[koniz-dev]

ENABLE_SSL_PINNING was read through EnvConfig.getBool, which treats anything but true/1/yes/on as false. So a typo (ture, enabled) or a stray blank silently turned pinning off in a staging or production release, with valid fingerprints and no warning. Both build helpers passed such a value through.

Change.

• AppConfig.enableSslPinning honours only the on spellings (true, 1, yes, on) and the off spellings (false, 0, no, off), in any case and trimmed. Any other value keeps the environment's default.
• New AppConfig.sslPinningFlagUnrecognised reports such a value, and main() refuses to start a release that carries one, naming the value. tool/golden/stripped/lib/main.dart mirrors the change.
• scripts/ci/ssl_pinning_defines.sh and fastlane/ssl_pinning.rb refuse a staging or production build with such a value. They now trim the flag as the app does, so " OFF " is an opt-out in all three places.
• .env.example and docs/guides/configuration.md list the accepted spellings.

Tests.

• test/core/config/ssl_pinning_flag_test.dart: in staging and production, enabled, ture and " " keep pinning on and are reported. False , OFF, 0 and no opt out. An unset flag is not reported. With the old parsing, the six unrecognised cases fail.
• startup_reachability_test.dart: a production release with valid fingerprints and ENABLE_SSL_PINNING=enabled boots into the failure screen, naming "enabled".
• build_all_analyze_size_test.dart and fastlane_ssl_pinning_rb_test.dart: enabled and " " are refused even with fingerprints, and a padded upper-case opt-out builds. With the old helpers, these 4 fail.

Pre-merge review (a fresh qa subagent on the diff): the fail-open is closed in all three places. Its findings, fixed in the second commit:

• Inner whitespace. The shell helper deleted every space, so "o n" and "t r u e" passed it while the app refuses to start on them. It now trims only the ends. Tests were added; against the first commit they fail.
• Debug output. printConfig and getDebugInfo now report an unrecognised value, so a debug run is not silent either.
• Message length. The release refusal shows at most 32 characters of the raw value.
• Docs. The security guide's settings table lists the accepted spellings, and the misconfiguration message no longer says ENABLE_SSL_PINNING=true.

It also confirmed:

• no other getBool flag fails open in its unsafe direction (debug features and HTTP logging fail closed);
• the refusal order in main() is right;
• refusing on web as well is consistent with the build helpers.

Refs #991

🤖 Generated with Claude Code