Yuvomi Mobile Contributors
2d12491516
Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.
3.1 KiB
Android development
Requirements: JDK 17, Android SDK platform 37.0, build-tools 36.0.0, current platform-tools, and accepted Android SDK licenses. Minimum Android 8 (API 26). Use a maintained Android System WebView. Target API 37. On Android 17, choose "Allow private-network servers" when using a LAN instance; public HTTPS servers do not need this optional runtime permission. No discovery/scanning is performed.
export ANDROID_HOME=/path/to/android-sdk
bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease
bash android/gradlew -p android connectedDebugAndroidTest
Gradle 9.6.0 is checksum-verified by the wrapper. AGP 9.4.1 uses built-in Kotlin with the build-cache fix in KGP 2.4.21. Maven versions are locked. No dynamic application dependencies or private Maven repository is required.
Ordinary outputs:
android/app/build/outputs/apk/debug/app-debug.apk(development-signed)android/app/build/outputs/apk/release/app-release-unsigned.apkandroid/app/build/outputs/bundle/release/app-release.aab(unsigned unless signed later)android/app/build/reports/(lint, JVM and emulator results)
Immediately after building, collect and inspect the outputs:
python3 scripts/collect-android-artifacts.py
This writes ignored artifacts/android/ copies, SHA256SUMS, source identity and
manifest/network-policy/signature evidence. It requires ANDROID_HOME and respects
YUVOMI_BUILD_DIR. Source identity records the checkout at collection time; always
rebuild immediately beforehand and use a clean worktree for a release candidate.
The unsigned release cannot be installed/published as-is. See release signing
instructions. gradle-wrapper.jar is the standard generated Gradle bootstrap
binary; it is intentionally versioned, unlike generated APKs or caches.
On WSL/Windows mounts that reject POSIX metadata operations, put outputs on the Linux filesystem:
export YUVOMI_BUILD_DIR="$HOME/yuvomi-build"
bash android/gradlew -p android testDebugUnitTest assembleDebug
The application never permits HTTP, including debug builds. Use real HTTPS for manual development. For a temporary local HTTPS integration environment:
git clone --filter=blob:none https://github.com/ulsklyc/yuvomi.git /path/to/upstream
git -C /path/to/upstream checkout 10bfef7686ed7303b4c74c7fcc55a5eb16356c9d
npm ci --omit=dev --prefix /path/to/upstream
python3 scripts/test-integration.py /path/to/upstream --android
Requires Node 22.14+ and a running emulator. The harness creates and removes its
own CA/key/database, uses adb reverse, and builds .integration with explicit
test trust. It does not weaken production TLS. Test credentials are ephemeral.
Keep test reports private if you customize the harness with real data (not advised).
For dependency updates run :app:dependencies --write-locks, the full pipeline,
and python3 scripts/check-dependencies.py. Review lockfile changes. The version
update lint recommendations are informational, not suppressed correctness errors;
OSV checks independently fail on known advisories.