james.maesandOpenAI GPT-6.1
d316567fdc
Use the optional device-provided EMDK service for normal scanner input, with exact compile-only SDK provenance and no shipped vendor classes. Keep synthetic scan broadcasts confined to the disposable E2E variant. Pause input behind overlays and lost focus, and share live drawer-first Back routing across every process/application handler and toolbar arrow. Replace inherited Auth0/Coil prereleases with reviewed stable versions. Invalidate standard generated notices on dependency graph changes and retain strict runtime/license checks. Pin hosted acceptance to the source-qualified API 1.9 core/server tuple with runtime provenance. Validation: 127 JVM tests, 34 TC22 shared native cases, eight-overlay native regression, and ordinary-UID/distinct-signer injection rejection pass. Eight forged broadcasts cause no process/record mutation; a real manual positive control saves through the API. All package/lint gates, four-APK notice/DEX/native/manifest inspection, focused independent source review, workflow syntax and staged secret checks pass. Actual hardware triggers, configured provider, optional files deployment and final signing/distribution remain separate documented release gates. No normal operator installation or data was changed by these tests. Co-Authored-By: OpenAI GPT-6.1 (Codex) <noreply@openai.com> Signed-off-by: James Maes <james@kof22.com>
3.0 KiB
October 31 client security review
The deep static review completed against published client revision d1de0bf.
It reported one medium and five low findings. Coverage is partial: external
server/provider/dependency implementations and some bundled binary implementation
review were outside the completed scope. This is not production release clearance.
| Finding | Severity | Current verification |
|---|---|---|
| Delayed password completion after logout/server change | Medium | Fixed origin/generation binding and deferred cookie adoption; HTTP and native delayed-response cases pass. |
| Sample release cleartext traffic | Low | Debug-only HTTP environments/manifest override; packaged release denies cleartext. |
| Auth0 provider failure preserving local QQQ login | Low | Local sign-out is independent, bounded and idempotent; failed-provider, restart and remount cases pass. |
| Unauthenticated external scan broadcasts | Low | Trusted optional EMDK adapter and production receiver removal verified by actual DEX inspection,51 scanner JVM tests and an ordinary-UID/distinct-signer TC22 case: eight forged broadcasts cause zero process/record mutations; manual positive control succeeds. Actual physical-trigger positive control remains required before closing the complete scanner acceptance; normal operator installation is unchanged. |
| Legacy Auth0 callback crossing server origins | Low | Origin-bound callback/exchange lifecycle, one-use exchange and discarded-session cleanup; HTTP/native cases pass. |
| Sample session backup | Low | No-backup storage, disabled backups and explicit cloud/transfer exclusions; native storage and packaged release checks pass. |
The qualification batch passes 109 JVM tests (30 core, 46 mobile, 33 scanner), scanner lint with no errors or warnings, debug/native-test APK assembly, and unsigned sample release assembly. A physical TC22 run passes all 32 selected navigation, input, account, synthetic OAuth/Auth0 lifecycle and host-storage cases in 117.325 seconds. Ten new lifecycle cases cover delayed completion, duplicate callbacks, failed provider logout, overlapping logout and logout-screen remounting. These use synthetic repositories/browser callbacks; they do not prove a real configured identity-provider round trip.
Packaged release inspection confirms backup and cleartext disabled, plus all ten
cloud/device-transfer exclusions. The wrapper now matches the official Gradle 8.7
checksum; see provenance. The new scanner debug APK hash is
8c4d3886b4e994759f909677849dae26a333f476a036457c9ea76fe4566c512a.
It has not replaced the operator's installed scanner app in this checkpoint.
Separate live dependency review identified affected Guava in the server's tested classpath. A patched source pin is undergoing isolated consumer qualification; the client APK does not contain that Guava artifact. Actual Authentik, trusted physical scanner input, immutable Record Files publication and final deployment and signing gates remain open. See TODO and release prerequisites.