| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
ic_content_copy used AppCompat's ?attr/colorControlNormal, which
ui:compose does not depend on, so building the module in release mode
failed resource verification. ?android:attr/colorControlNormal is the
same color under AppCompat themes and needs no dependency. A bare
assembleRelease now passes; update AGENTS.md accordingly.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The autofill setup dialog, the publisher-changed warning and the
biometric setting still told users to look for "Password Store", which
is not what the app is called in the autofill service list.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The Italian strings were largely machine-translated: "commit" became
"conferma" (confirm), pull and push became "trascina" and "spingi" or
"premi" (drag, push a button), rebase became "ricollocare", the store
became "negozio" (a shop), "pretend" became "pretendere" (a false
friend), and one string showed "/0" instead of "/". Autofill had five
different spellings.
Rewrite those, keep Git terms in English (remote, branch, push, pull,
rebase, merge, commit, detached HEAD, fast-forward), use "compilazione
automatica" as Android's Italian settings do, make "repository"
masculine throughout, replace the "Sei pregato di" calque with plain
imperatives, name the app HardenedPass, and translate the 52 strings
that fell back to English.
Also drop the "TODO: Add a recovery method" that the merge-failure
message showed users, in English and every locale.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Filling OTPs from SMS used Play Services' SMS User Consent API, removed
with the nonFree flavor; since then AutofillSmsActivity was a stub that
never offered the dataset. Delete it, its manifest entry, the dataset
builders in both response builders, its drawable and string.
AutofillAction.FillOtpFromSms stays in autofill-parser: it is public,
metalava-checked API and harmless for a client that never fills it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Entries created in the app said "username:dave". pass users and other
clients write "username: dave"; the parser already trims either form.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
sshj 0.40 replaced the unmaintained net.i2p.crypto:eddsa 0.3.0 (last
release 2019) with Bouncy Castle's Ed25519. 0.41.2 still targets Java 8.
The app used eddsa directly for wrapped Ed25519 SSH keys. Generate the
32-byte seed with SecureRandom and build the key pair with sshj's
Ed25519KeyFactory and Bouncy Castle's public key derivation. The wrapped
format is still the raw RFC 8032 seed, so keys generated by 0.1.3 keep
working; Ed25519KeyPairTest pins this with the RFC 8032 test vector.
sshj 0.40 also changed setSecurityProvider(null) to reset the
registerBouncyCastle flag, which undid the earlier
setRegisterBouncyCastle(false): sshj then forced every operation through
Bouncy Castle, which cannot sign with Android Keystore keys ("no encoding
for EC private key"), and hardware-backed SSH keys failed to
authenticate. Call the two in the opposite order; SshjConfigTest checks
that sshj leaves provider selection to the JCA.
Verified with the R8 release build on the emulator against the e2e
server: a hardware ECDSA key, a newly generated wrapped Ed25519 key and
an imported OpenSSH Ed25519 key all authenticated and synced.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
security-crypto is deprecated in 1.1.0 and the app was stuck on
1.1.0-alpha06, since the stable release fails the warnings-as-errors
build. It also pulled in Tink for what is a single AES-GCM operation.
KeystorePreferences is a SharedPreferences whose values are AES-GCM
sealed under an Android Keystore key (random IV, entry name as AAD so
values cannot be swapped between entries); a value that fails to
decrypt reads as absent. It backs the Git credentials (git_secrets),
the proxy credentials (proxy_secrets) and the PGP passphrase cache,
whose key needs the screen lock or a strong biometric within 60s and is
recreated if a new biometric enrollment invalidates it. Wrapped Ed25519
SSH keys are sealed the same way into the private key file. Password
generator settings are not secret and move to plain preferences.
Nothing is migrated: removeSecurityCryptoData deletes the old encrypted
preference files, Tink keysets, their Keystore master keys and a
security-crypto wrapped Ed25519 key once on upgrade. Only 0.1.x installs
from the last few hours have such data. Hardware SSH keys and imported
keys are untouched.
Tests: KeystorePreferencesTest (round trip, defaults, no plaintext,
random IVs, AAD binding, tamper rejection, remove/clear) with a software
AES key. Verified on the emulator by upgrading a 0.1.2 debug build that
held a wrapped Ed25519 key, Tink keysets and a cached passphrase: the old
data was deleted, a new Ed25519 key authenticated over SSH after a
fingerprint unlock, and a passphrase cached on first decrypt was reused
on the second with only the fingerprint.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Note where secrets are stored now that security-crypto is gone, that
the aps-test AVD's autofill service (upstream's debug app) grabs
passphrase fields, and that worktree and main-checkout debug builds are
signed with different keys. Correct the stale JGit entry: it is on 5.13,
not pinned at 4.5.7.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The add and edit commit messages said "using Android Password Store"
in every locale. The Italian remove message translated "store" as
"negozio" (a shop); use "archivio".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
CryptoRepository.encrypt looked up every .gpg-id recipient and dropped
the ones it could not find, so an entry saved on a device that lacked
one recipient's key was encrypted to the others only. With a store
shared between a phone key and a smartcard key, entries created on the
phone could no longer be decrypted with the smartcard alone.
