diff --git a/.fdroid.yml b/.fdroid.yml new file mode 100644 index 0000000..5a37570 --- /dev/null +++ b/.fdroid.yml @@ -0,0 +1,47 @@ +Categories: + - Connectivity +License: MIT +WebSite: https://github.com/andre487/AndroidMegaProxy +SourceCode: https://github.com/andre487/AndroidMegaProxy +IssueTracker: https://github.com/andre487/AndroidMegaProxy/issues +Changelog: https://github.com/andre487/AndroidMegaProxy/releases +AllowedAPKSigningKeys: 8a014a2a558a75b5f900ee0c33cd50f24b7432734912406699fc08866747f822 + +RepoType: git +Repo: https://github.com/andre487/AndroidMegaProxy.git + +Builds: + - versionName: 0.0.4 + versionCode: 4 + commit: v0.0.4 + subdir: app + ndk: 29.0.14206865 + sudo: + - apt-get update + - apt-get install -t bookworm-backports -y golang-go + - apt-get install -y gcc libc-dev make + gradle: + - yes + srclibs: + - go@go1.26.3 + rm: + - libs/megaproxy-sources.jar + binary: https://github.com/andre487/AndroidMegaProxy/releases/download/v%v/mega-proxy-universal.apk + build: + - pushd $$go$$/src + - ./make.bash + - popd + - export GOROOT=$$go$$ + - export GOPATH=$HOME/go + - export PATH=$GOROOT/bin:$GOPATH/bin:$PATH + - cd ../native + - go install golang.org/x/mobile/cmd/gomobile@v0.0.0-20260821190718-4776eadac327 + - go install golang.org/x/mobile/cmd/gobind@v0.0.0-20260821190718-4776eadac327 + - gomobile init + - gomobile bind -target=android -androidapi 26 -trimpath -ldflags='-s -w -buildid=' + -o ../app/libs/megaproxy.aar ./mobile + +AutoUpdateMode: Version +UpdateCheckMode: Tags +CurrentVersion: 0.0.4 +CurrentVersionCode: 4 diff --git a/.gitignore b/.gitignore index 847df0e..7be93a8 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,5 @@ local.properties .cxx/ native/*.aar app/libs/*.aar +app/libs/megaproxy-sources.jar +*.idsig diff --git a/README.md b/README.md index ccd09db..eb83054 100644 --- a/README.md +++ b/README.md @@ -103,21 +103,26 @@ vendors may impose additional background-execution restrictions. MegaProxy requires Android 8.0 (API 26) or newer. Download the latest signed build from [GitHub Releases](https://github.com/andre487/AndroidMegaProxy/releases/latest), expand the -**Assets** section, and choose the APK matching the device architecture: +**Assets** section, and download the file ending in `universal.apk`. It is the recommended build: +it supports every architecture listed below and is also the artifact independently rebuilt and +verified for F-Droid distribution. -| APK suffix | Intended device | +**[Download the recommended universal APK](https://github.com/andre487/AndroidMegaProxy/releases/latest/download/mega-proxy-universal.apk)** + +| APK | Intended device | | --- | --- | -| `arm64-v8a` | Almost all modern Android phones and tablets; choose this when unsure | -| `armeabi-v7a` | Older 32-bit ARM devices | -| `x86_64` | 64-bit x86 Android emulators and uncommon x86 devices | -| `x86` | Older 32-bit x86 Android emulators and devices | +| [`mega-proxy-universal.apk`](https://github.com/andre487/AndroidMegaProxy/releases/latest/download/mega-proxy-universal.apk) | Recommended for phones, tablets, and emulators; supports all listed architectures | +| [`mega-proxy-arm64-v8a.apk`](https://github.com/andre487/AndroidMegaProxy/releases/latest/download/mega-proxy-arm64-v8a.apk) | Smaller download for almost all modern Android phones and tablets | +| [`mega-proxy-armeabi-v7a.apk`](https://github.com/andre487/AndroidMegaProxy/releases/latest/download/mega-proxy-armeabi-v7a.apk) | Older 32-bit ARM devices | +| [`mega-proxy-x86_64.apk`](https://github.com/andre487/AndroidMegaProxy/releases/latest/download/mega-proxy-x86_64.apk) | 64-bit x86 Android emulators and uncommon x86 devices | +| [`mega-proxy-x86.apk`](https://github.com/andre487/AndroidMegaProxy/releases/latest/download/mega-proxy-x86.apk) | Older 32-bit x86 Android emulators and devices | ### Install a release APK on the device 1. Open the [latest release](https://github.com/andre487/AndroidMegaProxy/releases/latest) on the Android device. -2. Under **Assets**, download the appropriate APK, normally the file ending in - `arm64-v8a.apk`. +2. Under **Assets**, download the file ending in `universal.apk`. Architecture-specific APKs are + smaller alternatives when the device architecture is known. 