Add sigsum trusted pubkey overriding

ios/Configurations/Api.xcconfig.template

@@ -13,6 +13,11 @@ ENCRYPTED_DNS_HOST_NAME[config=Release] = frakta.eu
 ENCRYPTED_DNS_HOST_NAME[config=MockRelease] = frakta.eu
 ENCRYPTED_DNS_HOST_NAME[config=Staging] = stagemole.frakta.eu
 
+SIGSUM_TRUSTED_KEYS[config=Debug] =
+SIGSUM_TRUSTED_KEYS[config=Release] =
+SIGSUM_TRUSTED_KEYS[config=MockRelease] =
+SIGSUM_TRUSTED_KEYS[config=Staging] = 97d155e299dae58377d6b9b91739ac08e16b883781038398fe07fea1be9684b3:bcc9dc6dadca9de57d67799d6aff1a4a11ac4ea1eed659215751c8de6ae19b6b:74df47593c1c5fdee247b2b24440224ffb20d204cce7b11054a43c3b2b7a608f:70b9de05582ab87049f9408f856edac340138d52708283058f136229119a090d
+
 API_ENDPOINT[config=Debug] = 45.83.223.196:443
 API_ENDPOINT[config=Release] = 45.83.223.196:443
 API_ENDPOINT[config=MockRelease] = 45.83.223.196:443

ios/MullvadREST/ApiHandlers/RESTDefaults.swift

@@ -38,4 +38,13 @@ extension REST {
 
     /// am.i.mullvad.net hostname.
     public static let amIMullvadHostname = infoDictionary["AmIMullvad"] as! String
+
+    public static let sigsumTrustedKeys: String? = {
+        guard let keys = infoDictionary["SigsumTrustedKeys"] as? String,
+            !keys.isEmpty
+        else {
+            return nil
+        }
+        return keys
+    }()
 }

ios/MullvadREST/Info.plist

@@ -2,6 +2,8 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>SigsumTrustedKeys</key>
+	<string>$(SIGSUM_TRUSTED_KEYS)</string>
 	<key>AmIMullvad</key>
 	<string>$(AM_I_JSON_URL)</string>
 	<key>ApiHostName</key>

ios/MullvadRustRuntime/ApiContext+Extensions.swift

@@ -35,6 +35,7 @@ extension ApiContext {
         domain: String,
         domainFronting: DomainFrontingConfig,
         disableTls: Bool = false,
+        sigsumTrustedKeys: String? = nil,
         shadowsocksProvider: ShadowsocksBridgeProvider,
         accessMethodWrapper: SwiftAccessMethodSettingsContext,
         accessMethodChangeListeners: [any MullvadAccessMethodChangeListening]
@@ -47,6 +48,7 @@ extension ApiContext {
             domain: domain,
             domainFronting: domainFronting,
             disableTls: disableTls,
+            sigsumTrustedKeys: sigsumTrustedKeys,
             bridgeProvider: shadowsocksProvider,
             settingsProvider: accessMethodWrapper,
             accessMethodChangeListeners: accessMethodChangeListeners.map(CallbackShim.init))

ios/MullvadVPN/AppDelegate.swift

@@ -151,6 +151,7 @@ class AppDelegate: UIResponder, UIApplicationDelegate, UNUserNotificationCenterD
             amIMullvadHostIpv6: "ipv6.\(REST.amIMullvadHostname)",
             domain: REST.encryptedDNSHostname,
             domainFronting: REST.domainFronting,
+            sigsumTrustedKeys: REST.sigsumTrustedKeys,
             shadowsocksProvider: shadowsocksLoader,
             accessMethodWrapper: opaqueAccessMethodSettingsWrapper,
             accessMethodChangeListeners: [accessMethodRepository, shadowsocksCacheCleaner]

ios/MullvadVPNTests/MullvadVPN/TunnelManager/TunnelManagerTests.swift

@@ -51,6 +51,7 @@ class TunnelManagerTests: XCTestCase {
             domain: REST.encryptedDNSHostname,
             domainFronting: REST.domainFronting,
             disableTls: false,
+            sigsumTrustedKeys: nil,
             bridgeProvider: shadowsocksLoader,
             settingsProvider: opaqueAccessMethodSettingsWrapper,
             accessMethodChangeListeners: []

