ReactorcoremeltdownandClaude Opus 5.5
4ffc434b1b
Storage. The server keeps its data in SQLite (a file in the data directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or -database). Every row, the KDBX versions included, is sealed with AES-256-GCM under a key derived from the master key and named by an HMAC. The master key is required to start and a different one is refused. A data directory from 0.10 or earlier is imported on first start. Several servers may share one PostgreSQL database. Go goes to 1.26 for the pure-Go drivers (modernc.org/sqlite, jackc/pgx). Hardening, after an audit of the server, both clients and the deployment: - Single sign-on approves a device only after an explicit Approve in the browser that started it, bound by a cookie and PKCE; identities are never linked by username, by verified email only when allowed, never to admins. - Sign-in attempts are limited per address and per account, passwords are checked outside the store lock with uniform timing, one-time codes work once, and starting two-factor needs the password. - Merge vaults bound KDF parameters, payload size and XML shape, check pushes before storing them, and run at most two merges at once. A version is written in the same transaction as its metadata. - Tokens in URLs only on the event stream, which ends on revocation; CSP, frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases without access; new trusted_proxies. - Clients open only the server's approval page, keep case-variant and retired file names apart, never overwrite a save made during a pull, require https except locally, send the stream token in a header, bound their reads and escape notifications and terminal output. - The .deb creates the master key, systemd is sandboxed further, nginx sets modern TLS and HSTS, and CI deploys from main only. Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
KeepOrg for Android
A KDBX synchronization adapter with no third-party dependencies: the server
is reached with java.net.HttpURLConnection, JSON is parsed with the
platform's org.json, and the two screens are built in code. The release APK
is about 650 KB.
How a KeePass application sees it
KeepOrgProvider is a DocumentsProvider, so the mirrored databases appear
in every file picker under "KeepOrg". KeePassDX and Keepass2Android open them
like any other document. When the application closes a file it had opened for
writing, the provider triggers a synchronization pass, which is how a save
reaches the server.
SyncService is a foreground service that holds the server's event stream
open, so a change pushed by a colleague arrives without opening the app. The
user turns it on from the main screen; it is not started at boot.
Nothing the app holds may leave the device in a backup or a device transfer:
res/xml/data_extraction_rules.xml and res/xml/backup_rules.xml exclude
every domain. The session token authenticates as the user, and the mirrored
files are the organization's password databases.
The merge policy in Mirror.decide is the same table as the desktop client's
internal/client/decide.go. Keep the two in step.
Building
Requirements: JDK 17 (lint in AGP 8.7 fails on newer JDKs; set JAVA_HOME
to a 17 when Gradle defaults to something else), Gradle 8.9 or newer, and an
Android SDK with
platforms;android-35 and build-tools;35.0.0.
export ANDROID_HOME=$HOME/android-sdk
make android # unsigned release APK, named for the F-Droid repository
make android-lint # lint; the project is kept at zero findings
make android-publish
The Gradle wrapper is not committed, so the Makefile calls whichever gradle
is on PATH. Generate a wrapper if you prefer one:
gradle wrapper --gradle-version 8.10.2.
The release build is deliberately unsigned: the private F-Droid repository signs what it publishes.
Building on an arm64 Linux host
Google ships aapt2 for linux-x86_64 only, so an aarch64 build host needs to
be able to run it. Debian's own arm64 aapt2 is too old to read the API 35
android.jar, so run the official one through QEMU instead:
sudo dpkg --add-architecture amd64
sudo apt update
sudo apt install qemu-user-static libc6:amd64 libstdc++6:amd64 zlib1g:amd64
After that aapt2 runs transparently and the build needs no further flags.
Everything else in the Android toolchain (R8, the resource merger, zipflinger,
apksig) is Java and architecture-independent.
What is verified and what is not
The APK builds clean and lint reports no issues, and the packaged DEX contains every class the manifest names. The app has not been exercised on a device or emulator: there was none available. The first real run is where to confirm the picker integration, the save-triggered sync and the notification.