[kwsantiago]

Summary

Pins keep to v0.12.2 and follows its API and behavior changes.

TLS. v0.12.2 moves to webpki-roots 1.0.10, which drops a root CA whose intermediates' private keys were reported compromised, and rustls-webpki 0.103.16, which rejects chains through those intermediates. Every TLS connection the app makes (relay websockets and keep-frost-net's pinned transport) runs in the core and trusts the bundled webpki roots, not Android's platform store, so this pin is what changes trust on devices. cargo tree -p keep-mobile --locked --target aarch64-linux-android now shows only webpki-roots 1.0.10 and rustls-webpki 0.103.16, and the built libkeep_mobile.so no longer contains the removed root's subject (it did 7 times on arm64 and 6 on x86_64 at the previous pin).

Storage. Implements SecureStorage.readActiveShareKey(), which returns the stored active pointer as it is: no registry check, no inference and no write, and Unavailable when the pointer will not decrypt or the lookup cannot complete.

Bunker. In v0.12.2 a core revoke stops whatever bunker is running, drops live and saved grants with or without a running bunker, and replaces the connect secret; saved grants are restored only under the bunker key and account they were made under, so grants saved before this version are not restored.

• Revokes go through a handler of their own, so revoking while the bunker is off now drops the client's saved grants. The URL rotation after a revoke stays, which restarts a running bunker, so revoking behaves for users as before.
• When both the core revoke and the rotation fail, the revoke-all mark is set, so every client is revoked before the next start serves; a rotation that fails restarts a bunker the revoke stopped.
• The account-switch reset now revokes every grant immediately, and the start-time revoke-all runs before the start instead of after it (after it, it would stop the bunker it just started). It clears the mark only once the core reports the revoke saved, so the storage fault counter that stood in for that is removed.
• The post-start denylist sweep is removed: under v0.12.2 it would stop the bunker it had just started, and the grants it existed for are no longer restored.
• The core returns from a start before it marks the bunker running, so the service now waits for the start to settle and starts again with a fresh handler when it does not settle on running, instead of reporting the first status it reads.
• The core now stops the bunker whenever it drops its live node (a certificate pin change, deleting an account). A bunker that is meant to serve is restarted, and an enabled bunker is started once a node is built again.
• The revoke and rotate copy now says that clients approve again the actions they were allowed to remember.

Other. The new PolicyFault variants (SUPERSEDED, MISSING) need no app change, since the app does not read PolicyStatus. The approval timeout test moves to an instrumented test that reads the core's exported nip46ApprovalTimeoutSecs() instead of a copied constant.

Test plan

• ./gradlew assembleDebug lint testDebugUnitTest green
• Full instrumented suite on an API 33 emulator: OK (504 tests)
• New instrumented tests: readActiveShareKey returns the stored pointer as is, reports an absent pointer without inferring or writing one, and reports an unreadable pointer or a failed lookup as Unavailable; the approval timeout against the core's value; the start-time revoke clears the mark only when the revoke returns
• BunkerRevokeE2ETest against a live relay with the host-side NIP-46 probe (testharness/nip46probe/run-revoke-e2e.sh): a normal run and a run recovering from a force-stopped one both passed (50 requests each) and left no state behind, covering revoke while running and while stopped, Revoke All, disconnect from App Permissions, an approval answered after a revoke, the account switch and delete gates, and imports over the active account
• Mutation checks on the account-switch and revoke gates, each killed by its own assertion: removing the switch gate, the delete gate, the stop-before-wipe branch, the pre-start revoke-all, both rotations, the mark saved before an import, or its withdrawal

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4f2a87e6-25a7-498d-8cf4-68b5e8f99d0e

📥 Commits

Reviewing files that changed from the base of the PR and between 6f654d0 and 47ad04c.

📒 Files selected for processing: 12

• app/src/androidTest/kotlin/io/privkey/keep/nip46/ApprovalTimeoutTest.kt
• app/src/androidTest/kotlin/io/privkey/keep/nip46/BunkerRevokeE2ETest.kt
• app/src/androidTest/kotlin/io/privkey/keep/nip46/RevokeAllMarkTest.kt
• app/src/androidTest/kotlin/io/privkey/keep/storage/InfallibleStorageReadTest.kt
• app/src/androidTest/kotlin/io/privkey/keep/storage/StorageFaultCountTest.kt
• app/src/main/kotlin/io/privkey/keep/AccountActions.kt
• app/src/main/kotlin/io/privkey/keep/KeepMobileApp.kt
• app/src/main/kotlin/io/privkey/keep/nip46/BunkerService.kt
• app/src/main/kotlin/io/privkey/keep/nip46/RevokeAllMark.kt
• app/src/main/kotlin/io/privkey/keep/storage/AndroidKeystoreStorage.kt
• app/src/main/res/values/strings_connections.xml
• keep.version

+-------------------------------------------+
| Code reviewer with an internal monologue. |
+-------------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kwsantiago]

Superseded by the combined release PR, which carries these same four commits plus the v1.3.2 version bump.