feature: add option for pinning root ca or pinning leaf ca #93

.github/workflows/publish.yml

@@ -0,0 +1,14 @@
+name: Publish to pub.dev
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+*'
+
+jobs:
+  publish:
+    permissions:
+      id-token: write # Required for authentication using OIDC
+    uses: dart-lang/setup-dart/.github/workflows/publish.yml@v1
+    # with:
+    #   working-directory: path/to/package/within/repository

.vscode/settings.json

@@ -3,7 +3,7 @@
       "editor.formatOnSave": true
     },
     "editor.codeActionsOnSave": {
-      "source.organizeImports": true
+      "source.organizeImports": "explicit"
     },
   }
 

CHANGELOG.md

@@ -75,3 +75,21 @@ Upgrading to last plugin interface
 Bumping Alamofire version to 5.9.0
 Support for Flutter 3.29.0
 
+## 3.1.0
+
+Initial `http_certificate_pinning_plus` release.
+
+* Adds leaf or root certificate fingerprint validation.
+* Adds in-memory caching for successful certificate checks.
+* Coalesces concurrent checks for the same certificate identity.
+
+## 3.2.0
+
+* Fixes stale pending-check cleanup so completed checks cannot remove newer
+  in-flight validations.
+* Serializes native iOS certificate checks centrally to avoid wrapper-level
+  race conditions during concurrent requests.
+* Handles empty or non-X509 Android certificate chains safely when resolving
+  the validated chain.
+* Caches Android default trust manager and trust manager extensions for
+  repeated certificate chain validation.

README.md

@@ -1,8 +1,12 @@
-# Http Certificate Pinning
+# HTTP Certificate Pinning Plus
 
-Https Certificate pinning for Flutter
+HTTPS certificate pinning for Flutter with SHA-1/SHA-256 fingerprints,
+leaf or root certificate validation, Dio/http helpers, and in-memory check
+caching.
 
-This project ins based on [ssl_pinning_plugin](https://github.com/macif-dev/ssl_pinning_plugin) 
+This project is based on
+[http_certificate_pinning](https://github.com/diefferson/http_certificate_pinning)
+and [ssl_pinning_plugin](https://github.com/macif-dev/ssl_pinning_plugin).
 
 Any help is appreciated! Comment, suggestions, issues, PR's!
 
@@ -13,7 +17,7 @@ In your flutter or dart project add the dependency:
 ```yml
 dependencies:
   ...
-  http_certificate_pinning: 3.0.0
+  http_certificate_pinning_plus: ^3.2.0
 ```
 
 ## Get Certificate FingerPrint
@@ -28,18 +32,32 @@ The Result is like:
 
 '59:58:57:5A:5B:5C:5D:59:58:57:5A:5B:5C:5D:59:58:57:5A:5B:5C:5D:59:58:57:5A:5B:5C:5D:59:58:57:5A:5B:5C:5D'
 
+By default the plugin validates the leaf certificate for the requested host.
+To validate the root certificate fingerprint instead, pass
+`certificatePinningTarget: CertificatePinningTarget.root`.
+The same optional parameter is available on `CertificatePinningInterceptor`
+and `SecureHttpClient.build`.
+
+Successful certificate checks are cached in memory for 10 minutes by default.
+The cache key is based on the host, port, SHA type, pinning target, and
+fingerprints. Pass `cacheDuration: Duration.zero` to disable caching, or call
+`HttpCertificatePinning.clearCache()` to clear the in-memory cache manually.
+
 
 ## Usage example
 
 ### Using Dio
 
 ```dart
-import 'package:http_certificate_pinning/http_certificate_pinning.dart';
+import 'package:http_certificate_pinning_plus/http_certificate_pinning_plus.dart';
 
   // Add CertificatePinningInterceptor in dio Client
   Dio getClient(String baseUrl, List<String> allowedSHAFingerprints){
       var dio =  Dio(BaseOptions(baseUrl: baseUrl))
-        ..interceptors.add(CertificatePinningInterceptor(allowedSHAFingerprints));
+        ..interceptors.add(CertificatePinningInterceptor(
+          allowedSHAFingerprints: allowedSHAFingerprints,
+          cacheDuration: const Duration(minutes: 10),
+        ));
       return dio;
   }
 
@@ -51,11 +69,14 @@ import 'package:http_certificate_pinning/http_certificate_pinning.dart';
 ### Using Http
 
 ```dart
-import 'package:http_certificate_pinning/secure_http_client.dart';
+import 'package:http_certificate_pinning_plus/http_certificate_pinning_plus.dart';
 
   // Uses SecureHttpClient to make requests
   SecureHttpClient getClient(List<String> allowedSHAFingerprints){
-      final secureClient = SecureHttpClient.build(certificateSHA256Fingerprints);
+      final secureClient = SecureHttpClient.build(
+        certificateSHA256Fingerprints,
+        cacheDuration: const Duration(minutes: 10),
+      );
       return secureClient;
   }
 
@@ -68,7 +89,7 @@ import 'package:http_certificate_pinning/secure_http_client.dart';
 ### Other Client
 
 ```dart
-import 'package:http_certificate_pinning/http_certificate_pinning.dart';
+import 'package:http_certificate_pinning_plus/http_certificate_pinning_plus.dart';
 
 Future myCustomImplementation(String url, Map<String,String> headers, List<String> allowedSHAFingerprints) async {
   try{
@@ -77,6 +98,8 @@ Future myCustomImplementation(String url, Map<String,String> headers, List<Strin
       headerHttp: headers,
       sha: SHA.SHA256,
       allowedSHAFingerprints:allowedSHAFingerprints,
+      certificatePinningTarget: CertificatePinningTarget.root,
+      cacheDuration: const Duration(minutes: 10),
       timeout : 50
     );
 

android/build.gradle

@@ -1,5 +1,5 @@
-group = "diefferson.http_certificate_pinning"
-version = "3.0.0"
+group = "site.txtool.http_certificate_pinning_plus"
+version = "3.1.0"
 
 buildscript {
     ext.kotlin_version = "1.9.0"
@@ -26,7 +26,7 @@ apply plugin: "kotlin-android"
 
 android {
     if (project.android.hasProperty("namespace")) {
-        namespace = "diefferson.http_certificate_pinning"
+        namespace = "site.txtool.http_certificate_pinning_plus"
     }
 
     compileSdk = 34

android/settings.gradle

@@ -1 +1 @@
-rootProject.name = 'http_certificate_pinning'
+rootProject.name = 'http_certificate_pinning_plus'

android/src/main/AndroidManifest.xml

@@ -1,4 +1,4 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    package="diefferson.http_certificate_pinning"
+    package="site.txtool.http_certificate_pinning_plus"
   >
 </manifest>