Skip to content
Merged
Show file tree
Hide file tree
Changes from 42 commits
Commits
Show all changes
46 commits
Select commit Hold shift + click to select a range
a50f6e4
update CI
remicolin Aug 20, 2025
ed4aff6
bump iOS version
remicolin Aug 20, 2025
b811ab9
update readme
remicolin Aug 20, 2025
568908e
update mobile-deploy ci
remicolin Aug 20, 2025
2536db7
bump version iOS
remicolin Aug 20, 2025
53b8790
update workflow to use workload identity federation (#933)
pputman-clabs Aug 21, 2025
4d956b1
update ci
remicolin Aug 21, 2025
cd3671e
update ci
remicolin Aug 21, 2025
ef87c2a
update ci
remicolin Aug 21, 2025
130f192
update ci
remicolin Aug 21, 2025
ffc482b
update ci
remicolin Aug 21, 2025
7ffd52b
fix ci
remicolin Aug 22, 2025
76c08e2
fix ci
remicolin Aug 22, 2025
d17f1c2
fix ci
remicolin Aug 22, 2025
9dae851
remove fastlane use for android
remicolin Aug 22, 2025
82c57a6
bump iOS build version
remicolin Aug 22, 2025
3156c3a
update CI python script
remicolin Aug 22, 2025
865af1f
iterate on CI
remicolin Aug 22, 2025
353b57d
iterate on CI
remicolin Aug 22, 2025
462c8c5
iterate on CI
remicolin Aug 22, 2025
46041fd
Dev (#941)
remicolin Aug 25, 2025
3af32f5
bump version
remicolin Aug 25, 2025
867f23a
bump yarn.lock
remicolin Aug 25, 2025
1488979
update ci (#966)
remicolin Aug 28, 2025
fb586af
chore: Manually bump and release v2.6.4 (#961)
transphorm Aug 28, 2025
3796823
fix cold start of the app with deeplink
remicolin Aug 22, 2025
4e49d53
update ci
remicolin Aug 28, 2025
779f865
update ci
remicolin Aug 28, 2025
265fec6
Sync MARKETING_VERSION to iOS project files after version bump
remicolin Aug 28, 2025
37fab14
chore: incrementing android build version for version 2.6.4 [github a…
github-actions[bot] Aug 28, 2025
fdfa109
chore: add build dependencies step for iOS and Android in mobile depl…
remicolin Aug 28, 2025
e84dea8
chore: enhance mobile deploy workflow by adding CMake installation step
remicolin Aug 29, 2025
46de8cd
bump android build version
remicolin Aug 29, 2025
99490be
chore: incrementing android build version for version 2.6.4 [github a…
github-actions[bot] Aug 29, 2025
60fc1f2
chore: configure Metro bundler for production compatibility in mobile…
remicolin Aug 29, 2025
f4dadcb
Merge branch 'staging' of https://github.com/selfxyz/self into staging
remicolin Aug 29, 2025
4e53f2a
chore: incrementing android build version for version 2.6.4 [github a…
github-actions[bot] Aug 29, 2025
e208477
Revert "chore: configure Metro bundler for production compatibility i…
remicolin Aug 29, 2025
81db85f
reduce max old space size in mobile-deploy ci
remicolin Aug 29, 2025
85711e0
fix android french id card (#957)
remicolin Aug 29, 2025
3627364
unblock ci
transphorm Sep 7, 2025
2c0087f
Merge branch 'dev' into justin/update-dev-with-staging-09-06-25
transphorm Sep 7, 2025
33e9d1e
fix merge
transphorm Sep 7, 2025
32fff12
merge fixes
transphorm Sep 7, 2025
d0a24cb
fix tests
transphorm Sep 7, 2025
ee5419c
make ci happy
transphorm Sep 7, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .coderabbit.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ reviews:
auto_review:
enabled: true
drafts: false
base_branches: ["main", "dev"]
base_branches: ["main", "dev", "staging"]
tools:
github-checks:
timeout_ms: 300000
Expand Down
8 changes: 2 additions & 6 deletions .github/workflows/circuits-build.yml
Original file line number Diff line number Diff line change
@@ -1,13 +1,9 @@
name: Circuits Build
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@remicolin migrated your changes over

on:
push:
branches:
- main
paths:
- "circuits/circuits/**"
- ".github/workflows/artifacts.yml"
pull_request:
branches:
- dev
- staging
- main
paths:
- "circuits/circuits/**"
Expand Down
11 changes: 1 addition & 10 deletions .github/workflows/circuits.yml
Original file line number Diff line number Diff line change
@@ -1,21 +1,12 @@
name: Circuits CI
on:
push:
branches:
- dev
- main
- openpassportv2
paths:
- "circuits/**"
- "common/**"
pull_request:
branches:
- dev
- staging
- main
- openpassportv2
paths:
- "circuits/**"
- "common/**"
jobs:
run_circuit_tests:
if: github.event.pull_request.draft == false
Expand Down
8 changes: 1 addition & 7 deletions .github/workflows/contracts.yml
Original file line number Diff line number Diff line change
@@ -1,15 +1,9 @@
name: Contracts CI
on:
push:
branches:
- dev
- main
paths:
- "contracts/**"
- "common/**"
pull_request:
branches:
- dev
- staging
- main
paths:
- "contracts/**"
Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/mobile-ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,11 @@ env:
GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.workers.max=4 -Dorg.gradle.parallel=true -Dorg.gradle.configureondemand=true -Dorg.gradle.caching=true
CI: true
on:
push:
pull_request:
branches:
- dev
- staging
- main
paths:
- "common/**"
- "app/**"
Expand Down
328 changes: 217 additions & 111 deletions .github/workflows/mobile-deploy.yml

Large diffs are not rendered by default.

