3 Releases 3 Tags

RSS Feed

• scanner-v1.0.2 eeb9f63322

  Compare

  QQQ Mobile scanner 1.0.2 (versionCode 4) — signed candidate Pre-Release

  james.maes released this 2026-11-06 23:32:15 +00:00 | 19 commits to main since this release

  QQQ Mobile 1.0.2 (versionCode 4): Release notes

  STATUS: PENDING CANDIDATE. Signed, not published, not a stable release, not yet device-requalified.
  No scanner 1.0.2 tag, release or download exists. The only published release is the signed 1.0.0 preview (scanner-v1.0.0). This candidate supersedes the unpublished signed 1.0.1 (versionCode 3) candidate and updates it in place with the same signer. Central publication and final compatible server versions are not claimed.

  Install steps: INSTALL.md. Canonical docs:
  INSTALLATION.md,
  RELEASING.md,
  ZEBRA-SCANNING.md.

  Artifact

  Item	Value
  Application ID	io.qrun.mobile.scanner
  Version	1.0.2 / versionCode 4 (replaces 1.0.1 / code 3 and 1.0.0 / code 2 in place)
  File	QQQ-Mobile-1.0.2.apk, 15015419 bytes
  APK SHA-256	8119492239F7D87264B3F48B0B6BF2E7F259942EED1978DEA1D2AB57A9B104F0
  Signer certificate SHA-256	BDDB2D2F45A5925C643A83ABAF616C1EAB2387DC5CDA7B645A6F4C0D5B17A9FF
  Signing	Existing QRun release key, v2 + v3, one signer, non-debuggable, 16 KiB aligned. No new key.
  Release lint	0 errors, 0 warnings, 5 informational
  Source	Built from main at eeb9f63322c11fddfd81f770e35808c7ff95ca32 (tree a807578b239ad790548957d3842b76b7d7007209): 1.0.1 source plus Android PR 17 and PR 18. Android PR 19 (release notes only) does not change the APK.

  The checksum proves file integrity only. Separately verify the signing certificate; only the same signer permits in-place updates.

  What 1.0.2 changes

  • Company sign-out completes: the provider logout request now runs before the scanner host ends its device session, so the browser end-session page opens. Previously the device-session end ran first and no nativeLogoutData came back, so the browser never opened (observed on the MC9400 with the production APK against the real Authentik server). (PR 17)
  • OAuth user name: the signed-in user's name is shown after browser sign-in instead of a blank current user. (PR 17)
  • Heartbeat versions: the app and OS version are reported on every session heartbeat, so scan receipts show the new version after an in-place update. Effective with mobile-scanners server 1.6.0; older servers ignore the keys. (PR 18)

  Supported behavior (from 1.0.0 and 1.0.1)

  Runtime customer branding from one shared APK; server-advertised sign-in; administrator device approval; portrait default orientation; Zebra EMDK capture forwarding the raw barcode, symbology and AIM identifier; record browsing and photo attachment through server record actions (camera or gallery) with preview, parent scoping and cleanup on logout.

  Qualification status of this build

  1.0.2 has not been installed on or requalified against any device. Nothing below was rerun with this APK. The three 1.0.2 changes were verified by hosted unit and end-to-end tests at merge only.

  Historical evidence (1.0.1, versionCode 3; not rerun for 1.0.2)

  Zebra MC9400 (production-signed 1.0.1):

  • In-place update 1.0.0 → 1.0.1 preserved login and enrollment; enrollment over trusted HTTPS passed.
  • Physical CODE128 scan saved and verified by the backend (symbology, AIM identifier, raw bytes, user, device).
  • Gallery photo upload returned AVAILABLE with exact parent, type, size and hash.

  Zebra TC22 (disposable native test build; its development-signed install and manual Echo acceptance were preserved):

  • Camera/gallery photo upload AVAILABLE, thumbnail and full preview, parent scoping, rotation and logout cleanup passed.

  Server/API: 185 requests across 23 operations matched the semantic API contract; UI API 1.10 discovery with strict nonce passed.

  Limits: TC22 photo tests used a disposable build, and synthetic camera input is not camera-hardware acceptance.

  Open gates (not claimed)

  1. Device requalification of 1.0.2: in-place update 1.0.1 → 1.0.2 (or 1.0.0 → 1.0.2) on the MC9400, scan, photo, and the company sign-out fix with the production APK.
  2. Native browser sign-in (Authentik) login, logout and account switching with the production APK.
  3. Public server cohort: the full downstream cohort (Core RC22 canonical Gitea files and hashes were independently verified) is still pending; final compatible public versions are not stated.
  4. GS1 physical print and rescan.
  5. Print nonce fix (merged abc3d0d, 532 hosted tests passed): released in print client 1.2.1; not part of this scanner APK.
  6. Publication: no 1.0.2 tag, release, hosted APK or download URL exists.

  Compatibility

  • Same signer and non-decreasing versionCode: in-place update. Development-signed installs need the explicit migration in INSTALL.md (resets settings, login and enrollment).
  • Release builds reject HTTP; use trusted HTTPS only.
  • Server needs the semantic UI API (core 1.8+; OAuth2 sign-in needs 1.10) and mobile-scanners 1.1+ (1.6.0+ to record heartbeat versions). Compatibility is checked before credentials are sent.
  • Online only; no offline queue.

  Downloads

  • INSTALL.md
    4.7 KiB

    2026-11-06 23:32:19 +00:00
  • QQQ-Mobile-1.0.2.apk
    14 MiB

    2026-11-06 23:32:18 +00:00
  • RELEASE-NOTES.md
    5.1 KiB

    2026-11-06 23:32:19 +00:00
  • SHA256SUMS
    88 B

    2026-11-06 23:32:18 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)