3. Open the downloaded file from the browser notification or the system Downloads application. 4. If Android blocks the installation, open the settings offered by the warning and enable **Allow from this source** for the browser or file manager that opened the APK. Return to the @@ -136,10 +141,10 @@ before installation when the distribution channel is not trusted: ```shell # macOS -shasum -a 256 mega-proxy-v0.0.3-arm64-v8a.apk +shasum -a 256 mega-proxy-universal.apk # Linux -sha256sum mega-proxy-v0.0.3-arm64-v8a.apk +sha256sum mega-proxy-universal.apk ``` The printed value must exactly match the corresponding line in `SHA256SUMS`. Substitute the @@ -151,7 +156,7 @@ Alternatively, download the APK to a computer. With USB debugging enabled and th by `adb devices`, install or update MegaProxy with: ```shell -adb install -r mega-proxy-v0.0.3-arm64-v8a.apk +adb install -r mega-proxy-universal.apk ``` Use the APK filename that was actually downloaded. The `-r` option preserves existing application @@ -160,7 +165,8 @@ shows one. ### Update an existing installation -Download the newer APK for the same architecture and install it over the existing application. +Download the newer universal APK and install it over the existing application. An appropriate +architecture-specific APK signed by the project key can also update the same installation. Do not uninstall MegaProxy first: uninstalling removes its profiles, trusted SSH host keys, and other local settings. Android accepts an in-place update only when the application ID and signing key match the installed build. @@ -277,7 +283,8 @@ logging. ### Signed release builds -Build optimized and signed APKs for `arm64-v8a`, `armeabi-v7a`, `x86_64`, and `x86`: +Build optimized and signed APKs for `arm64-v8a`, `armeabi-v7a`, `x86_64`, and `x86`, plus the +universal APK used for reproducible F-Droid verification: ```shell ./scripts/build-release-apks.sh @@ -292,8 +299,8 @@ Pushing a version tag runs the GitHub release workflow, builds and verifies ever the artifacts to a GitHub Release. The tag must match `versionName` exactly: ```shell -git tag v0.0.3 -git push origin v0.0.3 +git tag v0.0.4 +git push origin v0.0.4 ``` ## Contributing diff --git a/app/build.gradle.kts b/app/build.gradle.kts index fa09f16..53f86e3 100644 --- a/app/build.gradle.kts +++ b/app/build.gradle.kts @@ -22,13 +22,14 @@ val gitCommitHash = providers.environmentVariable("GITHUB_SHA") android { namespace = "net.megaproxy487" compileSdk = 35 + buildToolsVersion = "34.0.0" defaultConfig { applicationId = "net.megaproxy487" minSdk = 26 targetSdk = 35 - versionCode = 3 - versionName = "0.0.3" + versionCode = 4 + versionName = "0.0.4" buildConfigField("String", "GIT_COMMIT_HASH", "\"$gitCommitHash\"") testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner" } diff --git a/app/libs/megaproxy-sources.jar b/app/libs/megaproxy-sources.jar deleted file mode 100644 index 4f2a5d7..0000000 Binary files a/app/libs/megaproxy-sources.jar and /dev/null differ diff --git a/docs/ru/installation.md b/docs/ru/installation.md index 5d950e2..4958153 100644 --- a/docs/ru/installation.md +++ b/docs/ru/installation.md @@ -5,26 +5,30 @@ MegaProxy поддерживает Android 8.0 (API 26) и новее. Официальные APK публикуются в разделе [GitHub Releases](https://github.com/andre487/AndroidMegaProxy/releases/latest). +**[Скачать рекомендуемый universal APK](https://github.com/andre487/AndroidMegaProxy/releases/latest/download/mega-proxy-universal.apk)** + ## Выбор APK -Откройте последний релиз, разверните список **Assets** и выберите APK для архитектуры устройства: +Откройте последний релиз, разверните список **Assets** и скачайте файл с окончанием +`universal.apk`. Это основной рекомендуемый вариант: он поддерживает все перечисленные ниже +архитектуры и используется для независимой проверки воспроизводимой