mvt-project · besendorf · Jul 29, 2026 · Jul 29, 2026 · Jul 29, 2026 · Jul 29, 2026
diff --git a/.github/workflows/add-issue-to-project.yml b/.github/workflows/add-issue-to-project.yml
@@ -11,7 +11,7 @@ jobs:
     name: Add issue to project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v0.5.0
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
         with:
           # You can target a project in a different organization
           # to the issue

diff --git a/.github/workflows/container.yaml b/.github/workflows/container.yaml
@@ -15,7 +15,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Set image version
               id: version
@@ -24,21 +24,21 @@ jobs:
                   echo "version=${version#v}" >> "$GITHUB_OUTPUT"
 
             - name: Set up QEMU
-              uses: docker/setup-qemu-action@v3
+              uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@v3
+              uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
             - name: Log in to GitHub Container Registry
-              uses: docker/login-action@v3
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: ghcr.io
                   username: ${{ github.actor }}
                   password: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Extract container metadata
               id: meta
-              uses: docker/metadata-action@v5
+              uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
               with:
                   images: ghcr.io/mvt-project/androidqf
                   tags: |
@@ -47,7 +47,7 @@ jobs:
                       type=raw,value=latest,enable=${{ github.event.release.prerelease == false }}
 
             - name: Build and publish
-              uses: docker/build-push-action@v6
+              uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
               with:
                   context: .
                   platforms: linux/amd64,linux/arm64

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -14,14 +14,14 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   fetch-depth: 0
 
             - name: Set up Go
-              uses: actions/setup-go@v5
+              uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
               with:
-                  go-version: "1.26.3"
+                  go-version: "1.26.5"
                   cache: true
 
             - name: Install cross-compilation tools
@@ -30,10 +30,10 @@ jobs:
                   sudo apt-get install -y gcc-mingw-w64-x86-64 wget unzip make
 
             - name: Run GoReleaser
-              uses: goreleaser/goreleaser-action@v6
+              uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
               with:
                   distribution: goreleaser
-                  version: latest
+                  version: v2.17.1
                   args: release --clean
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/staticcheck.yaml b/.github/workflows/staticcheck.yaml
@@ -6,18 +6,32 @@ jobs:
     name: "Run CI"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.3"
+          go-version: "1.26.5"
           cache: true
       - name: download assets
         run: make download
       - name: build collector
         run: make collector
-      - uses: dominikh/staticcheck-action@v1.3.1
-        with:
-          version: "latest"
-          install-go: false
+      - name: Run tests
+        run: |
+          go test -race ./...
+          (cd android-collector && go test -race ./...)
+      - name: Run vet
+        run: |
+          go vet ./...
+          (cd android-collector && go vet ./...)
+      - name: Run staticcheck
+        run: |
+          go install honnef.co/go/tools/cmd/staticcheck@v0.7.0
+          staticcheck ./...
+          (cd android-collector && staticcheck ./...)
+      - name: Run vulnerability checks
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@v1.6.0
+          govulncheck ./...
+          (cd android-collector && govulncheck ./...)
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
@@ -7,19 +7,18 @@ before:
         - sh -c 'cd android-collector && CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6 go build -ldflags="-s -w" -o ../assets/collector_arm . && upx --best ../assets/collector_arm'
         - sh -c 'cd android-collector && CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags="-s -w" -o ../assets/collector_arm64 . && upx --best ../assets/collector_arm64'
         # Download platform tools for different OSes
-        - mkdir -p /tmp/platform-tools-downloads
         # Windows platform tools
-        - bash -c 'if [ ! -f /tmp/platform-tools-downloads/platform-tools-latest-windows.zip ]; then wget https://dl.google.com/android/repository/platform-tools-latest-windows.zip -O /tmp/platform-tools-downloads/platform-tools-latest-windows.zip; fi'
+        - ./scripts/download_platform_tools.sh windows
         - bash -c 'cd /tmp && unzip -o /tmp/platform-tools-downloads/platform-tools-latest-windows.zip'
         - cp /tmp/platform-tools/AdbWinApi.dll assets/
         - cp /tmp/platform-tools/AdbWinUsbApi.dll assets/
         - cp /tmp/platform-tools/adb.exe assets/
         # macOS platform tools
-        - bash -c 'if [ ! -f /tmp/platform-tools-downloads/platform-tools-latest-darwin.zip ]; then wget https://dl.google.com/android/repository/platform-tools-latest-darwin.zip -O /tmp/platform-tools-downloads/platform-tools-latest-darwin.zip; fi'
+        - ./scripts/download_platform_tools.sh darwin
         - bash -c 'cd /tmp && unzip -o /tmp/platform-tools-downloads/platform-tools-latest-darwin.zip'
         - cp /tmp/platform-tools/adb assets/adb_darwin
         # Linux platform tools
-        - bash -c 'if [ ! -f /tmp/platform-tools-downloads/platform-tools-latest-linux.zip ]; then wget https://dl.google.com/android/repository/platform-tools-latest-linux.zip -O /tmp/platform-tools-downloads/platform-tools-latest-linux.zip; fi'
+        - ./scripts/download_platform_tools.sh linux
         - bash -c 'cd /tmp && unzip -o /tmp/platform-tools-downloads/platform-tools-latest-linux.zip'
         - cp /tmp/platform-tools/adb assets/adb_linux
 

