From 11cad9a78af71b93eb49cf7f1c185a096e522fe7 Mon Sep 17 00:00:00 2001
From: Brent Perteet <brent.perteet@gmail.com>
Date: Thu, 20 Aug 2026 13:10:35 -0500
Subject: [PATCH] SEC-1: build-inject Google Maps Android key; remove leaked
 literal

Removes the leaked Google Maps API key literal from README.md and the
live com.google.android.geo.API_KEY in AndroidManifest.xml (which shipped
in every built APK). The manifest value is now the build-time placeholder
${MAPS_API_KEY}, injected via AndroidManifestPlaceholders from the
MapsApiKey MSBuild property, resolved from a CI secret (-p:MapsApiKey=),
the MAPS_API_KEY env var, or a gitignored maps.key.props at the repo root
(maps.key.props.example committed as the template). maps.key.props is
gitignored so a real key is never committed.

No rotated key is included here; the human supplies it via CI secret.
Pairs with the console key rotation to close SEC-1 (decisions.md
2026-08-20; security/sec-1-gmaps-key.md). Git history intentionally not
rewritten (recorded risk-acceptance relies on revocation of the old key).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .gitignore                                        |  3 +++
 FieldLogger/FieldLogger.csproj                    | 12 ++++++++++++
 FieldLogger/Platforms/Android/AndroidManifest.xml |  6 ++++--
 README.md                                         | 11 +++++++----
 maps.key.props.example                            | 13 +++++++++++++
 5 files changed, 39 insertions(+), 6 deletions(-)
 create mode 100644 maps.key.props.example

diff --git a/.gitignore b/.gitignore
index bc78471..ffcac66 100644
--- a/.gitignore
+++ b/.gitignore
@@ -482,3 +482,6 @@ $RECYCLE.BIN/
 
 # Vim temporary swap files
 *.swp
+
+# SEC-1: local Google Maps key injection — never commit the real key
+maps.key.props
diff --git a/FieldLogger/FieldLogger.csproj b/FieldLogger/FieldLogger.csproj
index e1e8450..6b5a0bd 100644
--- a/FieldLogger/FieldLogger.csproj
+++ b/FieldLogger/FieldLogger.csproj
@@ -46,6 +46,18 @@
 		<SupportedOSPlatformVersion Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'tizen'">6.5</SupportedOSPlatformVersion>
 	</PropertyGroup>
 
+	<!-- SEC-1: the Google Maps Android key is injected at build time, never committed.
+	     Resolution order: (1) MapsApiKey MSBuild property (pass -p:MapsApiKey=... in CI from a
+	     secret), else (2) the MAPS_API_KEY environment variable, else (3) a gitignored
+	     maps.key.props at the repo root (copy maps.key.props.example). Left empty for local
+	     builds without a key — maps stay blank; the build does not embed a literal. -->
+	<Import Project="$(MSBuildThisFileDirectory)..\maps.key.props"
+	        Condition="Exists('$(MSBuildThisFileDirectory)..\maps.key.props')" />
+	<PropertyGroup Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'android'">
+		<MapsApiKey Condition="'$(MapsApiKey)' == ''">$(MAPS_API_KEY)</MapsApiKey>
+		<AndroidManifestPlaceholders>MAPS_API_KEY=$(MapsApiKey)</AndroidManifestPlaceholders>
+	</PropertyGroup>
+
 	<ItemGroup>
 		<!-- App Icon -->
 		<MauiIcon Include="Resources\AppIcon\appicon.svg" ForegroundFile="Resources\AppIcon\appiconfg.svg" Color="#512BD4" />
diff --git a/FieldLogger/Platforms/Android/AndroidManifest.xml b/FieldLogger/Platforms/Android/AndroidManifest.xml
index 2603a9b..04b7e59 100644
--- a/FieldLogger/Platforms/Android/AndroidManifest.xml
+++ b/FieldLogger/Platforms/Android/AndroidManifest.xml
@@ -1,8 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
 	<application android:allowBackup="true" android:icon="@mipmap/appicon" android:roundIcon="@mipmap/appicon_round" android:supportsRtl="true">
-		<!-- Google Maps API key: replace with your key from https://console.cloud.google.com (Maps SDK for Android) -->
-		<meta-data android:name="com.google.android.geo.API_KEY" android:value="AIzaSyDhH16gF-7UN-CBsTQGfQSHNGjLC6VJ5dI" />
+		<!-- Google Maps API key is injected at build time from the MAPS_API_KEY MSBuild
+		     placeholder (see FieldLogger.csproj / maps.key.props.example). Never commit a key
+		     literal here — SEC-1. -->
+		<meta-data android:name="com.google.android.geo.API_KEY" android:value="${MAPS_API_KEY}" />
 	</application>
 	<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
 	<uses-permission android:name="android.permission.INTERNET" />
diff --git a/README.md b/README.md
index 47b52ee..b1e87df 100644
--- a/README.md
+++ b/README.md
@@ -4,8 +4,6 @@ Cross-platform .NET MAUI app (Windows, macOS, iOS, Android) for logging utility
 points from an **Underground Magnetics locating receiver** paired with RTK GPS positions
 from a **Maglink (H11) RTK receiver**, both over BLE.
 
-Maps API Key: AIzaSyDhH16gF-7UN-CBsTQGfQSHNGjLC6VJ5dI
-
 ## Solution layout
 
 ```
@@ -40,8 +38,13 @@ doc/                 Device protocol documentation
 
 ## Setup required before running
 
-1. **Google Maps key (Android):** replace `YOUR_GOOGLE_MAPS_ANDROID_API_KEY` in
-   `FieldLogger/Platforms/Android/AndroidManifest.xml` (Google Cloud Console → Maps SDK for Android).
+1. **Google Maps key (Android):** the manifest key is **injected at build time**, never
+   committed (SEC-1). Provide it one of three ways: pass `-p:MapsApiKey=<key>` to
+   `dotnet build` (how CI supplies it from a secret), set the `MAPS_API_KEY` environment
+   variable, or copy `maps.key.props.example` to `maps.key.props` (gitignored) at the repo
+   root and put your key there. Use a key restricted to the app package + release SHA-1
+   (Google Cloud Console → Maps SDK for Android). Without a key, maps render blank but the
+   app builds.
 2. **Google Maps key (Windows):** create a Maps JavaScript API key and paste it into the
    Settings page of the app.
 3. **Maglink GATT UUIDs:** the Maglink docs describe the serial protocol but not its GATT
diff --git a/maps.key.props.example b/maps.key.props.example
new file mode 100644
index 0000000..436cdd4
--- /dev/null
+++ b/maps.key.props.example
@@ -0,0 +1,13 @@
+<!--
+  SEC-1: local Google Maps key injection for Android builds.
+
+  Copy this file to `maps.key.props` (same directory) and paste your restricted key.
+  `maps.key.props` is gitignored — never commit a real key. CI supplies the key instead
+  via `-p:MapsApiKey=$SECRET` or the MAPS_API_KEY environment variable, so this file is
+  only for local development.
+-->
+<Project>
+  <PropertyGroup>
+    <MapsApiKey>YOUR_GOOGLE_MAPS_ANDROID_API_KEY</MapsApiKey>
+  </PropertyGroup>
+</Project>