret
+
       - name: Submoudles update
         run: git -c submodule.auto-test.update=none submodule update --init --recursive
       - run: flutter pub cache repair
       - run: flutter pub get
+
+      # Encrypt secrets before use
+      - name: Encrypt Secrets
+        run: |
+          ./script/encrypt_secrets.sh ${{ secrets.ENTROPY }}
+
       - run: flutter build apk --flavor inhouse
       - run: mv build/app/outputs/flutter-apk/app-inhouse-release.apk build/app/outputs/flutter-apk/app-inhouse-release-${{ env.NAME_SUFFIX }}.apk
       - name: Distribute apk to App Center

.github/workflows/bmvn_build_appcenter_android.yaml

@@ -65,6 +65,8 @@ jobs:
           # echo "FLUTTER_VERSION_CODE=${{ inputs.build-number }}" >> $GITHUB_ENV
           echo "BRANCH_KEY=${{ secrets.BRANCH_KEY }}" >> $GITHUB_ENV
           echo "BRANCH_KEY_TEST=${{ secrets.BRANCH_KEY_TEST }}" >> $GITHUB_ENV
+          echo "SIGNATURE_HASH=${{ secrets.SIGNATURE_HASH }}" >> $GITHUB_ENV
+          echo "SIGNATURE_HASH_INHOUSE=${{ secrets.SIGNATURE_HASH_INHOUSE }}" >> $GITHUB_ENV
           ${{ inputs.testnet == true }} && echo APPCENTER_APP_ID=support-zzd0-28/Autonomy-Android-Test >> $GITHUB_ENV || echo APPCENTER_APP_ID=support-zzd0-28/Autonomy-Android-1 >> $GITHUB_ENV
           ${{ inputs.testnet == true }} && echo NAME_SUFFIX=test-${{env.FLUTTER_VERSION_CODE}} >> $GITHUB_ENV || echo NAME_SUFFIX=main-${{env.FLUTTER_VERSION_CODE}} >> $GITHUB_ENV
 
@@ -75,13 +77,25 @@ jobs:
       - name: Create env file
         run: |
           touch .env
-          ${{ inputs.testnet == true }} && echo -e "${{ secrets.DEV_ENV }}" | sed 's/\\n/\n/g' >> .env || echo -e "${{ secrets.STAGING_ENV }}" | sed 's/\\n/\n/g' >> .env
+          ${{ inputs.testnet == true }} && echo -e "${{ secrets.DEV_ENV_VARS }}" | sed 's/\\n/\n/g' >> .env || echo -e "${{ secrets.STAGING_ENV_VARS }}" | sed 's/\\n/\n/g' >> .env
           cat .env
 
+      - name: Create env secret file
+        run: |
+          touch .env.secret
+          ${{ inputs.testnet == true }} && echo -e "${{ secrets.DEV_ENV_SECRET }}" | sed 's/\\n/\n/g' >> .env.secret || echo -e "${{ secrets.STAGING_ENV_SECRET }}" | sed 's/\\n/\n/g' >> .env.secret
+          cat .env.secret
+
       - name: Submoudles update
         run: git -c submodule.auto-test.update=none submodule update --init --recursive
       - run: flutter pub cache repair
       - run: flutter pub get
+
+      # Encrypt secrets before use
+      - name: Encrypt Secrets
+        run: |
+          ./script/encrypt_secrets.sh ${{ secrets.ENTROPY }}
+
       - run: flutter build apk --flavor inhouse
       - run: mv build/app/outputs/flutter-apk/app-inhouse-release.apk build/app/outputs/flutter-apk/app-inhouse-release-${{ env.NAME_SUFFIX }}.apk
       - name: Distribute apk to App Center

.github/workflows/bmvn_build_appcenter_ios.yaml

@@ -69,9 +69,15 @@ jobs:
       - name: Create env file
         run: |
           touch .env
-          ${{ inputs.testnet == true }} && echo -e "${{ secrets.DEV_ENV }}" | sed 's/\\n/\n/g' >> .env || echo -e "${{ secrets.STAGING_ENV }}" | sed 's/\\n/\n/g' >> .env
+          ${{ inputs.testnet == true }} && echo -e "${{ secrets.DEV_ENV_VARS }}" | sed 's/\\n/\n/g' >> .env || echo -e "${{ secrets.STAGING_ENV_VARS }}" | sed 's/\\n/\n/g' >> .env
           cat .env
 
