Merge remote-tracking branch 'origin/main' into adb-device-selection

# Conflicts:
#	acquisition/acquisition.go

Author: besendorf

.github/workflows/container.yaml

@@ -0,0 +1,58 @@
+name: Build container image
+
+on:
+    release:
+        types:
+            - published
+
+permissions:
+    contents: read
+    packages: write
+
+jobs:
+    container:
+        name: Build and publish container image
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+
+            - name: Set image version
+              id: version
+              run: |
+                  version="${{ github.event.release.tag_name }}"
+                  echo "version=${version#v}" >> "$GITHUB_OUTPUT"
+
+            - name: Set up QEMU
+              uses: docker/setup-qemu-action@v3
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v3
+
+            - name: Log in to GitHub Container Registry
+              uses: docker/login-action@v3
+              with:
+                  registry: ghcr.io
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Extract container metadata
+              id: meta
+              uses: docker/metadata-action@v5
+              with:
+                  images: ghcr.io/mvt-project/androidqf
+                  tags: |
+                      type=semver,pattern={{version}},value=${{ github.event.release.tag_name }}
+                      type=semver,pattern={{major}}.{{minor}},value=${{ github.event.release.tag_name }}
+                      type=raw,value=latest,enable=${{ github.event.release.prerelease == false }}
+
+            - name: Build and publish
+              uses: docker/build-push-action@v6
+              with:
+                  context: .
+                  platforms: linux/amd64,linux/arm64
+                  push: true
+                  build-args: |
+                      VERSION=${{ steps.version.outputs.version }}
+                  labels: ${{ steps.meta.outputs.labels }}
+                  tags: ${{ steps.meta.outputs.tags }}

Dockerfile

@@ -0,0 +1,18 @@
+FROM alpine:3.23
+
+ARG TARGETARCH=amd64
+ARG VERSION=1.8.3
+
+RUN apk add --no-cache ca-certificates gcompat libgcc wget \
+    && case "${TARGETARCH}" in \
+        amd64|arm64) ;; \
+        *) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac \
+    && wget -O /usr/local/bin/androidqf \
+        "https://github.com/mvt-project/androidqf/releases/download/v${VERSION}/androidqf_linux_${TARGETARCH}_${VERSION}" \
+    && chmod +x /usr/local/bin/androidqf
+
+WORKDIR /acquisition
+
+ENTRYPOINT ["androidqf"]
+CMD ["-output", "/output"]

README.md

@@ -69,6 +69,30 @@ but the `assets/` package directory and its Go source files must remain present.
 The `unbundle` build still imports the `assets` package, and the build will fail
 if the whole `assets/` directory is deleted.
 
+## Container image
+
+The release container image is published to GitHub Container Registry:
+
+```bash
+docker pull ghcr.io/mvt-project/androidqf:latest
+```
+
+To collect from a USB-connected Android device on Linux, pass through the USB
+bus and mount an output directory:
+
+```bash
+docker run --rm -it --privileged \
+  -v /dev/bus/usb:/dev/bus/usb \
+  -v "$(pwd)/output:/output" \
+  ghcr.io/mvt-project/androidqf:latest -fast -output /output
+```
+
+You can also build the image locally for a released version:
+
+```bash
+docker build --build-arg VERSION=1.8.3 -t androidqf .
+```
+
 ## How to use
 
 > [!TIP]
@@ -78,7 +102,7 @@ Before launching androidqf you need to have the target Android device connected
 
 Once USB debugging is enabled, you can proceed launching androidqf. It will first attempt to connect to the device over the USB bridge, which should result in the Android phone to prompt you to manually authorize the host keys. Make sure to authorize them, ideally permanently so that the prompt wouldn't appear again.
 
-Now androidqf should be executing and creating an acquisition folder at the same path you have placed your androidqf binary. At some point in the execution, androidqf will prompt you some choices: these prompts will pause the acquisition until you provide a selection, so pay attention.
+Now androidqf should be executing and creating an acquisition folder in your current working directory. At some point in the execution, androidqf will prompt you some choices: these prompts will pause the acquisition until you provide a selection, so pay attention.
 
 The following data can be extracted:
 
@@ -162,7 +186,7 @@ Ideally you should have the drive fully encrypted, but that might not always be
 
 Alternatively, androidqf allows to encrypt each acquisition with a provided [age](https://age-encryption.org) public key. Preferably, this public key belongs to a keypair for which the end-user does not possess, or at least carry, the private key. In this way, the end-user would not be able to decrypt the acquired data even under duress.
 