сборки в F-Droid. -| Окончание имени APK | Для каких устройств | +| APK | Для каких устройств | | --- | --- | -| `arm64-v8a` | Почти все современные телефоны и планшеты Android; выбирайте этот вариант, если не уверены | -| `armeabi-v7a` | Старые 32-битные устройства ARM | -| `x86_64` | 64-битные устройства Android на x86 | -| `x86` | Старые 32-битные устройства Android на x86 | +| [`mega-proxy-universal.apk`](https://github.com/andre487/AndroidMegaProxy/releases/latest/download/mega-proxy-universal.apk) | Рекомендуется для телефонов, планшетов и эмуляторов; включает все поддерживаемые архитектуры | +| [`mega-proxy-arm64-v8a.apk`](https://github.com/andre487/AndroidMegaProxy/releases/latest/download/mega-proxy-arm64-v8a.apk) | Уменьшенный APK почти для всех современных телефонов и планшетов Android | +| [`mega-proxy-armeabi-v7a.apk`](https://github.com/andre487/AndroidMegaProxy/releases/latest/download/mega-proxy-armeabi-v7a.apk) | Старые 32-битные устройства ARM | +| [`mega-proxy-x86_64.apk`](https://github.com/andre487/AndroidMegaProxy/releases/latest/download/mega-proxy-x86_64.apk) | 64-битные устройства Android на x86 | +| [`mega-proxy-x86.apk`](https://github.com/andre487/AndroidMegaProxy/releases/latest/download/mega-proxy-x86.apk) | Старые 32-битные устройства Android на x86 | -Для современного телефона почти всегда нужен файл, имя которого заканчивается на -`arm64-v8a.apk`. +APK для конкретной архитектуры меньше по размеру, но его стоит выбирать только когда архитектура +устройства точно известна. ## Установка на телефон 1. Откройте на телефоне страницу [последнего релиза MegaProxy](https://github.com/andre487/AndroidMegaProxy/releases/latest). -2. Разверните раздел **Assets** и нажмите на подходящий APK — обычно это файл с окончанием - `arm64-v8a.apk`. +2. Разверните раздел **Assets** и нажмите на файл с окончанием `universal.apk`. 3. Если браузер предупреждает, что APK-файл может быть опасен, убедитесь, что адрес начинается с `https://github.com/andre487/AndroidMegaProxy/`, и подтвердите скачивание. 4. После завершения скачивания откройте файл из уведомления браузера или системного приложения @@ -62,7 +66,7 @@ adb devices Затем установите или обновите приложение: ```shell -adb install -r mega-proxy-v0.0.3-arm64-v8a.apk +adb install -r mega-proxy-universal.apk ``` Укажите фактическое имя скачанного APK. Параметр `-r` устанавливает новую версию поверх текущей и @@ -72,7 +76,8 @@ adb install -r mega-proxy-v0.0.3-arm64-v8a.apk Чтобы обновить MegaProxy: -1. Скачайте APK новой версии с той же архитектурой. +1. Скачайте universal APK новой версии. Подходящий APK для конкретной архитектуры также можно + установить поверх существующей версии. 2. Откройте его на телефоне и подтвердите обновление существующего приложения. 3. Не удаляйте MegaProxy перед обновлением: удаление приложения стирает профили, известные ключи SSH и остальные локальные настройки. diff --git a/fastlane/metadata/android/en-US/changelogs/3.txt b/fastlane/metadata/android/en-US/changelogs/3.txt new file mode 100644 index 0000000..48b54e6 --- /dev/null +++ b/fastlane/metadata/android/en-US/changelogs/3.txt @@ -0,0 +1,3 @@ +Initial F-Droid release. + +Includes HTTPS, SSH, and SSH-with-jump profiles, global and per-app routing, encrypted DNS, configurable client fingerprints, connection diagnostics, failover, and Always-on VPN support. diff --git a/fastlane/metadata/android/en-US/changelogs/4.txt b/fastlane/metadata/android/en-US/changelogs/4.txt new file mode 100644 index 0000000..eeb55fc --- /dev/null +++ b/fastlane/metadata/android/en-US/changelogs/4.txt @@ -0,0 +1,3 @@ +Prepare MegaProxy for verified distribution through F-Droid. + +Add a reproducible universal APK assembled entirely from source, localized store metadata, and graphics for the F-Droid catalog. diff --git a/fastlane/metadata/android/en-US/full_description.txt b/fastlane/metadata/android/en-US/full_description.txt new file mode 100644 index 0000000..69c7ae0 --- /dev/null +++ b/fastlane/metadata/android/en-US/full_description.txt @@ -0,0 +1,22 @@ +

