diff options
| -rw-r--r-- | android/app/build.gradle | 46 | ||||
| -rw-r--r-- | android/app/src/webview/java/io/coinos/app/Assets.java | 79 | ||||
| -rw-r--r-- | android/app/src/webview/java/io/coinos/app/MainActivity.java | 12 | ||||
| -rw-r--r-- | android/gradle/wrapper/gradle-wrapper.properties | 7 | ||||
| -rw-r--r-- | build.js | 7 | ||||
| -rw-r--r-- | docs/REPRODUCIBLE.md | 54 | ||||
| -rw-r--r-- | fdroid/io.coinos.fdroid.yml | 58 | ||||
| -rw-r--r-- | package.json | 1 |
8 files changed, 261 insertions, 3 deletions
diff --git a/android/app/build.gradle b/android/app/build.gradle index 532db83..1831ac5 100644 --- a/android/app/build.gradle +++ b/android/app/build.gradle @@ -3,6 +3,24 @@ apply plugin: 'com.android.application' def keystoreProps = new Properties() def keystoreFile = rootProject.file('keystore.properties') if (keystoreFile.exists()) keystoreProps.load(new FileInputStream(keystoreFile)) +// COINOS_UNSIGNED=1 builds without the keystore even when it is present — +// the reproducible-build check compares two unsigned builds byte for byte, +// and F-Droid builds unsigned and compares against our signed release. +def signRelease = keystoreFile.exists() && System.getenv('COINOS_UNSIGNED') == null + +// The bundled shell carries the built web app as assets. It is copied from +// ../dist, which the web build produces first: HAL_NO_SW=1 bun run build +// (the service worker is left out — inside the WebView the app is served +// from these assets, and a worker would fetch the live site over it). +tasks.register('copyWeb', Copy) { + def dist = rootProject.file('../dist') // the repo root's dist, not the module's + doFirst { + if (!new File(dist, 'index.html').exists()) + throw new GradleException('build the web app first: HAL_NO_SW=1 bun run build (in the repo root)') + } + from(dist) { exclude '*.apk', 'standalone.html', 'sw.js', 'zmq-watcher.js' } + into layout.buildDirectory.dir('www') +} android { namespace 'io.coinos.app' @@ -23,22 +41,44 @@ android { // webview — the wallet runs in the app, so a UnifiedPush message can // start it off-screen and let it answer. A separate app id, // because it is a separate wallet: its storage is its own. + // fdroid — the webview shell with the web app BUNDLED as assets: what + // runs is what was built from this source tree, reproducibly, + // which is what F-Droid publishes. No service worker, no + // remote code; the live site is only reached for its APIs. flavorDimensions += 'shell' + buildFeatures { buildConfig true } productFlavors { twa { dimension 'shell' isDefault = true + buildConfigField 'boolean', 'BUNDLED', 'false' } webview { dimension 'shell' applicationId 'io.coinos.webview' versionNameSuffix '-webview' resValue 'string', 'app_name', 'Coinos (UnifiedPush)' + buildConfigField 'boolean', 'BUNDLED', 'false' + } + fdroid { + dimension 'shell' + applicationId 'io.coinos.fdroid' + resValue 'string', 'app_name', 'Coinos' + buildConfigField 'boolean', 'BUNDLED', 'true' + } + } + sourceSets { + // the same shell as webview, plus the bundled web app + fdroid { + java.srcDirs = ['src/webview/java'] + res.srcDirs = ['src/webview/res'] + manifest.srcFile 'src/webview/AndroidManifest.xml' + assets.srcDirs += layout.buildDirectory.dir('www').get().asFile } } signingConfigs { release { - if (keystoreFile.exists()) { + if (signRelease) { storeFile rootProject.file(keystoreProps['storeFile']) storePassword keystoreProps['storePassword'] keyAlias keystoreProps['keyAlias'] @@ -49,7 +89,7 @@ android { buildTypes { release { minifyEnabled false - if (keystoreFile.exists()) signingConfig signingConfigs.release + if (signRelease) signingConfig signingConfigs.release } } } @@ -57,3 +97,5 @@ dependencies { // only the TWA shell needs Chrome's helper; the WebView build carries none twaImplementation 'com.google.androidbrowserhelper:androidbrowserhelper:2.5.0' } + +preBuild.dependsOn