commit fbcc22086935fb08d4d1ee66c404be95f9685da7a3745d3adf3a7568b8c11aaf Author: Yuvomi Mobile Contributors Date: Tue Oct 20 23:17:09 2026 +0200 chore(repo): establish isolated mobile repository and upstream audit diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..bf026be --- /dev/null +++ b/.gitattributes @@ -0,0 +1,3 @@ +* text=auto eol=lf +*.png binary +*.jar binary diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..977ce02 --- /dev/null +++ b/.gitignore @@ -0,0 +1,20 @@ +.DS_Store +.idea/ +.gradle/ +**/build/ +local.properties +*.keystore +*.jks +*.p12 +*.mobileprovision +.env +.env.* +DerivedData/ +*.xcuserstate +xcuserdata/ +ios/Yuvomi.xcodeproj/ +.swiftpm/ +.build/ +artifacts/ +__pycache__/ +node_modules/ diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..6a1f47a --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Yuvomi Mobile contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md new file mode 100644 index 0000000..020e353 --- /dev/null +++ b/README.md @@ -0,0 +1,24 @@ +# Yuvomi Mobile + +Independent, community-maintained Android (Kotlin/WebView) and iOS +(SwiftUI/WKWebView) companions for user-owned [Yuvomi](https://github.com/ulsklyc/yuvomi) +servers. Not affiliated with or endorsed by upstream. + +**Development build - not production-ready.** See [validation status](docs/validation.md). +No mobile backend, advertisements, telemetry, tracking, subscriptions, or mandatory cloud. +The configured server supplies the application and retains responsibility for its own +integrations, version checks, security and privacy. + +Use a root-hosted HTTPS instance with a valid certificate, including private servers +accessible through your VPN. Custom ports are supported. HTTP and subpath deployments +are intentionally rejected. Enter the server on first launch; use Server settings to +reconnect or erase local browsing data and switch installations. + +- [Architecture](docs/architecture.md) +- [Android build](docs/build-android.md) / [iOS build](docs/build-ios.md) +- [Compatibility and authentication](docs/server-compatibility.md) +- [Release process](docs/release-process.md) + +MIT licensed. Upstream notices are preserved in `THIRD_PARTY_NOTICES.md`. +This implementation is AI-assisted (OpenAI via OpenCode) and requires human security +review before release. No upstream modification or public submission is authorized. diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md new file mode 100644 index 0000000..c49df12 --- /dev/null +++ b/THIRD_PARTY_NOTICES.md @@ -0,0 +1,33 @@ +# Attribution + +Yuvomi Mobile is an independent community contribution, not an official Yuvomi +product. Yuvomi's name identifies the server with which it interoperates. +Visual color values follow upstream DESIGN.md. No upstream logo is redistributed. + +Upstream Yuvomi: https://github.com/ulsklyc/yuvomi + +MIT License + +Copyright (c) 2026 ulsklyc + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +Android build dependencies retain their own licenses (Android SDK/platform APIs, +AndroidX: Apache-2.0; Kotlin: Apache-2.0; Gradle: Apache-2.0). +Apple system frameworks are provided by the operating system, not vendored here. diff --git a/docs/upstream-audit.md b/docs/upstream-audit.md new file mode 100644 index 0000000..a614b94 --- /dev/null +++ b/docs/upstream-audit.md @@ -0,0 +1,35 @@ +# Upstream source audit + +Inspected 2026-10-20: https://github.com/ulsklyc/yuvomi +revision `10bfef7686ed7303b4c74c7fcc55a5eb16356c9d`, package version `2.78.0`. +Source was cloned outside this repository; no upstream files were modified. + +Read README, CONTRIBUTING (including AI disclosure), SECURITY, DESIGN, package +manifest, server/index.js, server/auth.js, public/sw.js, sw-register.js and +notification settings. Reviewed the latest 100 open issues/PRs via GitHub API; +that sample is not an exhaustive review of all historical reports. + +Findings: + +- Frontend has no framework/build step; native projects remain separate. +- Public `/api/v1/version` exposes `app_name`, `setup_required`, + `password_reset_enabled`, **not** a release number before authentication. +- `/api/v1/auth/oidc/config` exposes enabled/password-login flags. +- Sessions are HttpOnly, SameSite=Lax, persistent cookies. Operators must set + `SESSION_SECURE=true` behind TLS. Native code must not replace auth or CSRF. +- Username/password, TOTP/recovery codes, reset and logout are web features. +- OIDC stores state, nonce and PKCE in the initiating browser's server session, + and returns to the configured server callback. There is no mobile callback, + one-time session exchange, or universal-link association protocol. +- Root-relative API, assets, redirects, service-worker registration and cookie + path mean subpaths cannot be promised. Use a dedicated hostname instead. +- Service worker has versioned shell caches and allow-listed read-only API + caching; mutations and authentication remain network-only. No offline editing. +- Web Push is not native push. Optional upstream ntfy/Gotify/webhook channels + provide self-hosted alternatives through their own clients. +- Upstream uses violet `#6C3AED`, warm grouped background `#F5F3ED`, and native + system fonts. Native screens follow these tokens without changing web design. + +Compatibility probing is structural, not cryptographic identification: any server +can imitate the public endpoints. Users must trust the URL they enter. Exact release +compatibility needs authenticated integration testing; no version range is inferred.