Fail with the lookup error instead (KeyNotFoundException names the
key), so the user imports the missing public key and saves again.
PasswordCreationActivity also ignored the Result of encrypt and wrote
the output buffer regardless: on any encryption failure it wrote an
empty .gpg file, overwriting the entry when editing, and committed it.
Show the error and leave the file untouched.
CryptoRepositoryTest covers both the missing-recipient failure and the
all-present success path, with keys generated by PGPainless (added as
an app test dependency).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
A Keystore SSH key generated with "Protect with screen lock credential"
was bound to AUTH_DEVICE_CREDENTIAL only, while the unlock prompt also
accepted biometrics. A fingerprint passed the prompt, then signing the
SSH auth request threw UserNotAuthenticatedException, sshj logged "User
not authenticated" and the clone failed with "Socket closed".
Bind new keys to AUTH_DEVICE_CREDENTIAL or AUTH_BIOMETRIC_STRONG, and
allow only strong biometrics in the prompt on Android 11+, since weak
ones never unlock Keystore keys (the androidx MasterKey keys already
use credential or strong biometric). Android 9 and 10 cannot combine
BIOMETRIC_STRONG with DEVICE_CREDENTIAL, so they keep the weak class.
Existing protected keys still need the PIN until regenerated.
Verified on the emulator (Class 3 fingerprint): a protected ECDSA key
unlocked with a fingerprint authenticates and clones over SSH.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Set the version to 0.1.0 (versionCode 100, following the versioning
plugin's major*10000 + minor*100 + patch scheme) and add a changelog
section for the first release. Upstream's never-released [Unreleased]
section is kept below it, renamed, since 0.1.0 ships that work too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Add the fork's release keystore and its signing properties, encrypted
with openssl (aes-256-cbc, pbkdf2) as secrets/keystore.cipher and
secrets/props.cipher; the key is the ENCRYPT_KEY repository secret.
The plaintext files and the master copy never enter the repository.
Rewrite deploy_github_releases.yml for the single FOSS build: on a
vX.Y.Z tag it decrypts the signing secrets, builds the signed release
APK, removes the secrets, and creates a draft GitHub Release with
HardenedPass_<tag>.apk and its SHA-256 checksum using gh, replacing
the archived actions/create-release and upload-release-asset actions.
AGENTS.md records the certificate fingerprint and the procedure.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The fork gets its own application ID and name, so it installs next to
upstream's app.passwordstore instead of replacing it, and could be
submitted to F-Droid. Debug builds keep the .debug suffix and are
labelled "HardenedPass Debug". The Kotlin package stays
app.passwordstore: renaming it would be churn with no visible effect.
"GrapheneOS" is kept out of the name because it is that project's
trademark; "Hardened" nods to its vocabulary. README and AGENTS.md
describe the fork's GrapheneOS goal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The fork targets GrapheneOS and ships only FOSS builds. The nonFree
flavor added Sentry crash reporting, wired to upstream's Sentry project,
and Play Services SMS one-time-code autofill, which needs Google's
servers. Neither is wanted, so remove the flavor dimension entirely:
- Delete app/src/nonFree, the SentryPlugin, the sentry-stub module, the
Sentry and Play Services catalog entries, and the Sentry scope setup
in Application.
- Move the free AutofillSmsActivity stub into main; it keeps the SMS
OTP feature off exactly as the free build did. A ponytail note marks
the FillOtpFromSms paths for later removal.
- SlimTests no longer needs to skip a nonFree variant.
- Workflows and docs use :app:assembleDebug / :app:assembleRelease. A
bare assembleRelease would also verify library modules in release
mode, where ui:compose fails on a pre-existing AppCompat attribute
reference the old flavored task never touched.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
JGit 4.5.7 dates from 2019. 5.13 is the last line that needs only Java 8
APIs, so it works with Android's desugaring; it also fixes
GHSA-3p86-9955-h393 (arbitrary file overwrite on checkout).
GHSA-vrpq-qp53-qv56 (XXE in repo manifest parsing) has no 5.x fix but
the app never parses repo manifests.
API changes:
- SshSessionFactory now requires getType().
- CheckoutCommand.setForce is deprecated; setForceRefUpdate is its
documented replacement with the same meaning.