copyWeb diff --git a/android/app/src/webview/java/io/coinos/app/Assets.java b/android/app/src/webview/java/io/coinos/app/Assets.java new file mode 100644 index 0000000..ff3390b --- /dev/null +++ b/android/app/src/webview/java/io/coinos/app/Assets.java @@ -0,0 +1,79 @@ +package io.coinos.app; + +import android.content.Context; +import android.content.res.AssetManager; +import android.net.Uri; +import android.webkit.WebResourceRequest; +import android.webkit.WebResourceResponse; + +import java.io.IOException; +import java.io.InputStream; +import java.util.HashMap; +import java.util.Map; + +/** + * The bundled web app, served to the WebView from this APK's assets. + * + * <p>The page still lives at https://v3.coinos.io/ as far as the WebView is + * concerned — same origin, same storage, same links — but every file the + * page asks for under that origin is answered from this APK's assets, the build + * that shipped in this APK. Only the site's live endpoints (its Electrum + * and explorer proxies, LNURL, .well-known) go out to the network, exactly + * the paths the site's own nginx and service worker treat as live. A path + * with no file behind it and no extension is a deep link (/g/…, /invite/…, + * /npub…): it gets index.html, as the site's SPA fallback would. + */ +final class Assets { + private Assets() {} + + static final String HOST = "v3.coinos.io"; + private static final String[] LIVE = { "/electrum", "/esplora/", "/sp/", "/lnurlp/", "/.well-known/", "/api/" }; + private static final Map<String, String> MIME = new HashMap<>(); + static { + MIME.put("html", "text/html"); + MIME.put("js", "text/javascript"); + MIME.put("mjs", "text/javascript"); + MIME.put("css", "text/css"); + MIME.put("json", "application/json"); + MIME.put("webmanifest", "application/manifest+json"); + MIME.put("png", "image/png"); + MIME.put("webp", "image/webp"); + MIME.put("svg", "image/svg+xml"); + MIME.put("ico", "image/x-icon"); + MIME.put("woff2", "font/woff2"); + MIME.put("wasm", "application/wasm"); + MIME.put("txt", "text/plain"); + } + + /** The asset answering this request, or null to let the network have it. */ + static WebResourceResponse serve(Context ctx, WebResourceRequest req) { + Uri u = req.getUrl(); + if (u == null || !"https".equals(u.getScheme()) || !HOST.equals(u.getHost())) return null; + if (!"GET".equalsIgnoreCase(req.getMethod())) return null; + String path = u.getPath(); + if (path == null || path.isEmpty()) path = "/"; + for (String live : LIVE) if (path.startsWith(live)) return null; + String rel = path.equals("/") ? "index.html" : path.substring(1); + AssetManager am = ctx.getAssets(); + InputStream in = open(am, rel); + if (in == null) { + String last = rel.substring(rel.lastIndexOf('/') + 1); + if (last.contains(".")) return null; // a real file we don't carry (coinos.apk): the network's + rel = "index.html"; + in = open(am, rel); + if (in == null) return null; + } + String ext = rel.substring(rel.lastIndexOf('.') + 1).toLowerCase(); + String mime = MIME.containsKey(ext) ? MIME.get(ext) : "application/octet-stream"; + boolean text = mime.startsWith("text/") || mime.startsWith("application/json") || mime.startsWith("application/manifest") || mime.equals("image/svg+xml"); + WebResourceResponse res = new WebResourceResponse(mime, text ? "utf-8" : null, in); + Map<String, String> headers = new HashMap<>(); + headers.put("Cache-Control", "no-store"); + res.setResponseHeaders(headers); + return res; + } + + private static InputStream open(AssetManager am, String rel) { + try { return am.open(rel); } catch (IOException e) { return null; } + } +} diff --git a/android/app/src/webview/java/io/coinos/app/MainActivity.java b/android/app/src/webview/java/io/coinos/app/MainActivity.java index a7980c4..e75e723 100644 --- a/android/app/src/webview/java/io/coinos/app/MainActivity.java +++ b/android/app/src/webview/java/io/coinos/app/MainActivity.java @@ -13,6 +13,7 @@ import android.webkit.PermissionRequest; import android.webkit.ValueCallback; import android.webkit.WebChromeClient; import android.webkit.WebResourceRequest; +import android.webkit.WebResourceResponse; import android.webkit.WebSettings; import android.webkit.WebView; import android.webkit.WebViewClient; @@ -64,6 +65,17 @@ public class MainActivity extends Activity { CookieManager.getInstance().setAcceptCookie(true); web.setWebViewClient(new WebViewClient() { + // The bundled build answers the site's own files from assets; the + // plain webview build lets everything through to the live site. + @Override + public WebResourceResponse shouldInterceptRequest(WebView v, WebResourceRequest r) { + if (BuildConfig.BUNDLED) { + WebResourceResponse res = Assets.serve(MainActivity.this, r); + if (res != null) return res; + } + return super.shouldInterceptRequest(v, r); + } + @Override public boolean shouldOverrideUrlLoading(WebView v, WebResourceRequest r) { Uri u = r.getUrl(); diff --git a/android/gradle/wrapper/gradle-wrapper.properties b/android/gradle/wrapper/gradle-wrapper.properties new file mode 100644 index 0000000..cea7a79 --- /dev/null +++ b/android/gradle/wrapper/gradle-wrapper.properties @@ -0,0 +1,7 @@ +distributionBase=GRADLE_USER_HOME +distributionPath=wrapper/dists +distributionUrl=https\://services.gradle.org/distributions/gradle-8.12-bin.zip +networkTimeout=10000 +validateDistributionUrl=true +zipStoreBase=GRADLE_USER_HOME +zipStorePath=wrapper/dists @@ -360,6 +360,11 @@ function bootShell(logo, staging) { } const BOOT_SHELL_SCRIPT = `<script>try{var m=location.pathname.match(/^\\/([A-Za-z0-9._-]{1,64})\\/?$/);if(m){document.getElementById('boot-shell').style.display='';document.getElementById('boot-shell-name').textContent=decodeURIComponent(m[1]);}}catch(e){}</script>`; +// HAL_NO_SW=1: the page registers no service worker. The Android bundled +// build serves this page from its own assets, where a worker would only +// fetch the live site over the top of them. +const NO_SW = !!process.env.HAL_NO_SW; + async function pageHtml({ css, staging, pwa, scriptHtml }) { return `<!doctype html> <html lang="en"> @@ -376,7 +381,7 @@ ${pwa ? PWA_HEAD : ''}<style>${css}</style> <div id="app">${bootShell(await brandSvg(), staging)}</div> ${BOOT_SHELL_SCRIPT} ${scriptHtml} -${pwa ? SW_REGISTER + '\n' : ''}</body> +${pwa && !NO_SW ? SW_REGISTER + '\n' : ''}</body> </html>`; } diff --git a/docs/REPRODUCIBLE.md b/docs/REPRODUCIBLE.md new file mode 100644 index 0000000..1ceb538 --- /dev/null +++ b/docs/REPRODUCIBLE.md @@ -0,0 +1,54 @@ +# Reproducible Android build + +The `fdroid` flavor of the Android app carries the built web app inside the +APK (`assets/`), so what runs is what this source tree builds — not whatever +the live site serves. Two clean builds of it give the same unsigned APK. + +## Build + +Pinned toolchain: Bun 1.3.9 (`packageManager` in package.json), JDK 21, +Android SDK build-tools 35, Gradle 8.12 (android/gradle/wrapper), AGP 8.7.3. + +```sh +bun install --frozen-lockfile +HAL_NO_SW=1 bun run build # dist/ without the service worker +cd android +COINOS_UNSIGNED=1 gradle assembleFdroidRelease # unsigned +# app/build/outputs/apk/fdroid/release/app-fdroid-release-unsigned.apk +``` + +Without `COINOS_UNSIGNED` and with `android/keystore.properties` present, the +same command produces the signed release. + +## Verify + +Build twice from clean and compare: + +```sh +sha256sum app/build/outputs/apk/fdroid/release/app-fdroid-release-unsigned.apk +``` + +To compare a signed release against your own unsigned build, strip the +signature first (`apksigcopier compare`, or `diffoscope` on the two APKs — +only `META-INF/` should differ). + +## What's inside + +- `assets/index.html`, `assets/app-<hash>.js`, `assets/chunk-*.js`, locales, + icons, punks: the split web build, content-addressed. +- No service worker: inside the WebView the page is served from these + assets by `Assets.java`, and a worker would fetch the live site over them. +- The page still lives at the `https://v3.coinos.io/` origin, so storage, + links and gift URLs behave as on the web; only the site's live API paths + (`/electrum`, `/esplora/`, `/sp/`, `/lnurlp/`, `/.well-known/`, `/api/`) + reach the network. + +## Release + +1. Bump `versionCode`/`versionName` in `android/app/build.gradle`. +2. Tag `fdroid-v<versionName>` (the F-Droid recipe watches these tags). +3. Attach the signed APK to the GitHub release as `coinos-fdroid-<versionName>.apk` + — F-Droid rebuilds, compares, and publishes this file when they match. + +The F-Droid recipe lives in `fdroid/io.coinos.fdroid.yml` (a copy goes into +fdroiddata as `metadata/io.coinos.fdroid.yml`). diff --git a/fdroid/io.coinos.fdroid.yml b/fdroid/io.coinos.fdroid.yml new file mode 100644 index 0000000..4e4bd6d --- /dev/null +++ b/fdroid/io.coinos.fdroid.yml @@ -0,0 +1,58 @@ +# F-Droid build recipe for the bundled Android build (metadata/io.coinos.fdroid.yml +# in fdroiddata). The web app is built first with a checksum-pinned Bun, then +# the Gradle flavor packs dist/ into the APK as assets. Both halves are +# reproducible: two clean builds give the same unsigned APK, so F-Droid can +# publish the coinos-signed release once its own build matches (Binaries + +# AllowedAPKSigningKeys). +Categories: + - Money +License: MIT +AuthorName: Adam Soltys +WebSite: https://v3.coinos.io +SourceCode: https://github.com/coinos/coinosv3 +IssueTracker: https://github.com/coinos/coinosv3/issues + +AutoName: Coinos +Summary: Self-custodial bitcoin wallet with instant Ark payments and nostr chat +Description: |- + Bitcoin you actually hold: your wallet is twelve words, nobody else ever + has them, and they work in any wallet, anywhere. + + * Spending over Ark: instant, low-fee off-chain payments with a unilateral exit + * Savings on-chain: a full BIP84 bitcoin wallet + * Lightning sends and receives, plus a [email protected] payment address + * Nostr built in: encrypted DMs, community chat, posts, zaps + * Handles lightning:, bitcoin:, nostr: and lnurl: links and NFC taps + + This build carries the whole app inside the APK; the coinos servers are + only reached for their APIs (the Ark server, Electrum, the name registrar). + +RepoType: git +Repo: https://github.com/coinos/coinosv3.git +Binaries: https://github.com/coinos/coinosv3/releases/download/fdroid-v%v/coinos-fdroid-%v.apk + +Builds: + - versionName: '1.6' + versionCode: 7 + commit: fdroid-v1.6 + subdir: android/app + sudo: + - curl -fsSL -o /tmp/bun.zip https://github.com/oven-sh/bun/releases/download/bun-v1.3.9/bun-linux-x64-baseline.zip + - echo "104d4d037f4b35e10215c0507e1779691f39c57bd91ddeefe11cad781e3fc4b9 /tmp/bun.zip" | sha256sum -c + - unzip -q /tmp/bun.zip -d /tmp/bun + - install -m 0755 /tmp/bun/bun-linux-x64-baseline/bun /usr/local/bin/bun + gradle: + - fdroid + prebuild: + - cd ../.. && bun install --frozen-lockfile && HAL_NO_SW=1 bun run build + scandelete: + - node_modules + - static/coinos.apk + - static/graphene.apk + +AllowedAPKSigningKeys: 766483ab8372c02f8406d29595e7389a2869190b429e0ffd092ebb0bfa2bc2f4 + +AutoUpdateMode: Version +UpdateCheckMode: Tags ^fdroid-v[0-9.]+$ +CurrentVersion: '1.6' +CurrentVersionCode: 7 diff --git a/package.json b/package.json index 756a1e0..6783bf9 100644 --- a/package.json +++ b/package.json @@ -2,6 +2,7 @@ "name": "coinosv3", "private": true, "version": "0.1.0", + "packageManager": "[email protected]", "license": "MIT", "type": "module", "description": "coinos v3 — offline-capable, single-file self-custody Bitcoin wallet for the browser", |