SHA256
Yuvomi Mobile Contributors
40a7962307
Replace current wrapper claims with native architecture/security/build evidence, preserve historical documents, track all thirty pages and explicit release gates, correct brand attribution and provide the twelve-section delivery report without claiming completion. Native signing remains paused and Apple application/device validation outstanding.
86 lines
4.3 KiB
Markdown
86 lines
4.3 KiB
Markdown
# Android development
|
|
|
|
Requirements: JDK 17, Android SDK platform 37.0, build-tools 36.0.0, current
|
|
platform-tools, and accepted Android SDK licenses. Minimum Android 8 (API 26).
|
|
The application surface is Jetpack Compose, not Android System WebView. Target
|
|
API 37. On Android 17, choose "Zugriff auf private Netzwerke erlauben" for a LAN instance; public HTTPS servers
|
|
do not need this optional runtime permission. No discovery/scanning is performed.
|
|
|
|
```sh
|
|
export ANDROID_HOME=/path/to/android-sdk
|
|
bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease
|
|
bash android/gradlew -p android connectedDebugAndroidTest
|
|
```
|
|
|
|
Gradle 9.6.0 is checksum-verified by the wrapper. AGP 9.4.1 uses built-in Kotlin
|
|
with KGP and Compose compiler plugin 2.4.21. Maven versions are locked. No dynamic
|
|
application dependencies or private Maven repository is required.
|
|
|
|
Ordinary outputs:
|
|
|
|
- `android/app/build/outputs/apk/debug/app-debug.apk` (development-signed)
|
|
- `android/app/build/outputs/apk/release/app-release-unsigned.apk`
|
|
- `android/app/build/outputs/bundle/release/app-release.aab` (unsigned unless signed later)
|
|
- `android/app/build/reports/` (lint, JVM and emulator results)
|
|
|
|
The Gitea build job uploads `android-native-debug-apk`, containing an installable
|
|
development-signed `app-debug.apk`. It is a native preview, not a signed stable
|
|
release or a claim of full PWA parity. See `native-parity.md` before testing it.
|
|
|
|
Native UI tests live in `src/androidTestNative/java` and the real-server native
|
|
scenario in `src/androidTestNativeIntegration/java`. The old browser tests and
|
|
renderer are archived under `legacy/` and are not compiled into the app/suites.
|
|
|
|
Immediately after building, collect and inspect the outputs:
|
|
|
|
```sh
|
|
python3 scripts/collect-android-artifacts.py
|
|
```
|
|
|
|
This writes ignored `artifacts/android/` copies, `SHA256SUMS`, source identity and
|
|
manifest/network-policy/signature evidence. It requires `ANDROID_HOME` and respects
|
|
`YUVOMI_BUILD_DIR`. Source identity records the checkout at collection time; always
|
|
rebuild immediately beforehand and use a clean worktree for a release candidate.
|
|
|
|
The unsigned release cannot be installed/published as-is. See release signing
|
|
instructions. `gradle-wrapper.jar` is the standard generated Gradle bootstrap
|
|
binary; it is intentionally versioned, unlike generated APKs or caches.
|
|
|
|
On WSL/Windows mounts that reject POSIX metadata operations, put outputs on the
|
|
Linux filesystem:
|
|
|
|
```sh
|
|
export YUVOMI_BUILD_DIR="$HOME/yuvomi-build"
|
|
bash android/gradlew -p android testDebugUnitTest assembleDebug
|
|
```
|
|
|
|
The application never permits HTTP, including debug builds. Use real HTTPS for
|
|
manual development. For a temporary local HTTPS integration environment:
|
|
|
|
```sh
|
|
git clone --filter=blob:none https://github.com/ulsklyc/yuvomi.git /path/to/upstream
|
|
git -C /path/to/upstream checkout 10bfef7686ed7303b4c74c7fcc55a5eb16356c9d
|
|
npm ci --omit=dev --prefix /path/to/upstream
|
|
python3 scripts/test-integration.py /path/to/upstream --android
|
|
```
|
|
|
|
Requires Node 22.14+ and a running emulator. The harness creates and removes its
|
|
own CA/key/database, uses `adb reverse`, and builds `.integration` with explicit
|
|
test trust. It does not weaken production TLS. Test credentials are ephemeral.
|
|
Keep test reports private if you customize the harness with real data (not advised).
|
|
The native test calls the real API through native controls and saves a synthetic
|
|
dashboard screenshot under `app/build/outputs/native-screenshots/`. It does not
|
|
demonstrate native SSO merely because the protocol fixture also tests OIDC.
|
|
The test writes through `PlatformTestStorageRegistry`; AGP collects the file in
|
|
`outputs/connected_android_test_additional_output/integrationAndroidTest/` before
|
|
uninstalling the fixture. The harness rejects missing/ambiguous output and removes
|
|
only its known screenshot from previous runs. Do not extract app-private files
|
|
after Gradle returns: UTP has already uninstalled the `.integration` package.
|
|
Capture uses the native window and asserts nonuniform pixels; a valid PNG header
|
|
alone is not sufficient screenshot evidence.
|
|
|
|
For dependency updates run `:app:dependencies --write-locks`, the full pipeline,
|
|
and `python3 scripts/check-dependencies.py`. Review lockfile changes. The version
|
|
update lint recommendations are informational, not suppressed correctness errors;
|
|
OSV checks independently fail on known advisories.
|