SHA256
Yuvomi Mobile Contributors
2d12491516
Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.
68 lines
3.1 KiB
Markdown
68 lines
3.1 KiB
Markdown
# Android development
|
|
|
|
Requirements: JDK 17, Android SDK platform 37.0, build-tools 36.0.0, current
|
|
platform-tools, and accepted Android SDK licenses. Minimum Android 8 (API 26).
|
|
Use a maintained Android System WebView. Target API 37. On Android 17, choose
|
|
"Allow private-network servers" when using a LAN instance; public HTTPS servers
|
|
do not need this optional runtime permission. No discovery/scanning is performed.
|
|
|
|
```sh
|
|
export ANDROID_HOME=/path/to/android-sdk
|
|
bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease
|
|
bash android/gradlew -p android connectedDebugAndroidTest
|
|
```
|
|
|
|
Gradle 9.6.0 is checksum-verified by the wrapper. AGP 9.4.1 uses built-in Kotlin
|
|
with the build-cache fix in KGP 2.4.21. Maven versions are locked. No dynamic
|
|
application dependencies or private Maven repository is required.
|
|
|
|
Ordinary outputs:
|
|
|
|
- `android/app/build/outputs/apk/debug/app-debug.apk` (development-signed)
|
|
- `android/app/build/outputs/apk/release/app-release-unsigned.apk`
|
|
- `android/app/build/outputs/bundle/release/app-release.aab` (unsigned unless signed later)
|
|
- `android/app/build/reports/` (lint, JVM and emulator results)
|
|
|
|
Immediately after building, collect and inspect the outputs:
|
|
|
|
```sh
|
|
python3 scripts/collect-android-artifacts.py
|
|
```
|
|
|
|
This writes ignored `artifacts/android/` copies, `SHA256SUMS`, source identity and
|
|
manifest/network-policy/signature evidence. It requires `ANDROID_HOME` and respects
|
|
`YUVOMI_BUILD_DIR`. Source identity records the checkout at collection time; always
|
|
rebuild immediately beforehand and use a clean worktree for a release candidate.
|
|
|
|
The unsigned release cannot be installed/published as-is. See release signing
|
|
instructions. `gradle-wrapper.jar` is the standard generated Gradle bootstrap
|
|
binary; it is intentionally versioned, unlike generated APKs or caches.
|
|
|
|
On WSL/Windows mounts that reject POSIX metadata operations, put outputs on the
|
|
Linux filesystem:
|
|
|
|
```sh
|
|
export YUVOMI_BUILD_DIR="$HOME/yuvomi-build"
|
|
bash android/gradlew -p android testDebugUnitTest assembleDebug
|
|
```
|
|
|
|
The application never permits HTTP, including debug builds. Use real HTTPS for
|
|
manual development. For a temporary local HTTPS integration environment:
|
|
|
|
```sh
|
|
git clone --filter=blob:none https://github.com/ulsklyc/yuvomi.git /path/to/upstream
|
|
git -C /path/to/upstream checkout 10bfef7686ed7303b4c74c7fcc55a5eb16356c9d
|
|
npm ci --omit=dev --prefix /path/to/upstream
|
|
python3 scripts/test-integration.py /path/to/upstream --android
|
|
```
|
|
|
|
Requires Node 22.14+ and a running emulator. The harness creates and removes its
|
|
own CA/key/database, uses `adb reverse`, and builds `.integration` with explicit
|
|
test trust. It does not weaken production TLS. Test credentials are ephemeral.
|
|
Keep test reports private if you customize the harness with real data (not advised).
|
|
|
|
For dependency updates run `:app:dependencies --write-locks`, the full pipeline,
|
|
and `python3 scripts/check-dependencies.py`. Review lockfile changes. The version
|
|
update lint recommendations are informational, not suppressed correctness errors;
|
|
OSV checks independently fail on known advisories.
|