$ show appmattus/certificatetransparency
This repository is a Kotlin/Java library providing Certificate Transparency (CT) verification for Android and JVM applications. It prevents man-in-the-middle attacks by validating TLS certificates against public CT logs. The library offers multiple integration approaches: Java Security Provider, OkHttp interceptors, TrustManager and HostnameVerifier wrappers for HttpURLConnection/Volley/WebView, and direct API usage. Key features include CT log list fetching and parsing, SCT verification, optional CRL-based certificate revocation checking, and configurable caching. The architecture is modular with a core library, Android-specific extensions, and a sample application demonstrating all integration methods. The code employs modern Kotlin idioms (coroutines, sealed classes, builder patterns) and maintains strong separation of concerns between network fetching, policy enforcement, chain cleaning, and verification logic.
The LLM identified 3 files worth highlighting for reuse:
Defines a simple interface for cleaning certificate chains (removing unnecessary intermediates) before validation. The BasicCertificateChainCleaner implementation is self-contained, depending only on standard Java security classes, making it easily extractable for any Java TLS application needing chain cleaning.
Defines a generic interface for asynchronous data fetching with caching. The InMemoryCache and DiskCache implementations provide LRU and size-limited caching respectively, with minimal dependencies (standard library only for interfaces, trivial utility for DiskCache). This abstraction can be reused for caching any data type in Android or JVM applications.
Represents the outcome of CT verification as a sealed class with success (containing SCTs) and failure subtypes. This pattern provides type-safe error handling without exceptions, is completely decoupled from library internals (depends only on standard library and simple exceptions), and can be adapted for any operation result modeling.