hugo
bf83a0ba41
Add Rust distribution auditing, pinned post-build AAB signing, complete offline third-party notices, an Android privacy policy and reviewable Play listing assets. Preserve the application ID and audit both ARM ABIs, native symbols, baseline profiles and R8 mapping. Fix dialog focus ownership, navigation-triggered cleanup loops and stale authentication errors after first-run setup, with native and real-activity regressions. Google Play publication is deferred by the user. Issue #112 remains open for production signing, Console declarations and actual Play install/update verification.
36 lines
2.2 KiB
Markdown
36 lines
2.2 KiB
Markdown
# Android supplemental license notices
|
|
|
|
The build extracts notices already present in resolved release AAR/JARs and
|
|
uses `cargo-about` 0.9.2 for complete Rust license text and attribution. That
|
|
build-only tool is pinned by official release SHA-256 for native macOS/Linux
|
|
ARM64 hosts in `license-tool.json`. The ordinary dependency-policy/SBOM gate
|
|
still requires review of exact dependency versions and license expressions.
|
|
The generator checks notice coverage against both ARM normal Cargo graphs.
|
|
It renders names, versions, public authors, source-archive URLs and license
|
|
text, excluding Cargo metadata paths and private checkout locations.
|
|
|
|
These additional files cover license material not fully included in the
|
|
published Android binary artifacts. `android_notices.py` binds the exceptions
|
|
to exact component versions/expressions; a changed exception needs review.
|
|
|
|
- `Apache-2.0.txt`: https://www.apache.org/licenses/LICENSE-2.0.txt
|
|
- `checker-qual.txt`: Checker Framework 3.43.0,
|
|
https://github.com/typetools/checker-framework/blob/checker-framework-3.43.0/checker-qual/LICENSE.txt
|
|
(release ref `842c4d0080063ff37dc622398e8740731d96e801`).
|
|
- `jna-LICENSE.txt`: JNA 5.19.1,
|
|
https://github.com/java-native-access/jna/blob/5.19.1/LICENSE.
|
|
This distribution selects Apache-2.0 from JNA's offered dual license.
|
|
- `libffi.txt`: native libffi bundled by JNA 5.19.1,
|
|
https://github.com/java-native-access/jna/blob/5.19.1/native/libffi/LICENSE.
|
|
- `libyuv-LICENSE.txt` and `libyuv-PATENTS.txt`: libyuv used by CameraX native
|
|
image processing. Official Android 17 source notices:
|
|
https://android.googlesource.com/platform/external/libyuv/+/refs/tags/android-17.0.0_r1/LICENSE
|
|
and the sibling `PATENTS` file. CameraX's native build consumes the Android
|
|
external libyuv project; the published CameraX AAR supplies its Apache notice.
|
|
|
|
The generated text is packaged as `assets/third-party-notices.txt` in every app
|
|
variant. Preferences displays it offline as lazily laid-out paragraphs, keeping
|
|
the 1.3 MiB notice document off the main thread during loading. This includes
|
|
public source-archive links for MPL-covered Rust dependencies. Retain the same
|
|
notice document with each release's mapping, native symbols and SBOM.
|