From 26aade466e9d45c350e4590bff1e38ae16a882ee Mon Sep 17 00:00:00 2001 From: TheCryptoDonkey Date: Tue, 27 Oct 2026 08:28:55 +0000 Subject: [PATCH] chore: prepare Android 0.6.119 recording playback --- CHANGELOG.md | 6 ++++++ app/build.gradle.kts | 4 ++-- docs/android-release.md | 18 ++++++++++++++++++ 3 files changed, 26 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9b2b0278..43682290 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,9 @@ +## 0.6.119 — 27 October 2026 + +- Play audio and video attachments in a dedicated process, containing media-player crashes away from the room screen. +- Keep authenticated recording bytes in bounded, read-only shared memory and retain explicit play, pause, seek and background-pause controls. +- This is same-UID crash containment, not a separate security identity. Physical GrapheneOS playback and lifecycle acceptance remains outstanding. + ## 0.6.116 — 26 October 2026 - Restore bundled on-device background segmentation: keep the person visible diff --git a/app/build.gradle.kts b/app/build.gradle.kts index a26eb94b..3a475652 100644 --- a/app/build.gradle.kts +++ b/app/build.gradle.kts @@ -98,8 +98,8 @@ android { minSdk = 33 targetSdk = 35 // Remain newer than the 0.6.3 rendezvous candidate (code 26). - versionCode = 140 - versionName = "0.6.117" + versionCode = 142 + versionName = "0.6.119" buildConfigField("String", "ACCOUNT_NETWORK_DEFAULT", "\"$accountNetworkDefault\"") buildConfigField("String", "INVITATION_PROFILE", "\"$invitationProfile\"") diff --git a/docs/android-release.md b/docs/android-release.md index 0ac7a4f2..fd3b55bc 100644 --- a/docs/android-release.md +++ b/docs/android-release.md @@ -1,3 +1,21 @@ +## 0.6.119 (142): contain recording playback in a dedicated process + +Authenticated audio and video attachments now play through Android `MediaPlayer` +in a non-exported, dedicated same-UID process. The room process retains only the +Compose controls and a `SurfaceView`; bounded plaintext crosses through sealed, +read-only shared memory. This contains media-client failures but is not an +isolated-UID confidentiality or privilege boundary: platform media services +perform demuxing and decoding. The security trade-off is recorded in +`docs/attachment-safety.md`. + +PR #344 passed all 17 hosted jobs after an Android 13 emulator install failure +was rerun. Recording coverage includes preparation without autoplay, explicit +play and pause, corrupt/truncated input, recipient UI playback and minified-release +signing-lineage checks on Android 13 and 15. The versioned candidate has separate +hosted CI, production signing and publication gates. Physical GrapheneOS audible +output, video, seeking, accessibility, memory pressure, process death, active-call +behaviour and physical upgrade/readback remain required. + ## 0.6.117 (140): explicit account authentication for room relays An AUTH-only relay can allow a person's account while their KithMoot room