App 加固后 Google Play 许可校验失败：沿请求、签名与服务端逐层定位

import json
import re
import sys
from pathlib import Path

REQUIRED = {
    'artifactSha256',
    'installSource',
    'clientStage',
    'serverDecision',
    'signatureStatus',
    'nonceStatus',
    'networkStatus',
    'timeStatus',
}
FORBIDDEN = {'privateKey', 'token', 'password', 'rawResponse', 'userData'}
SHA256 = re.compile(r'^[a-f0-9]{64}$')
INSTALL_SOURCES = {'play-test', 'play-production', 'local', 'enterprise'}
CLIENT_STAGES = {'not-created', 'sent', 'callback', 'policy', 'completed'}
SERVER_DECISIONS = {'allow', 'deny', 'retryable', 'unavailable'}
SIGNATURE_STATES = {'valid', 'invalid', 'not-checked'}
NONCE_STATES = {'matched', 'mismatch', 'replayed', 'not-checked'}
NETWORK_STATES = {'online', 'timeout', 'offline'}
TIME_STATES = {'valid', 'expired', 'clock-unknown'}

def stop(message):
    raise SystemExit(message)

def classify(receipt):
    leaked = FORBIDDEN.intersection(receipt)
    if leaked:
        stop(f'forbidden fields: {sorted(leaked)}')
    missing = sorted(REQUIRED - receipt.keys())
    if missing:
        stop(f'missing fields: {missing}')
    if not SHA256.fullmatch(str(receipt['artifactSha256'])):
        stop('artifactSha256 is invalid')
    checks = [
        ('installSource', INSTALL_SOURCES),
        ('clientStage', CLIENT_STAGES),
        ('serverDecision', SERVER_DECISIONS),
        ('signatureStatus', SIGNATURE_STATES),
        ('nonceStatus', NONCE_STATES),
        ('networkStatus', NETWORK_STATES),
        ('timeStatus', TIME_STATES),
    ]
    for field, allowed in checks:
        if receipt[field] not in allowed:
            stop(f'{field} has an invalid value')
    if receipt['signatureStatus'] == 'invalid':
        return 'terminal-signature'
    if receipt['nonceStatus'] in {'mismatch', 'replayed'}:
        return 'terminal-nonce'
    if receipt['serverDecision'] == 'allow':
        if receipt['signatureStatus'] != 'valid' or receipt['nonceStatus'] != 'matched':
            stop('allow conflicts with signature or nonce evidence')
        return 'licensed'
    if receipt['serverDecision'] == 'deny':
        return 'terminal-license'
    if receipt['networkStatus'] in {'timeout', 'offline'}:
        return 'retryable-network'
    if receipt['timeStatus'] == 'expired':
        return 'terminal-time'
    return 'incomplete-evidence'

if len(sys.argv) != 2:
    stop('usage: validate_license_receipt.py receipt.json')
source = Path(sys.argv[1])
if not source.is_file():
    raise SystemExit('receipt file is missing')
receipt = json.loads(source.read_text(encoding='utf-8'))
if not isinstance(receipt, dict):
    raise SystemExit('receipt must be an object')
print(json.dumps({'classification': classify(receipt)}, ensure_ascii=False))