Paul Hitt
1594ce84f6
sha256 39ccfbde…, signed CN=Flamenet Messenger with 791fc826… — the same
certificate as every build since 0.3, so 0.9 installs are offered this
rather than refused.
⚠️ APK into downloads/ BEFORE the manifest, and the served copy hashed
over HTTPS rather than trusted as copied. A manifest that lands first
announces a version the file is not, and every client checking in the gap
downloads the old one and rejects it against the new hash.
Second release through the notes gate, and it did its job unprompted:
`release-manifest.sh` read 0.10 back out of the APK and confirmed
`Resources/releases.json` names it before writing a byte.
261 lines
13 KiB
Kotlin
261 lines
13 KiB
Kotlin
import java.io.File
|
|
import java.util.Properties
|
|
|
|
// The Android app shell. Everything below it — the cryptography and the wire
|
|
// layer — lives in :engine and :client, which are plain JVM libraries so they
|
|
// can be tested without any of this.
|
|
plugins {
|
|
id("com.android.application")
|
|
kotlin("android")
|
|
id("org.jetbrains.kotlin.plugin.compose")
|
|
}
|
|
|
|
android {
|
|
namespace = "io.flamenet.messenger"
|
|
compileSdk = 35
|
|
|
|
defaultConfig {
|
|
applicationId = "io.flamenet.messenger"
|
|
// Android exposes the XDH algorithm from API 33. Below that a provider
|
|
// such as BouncyCastle has to be registered at startup; the engine is
|
|
// provider-agnostic, but nothing here does that registration yet, so
|
|
// claiming a lower floor would be claiming something untrue.
|
|
minSdk = 33
|
|
targetSdk = 35
|
|
// 🔴 **Bump BOTH on every published build, and never reuse a code.**
|
|
// Nothing installs this app but the person holding the phone, so
|
|
// `versionCode` is not bookkeeping — it is the only thing that tells an
|
|
// existing install a newer build exists. `UpdateCheck` compares this
|
|
// against what the relay publishes in `downloads/android-latest.json`,
|
|
// and `scripts/release-manifest.sh` reads it back out of the built APK
|
|
// to write that file, so the two cannot drift.
|
|
//
|
|
// ⚠️ Android also refuses to install an APK whose `versionCode` is
|
|
// lower than the installed one, so a code that goes backwards makes a
|
|
// release uninstallable for everybody already on the higher number.
|
|
versionCode = 10
|
|
versionName = "0.10"
|
|
testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
|
|
}
|
|
|
|
sourceSets {
|
|
getByName("main") { java.srcDir("src/main/kotlin") }
|
|
getByName("androidTest") { java.srcDir("src/androidTest/kotlin") }
|
|
}
|
|
|
|
buildFeatures { compose = true }
|
|
|
|
compileOptions {
|
|
sourceCompatibility = JavaVersion.VERSION_17
|
|
targetCompatibility = JavaVersion.VERSION_17
|
|
}
|
|
kotlin { compilerOptions { jvmTarget.set(org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_17) } }
|
|
|
|
// Read from a properties file outside the repository, so the keystore and
|
|
// its password are never in git and a checkout without them still builds
|
|
// (unsigned, which is exactly what an unsigned build should be).
|
|
// 🔴 **This app's OWN key, not the one every Flamenet Android app shares.**
|
|
// `.flamenet-android-signing.properties` was made for Flamenet Files, and
|
|
// because the path is app-agnostic this app silently inherited it — every
|
|
// release before 2026-08-25 went out as `CN=Flamenet Files`. Nobody chose
|
|
// that for a messenger; it fell out of the layout.
|
|
//
|
|
// It matters because **an Android signing key is permanent**: once a device
|
|
// installs a build signed with one key, it REFUSES every later build signed
|
|
// with another. Sharing one key across products also means one compromised
|
|
// keystore takes out both.
|
|
//
|
|
// So: prefer this app's own file, fall back to the shared one so a machine
|
|
// that only has the old setup still produces a signed build rather than
|
|
// failing confusingly.
|
|
//
|
|
// ⚠️ Both files live outside the repo and hold a password in the clear. They
|
|
// are never in git, and a checkout without them still builds — unsigned,
|
|
// which is exactly what an unsigned build should be.
|
|
val signingProperties = Properties()
|
|
val home = File(System.getProperty("user.home"))
|
|
val signingFile = listOf(
|
|
File(home, ".flamenet-messenger-signing.properties"),
|
|
File(home, ".flamenet-android-signing.properties"),
|
|
).firstOrNull { it.exists() }
|
|
signingFile?.inputStream()?.use { signingProperties.load(it) }
|
|
|
|
signingConfigs {
|
|
if (signingProperties.isNotEmpty()) {
|
|
create("release") {
|
|
storeFile = File(signingProperties.getProperty("storeFile"))
|
|
storePassword = signingProperties.getProperty("storePassword")
|
|
keyAlias = signingProperties.getProperty("keyAlias")
|
|
keyPassword = signingProperties.getProperty("keyPassword")
|
|
}
|
|
}
|
|
}
|
|
|
|
buildTypes {
|
|
release {
|
|
// ⚠️ **WebRTC ships native libraries for four ABIs and they
|
|
// dominate the APK** — about 41 MB uncompressed, of which x86 and
|
|
// x86_64 are ~24 MB and exist only for emulators. Real phones are
|
|
// arm64-v8a, with armeabi-v7a for old ones.
