Skip to content

build-and-testing.md

Latest commit

 

History

History
84 lines (56 loc) · 3.71 KB

build-and-testing.md

File metadata and controls

84 lines (56 loc) · 3.71 KB
Raw

Build, Test, Compatibility, Dependencies, and License

Compatibility

The current project configuration targets:

  • Android minimum SDK: 26
  • Android compile SDK: 35
  • Java source and target compatibility: 17
  • Kotlin JVM target: 17
  • Android Gradle Plugin: 8.13.2
  • Kotlin Android plugin: 2.3.20

Installed-package signature history uses Android's SigningInfo APIs on Android 9 and newer. Android 8 uses the legacy package-manager signature API and therefore cannot expose the newer signing-certificate history model.

Dependencies

VPL has two runtime dependencies:

Component Version Purpose License
Gson 2.10.1 Strict streaming JSON parsing and small metadata documents. Apache License 2.0
Bouncy Castle bcprov-jdk18on 1.79 Ed25519 trust-list signature verification. Bouncy Castle Licence (MIT)

Test-only dependencies are:

Component Version License
JUnit 4.13.2 Eclipse Public License 1.0
AndroidX Test JUnit 1.2.1 Apache License 2.0
AndroidX Test Runner 1.6.2 Apache License 2.0

Local build

Use JDK 17 or a newer JDK capable of targeting Java 17:

./gradlew assembleDebug

The project also defines a fordebug build type derived from debug for host launchers that use the same variant name.

JVM unit tests

./gradlew testDebugUnitTest

The JVM suite currently covers:

  • Trust priority, bans, multi-signature behavior, explicit key trust, and signer history.
  • Canonical certificate fingerprints and strict trust-list parsing.
  • Ed25519 verification behavior.
  • Parallel mirror selection and configuration validation.
  • User-trust corruption recovery and persisted revocation.

Android instrumentation tests

Connect an API 26 or newer device or emulator, then run:

./gradlew connectedDebugAndroidTest

The instrumentation suite validates:

  • The bundled trust list and detached signature.
  • Installed and archived APK certificate extraction through Android's package manager.
  • Unreadable-archive failure behavior.
  • Concurrent initialization and inspection serialization.
  • Storage-unavailable fallback to the signed bundled list.
  • Invalid-signature rejection, active-version rollback rejection, and previous-pair recovery.

Suggested host verification

A host integration should run both VPL tests and its own final-load-guard tests. At minimum, host tests should cover protected native environment variables, package/path mismatch, authorization mismatch, setting-dependent direct certificate trust, and every supported plugin type.

An APK build confirms dependency and variant integration but does not replace the unit and instrumentation suites.

License

VPL is distributed under the GNU Lesser General Public License v3.0. Applications and modified distributions must comply with the applicable LGPLv3 terms. Consult the complete license text when determining distribution obligations; this document is not legal advice.

All third-party components remain subject to their respective upstream licenses. Integrators are responsible for preserving all required third-party notices in their distribution.