ios/MullvadVPNUITests/MullvadApi.swift

@@ -81,6 +81,7 @@ class MullvadApi {
             domain: hostname,
             domainFronting: DomainFrontingConfig(front: "", proxyHost: ""),
             disableTls: false,
+            sigsumTrustedKeys: nil,
             bridgeProvider: bridgeProvider,
             settingsProvider: settingsWrapper,
             accessMethodChangeListeners: [])

ios/PacketTunnel/PacketTunnelProvider/PacketTunnelProvider.swift

@@ -266,6 +266,7 @@ class PacketTunnelProvider: NEPacketTunnelProvider, @unchecked Sendable {
             amIMullvadHostIpv6: "ipv6.\(REST.amIMullvadHostname)",
             domain: REST.encryptedDNSHostname,
             domainFronting: REST.domainFronting,
+            sigsumTrustedKeys: REST.sigsumTrustedKeys,
             shadowsocksProvider: shadowsocksLoader,
             accessMethodWrapper: opaqueAccessMethodSettingsWrapper,
             accessMethodChangeListeners: [accessMethodRepository, shadowsocksCacheCleaner]

mullvad-ios/src/ios/api_client/mod.rs

@@ -66,12 +66,14 @@ impl ApiContext {
         am_i_mullvad_host_ipv6: String,
         domain: String,
         domain_fronting: DomainFrontingConfig,
-        disable_tls: bool,
+        #[cfg_attr(not(feature = "api-override"), expect(unused))] disable_tls: bool,
+        #[cfg_attr(not(feature = "api-override"), expect(unused))] sigsum_trusted_keys: Option<
+            String,
+        >,
         bridge_provider: Arc<dyn ShadowsocksBridgeProvider>,
         settings_provider: Arc<SwiftAccessMethodSettingsContext>,
         access_method_change_listeners: Vec<Arc<dyn AccessMethodChangeCallback>>,
     ) -> Arc<Self> {
-        _ = disable_tls;
         Self::new_inner(
             host,
             address,
@@ -81,6 +83,8 @@ impl ApiContext {
             domain_fronting,
             #[cfg(feature = "api-override")]
             disable_tls,
+            #[cfg(feature = "api-override")]
+            sigsum_trusted_keys,
             bridge_provider,
             settings_provider,
             access_method_change_listeners,
@@ -97,13 +101,23 @@ impl ApiContext {
         domain: String,
         domain_fronting: DomainFrontingConfig,
         #[cfg(feature = "api-override")] disable_tls: bool,
+        #[cfg(feature = "api-override")] sigsum_trusted_pubkeys: Option<String>,
         bridge_provider: Arc<dyn ShadowsocksBridgeProvider>,
         settings_provider: Arc<SwiftAccessMethodSettingsContext>,
         access_method_change_listeners: Vec<Arc<dyn AccessMethodChangeCallback>>,
     ) -> Arc<Self> {
         // The iOS client provides a different default endpoint based on its configuration
         // Debug and Release builds use the standard endpoints
-        // Staging builds will use the staging endpoint
+        // Staging builds will use the staging endpoint and staging signum keys
+
+        #[cfg(not(feature = "api-override"))]
+        let pubkeys = None::<Vec<mullvad_api::SigsumPublicKey>>;
+        #[cfg(feature = "api-override")]
+        let pubkeys = sigsum_trusted_pubkeys.and_then(|keys| {
+            ApiEndpoint::parse_sigsum_pubkeys(&keys)
+                .inspect_err(|e| log::error!("failed to parse override sigsum pubkeys: {e}"))
+                .ok()
+        });
         let endpoint = ApiEndpoint {
             host: Some(host),
             address: Some(address.parse().unwrap()),
@@ -111,7 +125,7 @@ impl ApiContext {
             disable_tls,
             #[cfg(feature = "api-override")]
             force_direct: false,
-            sigsum_trusted_pubkeys: None,
+            sigsum_trusted_pubkeys: pubkeys,
         };
 
         let tokio_handle = crate::mullvad_ios_runtime().unwrap();