diff --git a/Dockerfile b/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.23
+FROM alpine:3.23.5@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40
 
 ARG TARGETARCH=amd64
 ARG VERSION=1.8.3
@@ -10,6 +10,11 @@ RUN apk add --no-cache ca-certificates gcompat libgcc wget \
     esac \
     && wget -O /usr/local/bin/androidqf \
         "https://github.com/mvt-project/androidqf/releases/download/v${VERSION}/androidqf_linux_${TARGETARCH}_${VERSION}" \
+    && wget -O /tmp/checksums.txt \
+        "https://github.com/mvt-project/androidqf/releases/download/v${VERSION}/checksums.txt" \
+    && cd /usr/local/bin \
+    && grep "  androidqf_linux_${TARGETARCH}_${VERSION}$" /tmp/checksums.txt | sha256sum -c - \
+    && rm /tmp/checksums.txt \
     && chmod +x /usr/local/bin/androidqf
 
 WORKDIR /acquisition

diff --git a/Makefile b/Makefile
@@ -16,21 +16,28 @@ LD_FLAGS = -s -w -X ${PACKAGE_PATH}/utils.Version=${VERSION}
 # Set if binaries should be compressed with UPX. Zero disables UPX
 UPX_COMPRESS ?= "0"
 
-PLATFORMTOOLS_URL     = https://dl.google.com/android/repository/
 PLATFORMTOOLS_WINDOWS = platform-tools-latest-windows.zip
 PLATFORMTOOLS_DARWIN  = platform-tools-latest-darwin.zip
 PLATFORMTOOLS_LINUX   = platform-tools-latest-linux.zip
 PLATFORMTOOLS_FOLDER  = /tmp/platform-tools
+PLATFORMTOOLS_DOWNLOAD_FOLDER = /tmp/platform-tools-downloads
 
 check:
 	@echo "[lint] Running go vet"
 	go vet ./...
-	@echo "[lint] Running staticheck on codebase"
+	cd android-collector && go vet ./...
+	@echo "[lint] Running staticcheck on codebase"
 	@staticcheck ./...
+	cd android-collector && staticcheck ./...
 
 vuln:
 	@echo "Running go vuln check"
 	@govulncheck ./...
+	cd android-collector && govulncheck ./...
+
+test:
+	go test -race ./...
+	cd android-collector && go test -race ./...
 
 fmt:
 	gofumpt -l -w .
@@ -52,13 +59,10 @@ collector:
 windows:
 	@mkdir -p $(BUILD_FOLDER)
 
