QRun-IO/qqq-android
3
0 Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases 3 Wiki Activity

3 Releases 3 Tags

RSS Feed
  • scanner-v1.0.4 9bae976138
    Compare

    QQQ Mobile scanner 1.0.4 (versionCode 6) — signed, metadata timeout and sign-out fixes
    android / android (push) Failing after 3m53s
    Details
    build / android (push) Failing after 3m53s
    Details
    Pre-Release

    james.maes released this 2026-11-10 00:57:02 +00:00 | 0 commits to main since this release

    QQQ Mobile 1.0.4 (versionCode 6): Release notes

    Signed APK for direct installation over USB (adb install -r) or MDM. It updates 1.0.3, 1.0.2, 1.0.1 and 1.0.0 in place because the signer is the same; do not uninstall first.

    Install steps: INSTALL.md (Windows laptop, USB, adb).

    Artifact

    Item Value
    Application ID io.qrun.mobile.scanner
    Version 1.0.4 / versionCode 6 (min Android 8.0 / API 26, target API 35)
    File QQQ-Mobile-1.0.4.apk, 15015419 bytes
    APK SHA-256 F643872F4435B55F6A0B929D1762CAACB18010E5CC0B473C7B4BABBDC4299489
    Signer certificate SHA-256 BDDB2D2F45A5925C643A83ABAF616C1EAB2387DC5CDA7B645A6F4C0D5B17A9FF
    Signing Existing permanent QRun release key (CN=QQQ Mobile, OU=Android, O=QRunIO), APK signature schemes v2 + v3, one signer. No new key.
    Source main at 9bae976138c4447f3fa451ee49b8585e80f01847 (tree bb70c3128f4c7c10cac73973d96f02f3ac5ce9c9, tag scanner-v1.0.4): 1.0.3 source plus Android PR 26 and PR 27.

    The checksum proves file integrity only. Separately verify the signing certificate; only the same signer permits in-place updates.

    What 1.0.4 changes

    • Metadata load timeout: loading the server's metadata no longer fails with "Error loading QInstance: timeout" on a handheld. The metadata response is large (about 1.7 MB uncompressed for an administrator) and can take the server several seconds to build, so the default 10 second read timeout expired. That one call now allows 60 seconds; every other call keeps its short timeout. A timeout now reads "Timed out after 60.0s loading the server's metadata from /qqq/v1/metaData". (PR 26)
    • Sign-out ends the identity-provider session: Sign out now also ends the identity-provider session in the browser when the server supports it, and every browser sign-in sends max_age=0 next to prompt=login. Before, ordinary Sign out cleared only the QQQ session, so the provider session left in the browser silently signed the same person straight back in. Servers without provider logout still get local plus QQQ sign-out. (PR 27)
    • Includes 1.0.3 (versionCode 5): string widget icons and summary-only help content from current QQQ core are accepted. (PR 24)

    Verification of this file

    Checked on the published file before upload and again on the copy downloaded back from this release:

    • SHA-256 equals the value above.
    • aapt2 dump badging: versionCode='6' versionName='1.0.4', package io.qrun.mobile.scanner.
    • apksigner verify --print-certs: verifies with v2 and v3, exactly one signer, certificate SHA-256 as above.
    • The compiled code contains the new metadata timeout message ("Timed out after ... loading the server's metadata from"), which is absent from the 1.0.3 APK.

    Qualification status of this build

    • Hosted CI on the tagged commit (run 7323): checkout, set-up and the Gradle step (source checks, JVM unit tests, scanner lint, debug and QA assembly) passed. The emulator test step did not run because the runner that picked up the job has no usable /dev/kvm; that is a runner limitation, not a test failure. The PR 26 commit passed the full job including emulator tests (run 7319). The PR 27 commit has not had an emulator run.
    • Devices: at publication, 1.0.4 had not yet been installed on a handheld. Confirm the in-place update and the two fixes on the first device before rolling out to the rest.
    • This is published as a prerelease like the earlier scanner releases, because device qualification is by the operator.

    Compatibility

    • Same signer and a higher versionCode: in-place update that keeps login, server address and enrollment. Development-signed (debug/demo) installs have a different signer and are refused; that needs an explicit, owner-approved migration.
    • Release builds reject HTTP; use trusted HTTPS only.
    • Server needs the semantic UI API (core 1.8+; OAuth2 sign-in needs 1.10) and mobile-scanners 1.1+ (1.6.0+ to record heartbeat versions).
    • Online only; no offline queue.
    Downloads