[verified] Publish ReelBox source under GPLv3

tool/test_release_signer.py

@@ -0,0 +1,21 @@
+"""Release identity verification must accept only the explicitly pinned signer."""
+import unittest
+from verify_apk import verified_signer
+
+SHA = 'd684537f3637fde36c9e7b065b5acd78499c02d345c34bf87857b13ed1d8b87d'
+
+
+class SignerTests(unittest.TestCase):
+    def test_authorized_replacement_key_has_its_actual_subject(self):
+        text = f'Signer #1 certificate DN: CN=Reelbox Release, OU=Reelbox\nSigner #1 certificate SHA-256 digest: {SHA}\n'
+        self.assertEqual(verified_signer(text, SHA), (SHA, 'CN=Reelbox Release, OU=Reelbox'))
+
+    def test_mismatched_or_debug_signer_is_rejected(self):
+        with self.assertRaises(AssertionError):
+            verified_signer(f'Signer #1 certificate DN: CN=Reelbox Release\nSigner #1 certificate SHA-256 digest: {SHA}', 'a' * 64)
+        with self.assertRaises(AssertionError):
+            verified_signer(f'Signer #1 certificate DN: CN=Android Debug\nSigner #1 certificate SHA-256 digest: {SHA}', SHA)
+
+
+if __name__ == '__main__':
+    unittest.main()