summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
9 hoursrelease: HardenedPass 0.1.2v0.1.2Danilo M.2-2/+10
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
9 hoursfix(i18n): name HardenedPass in commit messagesDanilo M.7-15/+15
The add and edit commit messages said "using Android Password Store" in every locale. The Italian remove message translated "store" as "negozio" (a shop); use "archivio". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
9 hoursfix(crypto): refuse to encrypt when a .gpg-id recipient key is missingDanilo M.5-8/+112
CryptoRepository.encrypt looked up every .gpg-id recipient and dropped the ones it could not find, so an entry saved on a device that lacked one recipient's key was encrypted to the others only. With a store shared between a phone key and a smartcard key, entries created on the phone could no longer be decrypted with the smartcard alone. Fail with the lookup error instead (KeyNotFoundException names the key), so the user imports the missing public key and saves again. PasswordCreationActivity also ignored the Result of encrypt and wrote the output buffer regardless: on any encryption failure it wrote an empty .gpg file, overwriting the entry when editing, and committed it. Show the error and leave the file untouched. CryptoRepositoryTest covers both the missing-recipient failure and the all-present success path, with keys generated by PGPainless (added as an app test dependency). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
9 hoursrelease: HardenedPass 0.1.1v0.1.1Danilo M.2-2/+9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
9 hoursfix(ssh): unlock screen-lock protected SSH keys with a fingerprintDanilo M.2-3/+17
A Keystore SSH key generated with "Protect with screen lock credential" was bound to AUTH_DEVICE_CREDENTIAL only, while the unlock prompt also accepted biometrics. A fingerprint passed the prompt, then signing the SSH auth request threw UserNotAuthenticatedException, sshj logged "User not authenticated" and the clone failed with "Socket closed". Bind new keys to AUTH_DEVICE_CREDENTIAL or AUTH_BIOMETRIC_STRONG, and allow only strong biometrics in the prompt on Android 11+, since weak ones never unlock Keystore keys (the androidx MasterKey keys already use credential or strong biometric). Android 9 and 10 cannot combine BIOMETRIC_STRONG with DEVICE_CREDENTIAL, so they keep the weak class. Existing protected keys still need the PIN until regenerated. Verified on the emulator (Class 3 fingerprint): a protected ECDSA key unlocked with a fingerprint authenticates and clones over SSH. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
10 hoursrelease: HardenedPass 0.1.0v0.1.0Danilo M.2-3/+23
Set the version to 0.1.0 (versionCode 100, following the versioning plugin's major*10000 + minor*100 + patch scheme) and add a changelog section for the first release. Upstream's never-released [Unreleased] section is kept below it, renamed, since 0.1.0 ships that work too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
14 hoursci: sign and publish HardenedPass releases with the fork's own keyDanilo M.4-110/+33
Add the fork's release keystore and its signing properties, encrypted with openssl (aes-256-cbc, pbkdf2) as secrets/keystore.cipher and secrets/props.cipher; the key is the ENCRYPT_KEY repository secret. The plaintext files and the master copy never enter the repository. Rewrite deploy_github_releases.yml for the single FOSS build: on a vX.Y.Z tag it decrypts the signing secrets, builds the signed release APK, removes the secrets, and creates a draft GitHub Release with HardenedPass_<tag>.apk and its SHA-256 checksum using gh, replacing the archived actions/create-release and upload-release-asset actions. AGENTS.md records the certificate fingerprint and the procedure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
14 hoursfeat: rename the app to HardenedPass (xyz.danix.hardenedpass)Danilo M.5-9/+23