-	@if [ ! -f /tmp/$(PLATFORMTOOLS_WINDOWS) ]; then \
-		echo "Downloading Windows Android Platform Tools..."; \
-		wget $(PLATFORMTOOLS_URL)$(PLATFORMTOOLS_WINDOWS) -O /tmp/$(PLATFORMTOOLS_WINDOWS); \
-	fi
+	@./scripts/download_platform_tools.sh windows
 
 	@rm -rf $(PLATFORMTOOLS_FOLDER)
-	@cd /tmp && unzip -u $(PLATFORMTOOLS_WINDOWS)
+	@cd /tmp && unzip -u $(PLATFORMTOOLS_DOWNLOAD_FOLDER)/$(PLATFORMTOOLS_WINDOWS)
 	@cp $(PLATFORMTOOLS_FOLDER)/AdbWinApi.dll $(ASSETS_FOLDER)
 	@cp $(PLATFORMTOOLS_FOLDER)/AdbWinUsbApi.dll $(ASSETS_FOLDER)
 	@cp $(PLATFORMTOOLS_FOLDER)/adb.exe $(ASSETS_FOLDER)
@@ -72,13 +76,10 @@ windows:
 darwin:
 	@mkdir -p $(BUILD_FOLDER)
 
-	@if [ ! -f /tmp/$(PLATFORMTOOLS_DARWIN) ]; then \
-		echo "Downloading Darwin Android Platform Tools..."; \
-		wget $(PLATFORMTOOLS_URL)$(PLATFORMTOOLS_DARWIN) -O /tmp/$(PLATFORMTOOLS_DARWIN); \
-	fi
+	@./scripts/download_platform_tools.sh darwin
 
 	@rm -rf $(PLATFORMTOOLS_FOLDER)
-	@cd /tmp && unzip -u $(PLATFORMTOOLS_DARWIN)
+	@cd /tmp && unzip -u $(PLATFORMTOOLS_DOWNLOAD_FOLDER)/$(PLATFORMTOOLS_DARWIN)
 	@cp $(PLATFORMTOOLS_FOLDER)/adb $(ASSETS_FOLDER)
 
 	@echo "[builder] Building Darwin binary for amd64"
@@ -91,13 +92,10 @@ darwin:
 linux:
 	@mkdir -p $(BUILD_FOLDER)
 
-	@if [ ! -f /tmp/$(PLATFORMTOOLS_LINUX) ]; then \
-		echo "Downloading Linux Android Platform Tools..."; \
-		wget $(PLATFORMTOOLS_URL)$(PLATFORMTOOLS_LINUX) -O /tmp/$(PLATFORMTOOLS_LINUX); \
-	fi
+	@./scripts/download_platform_tools.sh linux
 
 	@rm -rf $(PLATFORMTOOLS_FOLDER)
-	@cd /tmp && unzip -u $(PLATFORMTOOLS_LINUX)
+	@cd /tmp && unzip -u $(PLATFORMTOOLS_DOWNLOAD_FOLDER)/$(PLATFORMTOOLS_LINUX)
 	@cp $(PLATFORMTOOLS_FOLDER)/adb $(ASSETS_FOLDER)
 
 	@echo "[builder] Building Linux binary for amd64"
@@ -108,24 +106,18 @@ linux:
 	@echo "[builder] Done!"
 
 download:
-	@if [ ! -f /tmp/$(PLATFORMTOOLS_WINDOWS) ]; then \
-		echo "Downloading Windows Android Platform Tools..."; \
-		wget $(PLATFORMTOOLS_URL)$(PLATFORMTOOLS_WINDOWS) -O /tmp/$(PLATFORMTOOLS_WINDOWS); \
-	fi
+	@./scripts/download_platform_tools.sh windows
 
