UL/ulapp
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SEC-1: build-inject Google Maps Android key; remove leaked literal

Browse Source 
Removes the leaked Google Maps API key literal from README.md and the
live com.google.android.geo.API_KEY in AndroidManifest.xml (which shipped
in every built APK). The manifest value is now the build-time placeholder
${MAPS_API_KEY}, injected via AndroidManifestPlaceholders from the
MapsApiKey MSBuild property, resolved from a CI secret (-p:MapsApiKey=),
the MAPS_API_KEY env var, or a gitignored maps.key.props at the repo root
(maps.key.props.example committed as the template). maps.key.props is
gitignored so a real key is never committed.

No rotated key is included here; the human supplies it via CI secret.
Pairs with the console key rotation to close SEC-1 (decisions.md
2026-08-20; security/sec-1-gmaps-key.md). Git history intentionally not
rewritten (recorded risk-acceptance relies on revocation of the old key).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Brent Perteet
2026-08-20 13:10:35 -05:00
parent 0b4fb83546
commit 11cad9a78a
5 changed files with 39 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
FieldLogger/FieldLogger.csproj
View File

@@ -46,6 +46,18 @@
<SupportedOSPlatformVersion Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'tizen'">6.5</SupportedOSPlatformVersion>
</PropertyGroup>
<!-- SEC-1: the Google Maps Android key is injected at build time, never committed.
Resolution order: (1) MapsApiKey MSBuild property (pass -p:MapsApiKey=... in CI from a
secret), else (2) the MAPS_API_KEY environment variable, else (3) a gitignored
maps.key.props at the repo root (copy maps.key.props.example). Left empty for local
builds without a key — maps stay blank; the build does not embed a literal. -->
<Import Project="$(MSBuildThisFileDirectory)..\maps.key.props"
Condition="Exists('$(MSBuildThisFileDirectory)..\maps.key.props')" />
<PropertyGroup Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'android'">
<MapsApiKey Condition="'$(MapsApiKey)' == ''">$(MAPS_API_KEY)</MapsApiKey>
<AndroidManifestPlaceholders>MAPS_API_KEY=$(MapsApiKey)</AndroidManifestPlaceholders>
</PropertyGroup>
<ItemGroup>
<!-- App Icon -->
<MauiIcon Include="Resources\AppIcon\appicon.svg" ForegroundFile="Resources\AppIcon\appiconfg.svg" Color="#512BD4" />