The fork gets its own application ID and name, so it installs next to upstream's app.passwordstore instead of replacing it, and could be submitted to F-Droid. Debug builds keep the .debug suffix and are labelled "HardenedPass Debug". The Kotlin package stays app.passwordstore: renaming it would be churn with no visible effect. "GrapheneOS" is kept out of the name because it is that project's trademark; "Hardened" nods to its vocabulary. README and AGENTS.md describe the fork's GrapheneOS goal. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
14 hoursbuild: drop the nonFree flavor, Sentry and Play ServicesDanilo M.44-600/+23
The fork targets GrapheneOS and ships only FOSS builds. The nonFree flavor added Sentry crash reporting, wired to upstream's Sentry project, and Play Services SMS one-time-code autofill, which needs Google's servers. Neither is wanted, so remove the flavor dimension entirely: - Delete app/src/nonFree, the SentryPlugin, the sentry-stub module, the Sentry and Play Services catalog entries, and the Sentry scope setup in Application. - Move the free AutofillSmsActivity stub into main; it keeps the SMS OTP feature off exactly as the free build did. A ponytail note marks the FillOtpFromSms paths for later removal. - SlimTests no longer needs to skip a nonFree variant. - Workflows and docs use :app:assembleDebug / :app:assembleRelease. A bare assembleRelease would also verify library modules in release mode, where ui:compose fails on a pre-existing AppCompat attribute reference the old flavored task never touched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
14 hoursbuild(deps): update JGit from 4.5.7 to 5.13.5Danilo M.8-7/+68
JGit 4.5.7 dates from 2019. 5.13 is the last line that needs only Java 8 APIs, so it works with Android's desugaring; it also fixes GHSA-3p86-9955-h393 (arbitrary file overwrite on checkout). GHSA-vrpq-qp53-qv56 (XXE in repo manifest parsing) has no 5.x fix but the app never parses repo manifests. API changes: - SshSessionFactory now requires getType(). - CheckoutCommand.setForce is deprecated; setForceRefUpdate is its documented replacement with the same meaning. JGit 5 references java.lang.management and javax.management, which Android lacks; R8 flagged them. Both paths are made unreachable rather than only silenced: - WindowCache registers JMX statistics by default; Application.onCreate now installs a WindowCacheConfig with exposeStatsViaJmx = false. - GC.gc() takes a PID lock that queries ManagementFactory and would throw NoClassDefFoundError on a device. GcOperation now runs the GC steps (packRefs, repack, prune) directly; the lock only guards against concurrent gc processes, which cannot happen in the app. Aggressive packing is dropped. The R8 -dontwarn rules and the lint baseline entries are added only for those two now-unreachable references. JGitBehaviourTest covers the operations' command chains plus the GC steps and passes on 5.13.5. It now ignores the developer's global git config, which JGit 5 reads (commit.gpgsign made test commits try to sign). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
15 hourstest(git): pin down the JGit behaviour the git operations rely onDanilo M.1-0/+158
Run the command chains of SyncOperation, PushOperation, BreakOutOfDetached and ResetToRemoteOperation against a local bare repository and assert the results GitCommandExecutor branches on: rebase success, push OK / UP_TO_DATE / REJECTED_NONFASTFORWARD, a stopped rebase with its branch recoverable, abort and push to a conflict branch, and hard reset to the remote. Passes on JGit 4.5.7; it is the safety net for the JGit upgrade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
15 hoursdocs: record the device test procedure in AGENTS.mdDanilo M.1-1/+28
Document what the emulator can and cannot cover, how to run autofill tests on a real device over adb reverse without exposing anything on the network, which device settings to record and restore, and the pitfalls hit during the first run (animations blocking uiautomator, the screen locking mid-test, localized inline autofill chips). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
15 hoursfix(git): keep the branch name when breaking out of a failed rebaseDanilo M.2-2/+43
