mirror of
https://github.com/bulwarkmail/native.git
synced 2026-10-31 00:06:17 +00:00
Linus Rath
6f0abb4384
Every published APK up to 0.1.62 was signed with the React Native template's debug keystore, whose key is public. Anyone could sign an "update" that Android installs over the app, with access to its SecureStore credentials and mail cache. The release build type fell back to the debug signing config whenever no release key was passed, and the workflow carried on silently when `ANDROID_KEYSTORE_BASE64` was empty. - `android/app/build.gradle` reads the release key from the `BULWARK_RELEASE_*` gradle properties or environment variables and has no fallback. Without them a release build fails in the new `checkReleaseSigning` task. It only runs for release variants, so debug builds and `expo run:android` are unchanged. A local test build can opt in with `-PallowDebugSignedRelease=true`, which is ignored whenever `CI` is set. - The release workflow fails in its first step when a signing secret is missing, checks the keystore, alias and password before the build, and refuses a debug key uploaded as the release key. - An optional `ANDROID_SIGNING_LINEAGE_BASE64` secret re-signs the APK with APK Signature Scheme v3 key rotation from the debug key to the release key, from API 28, so existing installs on Android 9+ can update and stop trusting the debug key afterwards. - Before anything is uploaded, `apksigner verify` has to show the release key as the Android 9+ signer, never the debug certificate. - `*.keystore` and `*.lineage` files are gitignored. Audit item S2 in `docs/audit-2026-09.md`.
Bulwark Mobile
Beta - work in progress. Many features are unfinished or rough. Expect bugs, missing functionality, and breaking changes between releases. Do not rely on this for primary email yet.
React Native (Expo SDK 54) client for Bulwark Webmail - a JMAP-based mail, calendar, and contacts app.
What works today
- Sign in to any JMAP server (e.g. Stalwart)
- Multiple accounts
- Email list, threads, compose
- Calendar (basic)
- Contacts (basic)
- Push notifications via the Bulwark relay - FCM by default, or UnifiedPush (e.g. ntfy) for devices without Google Play services
- In-app sideload updates from GitHub Releases
What's missing or rough
- iOS builds, but push notifications and client certificates are Android-only so far
- S/MIME, plugins, themes - UI stubs only (filters & rules, the vacation responder and file storage are real implementations)
- Calendar editing is partial; contacts editing is basic
- No Play Store distribution yet (sideload APK from Releases); iOS ships via TestFlight
Run locally
npm install
npx expo start
Then press a for Android, i for iOS, or scan the QR with Expo Go.
For a release APK build see .github/workflows/release-android.yml. For iOS builds and TestFlight distribution see docs/ios-release.md.
License
AGPL-3.0-only. See LICENSE.