9 changes: 4 additions & 5 deletions .github/workflows/mobile-e2e.yml
Original file line number Diff line number Diff line change
Expand Up @@ -17,12 +17,11 @@ env:
MAESTRO_VERSION: 1.41.0

on:
push:
branches: [main, release/**]
paths:
- "app/**"
- ".github/workflows/mobile-e2e.yml"
pull_request:
branches:
- dev
- staging
- main
paths:
- "app/**"
- ".github/workflows/mobile-e2e.yml"
Expand Down
9 changes: 4 additions & 5 deletions .github/workflows/qrcode-sdk-ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -10,16 +10,15 @@ env:

on:
pull_request:
branches:
- dev
- staging
- main
paths:
- "sdk/qrcode/**"
- "common/**"
- ".github/workflows/qrcode-sdk-ci.yml"
- ".github/actions/**"
push:
branches: [main, develop]
paths:
- "sdk/qrcode/**"
- "common/**"

jobs:
# Build dependencies once and cache for other jobs
Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/web.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,11 @@
name: Web CI

on:
push:
pull_request:
branches:
- dev
- staging
- main
paths:
- "app/**"
- ".github/workflows/web.yml"
Expand Down
2 changes: 2 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,8 @@ These guides provide comprehensive context for AI-assisted development with Chat

We are actively looking for contributors. Please check the [open issues](https://github.com/selfxyz/self/issues) if you don't know were to start! We offer bounties for significant contributions.

> **Important:** Please open your pull request from the `staging` branch. Pull requests from other branches will be automatically closed.
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

opening from staging makes sense 👍


## Contact us

[Contact us](https://t.me/selfprotocolbuilder) on telegram for feedback or questions.
Expand Down
2 changes: 1 addition & 1 deletion app/android/app/build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ android {
applicationId "com.proofofpassportapp"
minSdkVersion rootProject.ext.minSdkVersion
targetSdkVersion rootProject.ext.targetSdkVersion
versionCode 85
versionCode 90
versionName "2.6.4"
manifestPlaceholders = [appAuthRedirectScheme: 'com.proofofpassportapp']
Comment on lines +124 to 126
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Android versionCode likely out of sync with app/version.json.

AI summary indicates version.json Android build moved to 96, but Gradle uses 90. This can break Play uploads (non-monotonic versionCode).

Run to confirm and align:

#!/bin/bash
set -euo pipefail
echo "Gradle versionCode:"
rg -nP '^\s*versionCode\s+(\d+)' app/android/app/build.gradle

echo "version.json Android buildCode:"
jq '.android.buildCode' app/version.json

echo "If mismatched, update app/android/app/build.gradle versionCode to match version.json (or vice versa) and ensure monotonic increments."
🤖 Prompt for AI Agents
In app/android/app/build.gradle around lines 124 to 126, versionCode is set to
90 while app/version.json indicates android.buildCode has been moved to 96;
update the versionCode value in build.gradle to match the version.json (set
versionCode to 96) or reconcile the source of truth so they align, and ensure
the final value is a monotonic increment relative to previous Play Store
uploads.

externalNativeBuild {
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,114 @@
package io.tradle.nfc
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@seshanthS migrating this over to dev


import net.sf.scuba.smartcards.APDUEvent
import net.sf.scuba.smartcards.APDUListener
import net.sf.scuba.smartcards.CommandAPDU
import net.sf.scuba.smartcards.ResponseAPDU
import org.jmrtd.WrappedAPDUEvent
import android.util.Log

class APDULogger : APDUListener {

private var moduleReference: RNPassportReaderModule? = null

private val sessionContext = mutableMapOf<String, Any>()

fun setModuleReference(module: RNPassportReaderModule) {
moduleReference = module
}

fun setContext(key: String, value: Any) {
sessionContext[key] = value
}

fun clearContext() {
sessionContext.clear()
}

override fun exchangedAPDU(event: APDUEvent) {
try {
val entry = createLogEntry(event)

logToAnalytics(entry)

