Sterister
188c3db56a
Pure-JVM additions to shade-android (no Android SDK needed): - V4.9 blob primitives: BlobKdf (HKDF deriveBlobSlotId/Key/SigningSeed), BlobAead (nonce||ct||tag with shade-profile-aad-v1:<slot> AAD), BlobClient (java.net.http with hand-written canonical JSON signing matching TS signPayload output), Profile high-level namespace. - V4.10 approval helpers: CanonicalProfileBlob schema with denormalized trustedApproverFingerprints, build/sign/verify proxy approvals via length-prefixed u16 BE UTF-8 canonical signing payload. - Password KDFs: scrypt + argon2id via Bouncy Castle, NFKC-normalized. - SessionStateJson at-rest serializer for persistence layer. Cross-platform vectors (test-vectors/blob.json, approval.json) gate byte-identical output between TS and Kotlin, including a TS-signed Ed25519 signature the Kotlin port verifies and reproduces (Ed25519 is deterministic). New shade-android-keystore sibling Gradle module (Android-specific): - KeystoreMasterKey: hardware-backed AES-256-GCM with BIOMETRIC_STRONG gating, StrongBox-backed when available, invalidated on enrollment. - BiometricUnlock: coroutine wrapper around BiometricPrompt with tagged cancellation/failure exceptions. - KeystoreStorage: StorageProvider over biometric-gated AES-encrypted SharedPreferences with AAD-bound row keys. All 25 SDK packages typecheck clean; 104 SDK tests + 24 new Kotlin tests + 11 cross-platform vector tests all green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
57 lines
1.9 KiB
Kotlin
57 lines
1.9 KiB
Kotlin
plugins {
|
|
kotlin("jvm")
|
|
`java-library`
|
|
}
|
|
|
|
// V3.5 — Cross-platform parity gate.
|
|
//
|
|
// This module compiles as a pure-JVM Kotlin library so CI can run the
|
|
// cross-platform vector tests without an Android SDK. The protocol code
|
|
// is JVM-safe (no `android.*` imports); only Tink + java.* are used.
|
|
//
|
|
// When KeystoreStorage and EncryptedSharedPreferences-backed adapters land
|
|
// (M-Cross 4 + V3.5 §Storage), they will live in a sibling Android Library
|
|
// module that depends on this one.
|
|
|
|
java {
|
|
sourceCompatibility = JavaVersion.VERSION_17
|
|
targetCompatibility = JavaVersion.VERSION_17
|
|
}
|
|
|
|
kotlin {
|
|
compilerOptions {
|
|
jvmTarget.set(org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_17)
|
|
}
|
|
}
|
|
|
|
dependencies {
|
|
// Google Tink for X25519, Ed25519, AES-GCM, HMAC, HKDF (JVM build).
|
|
// The same `subtle.*` API as `tink-android` so the source compiles unchanged.
|
|
implementation("com.google.crypto.tink:tink:1.15.0")
|
|
|
|
// Bouncy Castle for scrypt + argon2id. Tink doesn't ship password
|
|
// KDFs; @shade/storage-encrypted uses @noble/hashes for both. We
|
|
// pin to the JDK18-on artifact so it works on JVM 17 + Android.
|
|
implementation("org.bouncycastle:bcprov-jdk18on:1.78.1")
|
|
|
|
// JSON serialization (session state + test-vector loader on JVM).
|
|
implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.7.3")
|
|
|
|
// Coroutines (StorageProvider uses `suspend` functions).
|
|
implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.9.0")
|
|
|
|
// org.json — bundled with Android but not present on the JVM classpath.
|
|
implementation("org.json:json:20240303")
|
|
|
|
testImplementation("junit:junit:4.13.2")
|
|
testImplementation("org.jetbrains.kotlinx:kotlinx-coroutines-test:1.9.0")
|
|
}
|
|
|
|
tasks.withType<Test>().configureEach {
|
|
useJUnit()
|
|
testLogging {
|
|
events("passed", "failed", "skipped")
|
|
showStandardStreams = false
|
|
}
|
|
}
|