makiolaj
ba48a9821c
Renewed pins can be re-trusted via sign in again, discovery keeps walking past an untrusted SRV target, trust is bound to the address it was given for, reauth replaces old pins, and the trust save is covered by rollback.
38 lines
1.8 KiB
XML
38 lines
1.8 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
Since Android 7 a user who correctly installs their private CA into the
|
|
system store is *still* not trusted by apps — user CAs are excluded from the
|
|
default trust anchors. That breaks exactly the self-hosting audience this app
|
|
is for, so they are added back here.
|
|
|
|
Cleartext is permitted here and gated in code instead, per account: every
|
|
client CalDavHttp builds leaves ConnectionSpec.CLEARTEXT out unless the user
|
|
opted that account into plain http behind an explicit warning, so OkHttp
|
|
itself refuses an http:// URL for everyone else. This file cannot express a
|
|
per-account choice, only a per-host one, and the hosts are the user's.
|
|
|
|
⚠️ That makes CalDavHttp the only gate. A client built any other way would
|
|
speak http silently, so HttpClientConstructionTest fails the build on one.
|
|
|
|
⚠️ KNOWN TRADE-OFF, and it is the widest form of this. base-config applies to
|
|
*all* traffic, so any CA in the user store — a corporate MDM profile, a "free
|
|
VPN" app's certificate, one installed during some earlier debugging — can
|
|
transparently intercept the CalDAV connection and read the app password out
|
|
of the Authorization header. Without this file
|
|
a correctly installed private CA is simply not trusted, which is the
|
|
self-hosting case the app exists to serve.
|
|
|
|
The narrower posture is cert4android's: trust nothing extra by default, and
|
|
ask the user per connection via its bound service + notification. That is
|
|
what should replace this block rather than
|
|
sit alongside it.
|
|
-->
|
|
<network-security-config>
|
|
<base-config cleartextTrafficPermitted="true">
|
|
<trust-anchors>
|
|
<certificates src="system" />
|
|
<certificates src="user" />
|
|
</trust-anchors>
|
|
</base-config>
|
|
</network-security-config>
|