From 5b8d85a4da2090c1691d3b96700a0cfcf789d31b Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Fri, 26 Jul 2019 18:00:41 +0200
Subject: [PATCH] set up whitelist of repo domains to force HTTPS

This uses the new Network Security Config feature:
https://developer.android.com/training/articles/security-config
---
 app/src/main/AndroidManifest.xml              |  1 +
 .../main/res/xml/network_security_config.xml  | 26 +++++++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 app/src/main/res/xml/network_security_config.xml

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 88d61ef20..2a9a29b15 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -65,6 +65,7 @@
             android:description="@string/app_description"
             android:allowBackup="true"
             android:fullBackupContent="@xml/backup_rules"
+            android:networkSecurityConfig="@xml/network_security_config"
             android:theme="@style/AppThemeLight"
             android:supportsRtl="true">
 
diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 000000000..103af9dad
--- /dev/null
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true"/>
+
+    <domain-config cleartextTrafficPermitted="false">
+        <domain includeSubdomains="true">amazonaws.com</domain>
+    </domain-config>
+    <domain-config cleartextTrafficPermitted="false">
+        <domain includeSubdomains="true">f-droid.org</domain>
+    </domain-config>
+    <domain-config cleartextTrafficPermitted="false">
+        <domain includeSubdomains="true">github.com</domain>
+    </domain-config>
+    <domain-config cleartextTrafficPermitted="false">
+        <domain includeSubdomains="true">githubusercontent.com</domain>
+    </domain-config>
+    <domain-config cleartextTrafficPermitted="false">
+        <domain includeSubdomains="true">github.io</domain>
+    </domain-config>
+    <domain-config cleartextTrafficPermitted="false">
+        <domain includeSubdomains="true">gitlab.com</domain>
+    </domain-config>
+    <domain-config cleartextTrafficPermitted="false">
+        <domain includeSubdomains="true">gitlab.io</domain>
+    </domain-config>
+</network-security-config>