Conscrypt Provider app, which can be included from other applications (WIP)

Overview

Conscrypt Provider is an APK which can provide the Conscrypt Library to apps that support older Android devices. The Conscrypt Library provides modern TLS capabilities and ciphers, including TLS 1.3.
I have wrapped it in a standalone APK because not all users will need it, and because the library is quite large.

Users will need to install the APK, and app developers will need to add code to their apps to make use of this provider.

Instructions for users

Download the app from F-Droid or go to the releases. Download the .apk file and install it.

(Optional) It's always a good idea to verify downloads (the method below only works with apk from the release section). First get my PGP public key

gpg --recv-key 6989CF77490369CFFDCBCD8995E7D75C76CBE9A9

You can verify the APK signature using:

gpg --verify ~/Downloads/conscrypt-provider-1.apk.asc

You can verify the APK checksum using:

sha256sum -c ~/Downloads/conscrypt-provider-1.apk.SHA256

Instructions for developers

In the app startup code, you can look for the APK being installed, and if it is, include it.

First, get your helper methods ready

public static String getPackageSignature(String targetPackage, Context context) throws PackageManager.NameNotFoundException, CertificateException, NoSuchAlgorithmException {
    Signature sig = context.getPackageManager().getPackageInfo(targetPackage, PackageManager.GET_SIGNATURES).signatures[0];
    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    X509Certificate cert = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(sig.toByteArray()));
    String hexString = null;
    MessageDigest md = MessageDigest.getInstance("SHA1");
    byte[] publicKey = md.digest(cert.getEncoded());
    hexString = byte2HexFormatted(publicKey);
    return hexString;
}

static String byte2HexFormatted(byte[] arr) {
    StringBuilder str = new StringBuilder(arr.length * 2);
    for (int i = 0; i < arr.length; i++) {
        String h = Integer.toHexString(arr[i]);
        int l = h.length();
        if (l == 1) h = "0" + h;
        if (l > 2) h = h.substring(l - 2, l);
        str.append(h.toUpperCase());
        if (i < (arr.length - 1)) str.append(':');
    }
    return str.toString();
}

Then early in the application lifecycle, do this:

// You should probably check if com.mendhak.conscryptprovider is installed first. 
// https://stackoverflow.com/q/6758841/974369
// Then:
try {
    //Get signature to compare - either Github or F-Droid versions
    String signature = getPackageSignature("com.mendhak.conscryptprovider", context);
    if (
            signature.equalsIgnoreCase("C7:90:8D:17:33:76:1D:F3:CD:EB:56:67:16:C8:00:B5:AF:C5:57:DB")
            || signature.equalsIgnoreCase("05:F2:E6:59:28:08:89:81:B3:17:FC:9A:6D:BF:E0:4B:0F:A1:3B:4E")
    ) {
        signatureMatch = true;
    }
    else {
        Log.e("com.mendhak.conscryptprovider found, but with an invalid signature. Ignoring.");
        return;
    }

    //https://gist.github.com/ByteHamster/f488f9993eeb6679c2b5f0180615d518
    Context targetContext = context.createPackageContext("com.mendhak.conscryptprovider",
            Context.CONTEXT_INCLUDE_CODE | Context.CONTEXT_IGNORE_SECURITY);
    ClassLoader classLoader = targetContext.getClassLoader();
    Class installClass = classLoader.loadClass("com.mendhak.conscryptprovider.ConscryptProvider");
    Method installMethod = installClass.getMethod("install", new Class[]{});
    installMethod.invoke(null);
    installed = true;
    Log.i("Conscrypt Provider installed");
} catch (Exception e) {
    Log.e("Could not install Conscrypt Provider", e);
}

Of course within the app, you'll also need to provide instructions for users to install the APK.

Motivation

I want to provide TLS 1.3 to pre-Android-10 users in my app, without having to rely on closed source libraries.
The simplest way to do this is to include the Conscrypt library.

However, this library is massive, it adds about 5+MB to the APK size.
And it isn't needed for Android 10+ users.

The next simplest way to deal with this situation is to make the Conscrypt provider a separate app, and reference it from my application.

This repository contains the code for the 'Conscrypt Provider'.
It can probably be used by any application though.

References

I have made use of the F-Droid blog post and an associated gist.

This isn't the best or perfect way to provide Conscrypt to applications, but it's a way that works for me.

App Icon by Flaticon.com

You might also like...
An android app to browse KDE Store and other Linux Desktop Environment stores of Pling
An android app to browse KDE Store and other Linux Desktop Environment stores of Pling

A free and open source android application for browsing KDE Store and other Linux Desktop Environment's Stores in Pling. Couldn't check it in different devices so there could be some bugs. Bug Report and Feedbacks are highly appreciated.

A sample app illustrating Android development using Kotlin with MVVM architecture, Android Jetpack, and other commonly used libraries.

