Publish the audited Android client through Google Play and prove that production install and update behavior preserves secure user state.
Scope
Begin only after the Android parity/security audit passes.
Keep the production application ID de.rfc1437.ironstorage; configure version code/name, icons, adaptive/monochrome icon, feature graphic/screenshots, descriptions, category, content rating, support/privacy URLs, Data safety, encryption/export declarations, and third-party license notices.
Produce a signed, optimized Android App Bundle containing only selected ABI libraries, valid 16 KB page-size native artifacts, R8 rules, baseline profile if adopted, and separately retained native mapping/debug symbols.
Configure Play App Signing/upload keys and protected release automation without committing credentials. Review Android developer verification and current target-SDK/Play policy at release time.
Audit manifest permissions and exported app/credential/autofill components. Request camera only at the QR feature; avoid storage, contacts, accessibility, overlay, notification, and other unrelated permissions.
Use staged internal/closed testing and pre-launch reports, with available ARM emulator install/update validation. Physical devices are outside the milestone testing scope.
Verify a clean Play install can complete local-first setup and optional HTTPS cloning, and that biometric, repository browsing/editing, TOTP, QR transfer, Git sync, Credential Manager, and Autofill work.
Install the production update over an existing version without uninstall/reset; verify repository, config, valid Keystore records, and TOTP cache survive, migrations are atomic, and rollback/failure behavior is documented.
Document uninstall/reinstall/backup behavior truthfully; never seed app data or publish review credentials/key material.
Acceptance criteria
Play accepts/processes the production AAB and the installed artifact has the intended ID, signing lineage, SDK/ABI set, permissions, and no debug/test endpoints.
Clean-install and update-over-existing production smoke tests pass on supported arm64 devices.
App update preserves valid local state without weakening Keystore/biometric policy; uninstall/reinstall limitations match documentation.
Credential Manager/Autofill provider enablement and camera permission flows work from the Play build.
Store listing, Data safety, privacy/support material, licenses, and encryption declarations accurately match the app.
Release credentials, application tokens, GPG material, and private diagnostics are absent from repository and published artifacts.
Depends on the Android parity/security audit. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
## Goal
Publish the audited Android client through Google Play and prove that production install and update behavior preserves secure user state.
## Scope
- Begin only after the Android parity/security audit passes.
- Keep the production application ID `de.rfc1437.ironstorage`; configure version code/name, icons, adaptive/monochrome icon, feature graphic/screenshots, descriptions, category, content rating, support/privacy URLs, Data safety, encryption/export declarations, and third-party license notices.
- Produce a signed, optimized Android App Bundle containing only selected ABI libraries, valid 16 KB page-size native artifacts, R8 rules, baseline profile if adopted, and separately retained native mapping/debug symbols.
- Configure Play App Signing/upload keys and protected release automation without committing credentials. Review Android developer verification and current target-SDK/Play policy at release time.
- Audit manifest permissions and exported app/credential/autofill components. Request camera only at the QR feature; avoid storage, contacts, accessibility, overlay, notification, and other unrelated permissions.
- Use staged internal/closed testing and pre-launch reports, with available ARM emulator install/update validation. Physical devices are outside the milestone testing scope.
- Verify a clean Play install can complete local-first setup and optional HTTPS cloning, and that biometric, repository browsing/editing, TOTP, QR transfer, Git sync, Credential Manager, and Autofill work.
- Install the production update over an existing version without uninstall/reset; verify repository, config, valid Keystore records, and TOTP cache survive, migrations are atomic, and rollback/failure behavior is documented.
- Document uninstall/reinstall/backup behavior truthfully; never seed app data or publish review credentials/key material.
## Acceptance criteria
- Play accepts/processes the production AAB and the installed artifact has the intended ID, signing lineage, SDK/ABI set, permissions, and no debug/test endpoints.
- Clean-install and update-over-existing production smoke tests pass on supported arm64 devices.
- App update preserves valid local state without weakening Keystore/biometric policy; uninstall/reinstall limitations match documentation.
- Credential Manager/Autofill provider enablement and camera permission flows work from the Play build.
- Store listing, Data safety, privacy/support material, licenses, and encryption declarations accurately match the app.
- Release credentials, application tokens, GPG material, and private diagnostics are absent from repository and published artifacts.
Depends on the Android parity/security audit. Part of #87.
## Android support update (2026-10-08)
User-directed scope: Android release and CI targets are **arm64-v8a** and **armeabi-v7a**. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
hugo
added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:15:16 +00:00
Local preparation checkpoint; this issue remains OPEN and has no delivery commit yet.
