hugo
bf83a0ba41
Add Rust distribution auditing, pinned post-build AAB signing, complete offline third-party notices, an Android privacy policy and reviewable Play listing assets. Preserve the application ID and audit both ARM ABIs, native symbols, baseline profiles and R8 mapping. Fix dialog focus ownership, navigation-triggered cleanup loops and stale authentication errors after first-run setup, with native and real-activity regressions. Google Play publication is deferred by the user. Issue #112 remains open for production signing, Console declarations and actual Play install/update verification.
Android supplemental license notices
The build extracts notices already present in resolved release AAR/JARs and
uses cargo-about 0.9.2 for complete Rust license text and attribution. That
build-only tool is pinned by official release SHA-256 for native macOS/Linux
ARM64 hosts in license-tool.json. The ordinary dependency-policy/SBOM gate
still requires review of exact dependency versions and license expressions.
The generator checks notice coverage against both ARM normal Cargo graphs.
It renders names, versions, public authors, source-archive URLs and license
text, excluding Cargo metadata paths and private checkout locations.
These additional files cover license material not fully included in the
published Android binary artifacts. android_notices.py binds the exceptions
to exact component versions/expressions; a changed exception needs review.
Apache-2.0.txt: https://www.apache.org/licenses/LICENSE-2.0.txtchecker-qual.txt: Checker Framework 3.43.0, https://github.com/typetools/checker-framework/blob/checker-framework-3.43.0/checker-qual/LICENSE.txt (release ref842c4d0080063ff37dc622398e8740731d96e801).jna-LICENSE.txt: JNA 5.19.1, https://github.com/java-native-access/jna/blob/5.19.1/LICENSE. This distribution selects Apache-2.0 from JNA's offered dual license.libffi.txt: native libffi bundled by JNA 5.19.1, https://github.com/java-native-access/jna/blob/5.19.1/native/libffi/LICENSE.libyuv-LICENSE.txtandlibyuv-PATENTS.txt: libyuv used by CameraX native image processing. Official Android 17 source notices: https://android.googlesource.com/platform/external/libyuv/+/refs/tags/android-17.0.0_r1/LICENSE and the siblingPATENTSfile. CameraX's native build consumes the Android external libyuv project; the published CameraX AAR supplies its Apache notice.
The generated text is packaged as assets/third-party-notices.txt in every app
variant. Preferences displays it offline as lazily laid-out paragraphs, keeping
the 1.3 MiB notice document off the main thread during loading. This includes
public source-archive links for MPL-covered Rust dependencies. Retain the same
notice document with each release's mapping, native symbols and SBOM.