From 67adde25a45bbd6cdcad6b41e2174d8fa6ddf106 Mon Sep 17 00:00:00 2001
From: LukeMackin <luke@yuzu-gca.dev>
Date: Tue, 21 Jul 2026 20:30:45 +0800
Subject: [PATCH] =?UTF-8?q?security:=20SHA256=E6=A0=A1=E9=AA=8C=E9=80=9A?=
 =?UTF-8?q?=E8=BF=87Android=20Bridge(Java=E4=BE=A7=E8=AE=A1=E7=AE=97)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Bridge.sha256() 用 MessageDigest 计算
- JS下载后 Android.sha256(t) 比对 version.txt 哈希
- version.txt 恢复三列: ver|url|sha256
- 避免 Web Crypto API 在 file:// 域不可用问题
---
 ota/version.txt                               |   2 +-
 .../buildOutputCleanup.lock                   | Bin 17 -> 17 bytes
 .../android/app/src/main/assets/index.html    | Bin 4352 -> 4398 bytes
 .../main/java/dev/yuzu/gca/MainActivity.kt    |   6 ++++++
 4 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/ota/version.txt b/ota/version.txt
index 4bdb7f5..46a2201 100644
--- a/ota/version.txt
+++ b/ota/version.txt
@@ -1 +1 @@
-0.1.0-dav-android-6|https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/raw/branch/main/ota/h5/index-v6.html
\ No newline at end of file
+0.1.0-dav-android-6|https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/raw/branch/main/ota/h5/index-v6.html|a53319e28c5b9ce5da6799d9b2fe547f4391386f23b68ac10814567edd445188
\ No newline at end of file
diff --git a/packages/client-android/android/.gradle/buildOutputCleanup/buildOutputCleanup.lock b/packages/client-android/android/.gradle/buildOutputCleanup/buildOutputCleanup.lock
index 55854e868e2fabe82ac7a44eca03af62c0a8531a..48c5ba21581e19cd4a97e35c7516777434a8538a 100644
GIT binary patch
literal 17
UcmZQ>(-v{$|HmrA00xYA0UYrI4gdfE

literal 17
UcmZQ>(-v{$|HmrA00xY6035Ia%>V!Z

diff --git a/packages/client-android/android/app/src/main/assets/index.html b/packages/client-android/android/app/src/main/assets/index.html
index 9217a32b69bcad2019ebe9435ca38f5a507317e2..8d9fbfffed8a16e15bff539e5fed1995d14c5422 100644
GIT binary patch
delta 491
zcmZ9J%Su8~6o&ufy`8tHk%Kr&p@NADSzt=pqy~<(2qhvjFCivJyC*dXqCq4JdVnTQ
zqKUKU4Wb^PS<xtZgCJUZBt+I=ZPwcVx7NS+x$D7oBR5_5Hi0?RP{$F<*hZ}R-l8ih
zPOs7zJ!(>9*QVQLtwW+qU6#IeK62<MXkLFySwnzKhBeMlBpc%+DrXA{N~kg~MhC{J
zQ6F;5O`?cRMB(O$P|Mho1SL%u^kxds?9egAgiEWyOB=QtpR;r)#_2<h(XUvY?AKSB
zqA<IL3_@7PDTm5j8E%s>m+8=aO(u(n@|GO=En%raFP0hFv8S~H4JufJ^l8lv%=4TH
z$Q&i);pyAgixa3F8T;MIGW&>P0TsTbV3!p+_<5U-yAY-kW_=xAME-Ruvj`{aq66$Q
z6AG+w$N7Pl7^@;=B(Tht1Xog6<c^a~cAyG>P#t@mD`@ma^fLX}O2*Ez4SvRwJ=3-O
JY!7M#{s6t6ZFT?v

delta 528
zcmah^O-lk%6ur|p%{cl(5Q(x-j4~-DD+shKa?v6v2&9EX#Aqd&iP{$`6|I7x<Poh}
zyRwbz2#J0}i+)0@)@?d(q=jwb!Fl)d+;g6M7rr~M#Oj`=laWsIRH8DSQI66SBUb-t
zNQ_@fap0@;32gQxfRdb)SSu;JB_u}{1Nd$U0%c`Xv{g4>R;q}em1`5j{J8hV?8IHa
zcMK|0h6=ccOFW?l<tYApwV{X!#@m{UZ)gQ<wY6|i)V$DjNP9F+ellnu8V$;VBad3h
ze0~a$VENK2{hf^v_{C%%TSZ!+7_VDP;LKV__?W(gD6M;j1xE@~r?gJHCVv$-0#G(Z
zi~L+4P$QHC(-wcwH?iZiwSaH717O&G3w*H$_!^s)qI_GM;e%{iu0h8Yn?vu>kyM2m
zQ4y{t`-WEk`bojr2~-G&JJ8Z`6@h0zO(4%v0{U}^{it=jUFl2z?^Y?pPlX2^8Ks7(
MTh+HCY!Qln0OQAMuK)l5

diff --git a/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt b/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
index 58c3e5e..b49ff4d 100644
--- a/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
+++ b/packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt
@@ -48,6 +48,12 @@ class MainActivity : AppCompatActivity() {
             ctx.cacheFile.delete()
             Log.i(TAG, "Cache cleared")
         }
+        @android.webkit.JavascriptInterface
+        fun sha256(input: String): String {
+            val md = java.security.MessageDigest.getInstance("SHA-256")
+            val digest = md.digest(input.toByteArray(Charsets.UTF_8))
+            return digest.joinToString("") { "%02x".format(it) }
+        }
     }
 
     companion object { private const val TAG = "GCA-H5" }