secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 13:59:40 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
110133bee9
secubox-deb/clients/android-toolbox
History
CyberMind-FR ac14e65353 docs: wiki/README/WIP/TODO/HISTORY for Android ToolBox app + root-mode (ref #538) 
- new wiki page Android-ToolBox.md (install via /wg/toolbox.apk, manual +
  root onboarding flows, CI build, endpoints) + sidebar link
- README: document the root-mode silent path + revised constraints
- WIP/TODO/HISTORY: Android client section (#531/#536/#538)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-13 07:46:50 +02:00
..
app feat(android): root-mode fully-automated silent R3 onboarding (ref #538) 2026-06-13 07:40:58 +02:00
.gitignore feat(android): scaffold one-tap toolbox R3 installer + CI (ref #531) 2026-06-12 18:15:46 +02:00
build.gradle.kts feat(android): scaffold one-tap toolbox R3 installer + CI (ref #531) 2026-06-12 18:15:46 +02:00
gradle.properties feat(android): scaffold one-tap toolbox R3 installer + CI (ref #531) 2026-06-12 18:15:46 +02:00
README.md docs: wiki/README/WIP/TODO/HISTORY for Android ToolBox app + root-mode (ref #538) 2026-06-13 07:46:50 +02:00
settings.gradle.kts feat(android): scaffold one-tap toolbox R3 installer + CI (ref #531) 2026-06-12 18:15:46 +02:00

README.md

SecuBox Android ToolBox client (#531)

One-tap R3 onboarding for the VILLAGE3B cabine : install the CA, import the WireGuard profile, verify the tunnel, then open the live cartographie sociale. Replaces the manual Android tutorial.

Flow (manual path)

  1. Discover — scan the kbin QR or type the booth host (kbin.gk2.secubox.in).
  2. Install CA — downloads /wg/ca.crt, launches the Android cert-install intent (KeyChain.createInstallIntent).
  3. Import profile — downloads /wg/profile/new, hands the .conf to the WireGuard app via FileProvider + ACTION_VIEW.
  4. Verify — polls /wg/r3-check → "Tunnel R3 actif ✓".
  5. Live metrics — opens /social/me (cartographie sociale).

Root path — fully-automated silent onboarding (#538)

When the device is rooted, the Discover step shows an extra ⚡ Installation automatique (root) button. Tapping it runs the whole onboarding with zero further interaction (RootAuto step, streaming log):

  1. System CA install — downloads /wg/ca.pem, computes the OpenSSL subject_hash_old in pure Kotlin, and bind-mounts a populated copy of the trust store over /system/etc/security/cacerts (+ the conscrypt APEX path on Android 14), restoring the SELinux context (u:object_r:system_security_cacerts_file:s0). Every app trusts the cabine CA — not just user-CA opt-in apps. Reversible via umount.
  2. Native WireGuard — if the kernel has the WireGuard module + wg/ip, brings the tunnel up natively (ip link add … type wireguard + wg set), no WireGuard app required.
  3. Auto R3 verify — polls /wg/r3-check.

Fallback — if the kernel lacks WireGuard, the root path installs the system CA then hands off to the manual WireGuard-app flow (steps 3–5 above).

All root actions are gated behind the explicit tap — nothing runs as root without the operator choosing root mode on their own device. See RootShell.kt (su wrapper) and RootOnboard.kt (silent sequence).

Build

No Gradle wrapper jar is committed (text-only scaffold). CI builds it:

  • GitHub Actions build-android-apk.yml → debug APK artifact. Locally (with Android SDK + Gradle 8.9 + JDK 17):
cd clients/android-toolbox
gradle :app:assembleDebug      # app/build/outputs/apk/debug/app-debug.apk

Constraints (MVP)

  • Android 11+ restricts user CA trust ; the manual path launches the install intent + guides the confirm step. Browsers on the device need the CA trusted for the mitm R3 break — this is the known Android limitation on non-rooted devices. Rooted devices bypass it entirely via the system CA install (see Root path above).
  • The manual path imports the WireGuard profile via the official WireGuard app (no embedded tunnel) — most reliable, no extra native deps. The root path brings the tunnel up natively with the kernel module.
  • Debug APK is self-signed (sideload). Release signing (published fingerprint, served from the toolbox) is a follow-up needing a keystore secret in CI.

Tech

Kotlin + Jetpack Compose, minSdk 26 / targetSdk 34. API client is plain HttpURLConnection (no Retrofit/OkHttp) to keep deps + CI minimal.

Package in.secubox.toolbox. License LicenseRef-CMSD-1.0.