|
|
//
|
|
// Restricted here rather than split into per-ABI APKs on purpose:
|
|
// this app is handed to testers as one file, and per-ABI outputs
|
|
// turn "send them the APK" into "send them the right APK".
|
|
//
|
|
// Debug keeps all four, because that is what runs on an emulator.
|
|
ndk { abiFilters += setOf("arm64-v8a", "armeabi-v7a") }
|
|
isMinifyEnabled = true
|
|
// 🔴 **R8 accepts a missing rules file in silence.** This one was
|
|
// referenced here and did not exist, so the release build shipped
|
|
// with the platform defaults alone — and answering a call aborted
|
|
// the process, because WebRTC's native JNI_OnLoad resolves its Java
|
|
// classes by name and R8 had renamed them. Nothing failed, nothing
|
|
// warned, and no debug test could see it. Fail the build instead.
|
|
file("proguard-rules.pro").takeIf { it.isFile }
|
|
?: throw GradleException(
|
|
"app/proguard-rules.pro is missing. The release build needs it — " +
|
|
"without the org.webrtc keep rules, answering a call aborts the " +
|
|
"process inside JNI_OnLoad with no Kotlin stack trace.")
|
|
proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
|
|
signingConfig = signingConfigs.findByName("release")
|
|
}
|
|
}
|
|
|
|
packaging {
|
|
resources.excludes += setOf("META-INF/*.kotlin_module", "META-INF/DEPENDENCIES")
|
|
}
|
|
|
|
// 🔴 **So screens can be rendered without an emulator.** Robolectric in
|
|
// native-graphics mode draws real Compose pixels on the JVM, which is what
|
|
// makes `./gradlew :app:test` able to produce a PNG of a screen. The
|
|
// emulator died four times in one afternoon under memory pressure, and an
|
|
// 8 GB AVD to look at a layout is a poor trade.
|
|
//
|
|
// ⚠️ `isIncludeAndroidResources` is not optional here — without it the
|
|
// theme cannot resolve and every render throws on a missing resource,
|
|
// which reads as a Compose problem rather than a configuration one.
|
|
testOptions {
|
|
unitTests {
|
|
isIncludeAndroidResources = true
|
|
isReturnDefaultValues = true
|
|
all {
|
|
it.systemProperty("robolectric.graphicsMode", "NATIVE")
|
|
|
|
// 🔴 **The screenshot tests are debug-variant tests, and
|
|
// `./gradlew test` runs BOTH variants.**
|
|
//
|
|
// They launch a `ComponentActivity`, which is declared by
|
|
// `androidx.compose.ui:ui-test-manifest` — a `debugImplementation`
|
|
// dependency, so the release variant's merged manifest has no
|
|
// such activity and all fifteen die with "Unable to resolve
|
|
// activity for Intent".
|
|
//
|
|
// ⚠️ The tempting fix is to add that dependency to release as
|
|
// well. Do not: it exists to inject a test-only activity into
|
|
// the manifest, and putting it on `releaseImplementation` would
|
|
// ship that into the APK. The tests belong to the variant that
|
|
// can run them.
|
|
//
|
|
// ⚠️ Excluded by name rather than by disabling
|
|
// `testReleaseUnitTest` wholesale — everything else in the
|
|
// suite still runs in both variants, so a genuine
|
|
// release-variant difference would still be caught.
|
|
if (it.name.contains("Release")) {
|
|
it.exclude("**/ScreenshotTest*")
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
dependencies {
|
|
implementation(project(":engine"))
|
|
implementation(project(":client"))
|
|
implementation(platform("androidx.compose:compose-bom:2024.12.01"))
|
|
implementation("androidx.compose.material3:material3")
|
|
implementation("androidx.compose.material:material-icons-extended")
|
|
implementation("androidx.compose.ui:ui")
|
|
implementation("androidx.compose.ui:ui-tooling-preview")
|
|
debugImplementation("androidx.compose.ui:ui-tooling")
|
|
implementation("androidx.activity:activity-compose:1.9.3")
|
|
// The app lock. `BiometricPrompt` covers fingerprint, face AND the device
|
|
// credential, so a phone with a PIN and no biometric hardware can still use
|
|
// it — matching iOS, which asks for `.deviceOwnerAuthentication` rather
|
|
// than biometrics specifically for the same reason.