+      - name: Create env secret file
+        run: |
+          touch .env.secret
+          ${{ inputs.testnet == true }} && echo -e "${{ secrets.DEV_ENV_SECRET }}" | sed 's/\\n/\n/g' >> .env.secret || echo -e "${{ secrets.STAGING_ENV_SECRET }}" | sed 's/\\n/\n/g' >> .env.secret
+          cat .env.secret
+
       - name: Flutter doctor
         run: flutter doctor
       - name: Submoudles update
@@ -96,6 +102,11 @@ jobs:
           cd ios/
           pod install
 
+      # Encrypt secrets before use
+      - name: Encrypt Secrets
+        run: |
+          ./script/encrypt_secrets.sh ${{ secrets.ENTROPY }}
+
       - uses: mathieu-bour/setup-sentry-cli@main
 
       # Build and deploy with Fastlane (by default, to ciappcenter track) 🚀.

.github/workflows/ios-release-appcenter.yaml

@@ -54,7 +54,7 @@ jobs:
       - name: Create env file
         run: |
           touch .env
-          ${{ inputs.testnet == true }} && echo -e "${{ secrets.DEV_ENV }}" | sed 's/\\n/\n/g' >> .env || echo -e "${{ secrets.STAGING_ENV }}" | sed 's/\\n/\n/g' >> .env
+          ${{ inputs.testnet == true }} && echo -e "${{ secrets.DEV_ENV_VARS }}" | sed 's/\\n/\n/g' >> .env || echo -e "${{ secrets.STAGING_ENV_VARS }}" | sed 's/\\n/\n/g' >> .env
           cat .env
 
       - name: Flutter doctor

.github/workflows/ios-release-testflight.yaml

@@ -49,9 +49,15 @@ jobs:
       - name: Create env file
         run: |
           touch .env
-          echo -e "${{ secrets.PRODUCTION_ENV }}" | sed 's/\\n/\n/g' >> .env
+          echo -e "${{ secrets.PRODUCTION_ENV_VARS }}" | sed 's/\\n/\n/g' >> .env
           cat .env
 
+      - name: Create env secret file
+        run: |
+          touch .env.secret
+          echo -e "${{ secrets.PRODUCTION_ENV_SECRET }}" | sed 's/\\n/\n/g' >> .env.secret
+          cat .env.secret
+
       - name: Flutter doctor
         run: flutter doctor
       - name: Submoudles update
@@ -76,6 +82,11 @@ jobs:
           cd ios/
           pod install
 
+      # Encrypt secrets before use
+      - name: Encrypt Secrets
+        run: |
+          ./script/encrypt_secrets.sh ${{ secrets.ENTROPY }}
+
       - uses: mathieu-bour/setup-sentry-cli@main
 
       # Build and deploy with Fastlane (by default, to ciappcenter track) 🚀.

README.md

@@ -67,8 +67,13 @@ Bitmark started with the idea of building tools to help individuals and institut
 3. Initialize submodule by running; `git submodule update --init --recursive`
 - If you don't want to clone the auto-test package, simply run: `git -c submodule.auto-test.update=none submodule update --init --recursive`
 4. Initialize the config file. `cp .env.example .env`
-- Contact with Feral File app development team for development env.
-5. Run `flutter run --flavor inhouse` to run **Feral File** app development on the connected device.
+- Contact with Feral File app development team for development env. 
+5. Initialize the secret config file. `cp .env.secret.example .env.secret`
+- There are credentials information. You may need to provide your own credentials.Contact with Feral File app development team for consultation.
+6. Run ./script/encrypt_secrets.sh <-entropy-> to generate the encrypted secrets file.
+- <-entropy-> is a random string. You can type a random string like akhrdsgl4893tynk3iu4y8hf
+- You only need to run this script again when you want to update .env.secret.
+7. Run `flutter run --flavor inhouse` to run **Feral File** app development on the connected device.
 
