R012: 签名证书APL等级和app-feature配置错误

To scan .p7b signing certificates for incorrect APL level and app-feature configuration, extract bundle-info.apl and bundle-info.app-feature fields, parse acls.allowed-acls and permissions.restricted-permissions, and classify permissions into A-H categories to identify mismatches during security review.

An incorrect APL level in a HarmonyOS signing certificate occurs when a normal app is misclassified with a higher privilege level like system_core. This mismatch between bundle-info.apl and actual restricted permissions creates security vulnerabilities and release compliance issues.

To fix APL and app-feature configuration errors in a .p7b file, you must regenerate the file using signing tools rather than editing it directly. The scan generates scenario-based repair suggestions to guide the regeneration and prevent signature invalidation.

Editing a .p7b file directly causes signature invalidation because the cryptographic signature no longer matches the modified certificate contents. To maintain release compliance, .p7b files must be regenerated with official signing tools after adjusting APL or app-feature settings.

Yes, you can check .p7b files repository-wide for release readiness by scanning all signature/*.p7b and root-level *.p7b files. The scan extracts APL and app-feature data, classifies permissions into A-H categories, and generates an issue report with severity and repair suggestions.

Restricted permissions are classified into A-H categories by parsing acls.allowed-acls and permissions.restricted-permissions from the .p7b file. Unknown permissions are flagged for manual confirmation to ensure accurate permission classification and security review.