secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 15:37:03 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
81da97e53e
secubox-deb/clients/android-toolbox
History
CyberMind-FR 81da97e53e feat(android): zero-tap auto-run silent onboarding on root (closes #551) 
On a rooted device the app now runs the full silent onboarding on launch
with no taps: a LaunchedEffect auto-starts the root sequence once when
root is detected and this host hasn't been onboarded yet. The root-auto
logic is extracted into a reusable runRootAuto lambda (shared by the
auto-launch and the ⚡ button, which remains for re-runs). An onboarded
flag is persisted per host in SharedPreferences so reopening doesn't redo
it. versionName 0.2.0 / versionCode 2.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-13 13:13:02 +02:00
..
app feat(android): zero-tap auto-run silent onboarding on root (closes #551) 2026-06-13 13:13:02 +02:00
.gitignore feat(android): scaffold one-tap toolbox R3 installer + CI (ref #531) 2026-06-12 18:15:46 +02:00
build.gradle.kts feat(android): scaffold one-tap toolbox R3 installer + CI (ref #531) 2026-06-12 18:15:46 +02:00
gradle.properties feat(android): scaffold one-tap toolbox R3 installer + CI (ref #531) 2026-06-12 18:15:46 +02:00
README.md feat(android): zero-tap auto-run silent onboarding on root (closes #551) 2026-06-13 13:13:02 +02:00
settings.gradle.kts feat(android): scaffold one-tap toolbox R3 installer + CI (ref #531) 2026-06-12 18:15:46 +02:00

README.md

SecuBox Android ToolBox client (#531)

One-tap R3 onboarding for the VILLAGE3B cabine : install the CA, import the WireGuard profile, verify the tunnel, then open the live cartographie sociale. Replaces the manual Android tutorial.

Flow (manual path)

  1. Discover — scan the kbin QR or type the booth host (kbin.gk2.secubox.in).
  2. Install CA — downloads /wg/ca.crt, launches the Android cert-install intent (KeyChain.createInstallIntent).
  3. Import profile — downloads /wg/profile/new, hands the .conf to the WireGuard app via FileProvider + ACTION_VIEW.
  4. Verify — polls /wg/r3-check → "Tunnel R3 actif ✓".
  5. Live metrics — opens /social/me (cartographie sociale).

Root path — fully-automated silent onboarding (#538, #551)

When the device is rooted, the app runs the whole onboarding with zero taps: on launch it auto-detects root and, if this cabine host hasn't been onboarded yet, starts the silent sequence automatically (RootAuto step, streaming log). The ⚡ Installation automatique (root) button stays for re-runs. The "already onboarded" flag is persisted per host (SharedPreferences) so reopening the app doesn't redo it. Steps:

  1. System CA install — downloads /wg/ca.pem, computes the OpenSSL subject_hash_old in pure Kotlin, and bind-mounts a populated copy of the trust store over /system/etc/security/cacerts (+ the conscrypt APEX path on Android 14), restoring the SELinux context (u:object_r:system_security_cacerts_file:s0). Every app trusts the cabine CA — not just user-CA opt-in apps. Reversible via umount.
  2. Native WireGuard — if the kernel has the WireGuard module + wg/ip, brings the tunnel up natively (ip link add … type wireguard + wg set), no WireGuard app required.
  3. Auto R3 verify — polls /wg/r3-check.

Fallback — if the kernel lacks WireGuard, the root path installs the system CA then hands off to the manual WireGuard-app flow (steps 3–5 above).

All root actions are gated behind the explicit tap — nothing runs as root without the operator choosing root mode on their own device. See RootShell.kt (su wrapper) and RootOnboard.kt (silent sequence).

Build

No Gradle wrapper jar is committed (text-only scaffold). CI builds it:

  • GitHub Actions build-android-apk.yml → debug APK artifact. Locally (with Android SDK + Gradle 8.9 + JDK 17):
cd clients/android-toolbox
gradle :app:assembleDebug      # app/build/outputs/apk/debug/app-debug.apk

Constraints (MVP)

  • Android 11+ restricts user CA trust ; the manual path launches the install intent + guides the confirm step. Browsers on the device need the CA trusted for the mitm R3 break — this is the known Android limitation on non-rooted devices. Rooted devices bypass it entirely via the system CA install (see Root path above).
  • The manual path imports the WireGuard profile via the official WireGuard app (no embedded tunnel) — most reliable, no extra native deps. The root path brings the tunnel up natively with the kernel module.
  • Debug APK is self-signed (sideload). Release signing (published fingerprint, served from the toolbox) is a follow-up needing a keystore secret in CI.

Tech

Kotlin + Jetpack Compose, minSdk 26 / targetSdk 34. API client is plain HttpURLConnection (no Retrofit/OkHttp) to keep deps + CI minimal.

Package in.secubox.toolbox. License LicenseRef-CMSD-1.0.