JGit 5 references java.lang.management and javax.management, which
Android lacks; R8 flagged them. Both paths are made unreachable rather
than only silenced:
- WindowCache registers JMX statistics by default; Application.onCreate
now installs a WindowCacheConfig with exposeStatsViaJmx = false.
- GC.gc() takes a PID lock that queries ManagementFactory and would
throw NoClassDefFoundError on a device. GcOperation now runs the GC
steps (packRefs, repack, prune) directly; the lock only guards against
concurrent gc processes, which cannot happen in the app. Aggressive
packing is dropped.
The R8 -dontwarn rules and the lint baseline entries are added only for
those two now-unreachable references.
JGitBehaviourTest covers the operations' command chains plus the GC
steps and passes on 5.13.5. It now ignores the developer's global git
config, which JGit 5 reads (commit.gpgsign made test commits try to
sign).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Run the command chains of SyncOperation, PushOperation,
BreakOutOfDetached and ResetToRemoteOperation against a local bare
repository and assert the results GitCommandExecutor branches on:
rebase success, push OK / UP_TO_DATE / REJECTED_NONFASTFORWARD, a
stopped rebase with its branch recoverable, abort and push to a
conflict branch, and hard reset to the remote. Passes on JGit 4.5.7;
it is the safety net for the JGit upgrade.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Document what the emulator can and cannot cover, how to run autofill
tests on a real device over adb reverse without exposing anything on
the network, which device settings to record and restore, and the
pitfalls hit during the first run (animations blocking uiautomator,
the screen locking mid-test, localized inline autofill chips).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
When a pull with rebase stops on a conflict, HEAD is detached and
getCurrentBranch() returned null. "Abort rebase and push new branch"
then pushed the local commits to "conflicting-null-<time>" and failed
to switch back with "Branch name <null> is not allowed", leaving the
repository on the conflict branch.
Fall back to the branch JGit records in rebase-merge/head-name (or
rebase-apply/head-name) while a rebase is in progress. Found while
driving the conflict flow on an emulator against the e2e test server;
verified there: the edit is pushed to conflicting-master-<time> and the
operation completes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
scripts/e2e-env.sh starts a git-over-SSH server in Docker, seeded with
a small pass-compatible store encrypted to a throwaway OpenPGP key, and
can push the throwaway SSH and OpenPGP keys to an emulator. Keys are
generated at runtime into the gitignored .e2e/ directory, so no key
material is committed. AGENTS.md documents the emulator setup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
autofill 1.3.0, constraintlayout 2.2.2, documentfile 1.1.0,
recyclerview 1.4.0, recyclerview-selection 1.2.0, swiperefreshlayout
1.2.0 and OkHttp 5.5.1 (build-logic only) replace their alpha, beta and
rc builds.
Left on pre-releases for now:
- biometric-ktx 1.2.0-alpha05 and modernandroidpreferences 2.4.0-beta2:
their newest stable releases are older than what is in use.
- security-crypto-ktx 1.1.0-alpha06: the 1.1.0 stable release
deprecates the whole library, which fails the warnings-as-errors
build. Replacing it is tracked separately.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
AGP 9 migration:
- Configure the shared Android setup through the new DSL
(CommonExtension, ApplicationExtension) instead of the removed
TestedExtension and BaseAppModuleExtension; targetSdk moves to the
application extension.
- Stop applying the Kotlin Android plugin; AGP 9 compiles Kotlin itself.
- Replace kapt with KSP 2.3.13 for Hilt, which built-in Kotlin requires,
and carry the Dagger compiler options over as KSP arguments.
- AGP 9 now applies packaging excludes to unit-test resources, which
stripped the diceware word list (**/*.txt) from its tests; lift that
exclude in the diceware module.
- Use resources.directories instead of the deprecated srcDir.
Plugin updates required by Gradle 9 / AGP 9: Sentry Gradle plugin
6.25.0 (sentry-android 8.62.0), metalava plugin 0.5.1, maven-publish
0.37.0, spotless 8.10.4, version-catalog-update 1.1.2, download task
5.7.0, foojay resolver 1.0.0, with their API changes. Newer metalava
models Kotlin properties, so autofill-parser/api.txt is regenerated;
the diff is representation only, no API was added or removed.
Fix new Kotlin 2.4 and lint findings (explicit return type in a
function with an early return, UseKtx in autofill-parser), drop
deprecated Kotlin Gradle properties, and make the AGENTS.md pre-commit
command cover every task CI runs (both flavors, lint on all modules).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Newest releases that still fit together on the Gradle 8 / AGP 8 line:
- Kotlin stops at 2.1, the newest metadata Gradle 8's embedded Kotlin
2.0 compiler can read when compiling build-logic.