When a pull with rebase stops on a conflict, HEAD is detached and getCurrentBranch() returned null. "Abort rebase and push new branch" then pushed the local commits to "conflicting-null-<time>" and failed to switch back with "Branch name <null> is not allowed", leaving the repository on the conflict branch. Fall back to the branch JGit records in rebase-merge/head-name (or rebase-apply/head-name) while a rebase is in progress. Found while driving the conflict flow on an emulator against the e2e test server; verified there: the edit is pushed to conflicting-master-<time> and the operation completes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
16 hourstest: add a disposable end-to-end environment for emulator runsDanilo M.3-0/+123
scripts/e2e-env.sh starts a git-over-SSH server in Docker, seeded with a small pass-compatible store encrypted to a throwaway OpenPGP key, and can push the throwaway SSH and OpenPGP keys to an emulator. Keys are generated at runtime into the gitignored .e2e/ directory, so no key material is committed. AGENTS.md documents the emulator setup. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
16 hoursbuild(deps): move pre-release libraries to stable releasesDanilo M.1-7/+7
autofill 1.3.0, constraintlayout 2.2.2, documentfile 1.1.0, recyclerview 1.4.0, recyclerview-selection 1.2.0, swiperefreshlayout 1.2.0 and OkHttp 5.5.1 (build-logic only) replace their alpha, beta and rc builds. Left on pre-releases for now: - biometric-ktx 1.2.0-alpha05 and modernandroidpreferences 2.4.0-beta2: their newest stable releases are older than what is in use. - security-crypto-ktx 1.1.0-alpha06: the 1.1.0 stable release deprecates the whole library, which fails the warnings-as-errors build. Replacing it is tracked separately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
16 hoursbuild: update to Gradle 9.8.2, AGP 9.5.0, Kotlin 2.4.21, Hilt 2.60.1Danilo M.23-208/+153
AGP 9 migration: - Configure the shared Android setup through the new DSL (CommonExtension, ApplicationExtension) instead of the removed TestedExtension and BaseAppModuleExtension; targetSdk moves to the application extension. - Stop applying the Kotlin Android plugin; AGP 9 compiles Kotlin itself. - Replace kapt with KSP 2.3.13 for Hilt, which built-in Kotlin requires, and carry the Dagger compiler options over as KSP arguments. - AGP 9 now applies packaging excludes to unit-test resources, which stripped the diceware word list (**/*.txt) from its tests; lift that exclude in the diceware module. - Use resources.directories instead of the deprecated srcDir. Plugin updates required by Gradle 9 / AGP 9: Sentry Gradle plugin 6.25.0 (sentry-android 8.62.0), metalava plugin 0.5.1, maven-publish 0.37.0, spotless 8.10.4, version-catalog-update 1.1.2, download task 5.7.0, foojay resolver 1.0.0, with their API changes. Newer metalava models Kotlin properties, so autofill-parser/api.txt is regenerated; the diff is representation only, no API was added or removed. Fix new Kotlin 2.4 and lint findings (explicit return type in a function with an early return, UseKtx in autofill-parser), drop deprecated Kotlin Gradle properties, and make the AGENTS.md pre-commit command cover every task CI runs (both flavors, lint on all modules). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 hoursbuild: update to Gradle 8.14.6, AGP 8.13.2, Kotlin 2.1.21, Hilt 2.58Danilo M.12-35/+16
Newest releases that still fit together on the Gradle 8 / AGP 8 line: - Kotlin stops at 2.1, the newest metadata Gradle 8's embedded Kotlin 2.0 compiler can read when compiling build-logic. - Hilt stops at 2.58; 2.59 and later require AGP 9. Hilt 2.52's annotation processor could not read Kotlin 2.1 metadata. Drop the languageVersion = 1.9 pin so code compiles with the K2 frontend; Kotlin 2.4 no longer accepts 1.9. Drop the R8 8.5.35 pin and its repository, which is older than the R8 AGP 8.13 bundles. Move the deprecated buildFeatures.androidResources flag to androidResources.enable, and replace Uri.parse with toUri for the new UseKtx lint check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 hoursbuild: limit Bouncy Castle alignment to -jdk18on modulesDanilo M.2-4/+8
The resolution rule also rewrote the legacy -jdk15on artifacts that metalava's tooling depends on to 1.86, a version that line never had (it ended at 1.70), so metalavaCheckCompatibilityRelease failed to resolve in CI. Only align the -jdk18on modules the app ships. Add the metalava check to the pre-commit command in AGENTS.md so local runs cover the same tasks as CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 hoursdocs: add AGENTS.md and CLAUDE.mdDanilo M.2-0/+98
