Problem
The file src/Xamarin.Android.Build.Tasks/Tests/Xamarin.ProjectTools/Resources/Base/test.keystore is a binary keystore checked into the repository. This triggers credential scanning warnings because the keystore and its passwords (android / mykey) are committed to source control.
While this is a harmless test-only keystore, it creates ongoing compliance noise and suppression maintenance.
Proposed Solution
Delete test.keystore from the repo and generate it dynamically at test time using keytool:
keytool -genkeypair -v -keystore test.keystore -alias mykey -keyalg RSA -keysize 2048 -validity 10000 -storepass android -keypass android -dname "CN=Test, OU=Test, O=Test, L=Test, ST=Test, C=US"
Files that need updating:
ResourceData.cs - GetKeystore() helper that loads test.keystore as an embedded resource. Change to generate a keystore on-the-fly or from a shared test fixture.KeyToolTests.cs - GetValidKeyStore() extracts the embedded keystore to a temp file. Change to generate it.InstallTests.cs - ChangeKeystoreRedeploy and TestAndroidStoreKey tests add test.keystore as a BuildItem with BinaryContent. Change to use a dynamically generated keystore.build-tools/scripts/TestApks.targets - DeployTestAabs target references the keystore by full path on disk. Change to generate before use..gdn/.gdnsuppress - Remove the suppression entry for test.keystore since the file will no longer exist.Xamarin.ProjectTools.csproj - Remove the embedded resource entry for test.keystore.
Approach
A helper method (e.g., in ResourceData.cs or a new test utility) could generate a keystore once per test run into a temp directory, and all consumers reference it from there. This keeps the same test coverage while eliminating the checked-in credential.
Problem
The file
src/Xamarin.Android.Build.Tasks/Tests/Xamarin.ProjectTools/Resources/Base/test.keystoreis a binary keystore checked into the repository. This triggers credential scanning warnings because the keystore and its passwords (android/mykey) are committed to source control.While this is a harmless test-only keystore, it creates ongoing compliance noise and suppression maintenance.
Proposed Solution
Delete
test.keystorefrom the repo and generate it dynamically at test time usingkeytool:Files that need updating:
ResourceData.cs-GetKeystore()helper that loads test.keystore as an embedded resource. Change to generate a keystore on-the-fly or from a shared test fixture.KeyToolTests.cs-GetValidKeyStore()extracts the embedded keystore to a temp file. Change to generate it.InstallTests.cs-ChangeKeystoreRedeployandTestAndroidStoreKeytests add test.keystore as aBuildItemwithBinaryContent. Change to use a dynamically generated keystore.build-tools/scripts/TestApks.targets-DeployTestAabstarget references the keystore by full path on disk. Change to generate before use..gdn/.gdnsuppress- Remove the suppression entry for test.keystore since the file will no longer exist.Xamarin.ProjectTools.csproj- Remove the embedded resource entry for test.keystore.Approach
A helper method (e.g., in
ResourceData.csor a new test utility) could generate a keystore once per test run into a temp directory, and all consumers reference it from there. This keeps the same test coverage while eliminating the checked-in credential.