Added an external, certificate-pinned upload-signing command. Build processes receive no upload-signing variables. The command signs only after Android verification, strictly verifies the signature, validates the AAB with pinned bundletool, and retains checksummed mapping, selected FULL symbols, SBOM and notices.
Added Rust distribution gates for the actual bundle manifest/version/SDK, production flags, permissions, both ARM/16 KiB libraries, matching symbols, baseline profiles, R8 mapping and exact notice bytes. Android version metadata is now centralized (code 2, name 1.0.1).
Added an offline Android privacy policy and actual third-party license notices (114 Android release components, 423 Rust normal dependencies), loaded off the main thread and displayed with bounded lazy layout.
Computer use exposed a document-dialog focus reset that the earlier fixture-only test missed. Reproduced it with the real activity, fixed owned-window/protected-surface handling, and verified ordinary dismissal plus real pause/resume cleanup.
Validation completed locally:
All required Rust gates; 526 tests passed, zero failed/ignored.
Fourteen CI self-checks; full Android verification (838 actionable Gradle tasks), release/native/manifest/dependency gates, pinned-certificate signing and bundletool validation.
Three settings tests passed on each ARM64 image: API 26/4 KiB, API 37/4 KiB, and strict API 37/16 KiB. Negative real-artifact checks reject mismatched mapping/notices without emitting successful provenance.
Final optimized APK generated from the audited AAB installed over the retained app with its existing debug certificate. Computer use verified unchanged repository state, both full documents and responsive scrolling. No uninstall, data reset, credential reset or ordinary biometric re-enrollment was used. Unused AVDs were shut down cleanly; the visible API-37 emulator remains running.
This used a DISPOSABLE validation upload key and a local release-equivalent APK. It does not establish Play acceptance, production signing lineage or a Play install/update result. Known emulator-fixture secret markers were absent from the candidate runtime code/assets.
Remaining: an enrolled Play developer account accessible to the publisher, production signing/protected publishing configuration, final listing graphics/screenshots and Console forms, and the required clean/update smoke tests from Play. Available consumer accounts currently reach registration; the project-domain Workspace account is administratively blocked from Play Console. No account, legal identity, production signing key, payment or release has been created/submitted. The working implementation and validation record are retained locally for this issue's eventual single commit; closure would be premature.
Local preparation checkpoint; this issue remains OPEN and has no delivery commit yet.
- Added an external, certificate-pinned upload-signing command. Build processes receive no upload-signing variables. The command signs only after Android verification, strictly verifies the signature, validates the AAB with pinned bundletool, and retains checksummed mapping, selected FULL symbols, SBOM and notices.
- Added Rust distribution gates for the actual bundle manifest/version/SDK, production flags, permissions, both ARM/16 KiB libraries, matching symbols, baseline profiles, R8 mapping and exact notice bytes. Android version metadata is now centralized (code 2, name 1.0.1).
- Added an offline Android privacy policy and actual third-party license notices (114 Android release components, 423 Rust normal dependencies), loaded off the main thread and displayed with bounded lazy layout.
- Computer use exposed a document-dialog focus reset that the earlier fixture-only test missed. Reproduced it with the real activity, fixed owned-window/protected-surface handling, and verified ordinary dismissal plus real pause/resume cleanup.
Validation completed locally:
- All required Rust gates; 526 tests passed, zero failed/ignored.
- Fourteen CI self-checks; full Android verification (838 actionable Gradle tasks), release/native/manifest/dependency gates, pinned-certificate signing and bundletool validation.
- Three settings tests passed on each ARM64 image: API 26/4 KiB, API 37/4 KiB, and strict API 37/16 KiB. Negative real-artifact checks reject mismatched mapping/notices without emitting successful provenance.
- Final optimized APK generated from the audited AAB installed over the retained app with its existing debug certificate. Computer use verified unchanged repository state, both full documents and responsive scrolling. No uninstall, data reset, credential reset or ordinary biometric re-enrollment was used. Unused AVDs were shut down cleanly; the visible API-37 emulator remains running.
This used a DISPOSABLE validation upload key and a local release-equivalent APK. It does not establish Play acceptance, production signing lineage or a Play install/update result. Known emulator-fixture secret markers were absent from the candidate runtime code/assets.