AGENTS.md holds the agent guidance for the fork: layout and remotes, build and test commands matching CI, verified gotchas, the manual public suffix list update with its last-run date, and the release signing status. CLAUDE.md only points at it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 hoursci: remove automated public suffix list updatesDanilo M.1-48/+0
The workflow committed through a bot PR on GitHub, which is only a push mirror of the main repository; bot commits there would diverge from it. Update the list by hand instead: ./gradlew updatePSL ./gradlew :autofill-parser:test -PslimTests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 hoursautofill-parser: update public suffix listDanilo M.1-0/+0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 hoursci: run checks on push to master, schedule CodeQLDanilo M.5-91/+6
The check workflow only triggered on pull requests, so direct pushes to master were never built or tested. Trigger it on push to master as well and rename it to CI. Run CodeQL weekly instead of manual-only. Remove draft_new_release.yml, which is built around upstream's develop and release-X.Y branch model, and upstream's encrypted signing keystore and properties, which only upstream can decrypt. Release signing needs a keystore of our own before deploy_github_releases.yml can run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 hoursdocs: rewrite README for the forkDanilo M.2-113/+35
Replace the upstream archival notice, badges, donation and community links with a fork description crediting upstream, a summary of changes, build instructions, license and the development approach disclosure. Drop crowdin.yml, whose sync workflow was removed with the other upstream-only workflows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 hoursbuild(deps): update Bouncy Castle to 1.86 and PGPainless to 1.7.8Danilo M.25-224/+74
Bouncy Castle 1.78.1 is affected by GHSA-574f-3g2m-x479, GHSA-9pwp-9qqc-pr26, GHSA-c3fc-8qff-9hwx and GHSA-qp49-qgx5-5m26, all fixed by 1.85. PGPainless 1.7.8 is the newest 1.x release. A root resolution rule keeps every Bouncy Castle module on the catalog version; before, bcpg 1.77 shipped next to bcprov 1.78.1. The new stack decrypts the OCB (LibrePGP) packets GnuPG 2.3+ emits by default, which the old one rejected as "non-standard AEAD". Drop the NonStandardAEAD error, its bottom sheet and strings, and replace the mislabelled aead_* fixtures (SHA-1 self-signed keys plus a message encrypted to an unrelated key) with a real GnuPG 2.5 key and OCB message that the tests now decrypt. The new fixture is a throwaway test key, so it is allowlisted in .gitleaksignore by fingerprint. Fix KeyUtils.isKeyUsable, which compared a Boolean to null and so accepted every key that parsed, including keys with no encryption subkey. A signing-only key fixture now covers the rejection path. Also: migrate the removed SelectUserId.firstMatch and deprecated addDecryptionPassphrase APIs, keep one copy of the Bouncy Castle META-INF/LICENSE.md in the APK, and move the existing InvalidPackage lint baseline entries to the bcpkix 1.86 jar. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 hoursbuild: remove Develocity build scansDanilo M.1-14/+1
The Develocity plugin published a build scan to gradle.com from every CI run, uploading build environment details to a third-party service. Drop the plugin, its configuration and its repository filter entries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
18 hoursfix: stop exporting DecryptActivity and validate decrypt pathsDanilo M.3-10/+62
DecryptActivity was exported without an intent filter, so any installed app could start it with arbitrary FILE_PATH/REPO_PATH extras (and crash it by omitting them). Nothing outside the app needs to launch it: shortcuts and the decrypt action go through LaunchActivity. LaunchActivity stays exported, so it now treats FILE_PATH as untrusted: the path is forwarded only when it canonically resolves to a regular file inside the password store, and REPO_PATH is always the real store directory instead of the caller-supplied value. Anything else falls back to the main screen. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