-If you place a file called `key.txt` in the same folder as the androidqf executable, androidqf will automatically attempt to compress and encrypt each acquisition and delete the original unencrypted copies.
+If you place a file called `key.txt` in the current working directory, androidqf will automatically attempt to compress and encrypt each acquisition and delete the original unencrypted copies. androidqf also checks for `key.txt` in the same folder as the executable; if both files exist, the current working directory takes precedence.
 
 Once you have retrieved an encrypted acquisition file, you can decrypt it with age like so:
 

acquisition/acquisition.go

@@ -118,7 +118,9 @@ func New(path string) (*Acquisition, error) {
 }
 
 func (a *Acquisition) Complete() {
-	a.Completed = time.Now().UTC()
+	if a.Completed.IsZero() {
+		a.Completed = time.Now().UTC()
+	}
 
 	// Handle streaming mode completion
 	if a.StreamingMode && a.EncryptedWriter != nil {
@@ -266,6 +268,10 @@ func (a *Acquisition) StoreInfo() error {
 		return nil
 	}
 
+	if a.Completed.IsZero() {
+		a.Completed = time.Now().UTC()
+	}
+
 	log.Info("Saving details about acquisition and device...")
 
 	info, err := json.MarshalIndent(a, "", " ")

acquisition/acquisition_test.go

@@ -0,0 +1,85 @@
+package acquisition
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestStoreInfoSetsCompletedTimestamp(t *testing.T) {
+	acq := &Acquisition{
+		UUID:        "test-acquisition",
+		StoragePath: t.TempDir(),
+	}
+
+	if err := acq.StoreInfo(); err != nil {
+		t.Fatalf("StoreInfo() error = %v", err)
+	}
+
+	if acq.Completed.IsZero() {
+		t.Fatal("StoreInfo() left Completed unset")
+	}
+
+	info, err := os.ReadFile(filepath.Join(acq.StoragePath, "acquisition.json"))
+	if err != nil {
+		t.Fatalf("ReadFile(acquisition.json) error = %v", err)
+	}
+
+	var stored Acquisition
+	if err := json.Unmarshal(info, &stored); err != nil {
+		t.Fatalf("json.Unmarshal(acquisition.json) error = %v", err)
+	}
+	if stored.Completed.IsZero() {
+		t.Fatal("acquisition.json contains a zero completed timestamp")
+	}
+}
+
+func TestCompleteDoesNotOverwriteExistingCompletedTimestamp(t *testing.T) {
+	acq := &Acquisition{
+		UUID:        "test-acquisition",
+		StoragePath: t.TempDir(),
+	}
+
+	if err := acq.StoreInfo(); err != nil {
+		t.Fatalf("StoreInfo() error = %v", err)
+	}
+	completed := acq.Completed
+
+	acq.Complete()
+
+	if !acq.Completed.Equal(completed) {
+		t.Fatalf("Complete() changed Completed from %s to %s", completed, acq.Completed)
+	}
+}
+
+func TestStoreSecurelyUsesCurrentWorkingDirectory(t *testing.T) {
+	cwd := t.TempDir()
+	t.Chdir(cwd)
+	writeTestAgeKey(t, cwd)
+
+	storagePath := filepath.Join(cwd, "test-acquisition")
+	if err := os.Mkdir(storagePath, 0o755); err != nil {
+		t.Fatalf("Mkdir(storagePath) error = %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(storagePath, "data.txt"), []byte("evidence"), 0o600); err != nil {
+		t.Fatalf("WriteFile(data.txt) error = %v", err)
+	}
+
+	acq := &Acquisition{
+		UUID:        "test-acquisition",
+		StoragePath: storagePath,
+	}
+
+	if err := acq.StoreSecurely(); err != nil {
+		t.Fatalf("StoreSecurely() error = %v", err)
+	}
+
+	wantPath := filepath.Join(cwd, "test-acquisition.zip.age")
+	if _, err := os.Stat(wantPath); err != nil {
+		t.Fatalf("Stat(encrypted output) error = %v", err)
+	}
+	if _, err := os.Stat(storagePath); !os.IsNotExist(err) {
+		t.Fatalf("storage path still exists or returned unexpected error: %v", err)
+	}
+}

acquisition/encrypted_stream.go

@@ -21,7 +21,6 @@ import (
 	"time"
 
