SHA256
Yuvomi Mobile Contributors
40a7962307
Replace current wrapper claims with native architecture/security/build evidence, preserve historical documents, track all thirty pages and explicit release gates, correct brand attribution and provide the twelve-section delivery report without claiming completion. Native signing remains paused and Apple application/device validation outstanding.
147 lines
8.6 KiB
Markdown
147 lines
8.6 KiB
Markdown
# Historical validation — superseded WebView prototype
|
|
|
|
These results describe the old wrapper, not the current native implementation.
|
|
See [current native validation](validation.md).
|
|
|
|
**Partially verified development software, not production-ready.**
|
|
Local validation date: 2026-10-21. No unexecuted iOS application test, hosted CI
|
|
run, production signing, or store publication is represented as completed.
|
|
|
|
## Executed evidence
|
|
|
|
- Android debug APK and unsigned release APK/AAB built successfully; both
|
|
`lintDebug` and `lintRelease` passed. JVM security/picker-policy tests: **7 passed,
|
|
zero failures/skips**.
|
|
- Android API 35 regular emulator suite: **6 passed, zero failures/skips**.
|
|
This covers onboarding, invalid URLs, background/resume, hardened settings,
|
|
cross-origin POST/subresource isolation, opaque-page Blob rejection and activity
|
|
recreation. Its permission test checks that the API 37 permission UI is absent;
|
|
it is **not** evidence of API 37 permission grant/denial behavior.
|
|
- Unmodified pinned upstream ran behind a temporary HTTPS reverse proxy.
|
|
Bootstrap metadata, password login, Secure/HttpOnly/SameSite cookies, persistent
|
|
session, CSRF rejection, logout/revocation passed in the harness.
|
|
- Android's extended real-server scenario exercises login, HttpOnly cookies,
|
|
document upload via upstream fetch, native FileTransfer output, bounded Blob
|
|
export, background/resume, recreation, CSRF-protected logout, revocation,
|
|
recovery, isolated OIDC return and back navigation. It does not automate the OS
|
|
camera/document destination picker or prove every upstream module works.
|
|
Two consecutive API 35 runs have **7 passed, zero failures/skips each**, including the
|
|
six regular security/onboarding cases and this real-server scenario.
|
|
- The cross-origin POST regression was deliberately observed failing without its
|
|
guard. The production guard was restored and the API 35 regression passes.
|
|
- Portable Swift production-policy tests: 7 passed (URL and typed metadata).
|
|
All Swift sources passed format lint and parsing with Swift 6.2.1 on Linux.
|
|
The portable package excludes BrowserModelTests. This does not build iOS.
|
|
- Selected upstream suites ran successfully: cookie-secure-flag (4),
|
|
session-sliding (8), two-factor (22), password-reset (24), sw-api-cache (42).
|
|
Upstream's plain OIDC script also exited successfully. These are upstream tests,
|
|
not evidence of a provider round-trip or native push support.
|
|
- The HTTPS harness independently passed upstream OIDC discovery, RS256 ID-token
|
|
signature/nonce validation, S256 PKCE exchange and session creation with a local
|
|
test IdP. The fixture checks single-use codes, exact redirect URIs and OAuth
|
|
Basic client authentication. Loopback hosts/ports and automatic fixture consent
|
|
are not representative of every provider's cross-site/embedded-agent policies.
|
|
- OSV: no listed advisories for **213** locked/direct Maven coordinates and build
|
|
plugins at scan time. This is not a guarantee that no vulnerabilities exist.
|
|
- ktlint 1.7.1, actionlint 1.7.7, repository invariants, Python compilation,
|
|
Node syntax and shell syntax checks passed. JUnit-verifier regression suite:
|
|
**8 passed**, including rejection of absent, empty, malformed, insufficient,
|
|
failed, errored and skipped evidence.
|
|
- Release APK inspection confirms API 26 minimum / API 37 target, no debuggable
|
|
flag, backups and cleartext disabled, system-only certificate trust. Exported
|
|
entry points are the launcher and AndroidX ProfileInstallReceiver protected by
|
|
the system DUMP permission; file/startup providers are not exported. Debug APK
|
|
signature verifies; release APK/AAB are unsigned. Collected archives contain no
|
|
fixture CA/key or signing-key files.
|
|
|
|
## Emulator limitations and retry evidence
|
|
|
|
Earlier extended-suite attempts crashed the host emulator with SIGSEGV under
|
|
software/off GPU modes. Host-GPU mode remained running and produced actionable
|
|
JUnit failures: an OIDC-return synchronization timeout, followed by an outage
|
|
assertion that incorrectly assumed the upstream worker could not serve its cached
|
|
app shell, then a document-readiness race after recreation. Tests now verify the
|
|
loaded JavaScript origin, wait for the sign-in window to close, retry only a probe
|
|
lost to document replacement and exercise recovery through uncached metadata.
|
|
The completed retry passes all seven tests without disabling the worker or
|
|
weakening production TLS/CSP/origin policies.