18 hoursci: adapt workflows to the forkDanilo M.9-189/+12
Drop workflows tied to upstream infrastructure: library publishing to Maven Central, Crowdin sync, the Healthchecks shadow job and snapshot deploys signed with upstream keys. Point the remaining workflows at this fork's setup-gradle action on master instead of the archived upstream's develop branch, and target master for automated pull requests. draft_new_release.yml is left untouched for now. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2024-10-15Add archival notice to READMEHarsh Shandilya1-0/+4
2024-10-10chore(deps): update kotlin and compose to v2.0.21 (#3258)latestrenovate[bot]1-1/+1
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-09fix(deps): update dependency io.sentry:sentry-android to v7.15.0 (#3257)renovate[bot]1-1/+1
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-09chore(deps): update actions/upload-artifact action to v4.4.3 (#3256)renovate[bot]2-9/+9
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-08chore(deps): update actions/upload-artifact action to v4.4.2 (#3255)renovate[bot]2-9/+9
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-07chore(deps): update github/codeql-action action to v3.26.12 (#3254)renovate[bot]1-2/+2
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-07chore(deps): update actions/checkout action to v4.2.1 (#3253)renovate[bot]2-2/+2
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-07chore(deps): update actions/upload-artifact action to v4.4.1 (#3252)renovate[bot]2-9/+9
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-07Update Public Suffix List data (#3251)Harsh Shandilya1-0/+0
autofill-parser: update publicsuffixes file Co-authored-by: GitHub Actions <noreply@github.com>
2024-10-04fix(deps): update dependency ↵renovate[bot]1-1/+1
com.google.testparameterinjector:test-parameter-injector to v1.18 (#3248) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-03chore(deps): update github/codeql-action action to v3.26.11 (#3247)renovate[bot]1-2/+2
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-02fix(deps): update dependency com.slack.lint.compose:compose-lint-checks to ↵renovate[bot]1-1/+1
v1.4.1 (#3244) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-02fix(deps): update dependency com.slack.lint:slack-lint-checks to v0.8.0 (#3245)renovate[bot]1-1/+1
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-02fix(deps): update androidx (#3243)renovate[bot]1-2/+2
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-02fix(deps): update dependency com.slack.lint.compose:compose-lint-checks to ↵renovate[bot]1-1/+1
v1.4.0 (#3242) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-10-01fix(deps): update dependency com.android.tools.build:gradle to v8.7.0 (#3240)renovate[bot]3-3/+1
* fix(deps): update dependency com.android.tools.build:gradle to v8.7.0 * fix: remove deprecated options --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>
2024-09-30chore(deps): update github/codeql-action action to v3.26.10 (#3239)renovate[bot]1-2/+2
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-09-30fix(renovate): automatically merge dependency updatesHarsh Shandilya1-0/+5
2024-09-30Update Public Suffix List data (#3238)Harsh Shandilya1-0/+0
autofill-parser: update publicsuffixes file Co-authored-by: GitHub Actions <noreply@github.com>
2024-09-28Reapply "refactor: use `Closeable#use` extension where applicable"Harsh Shandilya2-8/+3
This reverts commit 04f4b9804f10e4724bac22d40bf01711ff708533.
2024-09-28Reapply "refactor(app): inline pointless methods in `CryptoRepository`"Harsh Shandilya1-33/+17
This reverts commit cb22561878d4358dba974c16ba9a05cc693d411a.
2024-09-26Revert "refactor: use `Closeable#use` extension where applicable"Harsh Shandilya2-3/+8
This reverts commit 69513bf24613d4ba540bcdeaffe04dc9330a65a4.
2024-09-26Revert "refactor(app): inline pointless methods in `CryptoRepository`"Harsh Shandilya1-17/+33
This reverts commit b05a6d411b98393abe3bdbdd4f673bbe49e30f88.