Files

T

root a58fa6158d Make the Android app build, and fix what compiling it exposed

Why: the module was written but never compiled, so nothing about it was
proved. Building it found a name clash and a theme that would have crashed
every device below Android 10.

What:
- KeepOrgProvider.requireContext -> ctx(): ContentProvider gained
  requireContext() in API 30, and Kotlin refused the silent hiding.
- The application theme was @android:style/Theme.DeviceDefault.DayNight,
  which is API 29 while minSdk is 26. Replaced with @style/AppTheme, plain
  DeviceDefault in values/ and DayNight in values-v29/.
- Backup exclusions: data_extraction_rules.xml and backup_rules.xml exclude
  every domain for both cloud backup and device transfer. The session token
  authenticates as the user and the mirrored files are the organization's
  password databases; neither belongs in a backup.
- User-facing strings moved from code into strings.xml, so the app is
  translatable. Layouts stay in code, as before.
- mipmap-anydpi-v26 -> mipmap-anydpi (the qualifier is redundant at minSdk
  26), and the redundant activity label is gone.
- Lint is configured to write a text report, and `make android-lint` runs it;
  `make android` now fails with a clear message when ANDROID_HOME has no SDK.

Proved: the unsigned release APK builds (656 KB), lint reports "No issues
found", and the packaged DEX contains all 16 classes including every manifest
component. Toolchain used: JDK 21, Gradle 8.10.2, SDK platform 35 and
build-tools 35.0.0; on this arm64 host Google's x86-64 aapt2 runs under
qemu-user-static with amd64 multiarch libraries, which android/README.md now
documents. The app has still not run on a device: there is none here.

2026-10-29 16:55:26 +01:00

2.8 KiB

Raw Blame History

KeepOrg for Android

A KDBX synchronization adapter with no third-party dependencies: the server is reached with java.net.HttpURLConnection, JSON is parsed with the platform's org.json, and the two screens are built in code. The release APK is about 650 KB.

How a KeePass application sees it

KeepOrgProvider is a DocumentsProvider, so the mirrored databases appear in every file picker under "KeepOrg". KeePassDX and Keepass2Android open them like any other document. When the application closes a file it had opened for writing, the provider triggers a synchronization pass, which is how a save reaches the server.

SyncService is a foreground service that holds the server's event stream open, so a change pushed by a colleague arrives without opening the app. The user turns it on from the main screen; it is not started at boot.

Nothing the app holds may leave the device in a backup or a device transfer: res/xml/data_extraction_rules.xml and res/xml/backup_rules.xml exclude every domain. The session token authenticates as the user, and the mirrored files are the organization's password databases.

The merge policy in Mirror.decide is the same table as the desktop client's internal/client/decide.go. Keep the two in step.

Building

Requirements: JDK 17 or newer, Gradle 8.9 or newer, and an Android SDK with platforms;android-35 and build-tools;35.0.0.

export ANDROID_HOME=$HOME/android-sdk
make android        # unsigned release APK, named for the F-Droid repository
make android-lint   # lint; the project is kept at zero findings
make android-publish

The Gradle wrapper is not committed, so the Makefile calls whichever gradle is on PATH. Generate a wrapper if you prefer one: gradle wrapper --gradle-version 8.10.2.

The release build is deliberately unsigned: the private F-Droid repository signs what it publishes.

Building on an arm64 Linux host

Google ships aapt2 for linux-x86_64 only, so an aarch64 build host needs to be able to run it. Debian's own arm64 aapt2 is too old to read the API 35 android.jar, so run the official one through QEMU instead:

sudo dpkg --add-architecture amd64
sudo apt update
sudo apt install qemu-user-static libc6:amd64 libstdc++6:amd64 zlib1g:amd64

After that aapt2 runs transparently and the build needs no further flags. Everything else in the Android toolchain (R8, the resource merger, zipflinger, apksig) is Java and architecture-independent.

What is verified and what is not

The APK builds clean and lint reports no issues, and the packaged DEX contains every class the manifest names. The app has not been exercised on a device or emulator: there was none available. The first real run is where to confirm the picker integration, the save-triggered sync and the notification.

2.8 KiB Raw Blame History