RobotAutomationDevelopment-Dept/Ubisam-MobileGit

choiminyeong 69556b1e23 TASK-066: download page and in-app update check

- version 0.2.0 (versionCode 2)
- The app reads version.json from the download page once at launch and
  offers the page when a newer build is out; settings shows the version
  and a check button.
- tools/publish-download.py encrypts an APK under the download password
  and writes the page that decrypts it in the browser.

Agent: main (opus)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-07 20:52:45 +09:00

2.0 KiB

Raw Blame History

TASK-066: download page and in-app update check

Status: done Owner: Claude Reviewer: human product owner

Request

The human product owner asked for a web link to download the app, protected by a download password they chose, and for the app to offer the newest version when it is not on it. They chose to host it in a folder of the existing choimy0204.github.io site.

Acceptance criteria

https://choimy0204.github.io/ubgitea/ serves a page that asks for the password and only then gives the APK. The APK on the host is encrypted (AES-256-GCM, key from PBKDF2-SHA256), so its address alone gives nothing. The password is not in this repository.
version.json beside it names the newest versionCode, versionName and notes.
The app reads it once at launch; when it is newer than the installed build, a dialog offers the download page. Settings shows the installed version, a check button, and the download page when something newer is out. No Gitea token is sent to that host.
tools/publish-download.py builds the page from an APK; versionCode is raised for every build published.

Writable paths

app/build.gradle.kts, app/src/main/java/com/ubisam/ubgitea/core/update/, MainActivity.kt, feature/settings/SettingsScreen.kt, res/values/strings_update.xml, app/src/test/.../core/update/, tools/publish-download.py, docs/development-log.md, this file.

Checks

./gradlew compileDebugKotlin compileDebugUnitTestKotlin testDebugUnitTest assembleDebug lintDebug

Evidence

2026-10-07: the required checks pass; 468 unit tests, 0 failures; lint 0 errors.
The page's decryption was run with Node's WebCrypto (the browser's API): the right password gives a file byte-identical to app-debug.apk, a wrong one is refused.
Published version 0.2.0 (versionCode 2), the debug build, to choimy0204.github.io/ubgitea/.
Not seen: the page opened on a phone, the install over an existing copy, the in-app dialog.

Review findings

None yet.

2.0 KiB Raw Blame History