Implement local-first and HTTPS Git onboarding on Android #95

New Issue

hugo · 2026-08-17T19:12:18Z

hugo commented

2026-08-17 19:12:18 +00:00

Goal

Let a new Android installation create or import a pass-compatible local store and optionally connect an HTTPS Git remote.

Scope

Provide native staged onboarding for local-only setup, GPG key generation/import/selection, repository initialization/opening, and optional HTTPS server/account/repository/application-token setup.
Also support cloning an existing remote: validate a credential-free HTTPS URL, discover branches, select a branch, show progress/cancellation, and safely reuse a matching existing clone.
Pass app-private roots, all validation, key generation/import, .gpg-id, repository layout, Git clone/open/init, remote identity, token storage, and recovery decisions to crates/storage.
Store the application token only through the Android Keystore adapter; permit later replacement without revealing the old value.
Keep remote setup optional so offline/local users can create folders and entries, commit locally, use TOTP, and add HTTPS synchronization later.
Handle denied camera/biometric capabilities by offering safe manual alternatives, not weaker silent behavior.
Cover invalid/expired token, TLS/network failure, non-HTTPS scheme, interrupted clone, existing/different clone, key mismatch, low storage, and partially completed setup.
Never use SAF as the live repository and never launch git, gpg, pass, or a credential helper.

Acceptance criteria

Fresh install can reach a usable encrypted local store without any server.
Existing HTTPS store can be cloned with an application token, and SSH/embedded credentials are rejected before transport.
Failed/cancelled setup cannot replace an existing repository/config/credential.
Setup survives rotation, folding, and process recreation without saving secrets; unsafe interrupted stages restart or roll back deterministically.
Upstream-compatible fixtures prove the produced repository/key/policy format.
Kotlin owns only form/camera/permission presentation and does not select paths, recipients, or repository semantics.

Depends on private-path integration, Keystore, biometric authentication, and the app shell. Part of #87.

## Goal Let a new Android installation create or import a pass-compatible local store and optionally connect an HTTPS Git remote. ## Scope - Provide native staged onboarding for local-only setup, GPG key generation/import/selection, repository initialization/opening, and optional HTTPS server/account/repository/application-token setup. - Also support cloning an existing remote: validate a credential-free HTTPS URL, discover branches, select a branch, show progress/cancellation, and safely reuse a matching existing clone. - Pass app-private roots, all validation, key generation/import, `.gpg-id`, repository layout, Git clone/open/init, remote identity, token storage, and recovery decisions to `crates/storage`. - Store the application token only through the Android Keystore adapter; permit later replacement without revealing the old value. - Keep remote setup optional so offline/local users can create folders and entries, commit locally, use TOTP, and add HTTPS synchronization later. - Handle denied camera/biometric capabilities by offering safe manual alternatives, not weaker silent behavior. - Cover invalid/expired token, TLS/network failure, non-HTTPS scheme, interrupted clone, existing/different clone, key mismatch, low storage, and partially completed setup. - Never use SAF as the live repository and never launch `git`, `gpg`, `pass`, or a credential helper. ## Acceptance criteria - Fresh install can reach a usable encrypted local store without any server. - Existing HTTPS store can be cloned with an application token, and SSH/embedded credentials are rejected before transport. - Failed/cancelled setup cannot replace an existing repository/config/credential. - Setup survives rotation, folding, and process recreation without saving secrets; unsafe interrupted stages restart or roll back deterministically. - Upstream-compatible fixtures prove the produced repository/key/policy format. - Kotlin owns only form/camera/permission presentation and does not select paths, recipients, or repository semantics. Depends on private-path integration, Keystore, biometric authentication, and the app shell. Part of #87.

hugo added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:12:18 +00:00

hugo added the enhancement label 2026-08-17 19:12:18 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#95