Remaining: an enrolled Play developer account accessible to the publisher, production signing/protected publishing configuration, final listing graphics/screenshots and Console forms, and the required clean/update smoke tests from Play. Available consumer accounts currently reach registration; the project-domain Workspace account is administratively blocked from Play Console. No account, legal identity, production signing key, payment or release has been created/submitted. The working implementation and validation record are retained locally for this issue's eventual single commit; closure would be premature.
Local release preparation is committed and pushed to main in bf83a0b.
Google Play publication is explicitly deferred by the user. This issue remains open. No account enrollment, terms acceptance, production-key installation, Play upload or rollout was performed.
Implemented:
Version code 2 with the existing application ID, a pinned local AAB signing/validation command, and Rust distribution auditing of actual bundle identity, SDKs, permissions, both ARM ABIs, 16 KiB native alignment, matching FULL symbols/R8 mapping, baseline profiles and retained notice bytes.
Complete offline notices for 114 Android release components and 423 Rust normal dependencies, plus the Android privacy policy and usable Preferences dialogs.
Reviewable listing text, 512px icon, 1024x500 feature graphic and four actual 1080x1920 phone screenshots with original captures. No review secrets are included.
Release QA fixes for document focus ownership, the Passwords-to-TOTP cleanup/recomposition loop, and a stale authentication configuration error after successful first-run setup. Domain behavior continues to use Rust; the fixes refresh or present Rust-provided state.
Validation and review:
All four required workspace gates passed: formatting, warnings-as-errors check, Clippy and 526 Rust tests (0 failed, 0 ignored across 41 suites).
Android verification passed with 838 actionable tasks; CI orchestration self-checks passed all 14 tests. The final instrumentation-only precondition correction also passed compilation, KtLint and Android lint.
Local AAB signing and artifact audits passed with an external disposable validation key. The optimized emulator APK was generated using the retained debug signing certificate; this is not a production signing or Play-install claim.
Configured ARM64 stores passed 14 executed focused UI checks per image on API 26 / 4 KiB, API 37 / 4 KiB and API 37 / strict 16 KiB. Two opt-in interactive inspection fixtures were excluded per image. The main image's two actual-store navigation/lifecycle regressions were explicitly rerun with zero skips after fixing their store precondition.
The real Rust/Kotlin setup-and-entry integration regression failed without the setup refresh, then passed with the final queued refresh, including proof that setup does not grant an unlock lease. The navigation regression likewise failed before its fix.
Computer use verified optimized Passwords-to-TOTP navigation on all three images, retained repository state and responsive offline documents. The API 26 demonstration store was created through normal in-app key generation and setup. No uninstall, container/key reset or opaque app-data restore was used. Only the main emulator remains running.
Final runtime-code/library/asset scanning found no known test credential markers. The code was reviewed against the issue; local preparation is implemented, while the production acceptance criteria below remain deliberately unverified.
Deferred: publisher enrollment/verification, production signing lineage and protected publishing configuration, final Console declarations/rating/contact details, tablet listing captures if required, Play processing/pre-launch reports, and genuine Play clean-install/update/provider/camera validation. These require a later publication task; local APK tests are not substitutes.
Cleanup after local delivery: the checksummed disposable candidate was archived locally; cargo clean reclaimed 22.4 GiB, Android generated build/cache files were removed, and no IronStorage Xcode DerivedData directory was present. The checkout is clean and the remote main SHA matches the commit above. Exactly one ARM emulator process remains, the visible retained main AVD. The remaining publication work is paused at the user's request.
Local release preparation is committed and pushed to `main` in [bf83a0b](https://git.rfc1437.de/hugo/IronStorage/commit/bf83a0ba41c47d0944bfeede1553aefb0c7e0a30).
**Google Play publication is explicitly deferred by the user. This issue remains open.** No account enrollment, terms acceptance, production-key installation, Play upload or rollout was performed.
Implemented:
- Version code 2 with the existing application ID, a pinned local AAB signing/validation command, and Rust distribution auditing of actual bundle identity, SDKs, permissions, both ARM ABIs, 16 KiB native alignment, matching FULL symbols/R8 mapping, baseline profiles and retained notice bytes.
- Complete offline notices for 114 Android release components and 423 Rust normal dependencies, plus the Android privacy policy and usable Preferences dialogs.
- Reviewable listing text, 512px icon, 1024x500 feature graphic and four actual 1080x1920 phone screenshots with original captures. No review secrets are included.
- Release QA fixes for document focus ownership, the Passwords-to-TOTP cleanup/recomposition loop, and a stale authentication configuration error after successful first-run setup. Domain behavior continues to use Rust; the fixes refresh or present Rust-provided state.