|
|
implementation("androidx.biometric:biometric:1.1.0")
|
|
// 🔴 A version FLOOR, not a feature bump. biometric:1.1.0 drags in a
|
|
// 2019-era androidx.fragment whose FragmentActivity still enforces the
|
|
// 16-bit requestCode check — and Compose's ActivityResultRegistry mints
|
|
// codes far above that, so tapping ANY picker (post a story, change the
|
|
// avatar) threw "Can only use lower 16 bits for requestCode" and closed
|
|
// the app. Fragment 1.3+ removed the check; pin a current one explicitly.
|
|
implementation("androidx.fragment:fragment-ktx:1.8.5")
|
|
implementation("androidx.core:core-ktx:1.15.0")
|
|
implementation("androidx.lifecycle:lifecycle-viewmodel-compose:2.8.7")
|
|
implementation("androidx.lifecycle:lifecycle-runtime-compose:2.8.7")
|
|
implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.9.0")
|
|
|
|
// Voice calls (§8.10).
|
|
//
|
|
// The one third-party dependency in this app, and it is here because the
|
|
// alternative is implementing ICE, DTLS-SRTP and an audio pipeline, which
|
|
// is not a thing to hand-roll. `webrtc-sdk` is the maintained build of
|
|
// Google's own libwebrtc — the upstream project stopped publishing usable
|
|
// Android artifacts, and every Android client of consequence uses either
|
|
// this or its own build of the same source.
|
|
//
|
|
// ⚠️ It is a large native blob: roughly 15-20 MB of the APK, and not
|
|
// something that can be audited line by line. Worth stating rather than
|
|
// absorbing quietly, because everything else in this app deliberately is
|
|
// auditable.
|
|
implementation("io.github.webrtc-sdk:android:125.6422.07")
|
|
|
|
// Reads the QR on somebody's Address screen. Decode only, pure Java, no
|
|
// services — the camera frames come from the WebRTC capture stack above,
|
|
// so this is the algorithm (finder patterns + Reed-Solomon), not a second
|
|
// camera framework. The encoder half stays our own (`engine`'s QrCode).
|
|
implementation("com.google.zxing:core:3.5.3")
|
|
|
|
// On-device tests. The JVM suites cannot see a provider difference, and a
|
|
// provider difference is what broke X25519 the first time this engine's
|
|
// sibling ran on a phone.
|
|
// Plain JVM unit tests for the app module. There were none until a
|
|
// StateFlow write-back bug in SiteConfig shipped unnoticed; logic that
|
|
// lives in :app and needs no device belongs here, not in androidTest.
|
|
|
|
testImplementation(kotlin("test"))
|
|
// 🔴 The Android framework's `org.json` is STUBBED in unit tests — every
|
|
// method returns null or throws. A test that builds a JSONObject fails with
|
|
// a NullPointerException that says nothing about the cause. The engine and
|
|
// client modules already pull the real implementation in for exactly this;
|
|
// the app module needs it for the same reason.
|
|
testImplementation("org.json:json:20240303")
|
|
testImplementation("junit:junit:4.13.2")
|
|
|
|
// Screenshot tests that need no device. ⚠️ Test-only dependencies: none of
|
|
// this reaches the APK. Robolectric is the standard JVM Android runtime and
|
|
// is what AndroidX's own screenshot tooling is built on — the alternative
|
|
// to adopting it is not writing our own, it is keeping an 8 GB emulator
|
|
// alive to look at a layout.
|
|
testImplementation("org.robolectric:robolectric:4.14.1")
|
|
// Drives Session against a real HTTP server rather than a hand-written
|
|
// fake, the same way :client's tests do — a fake agrees with the client
|
|
// about every field name, including the ones it gets wrong.
|
|
testImplementation("com.squareup.okhttp3:mockwebserver:4.12.0")
|
|
testImplementation("androidx.test:core-ktx:1.6.1")
|
|
testImplementation("androidx.test.ext:junit:1.2.1")
|
|
testImplementation(platform("androidx.compose:compose-bom:2024.12.01"))
|
|
testImplementation("androidx.compose.ui:ui-test-junit4")
|
|
debugImplementation("androidx.compose.ui:ui-test-manifest")
|
|
|
|
androidTestImplementation("androidx.test.ext:junit:1.2.1")
|
|
androidTestImplementation("androidx.test:runner:1.6.2")
|
|
// GrantPermissionRule: permissions have to be granted before the
|
|
// activity launches, or its permission dialog steals focus from Compose.
|
|
androidTestImplementation("androidx.test:rules:1.6.1")
|
|
androidTestImplementation(platform("androidx.compose:compose-bom:2024.12.01"))
|
|
androidTestImplementation("androidx.compose.ui:ui-test-junit4")
|
|
debugImplementation("androidx.compose.ui:ui-test-manifest")
|
|
androidTestImplementation("androidx.tracing:tracing:1.2.0")
|
|
}
|