Correct test-only Android verification branches

Previously, the BuildConfig field used was not being evaluated at
compile-time like we expected. This resulted in test-only branches not
being eliminated by `javac` and remaining in the final artifact.

This both makes both auditing for correctness harder and inhibits more
future test-only code stripping, so we correct it by providing a more
narrowly scoped, and constant, boolean determined at build time based
off if any tests are being ran. This allows `javac` to remove test
branches entirely like we want.

Author: complexspaces

android/rustls-platform-verifier/build.gradle

@@ -3,6 +3,8 @@ plugins {
     id 'org.jetbrains.kotlin.android'
 }
 
+def isTest = gradle.startParameter.taskNames.any { it.contains("Test") }
+
 static def getOsArch() {
     final String hostArch = System.getProperty("os.arch")
 
@@ -28,6 +30,8 @@ android {
         minSdk 22
         targetSdk 33
 
+        buildConfigField "boolean", "TEST", "$isTest"
+
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
     }
 

android/rustls-platform-verifier/src/main/java/org/rustls/platformverifier/CertificateVerifier.kt

@@ -105,7 +105,7 @@ internal object CertificateVerifier {
 
     @JvmStatic
     private fun addMockRoot(root: ByteArray) {
-        if (!BuildConfig.DEBUG) {
+        if (!BuildConfig.TEST) {
             throw Exception("attempted to add a mock root outside a test!")
         }
 
@@ -222,10 +222,10 @@ internal object CertificateVerifier {
         // We select them as follows:
         // - If built for release, only use the system trust manager. This should let all test-related
         // code be optimized out.
-        // - If built for debug:
+        // - If built for tests:
         //      - If the mock CA store has any values, use the mock trust manager.
         //      - Otherwise, use the system trust manager.
-        val (trustManager, keystore) = if (!BuildConfig.DEBUG) {
+        val (trustManager, keystore) = if (!BuildConfig.TEST) {
             val trustManager =
                 systemTrustManager.value ?: return VerificationResult(StatusCode.Unavailable)
             Pair(trustManager, systemKeystore)
@@ -256,7 +256,7 @@ internal object CertificateVerifier {
         // TEST ONLY: Mock test suite cannot attempt to check revocation status if no OSCP data has been stapled,
         // because Android requires certificates to an specify OCSP responder for network fetch in this case.
         // If in testing w/o OCSP stapled, short-circuit here - only prior checks apply.
-        if ((mockKeystore.size() != 0) && (ocspResponse == null)) {
+        if (BuildConfig.TEST && (mockKeystore.size() != 0) && (ocspResponse == null)) {
             return VerificationResult(StatusCode.Ok)
         }