Jean-Luc Makiolaandmakiolaj
dd08c035df
Renovate / renovate (push) Successful in 54s
Release — F-Droid repo + Gitea/Codeberg release + Play / detect (push) Successful in 6s
Release — F-Droid repo + Gitea/Codeberg release + Play / release (push) Successful in 21m44s
Release — F-Droid repo + Gitea/Codeberg release + Play / play (push) Successful in 1m32s
Agendula 1.1.0. Merging this triggers the release pipeline (F-Droid, Codeberg, Play) and mints the v1.1.0 tag. - Tags, synced as CATEGORIES (#35) - Saved filters, also usable in the Tasks widget (#47) - Offline flavor without sync or network, published to Codeberg only (#39) - New Today, Up next, Lists and Week widgets; widgets can show several lists - Synced lists can be renamed and deleted - All-day tasks no longer land a day off west of UTC in smart lists and filters versionName 1.1.0 / versionCode 1010099. CHANGELOG has the 1.1.0 section, and What's New is written for en-US, en-GB, de-DE, pt-BR, plus new fr-FR and ar. After the tag lands, fdroiddata!49998 needs a 1.1.0 build entry with gradle: full. Closes #35, closes #39, closes #47 Co-authored-by: Jean-Luc Makiola <business@jeanlucmakiola.de> Reviewed-on: https://codeberg.org/jlmakiola/agendula/pulls/51
35 lines
1.7 KiB
XML
35 lines
1.7 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
Since Android 7 a user who correctly installs their private CA into the
|
|
system store is *still* not trusted by apps — user CAs are excluded from the
|
|
default trust anchors. That breaks exactly the self-hosting audience this app
|
|
is for, so they are added back here.
|
|
|
|
Cleartext stays off. It has been the default since API 28, and CalDavDiscovery
|
|
refuses a typed http:// address for the same reason: credentials are never
|
|
sent over an unencrypted connection. Any escape hatch has to be a narrow,
|
|
warned, per-account opt-in — Play's User Data policy requires modern
|
|
cryptography in transit — and this file is not the place for it.
|
|
|
|
⚠️ KNOWN TRADE-OFF, and it is the widest form of this. base-config applies to
|
|
*all* traffic, so any CA in the user store — a corporate MDM profile, a "free
|
|
VPN" app's certificate, one installed during some earlier debugging — can
|
|
transparently intercept the CalDAV connection and read the app password out
|
|
of the Authorization header. Without this file
|
|
a correctly installed private CA is simply not trusted, which is the
|
|
self-hosting case the app exists to serve.
|
|
|
|
The narrower posture is cert4android's: trust nothing extra by default, and
|
|
ask the user per connection via its bound service + notification. That is
|
|
what should replace this block rather than
|
|
sit alongside it.
|
|
-->
|
|
<network-security-config>
|
|
<base-config cleartextTrafficPermitted="false">
|
|
<trust-anchors>
|
|
<certificates src="system" />
|
|
<certificates src="user" />
|
|
</trust-anchors>
|
|
</base-config>
|
|
</network-security-config>
|