Implement Android app-private paths, configuration, cache, and backup policy in the Rust core #90

New Issue

hugo · 2026-08-17T19:10:19Z

hugo commented

2026-08-17 19:10:19 +00:00

Goal

Make all storage-owned files work correctly inside Android's sandbox and survive safe application updates without leaking into device or cloud backups.

Scope

Pass canonical Android app-private files, cache, and no-backup directories into the Rust runtime at initialization; do not infer Android paths from HOME, current working directory, or public storage.
Keep the password-store clone, GPG key material, config.toml, TOTP discovery catalog, and transactional scratch space under storage-owned capability roots with atomic mutation behavior.
Choose files versus no-backup placement per threat and recovery model. Exclude the repository, key material, secure-store ciphertext, token/passphrase artifacts, TOTP catalog, and temporary plaintext from Auto Backup/device transfer unless a later audited encrypted export feature explicitly permits it.
Preserve the repository, configuration, credentials, and TOTP cache across normal APK/Play updates. Do not treat update as uninstall/reset.
Handle low-storage, read-only, missing, corrupt, restored-without-Keystore, interrupted atomic write, and process-death cases with typed recovery.
Set the strongest meaningful Unix-style permissions on Android while relying on the application sandbox rather than claiming unsupported filesystem guarantees.
Ensure cache and temporary cleanup never traverses or mutates the password-store repository outside Rust-owned capabilities.
Add migration/version hooks for future Android storage layout changes.

Libraries and APIs

Android Context.filesDir, cacheDir, noBackupFilesDir, data-extraction/backup rules, and storage-owned Rust filesystem/capability APIs. No Storage Access Framework access is needed for the live repository.

Acceptance criteria

Fresh install, app update, process recreation, storage pressure, and corrupt cache fixtures have deterministic outcomes.
Normal updates retain the local repository and valid TOTP cache; uninstall behavior is documented.
Backup inspection shows no password repository, GPG key, secret-store payload, token, passphrase, TOTP metadata, or plaintext temporary file.
Kotlin never lists or mutates repository contents.
Android path behavior has Rust unit tests and instrumented sandbox tests.

Depends on #88, the Rust/UniFFI packaging issue, and the platform-neutral contract issue. Part of #87.

## Goal Make all storage-owned files work correctly inside Android's sandbox and survive safe application updates without leaking into device or cloud backups. ## Scope - Pass canonical Android app-private files, cache, and no-backup directories into the Rust runtime at initialization; do not infer Android paths from `HOME`, current working directory, or public storage. - Keep the password-store clone, GPG key material, `config.toml`, TOTP discovery catalog, and transactional scratch space under storage-owned capability roots with atomic mutation behavior. - Choose files versus no-backup placement per threat and recovery model. Exclude the repository, key material, secure-store ciphertext, token/passphrase artifacts, TOTP catalog, and temporary plaintext from Auto Backup/device transfer unless a later audited encrypted export feature explicitly permits it. - Preserve the repository, configuration, credentials, and TOTP cache across normal APK/Play updates. Do not treat update as uninstall/reset. - Handle low-storage, read-only, missing, corrupt, restored-without-Keystore, interrupted atomic write, and process-death cases with typed recovery. - Set the strongest meaningful Unix-style permissions on Android while relying on the application sandbox rather than claiming unsupported filesystem guarantees. - Ensure cache and temporary cleanup never traverses or mutates the password-store repository outside Rust-owned capabilities. - Add migration/version hooks for future Android storage layout changes. ## Libraries and APIs Android `Context.filesDir`, `cacheDir`, `noBackupFilesDir`, data-extraction/backup rules, and storage-owned Rust filesystem/capability APIs. No Storage Access Framework access is needed for the live repository. ## Acceptance criteria - Fresh install, app update, process recreation, storage pressure, and corrupt cache fixtures have deterministic outcomes. - Normal updates retain the local repository and valid TOTP cache; uninstall behavior is documented. - Backup inspection shows no password repository, GPG key, secret-store payload, token, passphrase, TOTP metadata, or plaintext temporary file. - Kotlin never lists or mutates repository contents. - Android path behavior has Rust unit tests and instrumented sandbox tests. Depends on #88, the Rust/UniFFI packaging issue, and the platform-neutral contract issue. Part of #87.

hugo added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:10:19 +00:00

hugo added the enhancement label 2026-08-17 19:10:19 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#90