## 4.5.1.9

* Bug Fixes
  * Allow for both trusted and untrusted transparent keys for plugins (fix for when shared libraries are omitted).

VERSION.md

@@ -1,5 +1,10 @@
 # Version History
 
+## 4.5.1.9
+
+* Bug Fixes
+  * Allow for both trusted and untrusted transparent keys for plugins (fix for when shared libraries are omitted).
+
 ## 4.5.1.8
 
 * Feature Additions

atak/ATAK/app/build.gradle

@@ -26,7 +26,7 @@ buildscript {
     apply from: '../../gradle/versions.gradle', to: project
 
     ext.ATAK_VERSION = "4.5.1"
-    ext.ATAK_VERSION_SUBMINOR = ".8"
+    ext.ATAK_VERSION_SUBMINOR = ".9"
 
     ext.isDevKitEnabled = { ->
         return getProperty('takRepoMavenUrl', null) != null &&

atak/ATAK/app/src/main/java/com/atak/plugins/impl/PluginValidator.java

@@ -148,16 +148,25 @@ public static boolean checkAppTransparencySignature(final Context context, Strin
                                 path.replace("base/dex/", "")
                                     .replace("base/lib/", "lib/"));
                     InputStream inputStream = null;
-                    String classesdexSha256;
+                    String classesdexSha256 = null;
+                    boolean missing = false;
                     try {
-                        inputStream = zipFile.getInputStream(dex);
-                        classesdexSha256 = HashingUtils.sha256sum(inputStream);
+                        // if dex is null, the file was not included in the app bundle
+                        // download from the store.   Since it is missing, there is no
+                        // reason to check the validity.
+                        if (dex != null) {
+                            inputStream = zipFile.getInputStream(dex);
+                            classesdexSha256 = HashingUtils.sha256sum(inputStream);
+                        } else {
+                            Log.e(TAG, "missing: " + path);
+                            missing = true;
+                        }
                     } finally {
                         if (inputStream != null)
                             inputStream.close();
                     }
 
-                    if (!sha256.equals(classesdexSha256)) {
+                    if (!missing && !sha256.equals(classesdexSha256)) {
                         Log.d(TAG, "valid signature but invalid hashes for: " + pkgname + "@" + path +
                                " took: " + (SystemClock.elapsedRealtime() - start) + "ms");
                         persistValidityRecord(pkgname, apkHash, INVALID, "");