Validation and review:
- All four required workspace gates passed: formatting, warnings-as-errors check, Clippy and 526 Rust tests (0 failed, 0 ignored across 41 suites).
- Android verification passed with 838 actionable tasks; CI orchestration self-checks passed all 14 tests. The final instrumentation-only precondition correction also passed compilation, KtLint and Android lint.
- Local AAB signing and artifact audits passed with an external disposable validation key. The optimized emulator APK was generated using the retained debug signing certificate; this is not a production signing or Play-install claim.
- Configured ARM64 stores passed 14 executed focused UI checks per image on API 26 / 4 KiB, API 37 / 4 KiB and API 37 / strict 16 KiB. Two opt-in interactive inspection fixtures were excluded per image. The main image's two actual-store navigation/lifecycle regressions were explicitly rerun with zero skips after fixing their store precondition.
- The real Rust/Kotlin setup-and-entry integration regression failed without the setup refresh, then passed with the final queued refresh, including proof that setup does not grant an unlock lease. The navigation regression likewise failed before its fix.
- Computer use verified optimized Passwords-to-TOTP navigation on all three images, retained repository state and responsive offline documents. The API 26 demonstration store was created through normal in-app key generation and setup. No uninstall, container/key reset or opaque app-data restore was used. Only the main emulator remains running.
- Final runtime-code/library/asset scanning found no known test credential markers. The code was reviewed against the issue; local preparation is implemented, while the production acceptance criteria below remain deliberately unverified.
Deferred: publisher enrollment/verification, production signing lineage and protected publishing configuration, final Console declarations/rating/contact details, tablet listing captures if required, Play processing/pre-launch reports, and genuine Play clean-install/update/provider/camera validation. These require a later publication task; local APK tests are not substitutes.
The release procedure, policy review, limitations and validation record are in [docs/android/distribution.md](https://git.rfc1437.de/hugo/IronStorage/src/branch/main/docs/android/distribution.md).
Cleanup after local delivery: the checksummed disposable candidate was archived locally; `cargo clean` reclaimed 22.4 GiB, Android generated build/cache files were removed, and no IronStorage Xcode DerivedData directory was present. The checkout is clean and the remote main SHA matches the commit above. Exactly one ARM emulator process remains, the visible retained main AVD. The remaining publication work is paused at the user's request.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Publish the audited Android client through Google Play and prove that production install and update behavior preserves secure user state.
Scope
de.rfc1437.ironstorage; configure version code/name, icons, adaptive/monochrome icon, feature graphic/screenshots, descriptions, category, content rating, support/privacy URLs, Data safety, encryption/export declarations, and third-party license notices.Acceptance criteria
Depends on the Android parity/security audit. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
Local preparation checkpoint; this issue remains OPEN and has no delivery commit yet.
Validation completed locally:
This used a DISPOSABLE validation upload key and a local release-equivalent APK. It does not establish Play acceptance, production signing lineage or a Play install/update result. Known emulator-fixture secret markers were absent from the candidate runtime code/assets.
Remaining: an enrolled Play developer account accessible to the publisher, production signing/protected publishing configuration, final listing graphics/screenshots and Console forms, and the required clean/update smoke tests from Play. Available consumer accounts currently reach registration; the project-domain Workspace account is administratively blocked from Play Console. No account, legal identity, production signing key, payment or release has been created/submitted. The working implementation and validation record are retained locally for this issue's eventual single commit; closure would be premature.
Local release preparation is committed and pushed to
mainin bf83a0b.Google Play publication is explicitly deferred by the user. This issue remains open. No account enrollment, terms acceptance, production-key installation, Play upload or rollout was performed.
Implemented:
Validation and review:
Deferred: publisher enrollment/verification, production signing lineage and protected publishing configuration, final Console declarations/rating/contact details, tablet listing captures if required, Play processing/pre-launch reports, and genuine Play clean-install/update/provider/camera validation. These require a later publication task; local APK tests are not substitutes.
The release procedure, policy review, limitations and validation record are in docs/android/distribution.md.
Cleanup after local delivery: the checksummed disposable candidate was archived locally;
cargo cleanreclaimed 22.4 GiB, Android generated build/cache files were removed, and no IronStorage Xcode DerivedData directory was present. The checkout is clean and the remote main SHA matches the commit above. Exactly one ARM emulator process remains, the visible retained main AVD. The remaining publication work is paused at the user's request.