aboutsummaryrefslogtreecommitdiffstats
path: root/AGENTS.md
AgeCommit message (Collapse)AuthorFilesLines
3 hoursfix(git): get sshj's Ed25519 keys from Bouncy CastlecomposeDanilo M.1-0/+4
Recent Conscrypt (Android 14 mainline updates) registers a KeyFactory for Ed25519. With sshj leaving provider selection to the JCA, its Ed25519KeyFactory now gets Conscrypt's key class, whose algorithm name sshj does not map to ssh-ed25519: KeyType.fromKey returns UNKNOWN and every Ed25519 host key fails with "Don't know how to encode key", so clone and sync over SSH break. 0.1.4 is affected since the sshj 0.41.2 update. Register a provider at position 1 that serves only KeyFactory.Ed25519 from Bouncy Castle (kept by the existing R8 rule). Everything else, including signatures with Android Keystore keys, still goes through normal JCA provider selection. Verified on an Android 14 tablet: clone over SSH failed before and works with the fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit ad3c63f665e6264ed1db42d6ae2dfc0947e33393)
13 hoursrefactor(app): remove the legacy decrypt screenDanilo M.1-2/+3
The Compose entry view replaces DecryptActivity, its layouts, menu and field adapter, and upstream's unused ViewPasswordScreen. BasePGPActivity keeps what the editor and autofill still need. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
16 hoursdocs: start the compose branch for the UI overhaulDanilo M.1-1/+5
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 hourschore: rename the repository to HardenedPassDanilo M.1-1/+1
The GitHub repository is now danixland/HardenedPass and the main repository on the personal server is HardenedPass. Point the reusable workflow references, the issue template, README and AGENTS.md at the new name; GitHub redirects the old URLs, but workflow `uses:` should not rely on that. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17 hoursfix(ui-compose): tint the copy icon with the platform attributeDanilo M.1-3/+2
ic_content_copy used AppCompat's ?attr/colorControlNormal, which ui:compose does not depend on, so building the module in release mode failed resource verification. ?android:attr/colorControlNormal is the same color under AppCompat themes and needs no dependency. A bare assembleRelease now passes; update AGENTS.md accordingly. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
18 hoursdocs(agents): record Keystore storage and emulator gotchasDanilo M.1-3/+12
Note where secrets are stored now that security-crypto is gone, that the aps-test AVD's autofill service (upstream's debug app) grabs passphrase fields, and that worktree and main-checkout debug builds are signed with different keys. Correct the stale JGit entry: it is on 5.13, not pinned at 4.5.7. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
23 hoursci: sign and publish HardenedPass releases with the fork's own keyDanilo M.1-4/+13
Add the fork's release keystore and its signing properties, encrypted with openssl (aes-256-cbc, pbkdf2) as secrets/keystore.cipher and secrets/props.cipher; the key is the ENCRYPT_KEY repository secret. The plaintext files and the master copy never enter the repository. Rewrite deploy_github_releases.yml for the single FOSS build: on a vX.Y.Z tag it decrypts the signing secrets, builds the signed release APK, removes the secrets, and creates a draft GitHub Release with HardenedPass_<tag>.apk and its SHA-256 checksum using gh, replacing the archived actions/create-release and upload-release-asset actions. AGENTS.md records the certificate fingerprint and the procedure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
23 hoursfeat: rename the app to HardenedPass (xyz.danix.hardenedpass)Danilo M.1-5/+8
The fork gets its own application ID and name, so it installs next to upstream's app.passwordstore instead of replacing it, and could be submitted to F-Droid. Debug builds keep the .debug suffix and are labelled "HardenedPass Debug". The Kotlin package stays app.passwordstore: renaming it would be churn with no visible effect. "GrapheneOS" is kept out of the name because it is that project's trademark; "Hardened" nods to its vocabulary. README and AGENTS.md describe the fork's GrapheneOS goal. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
23 hoursbuild: drop the nonFree flavor, Sentry and Play ServicesDanilo M.1-7/+9