 	@rm -rf $(PLATFORMTOOLS_FOLDER)
-	@cd /tmp && unzip -u $(PLATFORMTOOLS_WINDOWS)
+	@cd /tmp && unzip -u $(PLATFORMTOOLS_DOWNLOAD_FOLDER)/$(PLATFORMTOOLS_WINDOWS)
 	@cp $(PLATFORMTOOLS_FOLDER)/AdbWinApi.dll $(ASSETS_FOLDER)
 	@cp $(PLATFORMTOOLS_FOLDER)/AdbWinUsbApi.dll $(ASSETS_FOLDER)
 	@cp $(PLATFORMTOOLS_FOLDER)/adb.exe $(ASSETS_FOLDER)
 
-	@if [ ! -f /tmp/$(PLATFORMTOOLS_DARWIN) ]; then \
-		echo "Downloading Darwin Android Platform Tools..."; \
-		wget $(PLATFORMTOOLS_URL)$(PLATFORMTOOLS_DARWIN) -O /tmp/$(PLATFORMTOOLS_DARWIN); \
-	fi
+	@./scripts/download_platform_tools.sh darwin
 
 	@rm -rf $(PLATFORMTOOLS_FOLDER)
-	@cd /tmp && unzip -u $(PLATFORMTOOLS_DARWIN)
+	@cd /tmp && unzip -u $(PLATFORMTOOLS_DOWNLOAD_FOLDER)/$(PLATFORMTOOLS_DARWIN)
 	@cp $(PLATFORMTOOLS_FOLDER)/adb $(ASSETS_FOLDER)
 
 all: collector windows darwin linux

diff --git a/README.md b/README.md
@@ -22,7 +22,7 @@ This project uses [GoReleaser](https://goreleaser.com/) for automated builds and
 
 1. Install GoReleaser:
    ```bash
-   go install github.com/goreleaser/goreleaser@latest
+   go install github.com/goreleaser/goreleaser@v2.17.1
    ```
 
 2. Run a snapshot build (no publishing):
@@ -34,7 +34,7 @@ This will create binaries for all platforms in the `dist/` directory, including
 
 ### Building with Make (Legacy)
 
-You can still use the traditional Makefile approach. You will need Go 1.23+ installed, along with `make`, `git`, `unzip` and `wget`. AndroidQF includes a cross-compiled `collector` which runs on the target device to more reliably extract forensically relevant information.
+You can still use the traditional Makefile approach. You will need Go 1.26.5+ installed, along with `make`, `git`, `unzip` and `curl`. AndroidQF includes a cross-compiled `collector` which runs on the target device to more reliably extract forensically relevant information.
 
 First build the `collector` module:
 
@@ -111,7 +111,7 @@ The following data can be extracted:
 | A full backup or backup of SMS and MMS messages. | :white_check_mark: | `backup.ab` |
 | The output of the getprop shell command, providing build information and configuration parameters. | |  `getprop.txt` |
 | All system settings | | `settings_*.txt` |
-| The output of the ps shell command, providing a list of all running processes. | | `processes.txt` |
+| The output of the ps shell command, providing a list of all running processes. | | `processes.json` when the collector is available, otherwise `processes.txt` |
 | The list of system's services. | | `services.txt` |
 | A copy of all the logs from the system. | | `logs/`, `logcat.txt` |
 | The output of the dumpsys shell command, providing diagnostic information about the device. | | `dumpsys.txt` |
@@ -125,7 +125,10 @@ The following data can be extracted:
 Every acquisition also contains `acquisition.json`, `command.log` when log output
 was produced, and `hashes.csv`. The hash list records the SHA-256 digest of each
 preceding plaintext archive entry and does not include itself. Failed device
-pulls are not committed as archive entries. See [Acquisition
+transfers are not committed as archive entries. `acquisition.json` records the
+status, timing, and error (if any) for every module that ran. A finalized
+partial acquisition exits unsuccessfully instead of printing the normal
+completion message. See [Acquisition
 archives](docs/acquisition-archives.md) for details.
 
 ### About optional data collection