Repository: beeware/briefcase
Pull request #1816 (2024-05-20 20:50:19)

Document that users should change default Android cert password
Update docs to clarify that SHA-1 is now breakable enough that the Android password matters

Updated android.rst to clarify that recent improvements to intentional SHA-1 collision development bringing the cost of an attack under USD$10k mean that you reallllly actually should change the password from default, but in a hopefully-user-friendly FUD-free way. I updated the existing description and added an admonition to emphasize that you really ought to update it.

Previously the docs said that you didn't need to change the password. 

## PR Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
- [X] All new features have been tested
- [ N/A ] All new features have been documented
- [X] I have read the **CONTRIBUTING.md** file
- [X] I will abide by the code of conduct



Patch:
diff --git a/changes/1703.doc.rst b/changes/1703.doc.rst
deleted file mode 100644
index 69665d17..00000000
--- a/changes/1703.doc.rst
+++ /dev/null
@@ -1,1 +0,0 @@
-Added documentation describing manual signing requirement for Android packages.
diff --git a/changes/1746.bugfix.rst b/changes/1746.bugfix.rst
deleted file mode 100644
index 0c9d3a96..00000000
--- a/changes/1746.bugfix.rst
+++ /dev/null
@@ -1,1 +0,0 @@
-Escaping of quotation marks in TOML templates was corrected.
diff --git a/changes/1786.doc.rst b/changes/1786.doc.rst
deleted file mode 100644
index dcb6efe9..00000000
--- a/changes/1786.doc.rst
+++ /dev/null
@@ -1,1 +0,0 @@
-Specific examples added for requires under configuration.
diff --git a/changes/1816.doc.rst b/changes/1816.doc.rst
new file mode 100644
index 00000000..282537f3
--- /dev/null
+++ b/changes/1816.doc.rst
@@ -0,0 +1,1 @@
+Updated Android publishing documentation to encourage users to set non-default passwords.
diff --git a/docs/background/releases.rst b/docs/background/releases.rst
index 84d4847e..a61c2906 100644
--- a/docs/background/releases.rst
+++ b/docs/background/releases.rst
@@ -466,12 +466,12 @@ Features
 --------
 
 * Apps can be updated as part of a call to package. (#473)
-* The Android emulator can now be used on Apple Silicon hardware. (#616)
+* The Android emulator can now be used on Apple M1 hardware. (#616)
 * Names that are reserved words in Python (or other common programming languages) are now prevented when creating apps. (#617)
 * Names that are invalid on Windows as filenames (such as CON and LPT0) are now invalid as app names. (#685)
 * Verbose logging via ``-v`` and ``-vv`` now includes the return code, output, and environment variables for shell commands (#704)
 * When the output of a wrapped command cannot be parsed, full command output, and failure reason is now logged. (#728)
-* The iOS emulator will now run apps natively on Apple Silicon hardware, rather than through Rosetta emulation. (#739)
+* The iOS emulator will now run apps natively on M1 hardware, rather than through Rosetta emulation. (#739)
 
 
 Bugfixes
@@ -481,7 +481,7 @@ Bugfixes
 * The error reporting when the user is on an unsupported platform or Python version has been improved. (#541)
 * When the formal name uses non-Latin characters, the suggested Class and App names are now valid. (#612)
 * The code signing process for macOS apps has been made more robust. (#652)
-* macOS app binaries are now adhoc signed by default, ensuring they can run on Apple Silicon hardware. (#664)
+* macOS app binaries are now adhoc signed by default, ensuring they can run on M1 hardware. (#664)
 * Xcode version checks are now more robust. (#668)
 * Android projects that have punctuation in their formal names can now build without error. (#696)
 * Bundle name validation no longer excludes valid country identifiers (like ``in.example``). (#709)
diff --git a/docs/how-to/code-signing/android.rst b/docs/how-to/code-signing/android.rst
index a8c0f716..7c9c1464 100644
--- a/docs/how-to/code-signing/android.rst
+++ b/docs/how-to/code-signing/android.rst
@@ -77,8 +77,8 @@ used as an upload key for the Google Play store, we call the key "upload-key".
 
 We use a password of ``android``. This is the `default password for common
 Android keystores <https://developers.google.com/android/guides/client-auth>`__.
-You can change the password if you like. It is more important to limit who
-has access to the keystore file than to change the password.
+You should change the password. It is most critical to limit who
+has access to the keystore file, but changing the password is also important.
 
 See :doc:`Publishing your app <../publishing/android/>` for instructions
 on using this key to upload an app to the Google Play store.
diff --git a/docs/how-to/contribute-docs.rst b/docs/how-to/contribute-docs.rst
index 1dc38ea2..43cd7654 100644
--- a/docs/how-to/contribute-docs.rst
+++ b/docs/how-to/contribute-docs.rst
@@ -34,7 +34,7 @@ You'll also need to install the Enchant spell checking library.
 
       (venv) $ brew install enchant
 
-    If you're on an Apple Silicon machine, you'll also need to manually set the location
+    If you're on an M1 machine, you'll also need to manually set the location
     of the Enchant library:
 
     .. code-block:: console
diff --git a/docs/reference/configuration.rst b/docs/reference/configuration.rst
index 9cf896f4..f038f238 100644
--- a/docs/reference/configuration.rst
+++ b/docs/reference/configuration.rst
@@ -313,9 +313,6 @@ A hexadecimal RGB color value (e.g., ``#008577``) used alongside the primary
 color. This setting is only used if the platform allows color modification,
 otherwise it is ignored.
 