The fork targets GrapheneOS and ships only FOSS builds. The nonFree flavor added Sentry crash reporting, wired to upstream's Sentry project, and Play Services SMS one-time-code autofill, which needs Google's servers. Neither is wanted, so remove the flavor dimension entirely: - Delete app/src/nonFree, the SentryPlugin, the sentry-stub module, the Sentry and Play Services catalog entries, and the Sentry scope setup in Application. - Move the free AutofillSmsActivity stub into main; it keeps the SMS OTP feature off exactly as the free build did. A ponytail note marks the FillOtpFromSms paths for later removal. - SlimTests no longer needs to skip a nonFree variant. - Workflows and docs use :app:assembleDebug / :app:assembleRelease. A bare assembleRelease would also verify library modules in release mode, where ui:compose fails on a pre-existing AppCompat attribute reference the old flavored task never touched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
24 hoursdocs: record the device test procedure in AGENTS.mdDanilo M.1-1/+28
Document what the emulator can and cannot cover, how to run autofill tests on a real device over adb reverse without exposing anything on the network, which device settings to record and restore, and the pitfalls hit during the first run (animations blocking uiautomator, the screen locking mid-test, localized inline autofill chips). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
25 hourstest: add a disposable end-to-end environment for emulator runsDanilo M.1-0/+19
scripts/e2e-env.sh starts a git-over-SSH server in Docker, seeded with a small pass-compatible store encrypted to a throwaway OpenPGP key, and can push the throwaway SSH and OpenPGP keys to an emulator. Keys are generated at runtime into the gitignored .e2e/ directory, so no key material is committed. AGENTS.md documents the emulator setup. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
25 hoursbuild: update to Gradle 9.8.2, AGP 9.5.0, Kotlin 2.4.21, Hilt 2.60.1Danilo M.1-2/+7
AGP 9 migration: - Configure the shared Android setup through the new DSL (CommonExtension, ApplicationExtension) instead of the removed TestedExtension and BaseAppModuleExtension; targetSdk moves to the application extension. - Stop applying the Kotlin Android plugin; AGP 9 compiles Kotlin itself. - Replace kapt with KSP 2.3.13 for Hilt, which built-in Kotlin requires, and carry the Dagger compiler options over as KSP arguments. - AGP 9 now applies packaging excludes to unit-test resources, which stripped the diceware word list (**/*.txt) from its tests; lift that exclude in the diceware module. - Use resources.directories instead of the deprecated srcDir. Plugin updates required by Gradle 9 / AGP 9: Sentry Gradle plugin 6.25.0 (sentry-android 8.62.0), metalava plugin 0.5.1, maven-publish 0.37.0, spotless 8.10.4, version-catalog-update 1.1.2, download task 5.7.0, foojay resolver 1.0.0, with their API changes. Newer metalava models Kotlin properties, so autofill-parser/api.txt is regenerated; the diff is representation only, no API was added or removed. Fix new Kotlin 2.4 and lint findings (explicit return type in a function with an early return, UseKtx in autofill-parser), drop deprecated Kotlin Gradle properties, and make the AGENTS.md pre-commit command cover every task CI runs (both flavors, lint on all modules). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
26 hoursbuild: limit Bouncy Castle alignment to -jdk18on modulesDanilo M.1-1/+2
The resolution rule also rewrote the legacy -jdk15on artifacts that metalava's tooling depends on to 1.86, a version that line never had (it ended at 1.70), so metalavaCheckCompatibilityRelease failed to resolve in CI. Only align the -jdk18on modules the app ships. Add the metalava check to the pre-commit command in AGENTS.md so local runs cover the same tasks as CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
26 hoursdocs: add AGENTS.md and CLAUDE.mdDanilo M.1-0/+92
AGENTS.md holds the agent guidance for the fork: layout and remotes, build and test commands matching CI, verified gotchas, the manual public suffix list update with its last-run date, and the release signing status. CLAUDE.md only points at it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>