MegaProxy is an open-source Android VPN client for reliable and secure connections through proxy servers you control or trust.

+ +

It contains no advertising, analytics SDKs, tracking identifiers, or remote telemetry. Connection statistics, profiles, and diagnostic logs remain on the device unless you explicitly choose to share them.

+ +

Features include:

+ + + +

MegaProxy does not provide a proxy service. You need an HTTPS, SSH, or SSH-with-jump server that you operate or trust.

+ +

Only TCP application traffic is forwarded. General UDP and QUIC forwarding are not supported.

diff --git a/fastlane/metadata/android/en-US/images/featureGraphic.png b/fastlane/metadata/android/en-US/images/featureGraphic.png new file mode 100644 index 0000000..3574621 Binary files /dev/null and b/fastlane/metadata/android/en-US/images/featureGraphic.png differ diff --git a/fastlane/metadata/android/en-US/images/icon.png b/fastlane/metadata/android/en-US/images/icon.png new file mode 100644 index 0000000..4978f48 Binary files /dev/null and b/fastlane/metadata/android/en-US/images/icon.png differ diff --git a/fastlane/metadata/android/en-US/short_description.txt b/fastlane/metadata/android/en-US/short_description.txt new file mode 100644 index 0000000..9c54f7c --- /dev/null +++ b/fastlane/metadata/android/en-US/short_description.txt @@ -0,0 +1 @@ +Private VPN client for HTTPS and SSH proxy servers you control diff --git a/fastlane/metadata/android/en-US/title.txt b/fastlane/metadata/android/en-US/title.txt new file mode 100644 index 0000000..60af6f0 --- /dev/null +++ b/fastlane/metadata/android/en-US/title.txt @@ -0,0 +1 @@ +MegaProxy diff --git a/fastlane/metadata/android/ru-RU/changelogs/3.txt b/fastlane/metadata/android/ru-RU/changelogs/3.txt new file mode 100644 index 0000000..6419f30 --- /dev/null +++ b/fastlane/metadata/android/ru-RU/changelogs/3.txt @@ -0,0 +1,3 @@ +Первый релиз для F-Droid. + +Поддерживаются профили HTTPS, SSH и SSH с jump host, глобальная и выборочная маршрутизация приложений, шифрованный DNS, настраиваемые профили клиентов, диагностика соединения, failover и Always-on VPN. diff --git a/fastlane/metadata/android/ru-RU/changelogs/4.txt b/fastlane/metadata/android/ru-RU/changelogs/4.txt new file mode 100644 index 0000000..4ae10ad --- /dev/null +++ b/fastlane/metadata/android/ru-RU/changelogs/4.txt @@ -0,0 +1,3 @@ +Подготовлена проверяемая публикация MegaProxy через F-Droid. + +Добавлены воспроизводимый universal APK, полностью собираемый из исходников, локализованные описания и графика для каталога F-Droid. diff --git a/fastlane/metadata/android/ru-RU/full_description.txt b/fastlane/metadata/android/ru-RU/full_description.txt new file mode 100644 index 0000000..f7c939d --- /dev/null +++ b/fastlane/metadata/android/ru-RU/full_description.txt @@ -0,0 +1,22 @@ +

