From 9bb39cbc002485fb27fee2de189a257a7b4b02e5 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Mon, 2 Nov 2026 18:57:25 +0100 Subject: docs(agents): record Keystore storage and emulator gotchas Note where secrets are stored now that security-crypto is gone, that the aps-test AVD's autofill service (upstream's debug app) grabs passphrase fields, and that worktree and main-checkout debug builds are signed with different keys. Correct the stale JGit entry: it is on 5.13, not pinned at 4.5.7. Co-Authored-By: Claude Opus 5.5 --- AGENTS.md | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 887fcb2a..4d6b4f88 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -75,7 +75,11 @@ Fingerprint: `adb emu finger touch 1` after enrolling one in Settings (needs a l (`settings put global animator_duration_scale 0`, same for `transition_` and `window_`) or `uiautomator dump` waits for an idle state that never comes. The OTP screen never goes idle anyway (live countdown), so its code can only be checked by eye. A windowed emulator needs the -host's `libbsd`. +host's `libbsd`. The `aps-test` AVD also has upstream's debug app as its autofill +service, which grabs passphrase fields: `settings put secure autofill_service null` first. Debug +builds from the main checkout are signed with the local release keystore, builds from a clean +worktree with `~/.android/debug.keystore`, so an in-place upgrade between them needs `apksigner` +re-signing. Autofill cannot be tested on the emulator image: Settings is denylisted in `OreoAutofillService`, and the only browser (WebView Shell) is not a trusted browser. Use a @@ -119,8 +123,13 @@ passed. (see `passgen/diceware/build.gradle.kts`). - Hilt runs through KSP (no kapt; AGP 9's built-in Kotlin does not support it). Dagger compiler options are `ksp { arg(...) }` in `app/build.gradle.kts`. -- JGit is pinned at 4.5.7 (2019). Newer JGit needs Java 11 APIs Android only partly desugars; - upgrading it is a large, separate job. +- Secrets (Git and proxy credentials, the PGP passphrase cache, wrapped Ed25519 SSH keys) are + AES-GCM encrypted under Android Keystore keys by `util/crypto/KeystorePreferences.kt`. + androidx security-crypto was removed; `removeSecurityCryptoData` in `Migrations.kt` deleted + its data once on upgrade from 0.1.x. +- JGit is on 5.13.x, the last line that needs only Java 8 APIs. JGit 6+ needs Java 11 APIs + Android only partly desugars; moving to it is a large, separate job. Window cache JMX is off + in `Application` and GC runs without JGit's PID lock, because Android has no JMX. ## Maintenance tasks -- cgit v1.2.3