fix: enforce Android certificate pinning #19

Merged

ober merged 9 commits from chore/finish2-acceptance-sweep into main 2026-08-14 17:43:28 -04:00

Conversation 0 Commits 9 Files changed 17 +434 -131

ober commented 2026-08-12 19:43:51 -04:00

Owner

Copy link

Summary

• wire the Android JMAP client through OkHttp CertificatePinner using the configured SPKI pins
• add a security grep gate so the Android pinning invariant remains checked
• advance VERSION, jpkg.sexp, Android app version, CLI version output, and the tracked jjmapd binary to 0.2.20

Verification

• ./support/fetch-deps.sh
• jerboa_verify support/android/app.ss
• jerboa_verify lib/jjmap/main.ss
• jerboa_security_scan support/android/src/main/java/org/jerboa/mail/JmapClient.kt
• make build
• make test
• make binary
• make verify
• make release-verify
• env -i PATH="$PATH" HOME="$HOME" ./jjmapd version -> jjmapd 0.2.20
• RUSTC="$(rustup which --toolchain stable rustc)" JANDROID_REPO=/Users/user/mine/jerboa-android make android-apk

Android Gradle note

The generated Gradle project was produced successfully. A direct local gradle assembleDebug attempt is blocked by the host Gradle 9.6.1 installation: generated AGP 8.13.2 reports that it requires Gradle 9.5 or a compatible newer AGP. I did not change the generator-owned AGP default in this repo.

Finish2 audit note

The concrete remaining implementation gap found in the current tree was the Android CertificatePinner claim from plan.md/finish2-kimi3.md. The repo still uses the existing kotlin-source-dir migration bridge for the Android app spec; this PR does not convert the entire client to typed-kotlin-file.

## Summary - wire the Android JMAP client through OkHttp CertificatePinner using the configured SPKI pins - add a security grep gate so the Android pinning invariant remains checked - advance VERSION, jpkg.sexp, Android app version, CLI version output, and the tracked jjmapd binary to 0.2.20 ## Verification - ./support/fetch-deps.sh - jerboa_verify support/android/app.ss - jerboa_verify lib/jjmap/main.ss - jerboa_security_scan support/android/src/main/java/org/jerboa/mail/JmapClient.kt - make build - make test - make binary - make verify - make release-verify - env -i PATH="$PATH" HOME="$HOME" ./jjmapd version -> jjmapd 0.2.20 - RUSTC="$(rustup which --toolchain stable rustc)" JANDROID_REPO=/Users/user/mine/jerboa-android make android-apk ## Android Gradle note The generated Gradle project was produced successfully. A direct local `gradle assembleDebug` attempt is blocked by the host Gradle 9.6.1 installation: generated AGP 8.13.2 reports that it requires Gradle 9.5 or a compatible newer AGP. I did not change the generator-owned AGP default in this repo. ## Finish2 audit note The concrete remaining implementation gap found in the current tree was the Android `CertificatePinner` claim from plan.md/finish2-kimi3.md. The repo still uses the existing `kotlin-source-dir` migration bridge for the Android app spec; this PR does not convert the entire client to typed-kotlin-file.

ober added 1 commit 2026-08-12 19:43:51 -04:00

fix: enforce Android certificate pinning 716795d178

ober added 1 commit 2026-08-12 23:15:32 -04:00

fix android debug TLS pinning 6f033b2c05

ober added 1 commit 2026-08-13 13:47:53 -04:00

fix android emulator config handoff 0e594fe392

ober added 1 commit 2026-08-13 14:35:21 -04:00

fix android config startup after bad handoff 7582a42b42

ober added 1 commit 2026-08-13 17:20:59 -04:00

fix android jmap session loopback urls d438cef335

ober added 1 commit 2026-08-13 18:39:39 -04:00

fix android mail usability and compose 84fb9fa4ff

ober added 1 commit 2026-08-13 18:53:31 -04:00

fix android sync and message contrast ea9ab300ad

ober added 1 commit 2026-08-13 19:03:51 -04:00

refresh verified jjmapd binary a12909584c

ober added 1 commit 2026-08-13 20:19:08 -04:00

add mail delivery diagnostics ad198fc9ee

ober merged commit c1bffa7695 into main 2026-08-14 17:43:28 -04:00

ober referenced this pull request from a commit 2026-08-14 17:43:29 -04:00

Merge pull request #19

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ober/jerboa-jmap!19

No description provided.