-
-.. _configuration-requires-key:
-
 ``requires``
 ~~~~~~~~~~~~
 
@@ -327,35 +324,6 @@ application level, *and* platform level, the final set of requirements will be
 the *concatenation* of requirements from all levels, starting from least to
 most specific.
 
-Any PEP 508 version specifier is legal. For example:
-
-* Bare package name::
-
-    requires = ["pillow"]
-
-* Package name with version specifier::
-
-    requires = ["pillow==9.1.0"]
-
-* Install from source using the ``--no-binary`` entry::
-
-    requires = [
-        "pillow==9.1.0",
-        "--no-binary", "pillow",
-    ]
-
-* Git repository::
-
-    requires=["git+https://github.com/beeware/briefcase.git"]
-
-* Local directory::
-
-    requires=["mysrc/myapp"]
-
-* Local wheel file::
-
-    requires=["fullpath/wheelfile.whl"]
-
 ``revision``
 ~~~~~~~~~~~~
 
@@ -434,8 +402,6 @@ level, application level, *and* platform level, the final set of requirements
 will be the *concatenation* of requirements from all levels, starting from least
 to most specific.
 
-See :ref:`requires <configuration-requires-key>` for examples.
-
 ``test_sources``
 ~~~~~~~~~~~~~~~~
 
diff --git a/docs/reference/platforms/android/gradle.rst b/docs/reference/platforms/android/gradle.rst
index 14da87b1..065f87b5 100644
--- a/docs/reference/platforms/android/gradle.rst
+++ b/docs/reference/platforms/android/gradle.rst
@@ -380,10 +380,3 @@ recipes for building the packages that are stored in the `secondary package repo
 can be submitted as pull requests. Or, if you have a particular package that you'd like
 us to support, please visit the `issue tracker
 <https://github.com/chaquo/chaquopy/issues>`__ and provide details about that package.
-
-While it is possible to use `briefcase package android` to produce an APK or AAB
-file for distribution, the file is *not* usable as-is. It must be signed
-regardless of whether you're distributing your app through the Play Store, or
-via loading the APK directly. For details on how to manually sign your code,
-see the instructions on `signing an Android App Bundle
-<https://briefcase.readthedocs.io/en/stable/how-to/publishing/android.html#sign-the-android-app-bundle>`__.```
diff --git a/src/briefcase/integrations/cookiecutter.py b/src/briefcase/integrations/cookiecutter.py
index 3c66ffd0..25c0e586 100644
--- a/src/briefcase/integrations/cookiecutter.py
+++ b/src/briefcase/integrations/cookiecutter.py
@@ -62,7 +62,7 @@ class TOMLEscape(Extension):
 
         def escape_toml(obj):
             """Escapes double quotes and backslashes."""
-            return obj.replace("\\", "\\\\").replace('"', '\\"')
+            return obj.replace('"', '"').replace("\\", "\\\\")
 
         def escape_non_ascii(obj):
             """Quotes obj if non ascii characters are present."""
diff --git a/src/briefcase/platforms/macOS/app.py b/src/briefcase/platforms/macOS/app.py
index 2ff7ae34..263cf2b6 100644
--- a/src/briefcase/platforms/macOS/app.py
+++ b/src/briefcase/platforms/macOS/app.py
@@ -93,7 +93,7 @@ class macOSAppBuildCommand(macOSAppMixin, macOSSigningMixin, BuildCommand):
         :param app: The application to build
         """
         # macOS apps don't have anything to compile, but they do need to be
-        # signed to be able to execute on Apple Silicon hardware - even if it's only an
+        # signed to be able to execute on M1 hardware - even if it's only an
         # ad-hoc signing identity. Apply an ad-hoc signing identity to the
         # app bundle.
         self.logger.info("Ad-hoc signing app...", prefix=app.app_name)
diff --git a/tox.ini b/tox.ini
index 5cb8298b..5d3e5b0b 100644
--- a/tox.ini
+++ b/tox.ini
@@ -118,7 +118,7 @@ package = wheel
 wheel_build_env = .pkg
 extras = docs
 passenv =
-    # On macOS Apple Silicon, you need to manually set the location of the PyEnchant
+    # On macOS M1, you need to manually set the location of the PyEnchant
     # library:
     #     export PYENCHANT_LIBRARY_PATH=/opt/homebrew/lib/libenchant-2.2.dylib
     PYENCHANT_LIBRARY_PATH


Test patch:
diff --git a/tests/integrations/cookiecutter/test_TOMLEscape.py b/tests/integrations/cookiecutter/test_TOMLEscape.py
index a3e6d05f..e80adc33 100644
--- a/tests/integrations/cookiecutter/test_TOMLEscape.py
+++ b/tests/integrations/cookiecutter/test_TOMLEscape.py
@@ -10,7 +10,7 @@ from briefcase.integrations.cookiecutter import TOMLEscape
     [
         # Single digit minor
         ("Hello World", "Hello World"),
-        ('Hello " World', 'Hello \\" World'),
+        ('Hello " World', 'Hello " World'),
         ("Hello \\ World", "Hello \\\\ World"),
     ],
 )