Anime Facts A sample app illustrating Android development using Kotlin with MVVM architecture, Android Jetpack, and other commonly used libraries. Ani

This Android app shows bus connections from Koleje Strahov station to Dejvická station and the other way in the city of Prague
This Android app shows bus connections from Koleje Strahov station to Dejvická station and the other way in the city of Prague

This Android app shows bus connections from Koleje Strahov station to Dejvická station and the other way in the city of Prague. These are important for many students from the Czech Technical University in Prague.

KeyCip - an Android app that allows users to encrypt, decrypt and sign text, photos, videos and other files
KeyCip - an Android app that allows users to encrypt, decrypt and sign text, photos, videos and other files

KeyCip is an Android app that allows users to encrypt, decrypt and sign text, photos, videos and other files. To accomplish this goal, it relie

This app aims at helping people keep track of their job applications, and remind them regularly about the same.
This app aims at helping people keep track of their job applications, and remind them regularly about the same.

Applications Tracker Lately I have been applying for many roles, and it has become a hard task to keep track of all the applications. Spreadsheets are

 Detect-My-Mask: An android app which runs along with a TensorLite ML Model which detect whether a person is wearing mask or not.
Detect-My-Mask: An android app which runs along with a TensorLite ML Model which detect whether a person is wearing mask or not.

Detect-My-Mask About : Detect My Mask is an Android Application which is powered by a TensorLite ML Model which is programmed and trained to detect wh

An android library through which users can add a customized loading dialog box with Lottie Animations.
An android library through which users can add a customized loading dialog box with Lottie Animations.

CustomLottieDialogBox About CustomLottieDialogBox is an android library which facilitate developers to add customized loading Dialog-Boxes to their an

A minimalistic Face Recognition module which can be easily incorporated in any Android project.
A minimalistic Face Recognition module which can be easily incorporated in any Android project.

Real Time Face Recognition with TfLite A minimalistic Face Recognition module which can be easily incorporated in any Android project. Key Features Fa

A news application through which you can learn and browse all the news that interests you by choosing the country and type of news with the ability to browse and add some news to your favorites
A news application through which you can learn and browse all the news that interests you by choosing the country and type of news with the ability to browse and add some news to your favorites

MY-NEWS-Android A news application through which you can learn and browse all the news that interests you by choosing the country and type of news wit

Comments
  • Update README.md

    Update README.md

    Hi,

    This small PR adds a link to get your app on F-Droid 👍

    You can now eventually add the fdroid and/or f-droid tags that will appear on the right side of the repo.

    opened by Poussinou 1
Releases(v1)
Owner
mendhak
mendhak
Allows usage of vCard resources with the Android contacts provider

vcard4android vcard4android is an Android library that brings together VCard and Android. It's a framework for parsing and generating VCard resources

bitfire web engineering 7 Dec 15, 2022
Media Provider Manager - An Xposed module intended to prevent media storage abuse

Media Provider Manager - An Xposed module intended to prevent media storage abuse

null 104 Dec 26, 2022
A sample Android app which showcases advanced usage of Dagger among other open source libraries.

U+2020 A sample Android app which showcases advanced usage of Dagger among other open source libraries. Watch the corresponding talk or view the slide

Jake Wharton 5.7k Dec 27, 2022
StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.

StaCoAn Not maintained anymore! Will be archived soon. StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers pe

Vincent Cox 769 Dec 31, 2022
Sunlight Apk - Sunlight App where You can decide Your Mood and Relative suggestions of what you can do will be displayed

Sunlight_Apk This Is a App where You can decide Your Mood and Relative suggestio

Jadu 1 Feb 5, 2022
Source code of JekyllEx Android App which can manage your Jekyll blog directly from your Android device!

JekyllEx Android App Built with ❤︎ by Gourav Khunger ?? Introduction JekyllEx is an Android App that allows you to manage a Jekyll Blog directly from

JekyllEx 24 Nov 8, 2022
An app which displays questions from Stack Exchange from it's api. Can search questions with tags as well. Uses MVVM architecture, dependency injection, coroutines, retrofit2 for network calls

Stack Exchange app What the app does? Shows a list of trending questions from stack exchange api Can search for the desires question. Can add tags to

null 0 Apr 27, 2022
Note-Taking-App - Android application which can be used to take notes

Android application which can be used to take notes.The application uses Recycle

Utkarsh Panwar 0 Jan 30, 2022
An android app written in Kotlin Programming language which a user can use to store his/her monthly expenditure.

#Expenditure-Tracker An android app that allows the user to input , edit , view his/her expenditures for each month. Languages Used - Kotlin UI develo

Priyansh Agarwal 2 Aug 21, 2022
This is an android app using which users can chat to people nearby them with help of Bluetooth.

This is an android app using which users can chat to people nearby them with help of Bluetooth. This app is developed in Kotlin programming language. It is still in its early stages of development and currently let user to one-person-one-time chat at a time. It is under heavy development ????

Shalu Ambasta 4 Sep 28, 2022