From 34a6e2cfee357a8a7af3141bc7db1fa2a55cdc4c Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Mon, 24 Nov 2025 15:18:53 +0100
Subject: [PATCH] lint: require https:// and no shorteners in Donate: links

---
 fdroidserver/lint.py |  3 ++-
 tests/test_lint.py   | 14 ++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/fdroidserver/lint.py b/fdroidserver/lint.py
index 8ee356aa..a3fcfc2f 100644
--- a/fdroidserver/lint.py
+++ b/fdroidserver/lint.py
@@ -154,7 +154,8 @@ regex_checks = {
         (re.compile(r'.*github\.com/[^/]+/[^/]+/*$'), _("/issues is missing")),
         (re.compile(r'.*gitlab\.com/[^/]+/[^/]+/*$'), _("/issues is missing")),
     ],
-    'Donate': http_checks
+    'Donate': http_url_shorteners
+    + require_https
     + [
         (
             re.compile(r'.*liberapay\.com'),
diff --git a/tests/test_lint.py b/tests/test_lint.py
index 63e11215..436eba0b 100755
--- a/tests/test_lint.py
+++ b/tests/test_lint.py
@@ -177,6 +177,20 @@ class LintTest(SetUpTearDownMixin, unittest.TestCase):
                 logging.debug(warn)
             self.assertTrue(anywarns, f"{url} does not fail lint!")
 
+    def test_check_regexes_donate(self):
+        app = fdroidserver.metadata.App()
+        app.Donate = 'https://example.com/donate/'
+        for warn in fdroidserver.lint.check_regexes(app):
+            self.fail()
+
+    def test_check_regexes_donate_both(self):
+        app = fdroidserver.metadata.App()
+        app.Donate = 'http://bit.ly/givememoney/'
+        warns = list(fdroidserver.lint.check_regexes(app))
+        for warn in warns:
+            self.assertIn('bit.ly', warn)
+        self.assertEqual(2, len(warns))
+
     def test_check_regexes_binaries(self):
         app = fdroidserver.metadata.App()
         app.Binaries = 'https://example.com/%v.apk'