GLEGram 12.5 — Initial public release

Based on Swiftgram 12.5 (Telegram iOS 12.5).
All GLEGram features ported and organized in GLEGram/ folder.

Features: Ghost Mode, Saved Deleted Messages, Content Protection Bypass,
Font Replacement, Fake Profile, Chat Export, Plugin System, and more.

See CHANGELOG_12.5.md for full details.

Swiftgram/SGRequests/BUILD

@@ -0,0 +1,18 @@
+load("@build_bazel_rules_swift//swift:swift.bzl", "swift_library")
+
+swift_library(
+    name = "SGRequests",
+    module_name = "SGRequests",
+    srcs = glob([
+        "Sources/**/*.swift",
+    ]),
+    copts = [
+        "-warnings-as-errors",
+    ],
+    deps = [
+        "//submodules/SSignalKit/SwiftSignalKit:SwiftSignalKit"
+    ],
+    visibility = [
+        "//visibility:public",
+    ],
+)

Swiftgram/SGRequests/Sources/File.swift

@@ -0,0 +1,110 @@
+import Foundation
+import SwiftSignalKit
+
+
+public func requestsDownload(url: URL) -> Signal<(Data, URLResponse?), Error?> {
+    return Signal { subscriber in
+        let completed = Atomic<Bool>(value: false)
+
+        let downloadTask = URLSession.shared.downloadTask(with: url, completionHandler: { location, response, error in
+            let _ = completed.swap(true)
+            if let location = location, let data = try? Data(contentsOf: location) {
+                subscriber.putNext((data, response))
+                subscriber.putCompletion()
+            } else {
+                subscriber.putError(error)
+            }
+        })
+        downloadTask.resume()
+
+        return ActionDisposable {
+            if !completed.with({ $0 }) {
+                downloadTask.cancel()
+            }
+        }
+    }
+}
+
+public func requestsGet(url: URL) -> Signal<(Data, URLResponse?), Error?> {
+    return Signal { subscriber in
+        let completed = Atomic<Bool>(value: false)
+
+        let urlTask = URLSession.shared.dataTask(with: url, completionHandler: { data, response, error in
+            let _ = completed.swap(true)
+            if let strongData = data {
+                subscriber.putNext((strongData, response))
+                subscriber.putCompletion()
+            } else {
+                subscriber.putError(error)
+            }
+        })
+        urlTask.resume()
+
+        return ActionDisposable {
+            if !completed.with({ $0 }) {
+                urlTask.cancel()
+            }
+        }
+    }
+}
+
+
+public func requestsCustom(request: URLRequest) -> Signal<(Data, URLResponse?), Error?> {
+    return Signal { subscriber in
+        let completed = Atomic<Bool>(value: false)
+        let urlTask = URLSession.shared.dataTask(with: request, completionHandler: { data, response, error in
+            _ = completed.swap(true)
+            if let strongData = data {
+                subscriber.putNext((strongData, response))
+                subscriber.putCompletion()
+            } else {
+                subscriber.putError(error)
+            }
+        })
+        urlTask.resume()
+
+        return ActionDisposable {
+            if !completed.with({ $0 }) {
+                urlTask.cancel()
+            }
+        }
+    }
+}
+
+/// Same as requestsCustom but with SSL certificate pinning. Use for supporters API.
+/// - Parameters:
+///   - request: The URL request
+///   - host: Expected host (e.g. "glegram.site")
+///   - pinnedHashes: Base64 SHA256 hashes of server cert(s). Empty = no pinning (fallback to default).
+public func requestsCustomWithPinning(
+    request: URLRequest,
+    host: String,
+    pinnedHashes: [String]
+) -> Signal<(Data, URLResponse?), Error?> {
+    guard !pinnedHashes.isEmpty else {
+        return requestsCustom(request: request)
+    }
+    return Signal { subscriber in
+        let completed = Atomic<Bool>(value: false)
+        let delegate = SSLPinningDelegate(host: host, pinnedHashes: pinnedHashes)
+        let config = URLSessionConfiguration.default
+        let session = URLSession(configuration: config, delegate: delegate, delegateQueue: nil)
+        let urlTask = session.dataTask(with: request, completionHandler: { data, response, error in
+            _ = completed.swap(true)
+            session.finishTasksAndInvalidate()
+            if let strongData = data {
+                subscriber.putNext((strongData, response))
+                subscriber.putCompletion()
+            } else {
+                subscriber.putError(error)
+            }
+        })
+        urlTask.resume()
+
+        return ActionDisposable {
+            if !completed.with({ $0 }) {
+                urlTask.cancel()
+            }
+        }
+    }
+}

Swiftgram/SGRequests/Sources/SSLPinning.swift

@@ -0,0 +1,56 @@
+import Foundation
+import Security
+import CryptoKit
+
+/// SSL certificate pinning for URLSession. Pins SHA256 of server certificate (base64).
+/// For Let's Encrypt: update the pin when the cert renews (~90 days), or pin multiple certs for rotation.
+
+public final class SSLPinningDelegate: NSObject, URLSessionDelegate {
+    private let host: String
+    private let pinnedHashes: Set<String>
+
+    /// - Parameters:
+    ///   - host: Expected host (e.g. "glegram.site"). Must match the request's host.
+    ///   - pinnedHashes: Set of base64-encoded SHA256 hashes of the server certificate(s).
+    ///     Generate: `openssl s_client -servername HOST -connect HOST:443 </dev/null 2>/dev/null | openssl x509 -outform DER | openssl dgst -sha256 -binary | base64`
+    public init(host: String, pinnedHashes: [String]) {
+        self.host = host.lowercased()
+        self.pinnedHashes = Set(pinnedHashes.map { $0.replacingOccurrences(of: " ", with: "").trimmingCharacters(in: .whitespacesAndNewlines) })
+    }
+
+    public func urlSession(
+        _ session: URLSession,
+        didReceive challenge: URLAuthenticationChallenge,
+        completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
+    ) {
+        guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust,
+              let serverTrust = challenge.protectionSpace.serverTrust,
+              challenge.protectionSpace.host.lowercased() == host else {
+            completionHandler(.performDefaultHandling, nil)
+            return
+        }
+
+        guard SecTrustEvaluateWithError(serverTrust, nil) else {
+            completionHandler(.cancelAuthenticationChallenge, nil)
+            return
+        }
+
+        let certCount = SecTrustGetCertificateCount(serverTrust)
+        for i in 0..<certCount {
+            guard let cert = SecTrustGetCertificateAtIndex(serverTrust, i) else { continue }
+            let certData = SecCertificateCopyData(cert) as Data
+            let hash = sha256(certData)
+            let hashB64 = Data(hash).base64EncodedString()
+            if pinnedHashes.contains(hashB64) {
+                completionHandler(.useCredential, URLCredential(trust: serverTrust))
+                return
+            }
+        }
+
+        completionHandler(.cancelAuthenticationChallenge, nil)
+    }
+}
+
+private func sha256(_ data: Data) -> Data {
+    Data(SHA256.hash(data: data))
+}