|
|
|
|
API 37 attempts encountered broken package/activity services and locked
|
|
credential-encrypted storage. **No API 37 runtime pass is claimed.**
|
|
|
|
Local logs and reports live in `/home/neste/yuvomi-build/`; test XML is under
|
|
`app/outputs/androidTest-results/connected/`. Earlier failing JUnit snapshots are
|
|
preserved as `integration-host-gpu-oidc-race.xml` and
|
|
`integration-host-gpu-sw-cache.xml`, plus
|
|
`integration-host-gpu-document-ready.xml`. Passing evidence is preserved in
|
|
`integration-api35-first-pass.xml` and `integration-api35-repeat-pass.xml`; logs are
|
|
`upstream-integration-final-retry.log` and `upstream-integration-repeat.log`.
|
|
These files are local evidence, not published
|
|
artifacts or a hosted CI result.
|
|
|
|
Test environment: JDK 17.0.20.1, Node 22.22.1, Python 3.14.4, Android Emulator
|
|
37.2.12, API 35 x86_64 Google APIs image, WebView 124.0.6367.219. The old bundled
|
|
WebView is useful compatibility evidence, not a recommendation to use an unpatched
|
|
engine; a current engine/device run remains mandatory.
|
|
|
|
## Artifacts
|
|
|
|
Ignored `artifacts/android/` contains the development-signed debug APK and unsigned
|
|
release APK/AAB, `SHA256SUMS`, `build-info.json` and manifest/policy/signature
|
|
inspection evidence. No integration APK is collected. No IPA or Apple archive
|
|
exists. See [Android build](build-android.md) for repeatable collection commands.
|
|
|
|
## Commands
|
|
|
|
```sh
|
|
bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease connectedDebugAndroidTest
|
|
python3 scripts/test-integration.py /path/to/pinned-upstream --android
|
|
swift test --package-path ios
|
|
swiftc -frontend -parse ios/Sources/*.swift ios/Tests/*.swift ios/UITests/*.swift
|
|
python3 scripts/check-repository.py
|
|
python3 scripts/check-dependencies.py
|
|
python3 scripts/test-verifier.py
|
|
python3 scripts/collect-android-artifacts.py
|
|
git diff --check
|
|
```
|
|
|
|
This environment is Linux/WSL. Android SDK and a KVM emulator were installed for
|
|
real execution. Build output relocation was needed because the Windows mount
|
|
rejects some Gradle POSIX metadata operations. Swift's Linux toolchain was
|
|
installed for portable tests. No macOS, Xcode, Apple simulator or physical device
|
|
is available; no iOS build/archive/UI result is claimed.
|
|
|
|
## Mandatory remaining evidence
|
|
|
|
- Run Xcode build, XCTest/UI tests and unsigned archive on macOS; fix any compiler
|
|
or runtime issues. The app has **not** yet been typechecked against Apple SDKs.
|
|
- Validate real IdPs: cancellation, account linking, TOTP after OIDC, and embedded
|
|
provider policy. Browser-only providers have no native-session handoff upstream.
|
|
- Real-device camera/document picker cancellation, file MIME cases, rotation with
|
|
an outstanding picker, network loss/reconnect, process kill/memory pressure,
|
|
session expiry/revocation, OS backup, and offline account isolation.
|
|
- Android 17 private-network permission grant/denial/revocation on a matching OS.
|
|
Also run minimum-supported API 26 and a current OS/WebView device matrix.
|
|
- VoiceOver/TalkBack, large text, contrast, keyboard/safe areas, reduced motion,
|
|
light/dark appearance and responsive web modules on actual supported devices.
|
|
- Successful CI runs on the configured Gitea runners, private security
|
|
reporting contact, human security review, store ownership and production signing.
|
|
|
|
No Firebase/APNs registration, closed-app push, offline editing, App Store approval,
|
|
signing, publication or physical-device validation is claimed. See `SECURITY.md`
|
|
and `docs/security-review.md` for residual limitations.
|
|
Resume work using [maintainer continuation](continuation.md).
|
|
|
|
## Gitea runner adaptation
|
|
|
|
Workflows now live in `.gitea/workflows/` and target the supplied `ubuntu-latest`
|
|
pool and native `macos-arm64` M4 Pro runner. Local workflow grammar lint (Gitea URL
|
|
syntax normalized), repository invariants, shell/Python syntax, ten mocked runner
|
|
preflight regressions and eight evidence-verifier regressions pass. SHA-256 Git
|
|
initialization/fetch was exercised locally; the pinned XcodeGen archive's checksum
|
|
and native arm64 slice were verified. These are not remote runner execution or
|
|
Apple SDK results. See [runner requirements](ci-runners.md); the local emulator
|
|
preflight currently rejects unavailable/inaccessible KVM as designed. Original
|
|
application build evidence above remains historical and is not a rebuild of the
|
|
workflow-only changes.
|