 A few resources to get you started if this is your first Flutter project:
 

android/app/build.gradle

@@ -63,6 +63,10 @@ if (branchKeyTest == null) {
 
 def branchTestMode = localProperties["branch.testMode"] ?: environment["BRANCH_IS_TEST"] ?: false
 
+def signature_hash = localProperties["signature.hash"] ?: environment["SIGNATURE_HASH"]
+
+def signature_hash_inhouse = localProperties["signature.hashInhouse"] ?: environment["SIGNATURE_HASH_INHOUSE"]
+
 android {
     compileSdkVersion 34
     flavorDimensions 'env'
@@ -77,7 +81,7 @@ android {
     defaultConfig {
         // TODO: Specify your own unique Application ID (https://developer.android.com/studio/build/application-id.html).
         applicationId "com.bitmark.autonomy_client"
-        minSdkVersion 24
+        minSdkVersion 29
         targetSdkVersion 34
         versionCode flutterVersionCode.toInteger()
         versionName flutterVersionName
@@ -94,6 +98,8 @@ android {
             // TODO: Add your own signing config for the release build.
             // Signing with the debug keys for now, so `flutter run --release` works.
             signingConfig signingConfigs.debug
+            minifyEnabled true
+            shrinkResources true
 
             proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
 
@@ -109,6 +115,8 @@ android {
                     appIcon     : "@mipmap/ic_launcher_dev",
                     appIconRound: "@mipmap/ic_launcher_dev_round"
             ]
+            buildConfigField "boolean", "ENABLE_DEBUGGER_DETECTION", "false"
+            buildConfigField "String", "SIGNATURE_HASH", '\"' + signature_hash_inhouse + '\"'
         }
 
         prd {
@@ -118,6 +126,10 @@ android {
                     appIcon     : "@mipmap/ic_launcher",
                     appIconRound: "@mipmap/ic_launcher_round"
             ]
+            buildConfigField "boolean", "ENABLE_DEBUGGER_DETECTION", "true"
+            // SIGNATURE_HASH with value from local.properties
+
+            buildConfigField "String", "SIGNATURE_HASH", '\"' + signature_hash + '\"'
         }
     }
     packagingOptions {
@@ -146,10 +158,10 @@ dependencies {
 
     implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk7:$kotlin_version"
     implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.4.1")
-    implementation 'com.google.android.gms:play-services-auth-blockstore:16.1.0'
+    implementation 'com.google.android.gms:play-services-auth-blockstore:16.2.0'
     implementation 'io.reactivex.rxjava2:rxjava:2.2.10'
     implementation 'io.reactivex.rxjava2:rxandroid:2.1.1'
-    implementation('com.github.bitmark-inc:libauk-kotlin:0.5.1') {
+    implementation('com.github.bitmark-inc:libauk-kotlin:f38858213e') {
         exclude group: 'com.google.protobuf'
         exclude module: 'jetified-protobuf-java'
     }
@@ -166,6 +178,7 @@ dependencies {
     implementation(platform("com.walletconnect:android-bom:1.12.0"))
     implementation("com.walletconnect:android-core:1.17.0")
     implementation("com.walletconnect:sign:2.15.0")
+    implementation("com.scottyab:rootbeer-lib:0.1.0")
 
     implementation("com.github.airgap-it:beacon-android-sdk:$beacon_version") {
         exclude group: 'com.goterl'

android/app/src/main/AndroidManifest.xml

@@ -3,6 +3,7 @@
     xmlns:tools="http://schemas.android.com/tools"
     package="com.bitmark.autonomy_flutter">
 
+    <uses-permission android:name="android.permission.HIDE_OVERLAY_WINDOWS" />
     <uses-permission android:name="android.permission.INTERNET" />
     <uses-permission android:name="android.permission.BLUETOOTH" />
     <uses-permission android:name="android.permission.BLUETOOTH_ADMIN" />
@@ -25,12 +26,8 @@
         android:icon="${appIcon}"
         android:label="@string/app_name"
         android:roundIcon="${appIconRound}"
-        android:usesCleartextTraffic="true"
+        android:networkSecurityConfig="@xml/network_security_config"
         tools:replace="android:label">
-        <!--
-         - Enable usesCleartextTraffic only to allow make connection to localhost
-         - It will be used to rendering model viewer for 3d artworks.
-         -->
 
         <meta-data
             android:name="com.onesignal.NotificationServiceExtension"