MegaProxy — открытый VPN-клиент для Android, предназначенный для надёжных и безопасных подключений через прокси-серверы, которыми вы управляете или которым доверяете.

+ +

В приложении нет рекламы, аналитических SDK, идентификаторов отслеживания и удалённой телеметрии. Статистика соединения, профили и диагностические журналы остаются на устройстве, пока вы сами не решите ими поделиться.

+ +

Возможности:

+ + + +

MegaProxy не предоставляет прокси-сервис. Для работы нужен HTTPS-, SSH- или SSH-with-jump-сервер, которым вы управляете или которому доверяете.

+ +

Перенаправляется только TCP-трафик приложений. Произвольный UDP- и QUIC-трафик не поддерживается.

diff --git a/fastlane/metadata/android/ru-RU/images/featureGraphic.png b/fastlane/metadata/android/ru-RU/images/featureGraphic.png new file mode 100644 index 0000000..3574621 Binary files /dev/null and b/fastlane/metadata/android/ru-RU/images/featureGraphic.png differ diff --git a/fastlane/metadata/android/ru-RU/images/icon.png b/fastlane/metadata/android/ru-RU/images/icon.png new file mode 100644 index 0000000..4978f48 Binary files /dev/null and b/fastlane/metadata/android/ru-RU/images/icon.png differ diff --git a/fastlane/metadata/android/ru-RU/short_description.txt b/fastlane/metadata/android/ru-RU/short_description.txt new file mode 100644 index 0000000..094c196 --- /dev/null +++ b/fastlane/metadata/android/ru-RU/short_description.txt @@ -0,0 +1 @@ +Приватный VPN-клиент для собственных HTTPS- и SSH-прокси diff --git a/fastlane/metadata/android/ru-RU/title.txt b/fastlane/metadata/android/ru-RU/title.txt new file mode 100644 index 0000000..60af6f0 --- /dev/null +++ b/fastlane/metadata/android/ru-RU/title.txt @@ -0,0 +1 @@ +MegaProxy diff --git a/scripts/build-release-apks.sh b/scripts/build-release-apks.sh index 25ba8a4..b921e4d 100755 --- a/scripts/build-release-apks.sh +++ b/scripts/build-release-apks.sh @@ -15,6 +15,7 @@ fi : "${MEGAPROXY_KEY_PASSWORD_FILE:=$HOME/.my-tokens/android-key-password}" : "${MEGAPROXY_KEY_ALIAS:=key0}" : "${MEGAPROXY_RELEASE_DIR:=$project_dir/dist/release}" +: "${MEGAPROXY_EXPECTED_CERT_SHA256:=8a014a2a558a75b5f900ee0c33cd50f24b7432734912406699fc08866747f822}" export JAVA_HOME ANDROID_HOME ANDROID_NDK_HOME export PATH="$JAVA_HOME/bin:$HOME/go/bin:$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools:$PATH" @@ -62,6 +63,27 @@ if [[ -z "$version_name" ]]; then fi mkdir -p "$MEGAPROXY_RELEASE_DIR" "$project_dir/app/libs" +# Avoid carrying artifacts from an older version into SHA256SUMS or a release. +find "$MEGAPROXY_RELEASE_DIR" -maxdepth 1 -type f \ + \( -name 'mega-proxy-*.apk' -o -name SHA256SUMS \) -delete +apksigner="$ANDROID_HOME/build-tools/34.0.0/apksigner" +if [[ ! -x "$apksigner" ]]; then + echo "Android apksigner 34.0.0 is unavailable: $apksigner" >&2 + exit 1 +fi + +verify_release_apk() { + local apk="$1" + local actual_fingerprint + actual_fingerprint="$( + "$apksigner" verify --verbose --print-certs "$apk" \ + | sed -n 's/^Signer #1 certificate SHA-256 digest: //p' + )" + if [[ "$actual_fingerprint" != "$MEGAPROXY_EXPECTED_CERT_SHA256" ]]; then + echo "Unexpected signing certificate for $apk: $actual_fingerprint" >&2 + exit 1 + fi +} temporary_dir="$(mktemp -d "${TMPDIR:-/tmp}/megaproxy-release.XXXXXX")" original_aar="$project_dir/app/libs/megaproxy.aar" @@ -126,7 +148,7 @@ echo "Running Android unit tests" for target in "${targets[@]}"; do go_arch="${target%%:*}" android_abi="${target##*:}" - output_apk="$MEGAPROXY_RELEASE_DIR/mega-proxy-v${version_name}-${android_abi}.apk" + output_apk="$MEGAPROXY_RELEASE_DIR/mega-proxy-${android_abi}.apk" if [[ "$android_abi" == "$first_android_abi" ]]; then echo "Reusing initial native AAR for $android_abi" @@ -160,17 +182,39 @@ for target in "${targets[@]}"; do fi cp "$built_apk" "$output_apk" - apksigner="$ANDROID_HOME/build-tools/35.0.0/apksigner" - if [[ ! -x "$apksigner" ]]; then - apksigner="$(find "$ANDROID_HOME/build-tools" -type f -name apksigner -perm -u+x | sort -V | tail -n 1)" - fi - if [[ -z "$apksigner" || ! -x "$apksigner" ]]; then - echo "Android apksigner is unavailable" >&2 - exit 1 - fi - "$apksigner" verify --verbose --print-certs "$output_apk" >/dev/null + verify_release_apk "$output_apk" done +# F-Droid verifies this universal APK against a clean source build before +# publishing it with the upstream signature. Keep its gomobile and Gradle +# inputs identical to the F-Droid recipe in .fdroid.yml. +echo "Building optimized native AAR for the universal APK" +( + cd "$project_dir/native" + gomobile bind \ + -target=android \ + -androidapi 26 \ + -trimpath \ + -ldflags="-s -w -buildid=" \ + -o ../app/libs/megaproxy.aar \ + ./mobile +) + +echo "Building and signing universal APK" +( + cd "$project_dir" + ./gradlew clean + ./gradlew assembleRelease +) +universal_apk="$MEGAPROXY_RELEASE_DIR/mega-proxy-universal.apk" +built_apk="$project_dir/app/build/outputs/apk/release/app-release.apk" +if [[ ! -f "$built_apk" ]]; then + echo "Gradle did not produce the expected APK: $built_apk" >&2 + exit 1 +fi +cp "$built_apk" "$universal_apk" +verify_release_apk "$universal_apk" + ( cd "$MEGAPROXY_RELEASE_DIR" shasum -a 256 ./*.apk > SHA256SUMS