[kwsantiago]

Summary

Releases v1.3.2 (versionCode 31) with per-ABI changelogs 312 and 314 in every locale, and pins keep to v0.12.2, following its API and behavior changes.

TLS. v0.12.2 moves to webpki-roots 1.0.10, which drops a root CA whose intermediates' private keys were reported compromised, and rustls-webpki 0.103.16, which rejects chains through those intermediates. Every TLS connection the app makes (relay websockets and keep-frost-net's pinned transport) runs in the core and trusts the bundled webpki roots, not Android's platform store, so this pin is what changes trust on devices. cargo tree -p keep-mobile --locked --target aarch64-linux-android now shows only webpki-roots 1.0.10 and rustls-webpki 0.103.16, and the built libkeep_mobile.so no longer contains the removed root's subject (it did 7 times on arm64 and 6 on x86_64 at the previous pin).

Storage. Implements SecureStorage.readActiveShareKey(), which returns the stored active pointer as it is: no registry check, no inference and no write, and Unavailable when the pointer will not decrypt or the lookup cannot complete.

Bunker. In v0.12.2 a core revoke stops whatever bunker is running, drops live and saved grants with or without a running bunker, and replaces the connect secret; saved grants are restored only under the bunker key and account they were made under, so grants saved before this version are not restored.

• Revokes go through a handler of their own, so revoking while the bunker is off now drops the client's saved grants. The URL rotation after a revoke stays, which restarts a running bunker, so revoking behaves for users as before.
• When both the core revoke and the rotation fail, the revoke-all mark is set, so every client is revoked before the next start serves; a rotation that fails restarts a bunker the revoke stopped.
• The account-switch reset now revokes every grant immediately, and the start-time revoke-all runs before the start instead of after it (after it, it would stop the bunker it just started). It clears the mark only once the core reports the revoke saved, so the storage fault counter that stood in for that is removed.
• The post-start denylist sweep is removed: under v0.12.2 it would stop the bunker it had just started, and the grants it existed for are no longer restored.
• The core returns from a start before it marks the bunker running, so the service now waits for the start to settle and starts again with a fresh handler when it does not settle on running, instead of reporting the first status it reads.
• The core now stops the bunker whenever it drops its live node (a certificate pin change, deleting an account). A bunker that is meant to serve is restarted, and an enabled bunker is started once a node is built again.
• The revoke and rotate copy now says that clients approve again the actions they were allowed to remember.

Other. The new PolicyFault variants (SUPERSEDED, MISSING) need no app change, since the app does not read PolicyStatus. The approval timeout test moves to an instrumented test that reads the core's exported nip46ApprovalTimeoutSecs() instead of a copied constant.

Test plan

• ./gradlew assembleDebug lint testDebugUnitTest green
• scripts/check-release-changelogs.sh passes for versionCode base 31 in all five locales
• Full instrumented suite on an API 33 emulator: OK (504 tests)
• New instrumented tests: readActiveShareKey returns the stored pointer as is, reports an absent pointer without inferring or writing one, and reports an unreadable pointer or a failed lookup as Unavailable; the approval timeout against the core's value; the start-time revoke clears the mark only when the revoke returns
• BunkerRevokeE2ETest against a live relay with the host-side NIP-46 probe (testharness/nip46probe/run-revoke-e2e.sh): a normal run and a run recovering from a force-stopped one both passed (50 requests each) and left no state behind, covering revoke while running and while stopped, Revoke All, disconnect from App Permissions, an approval answered after a revoke, the account switch and delete gates, and imports over the active account
• Mutation checks on the account-switch and revoke gates, each killed by its own assertion: removing the switch gate, the delete gate, the stop-before-wipe branch, the pre-start revoke-all, both rotations, the mark saved before an import, or its withdrawal

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: fd3f7d65-ecd0-4016-9bd5-7a0663205c45

📥 Commits

Reviewing files that changed from the base of the PR and between 6f654d0 and 69fea31.

📒 Files selected for processing: 23

• app/build.gradle.kts
• app/src/androidTest/kotlin/io/privkey/keep/nip46/ApprovalTimeoutTest.kt
• app/src/androidTest/kotlin/io/privkey/keep/nip46/BunkerRevokeE2ETest.kt
• app/src/androidTest/kotlin/io/privkey/keep/nip46/RevokeAllMarkTest.kt
• app/src/androidTest/kotlin/io/privkey/keep/storage/InfallibleStorageReadTest.kt
• app/src/androidTest/kotlin/io/privkey/keep/storage/StorageFaultCountTest.kt
• app/src/main/kotlin/io/privkey/keep/AccountActions.kt
• app/src/main/kotlin/io/privkey/keep/KeepMobileApp.kt
• app/src/main/kotlin/io/privkey/keep/nip46/BunkerService.kt
• app/src/main/kotlin/io/privkey/keep/nip46/RevokeAllMark.kt
• app/src/main/kotlin/io/privkey/keep/storage/AndroidKeystoreStorage.kt
• app/src/main/res/values/strings_connections.xml
• fastlane/metadata/android/de-DE/changelogs/312.txt
• fastlane/metadata/android/de-DE/changelogs/314.txt
• fastlane/metadata/android/en-US/changelogs/312.txt
• fastlane/metadata/android/en-US/changelogs/314.txt
• fastlane/metadata/android/es-ES/changelogs/312.txt
• fastlane/metadata/android/es-ES/changelogs/314.txt
• fastlane/metadata/android/ja-JP/changelogs/312.txt
• fastlane/metadata/android/ja-JP/changelogs/314.txt
• fastlane/metadata/android/pt-BR/changelogs/312.txt
• fastlane/metadata/android/pt-BR/changelogs/314.txt
• keep.version

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}