 	"filippo.io/age"
-	saveRuntime "github.com/botherder/go-savetime/runtime"
 	"github.com/mvt-project/androidqf/log"
 )
 
@@ -55,11 +54,17 @@ func (hw *hashingWriter) Write(p []byte) (int, error) {
 
 // NewEncryptedZipWriter creates a new encrypted zip writer if key.txt exists
 func NewEncryptedZipWriter(uuid string) (*EncryptedZipWriter, error) {
-	cwd := saveRuntime.GetExecutableDirectory()
-	keyFilePath := filepath.Join(cwd, "key.txt")
+	cwd, err := os.Getwd()
+	if err != nil {
+		return nil, err
+	}
 
 	// Check if key file exists
-	if _, err := os.Stat(keyFilePath); os.IsNotExist(err) {
+	keyFilePath, ok, err := findAgeKeyFile()
+	if err != nil {
+		return nil, err
+	}
+	if !ok {
 		return nil, fmt.Errorf("key.txt not found, encrypted streaming not available")
 	}
 

acquisition/encrypted_stream_test.go

@@ -7,8 +7,12 @@ import (
 	"encoding/csv"
 	"encoding/hex"
 	"io"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
+
+	"filippo.io/age"
 )
 
 func TestCreateHashListTracksPlaintextZipEntries(t *testing.T) {
@@ -93,6 +97,44 @@ func sha256Hex(content string) string {
 	return hex.EncodeToString(sum[:])
 }
 
+func writeTestAgeKey(t *testing.T, dir string) {
+	t.Helper()
+
+	identity, err := age.GenerateX25519Identity()
+	if err != nil {
+		t.Fatalf("GenerateX25519Identity() error = %v", err)
+	}
+
+	keyPath := filepath.Join(dir, "key.txt")
+	if err := os.WriteFile(keyPath, []byte(identity.Recipient().String()), 0o600); err != nil {
+		t.Fatalf("WriteFile(key.txt) error = %v", err)
+	}
+}
+
+func TestNewEncryptedZipWriterUsesCurrentWorkingDirectory(t *testing.T) {
+	cwd := t.TempDir()
+	t.Chdir(cwd)
+	writeTestAgeKey(t, cwd)
+
+	ezw, err := NewEncryptedZipWriter("test-acquisition")
+	if err != nil {
+		t.Fatalf("NewEncryptedZipWriter() error = %v", err)
+	}
+	defer os.Remove(ezw.GetOutputPath())
+
+	if err := ezw.Close(); err != nil {
+		t.Fatalf("Close() error = %v", err)
+	}
+
+	wantPath := filepath.Join(cwd, "test-acquisition.zip.age")
+	if ezw.GetOutputPath() != wantPath {
+		t.Fatalf("output path = %q, want %q", ezw.GetOutputPath(), wantPath)
+	}
+	if _, err := os.Stat(wantPath); err != nil {
+		t.Fatalf("Stat(output) error = %v", err)
+	}
+}
+
 func TestValidateZipEntryName(t *testing.T) {
 	tests := []struct {
 		name    string

acquisition/key.go

@@ -0,0 +1,46 @@
+// androidqf - Android Quick Forensics
+// Copyright (c) 2021-2022 Claudio Guarnieri.
+// Use of this software is governed by the MVT License 1.1 that can be found at
+//   https://license.mvt.re/1.1/
+
+package acquisition
+
+import (
+	"os"
+	"path/filepath"
+)
+
+const keyFileName = "key.txt"
+
+func findAgeKeyFile() (string, bool, error) {
+	cwd, err := os.Getwd()
+	if err != nil {
+		return "", false, err
+	}
+	if keyPath, ok := findAgeKeyFileInDirs(cwd, ""); ok {
+		return keyPath, true, nil
+	}
+
+	exe, err := os.Executable()
+	if err != nil {
+		return "", false, err
+	}
+
+	keyPath, ok := findAgeKeyFileInDirs(cwd, filepath.Dir(exe))
+	return keyPath, ok, nil
+}
+
+func findAgeKeyFileInDirs(cwd, executableDir string) (string, bool) {
+	for _, dir := range []string{cwd, executableDir} {
+		if dir == "" {
+			continue
+		}
+
+		keyPath := filepath.Join(dir, keyFileName)
+		if _, err := os.Stat(keyPath); err == nil {
+			return keyPath, true
+		}
+	}
+
+	return "", false
+}