- Hilt stops at 2.58; 2.59 and later require AGP 9. Hilt 2.52's
annotation processor could not read Kotlin 2.1 metadata.
Drop the languageVersion = 1.9 pin so code compiles with the K2
frontend; Kotlin 2.4 no longer accepts 1.9. Drop the R8 8.5.35 pin and
its repository, which is older than the R8 AGP 8.13 bundles. Move the
deprecated buildFeatures.androidResources flag to
androidResources.enable, and replace Uri.parse with toUri for the new
UseKtx lint check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The resolution rule also rewrote the legacy -jdk15on artifacts that
metalava's tooling depends on to 1.86, a version that line never had
(it ended at 1.70), so metalavaCheckCompatibilityRelease failed to
resolve in CI. Only align the -jdk18on modules the app ships.
Add the metalava check to the pre-commit command in AGENTS.md so local
runs cover the same tasks as CI.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
AGENTS.md holds the agent guidance for the fork: layout and remotes,
build and test commands matching CI, verified gotchas, the manual
public suffix list update with its last-run date, and the release
signing status. CLAUDE.md only points at it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The workflow committed through a bot PR on GitHub, which is only a push
mirror of the main repository; bot commits there would diverge from it.
Update the list by hand instead:
./gradlew updatePSL
./gradlew :autofill-parser:test -PslimTests
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The check workflow only triggered on pull requests, so direct pushes to
master were never built or tested. Trigger it on push to master as well
and rename it to CI. Run CodeQL weekly instead of manual-only.
Remove draft_new_release.yml, which is built around upstream's develop
and release-X.Y branch model, and upstream's encrypted signing keystore
and properties, which only upstream can decrypt. Release signing needs
a keystore of our own before deploy_github_releases.yml can run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Replace the upstream archival notice, badges, donation and community
links with a fork description crediting upstream, a summary of changes,
build instructions, license and the development approach disclosure.
Drop crowdin.yml, whose sync workflow was removed with the other
upstream-only workflows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Bouncy Castle 1.78.1 is affected by GHSA-574f-3g2m-x479,
GHSA-9pwp-9qqc-pr26, GHSA-c3fc-8qff-9hwx and GHSA-qp49-qgx5-5m26, all
fixed by 1.85. PGPainless 1.7.8 is the newest 1.x release. A root
resolution rule keeps every Bouncy Castle module on the catalog version;
before, bcpg 1.77 shipped next to bcprov 1.78.1.
The new stack decrypts the OCB (LibrePGP) packets GnuPG 2.3+ emits by
default, which the old one rejected as "non-standard AEAD". Drop the
NonStandardAEAD error, its bottom sheet and strings, and replace the
mislabelled aead_* fixtures (SHA-1 self-signed keys plus a message
encrypted to an unrelated key) with a real GnuPG 2.5 key and OCB message
that the tests now decrypt. The new fixture is a throwaway test key, so
it is allowlisted in .gitleaksignore by fingerprint.
Fix KeyUtils.isKeyUsable, which compared a Boolean to null and so
accepted every key that parsed, including keys with no encryption
subkey. A signing-only key fixture now covers the rejection path.
Also: migrate the removed SelectUserId.firstMatch and deprecated
addDecryptionPassphrase APIs, keep one copy of the Bouncy Castle
META-INF/LICENSE.md in the APK, and move the existing InvalidPackage
lint baseline entries to the bcpkix 1.86 jar.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
The Develocity plugin published a build scan to gradle.com from every
CI run, uploading build environment details to a third-party service.
Drop the plugin, its configuration and its repository filter entries.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
DecryptActivity was exported without an intent filter, so any installed
app could start it with arbitrary FILE_PATH/REPO_PATH extras (and crash
it by omitting them). Nothing outside the app needs to launch it:
shortcuts and the decrypt action go through LaunchActivity.
LaunchActivity stays exported, so it now treats FILE_PATH as untrusted:
the path is forwarded only when it canonically resolves to a regular
file inside the password store, and REPO_PATH is always the real store
directory instead of the caller-supplied value. Anything else falls
back to the main screen.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Drop workflows tied to upstream infrastructure: library publishing to
Maven Central, Crowdin sync, the Healthchecks shadow job and snapshot
deploys signed with upstream keys.
Point the remaining workflows at this fork's setup-gradle action on
master instead of the archived upstream's develop branch, and target
master for automated pull requests.
draft_new_release.yml is left untouched for now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
|
|
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
|
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
|
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
|
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
|
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
|
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
|
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
|
autofill-parser: update publicsuffixes file
Co-authored-by: GitHub Actions <noreply@github.com>
|
|
com.google.testparameterinjector:test-parameter-injector to v1.18 (#3248)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
|
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
|
v1.4.1 (#3244)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
|
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
