From 1bd3e2613641a8d2bc63c262a58cad126632459f Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Thu, 17 Sep 2026 08:19:41 -0700 Subject: Android: a reproducible F-Droid flavor with the web app bundled inside. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Android builds so far were shells around the live site: a verified APK proved nothing about the code that ran. The new `fdroid` flavor (io.coinos.fdroid) shares the WebView shell and carries the built web app in its assets. The page still lives at the v3.coinos.io origin — same storage, links and gift URLs — but every file under it is answered from the APK (Assets.java); only the site's live API paths reach the network, and the bundled page registers no service worker (HAL_NO_SW=1). Two clean unsigned builds give the same APK. COINOS_UNSIGNED=1 builds without the keystore; Bun is pinned via packageManager; the Gradle wrapper properties pin 8.12. fdroid/io.coinos.fdroid.yml is the fdroiddata recipe (checksum-pinned Bun in sudo, prebuild web build, scandelete, our signing key allowed for the Binaries match) and docs/REPRODUCIBLE.md the how-to. Verified on a phone: the bundled build cold-starts in airplane mode. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01JuwQqNWtDJcxPWtEm9134z --- .../app/src/webview/java/io/coinos/app/Assets.java | 79 ++++++++++++++++++++++ .../webview/java/io/coinos/app/MainActivity.java | 12 ++++ 2 files changed, 91 insertions(+) create mode 100644 android/app/src/webview/java/io/coinos/app/Assets.java (limited to 'android/app/src/webview/java') diff --git a/android/app/src/webview/java/io/coinos/app/Assets.java b/android/app/src/webview/java/io/coinos/app/Assets.java new file mode 100644 index 0000000..ff3390b --- /dev/null +++ b/android/app/src/webview/java/io/coinos/app/Assets.java @@ -0,0 +1,79 @@ +package io.coinos.app; + +import android.content.Context; +import android.content.res.AssetManager; +import android.net.Uri; +import android.webkit.WebResourceRequest; +import android.webkit.WebResourceResponse; + +import java.io.IOException; +import java.io.InputStream; +import java.util.HashMap; +import java.util.Map; + +/** + * The bundled web app, served to the WebView from this APK's assets. + * + *

The page still lives at https://v3.coinos.io/ as far as the WebView is + * concerned — same origin, same storage, same links — but every file the + * page asks for under that origin is answered from this APK's assets, the build + * that shipped in this APK. Only the site's live endpoints (its Electrum + * and explorer proxies, LNURL, .well-known) go out to the network, exactly + * the paths the site's own nginx and service worker treat as live. A path + * with no file behind it and no extension is a deep link (/g/…, /invite/…, + * /npub…): it gets index.html, as the site's SPA fallback would. + */ +final class Assets { + private Assets() {} + + static final String HOST = "v3.coinos.io"; + private static final String[] LIVE = { "/electrum", "/esplora/", "/sp/", "/lnurlp/", "/.well-known/", "/api/" }; + private static final Map MIME = new HashMap<>(); + static { + MIME.put("html", "text/html"); + MIME.put("js", "text/javascript"); + MIME.put("mjs", "text/javascript"); + MIME.put("css", "text/css"); + MIME.put("json", "application/json"); + MIME.put("webmanifest", "application/manifest+json"); + MIME.put("png", "image/png"); + MIME.put("webp", "image/webp"); + MIME.put("svg", "image/svg+xml"); + MIME.put("ico", "image/x-icon"); + MIME.put("woff2", "font/woff2"); + MIME.put("wasm", "application/wasm"); + MIME.put("txt", "text/plain"); + } + + /** The asset answering this request, or null to let the network have it. */ + static WebResourceResponse serve(Context ctx, WebResourceRequest req) { + Uri u = req.getUrl(); + if (u == null || !"https".equals(u.getScheme()) || !HOST.equals(u.getHost())) return null; + if (!"GET".equalsIgnoreCase(req.getMethod())) return null; + String path = u.getPath(); + if (path == null || path.isEmpty()) path = "/"; + for (String live : LIVE) if (path.startsWith(live)) return null; + String rel = path.equals("/") ? "index.html" : path.substring(1); + AssetManager am = ctx.getAssets(); + InputStream in = open(am, rel); + if (in == null) { + String last = rel.substring(rel.lastIndexOf('/') + 1); + if (last.contains(".")) return null; // a real file we don't carry (coinos.apk): the network's + rel = "index.html"; + in = open(am, rel); + if (in == null) return null; + } + String ext = rel.substring(rel.lastIndexOf('.') + 1).toLowerCase(); + String mime = MIME.containsKey(ext) ? MIME.get(ext) : "application/octet-stream"; + boolean text = mime.startsWith("text/") || mime.startsWith("application/json") || mime.startsWith("application/manifest") || mime.equals("image/svg+xml"); + WebResourceResponse res = new WebResourceResponse(mime, text ? "utf-8" : null, in); + Map headers = new HashMap<>(); + headers.put("Cache-Control", "no-store"); + res.setResponseHeaders(headers); + return res; + } + + private static InputStream open(AssetManager am, String rel) { + try { return am.open(rel); } catch (IOException e) { return null; } + } +} diff --git a/android/app/src/webview/java/io/coinos/app/MainActivity.java b/android/app/src/webview/java/io/coinos/app/MainActivity.java index a7980c4..e75e723 100644 --- a/android/app/src/webview/java/io/coinos/app/MainActivity.java +++ b/android/app/src/webview/java/io/coinos/app/MainActivity.java @@ -13,6 +13,7 @@ import android.webkit.PermissionRequest; import android.webkit.ValueCallback; import android.webkit.WebChromeClient; import android.webkit.WebResourceRequest; +import android.webkit.WebResourceResponse; import android.webkit.WebSettings; import android.webkit.WebView; import android.webkit.WebViewClient; @@ -64,6 +65,17 @@ public class MainActivity extends Activity { CookieManager.getInstance().setAcceptCookie(true); web.setWebViewClient(new WebViewClient() { + // The bundled build answers the site's own files from assets; the + // plain webview build lets everything through to the live site. + @Override + public WebResourceResponse shouldInterceptRequest(WebView v, WebResourceRequest r) { + if (BuildConfig.BUNDLED) { + WebResourceResponse res = Assets.serve(MainActivity.this, r); + if (res != null) return res; + } + return super.shouldInterceptRequest(v, r); + } + @Override public boolean shouldOverrideUrlLoading(WebView v, WebResourceRequest r) { Uri u = r.getUrl(); -- cgit v1.2.3