} catch (e: Exception) {
Log.e("APDULogger", "Error exchanging APDU", e)
}
}

private fun createLogEntry(event: APDUEvent): APDULogEntry {
val command = event.commandAPDU
val response = event.responseAPDU
val timestamp = System.currentTimeMillis()

val entry = APDULogEntry(
timestamp = timestamp,
commandHex = command.bytes.toHexString(),
responseHex = response.bytes.toHexString(),
statusWord = response.sw,
statusWordHex = "0x${response.sw.toString(16).uppercase().padStart(4, '0')}",
commandLength = command.bytes.size,
responseLength = response.bytes.size,
dataLength = response.data.size,
isWrapped = event is WrappedAPDUEvent,
plainCommandHex = if (event is WrappedAPDUEvent) event.plainTextCommandAPDU.bytes.toHexString() else null,
plainResponseHex = if (event is WrappedAPDUEvent) event.plainTextResponseAPDU.bytes.toHexString() else null,
plainCommandLength = if (event is WrappedAPDUEvent) event.plainTextCommandAPDU.bytes.size else null,
plainResponseLength = if (event is WrappedAPDUEvent) event.plainTextResponseAPDU.bytes.size else null,
plainDataLength = if (event is WrappedAPDUEvent) event.plainTextResponseAPDU.data.size else null,
context = sessionContext.toMap()
)

return entry
}

private fun ByteArray.toHexString(): String {
return joinToString("") { "%02X".format(it) }
}

private fun logToAnalytics(entry: APDULogEntry) {
try {
val params = mutableMapOf<String, Any>().apply {
put("timestamp", entry.timestamp)
put("command_hex", entry.commandHex)
put("response_hex", entry.responseHex)
put("status_word", entry.statusWord)
put("status_word_hex", entry.statusWordHex)
put("command_length", entry.commandLength)
put("response_length", entry.responseLength)
put("data_length", entry.dataLength)
put("is_wrapped", entry.isWrapped)
put("context", entry.context)

entry.plainCommandHex?.let { put("plain_command_hex", it) }
entry.plainResponseHex?.let { put("plain_response_hex", it) }
entry.plainCommandLength?.let { put("plain_command_length", it) }
entry.plainResponseLength?.let { put("plain_response_length", it) }
entry.plainDataLength?.let { put("plain_data_length", it) }
}

moduleReference?.logAnalyticsEvent("nfc_apdu_exchange", params)

Comment on lines +69 to +91
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Do not send raw APDU payloads to analytics (PII leakage, high risk).

command_hex/response_hex and “plain” fields can contain MRZ/DG1/DG2 and other sensitive data. Shipping these off-device violates least-privilege and may breach privacy/compliance. Log only safe metadata (timestamp, SW, lengths, wrapped flag, minimal header bytes), and gate any content logging behind an explicit debug-only flag with size caps and redaction.

@@ class APDULogger : APDUListener {
-    private fun logToAnalytics(entry: APDULogEntry) {
+    private var enableSensitiveApduLogging: Boolean = false
+    fun setSensitiveApduLoggingEnabled(enabled: Boolean) { enableSensitiveApduLogging = enabled }
+
+    private fun logToAnalytics(entry: APDULogEntry) {
         try {
-            val params = mutableMapOf<String, Any>().apply {
+            val params = mutableMapOf<String, Any>().apply {
                 put("timestamp", entry.timestamp)
-                put("command_hex", entry.commandHex)
-                put("response_hex", entry.responseHex)
                 put("status_word", entry.statusWord)
                 put("status_word_hex", entry.statusWordHex)
                 put("command_length", entry.commandLength)
                 put("response_length", entry.responseLength)
                 put("data_length", entry.dataLength)
                 put("is_wrapped", entry.isWrapped)
                 put("context", entry.context)
-
-                entry.plainCommandHex?.let { put("plain_command_hex", it) }
-                entry.plainResponseHex?.let { put("plain_response_hex", it) }
-                entry.plainCommandLength?.let { put("plain_command_length", it) }
-                entry.plainResponseLength?.let { put("plain_response_length", it) }
-                entry.plainDataLength?.let { put("plain_data_length", it) }
+                // Optional, debug-only: include minimal headers and cap size
+                if (enableSensitiveApduLogging) {
+                    put("command_header_hex", entry.commandHex.take(8)) // CLA+INS+P1+P2
+                    put("response_header_hex", entry.responseHex.take(2)) // SW1 (best-effort)
+                }
             }
             moduleReference?.logAnalyticsEvent("nfc_apdu_exchange", params)
         } catch (e: Exception) {
             Log.e("APDULogger", "Error logging to analytics", e)
         }
     }
@@
-data class APDULogEntry(
+data class APDULogEntry(
     val timestamp: Long,
-    val commandHex: String,
-    val responseHex: String,
+    val commandHex: String, // retained in-memory; not sent unless debug flag
+    val responseHex: String, // retained in-memory; not sent unless debug flag
     val statusWord: Int,
     val statusWordHex: String,
     val commandLength: Int,
     val responseLength: Int,
     val dataLength: Int,
     val isWrapped: Boolean,
-    val plainCommandHex: String?,
-    val plainResponseHex: String?,
-    val plainCommandLength: Int?,
-    val plainResponseLength: Int?,
-    val plainDataLength: Int?,
+    val plainCommandHex: String?, // never sent to analytics
+    val plainResponseHex: String?, // never sent to analytics
+    val plainCommandLength: Int?,
+    val plainResponseLength: Int?,
+    val plainDataLength: Int?,
     val context: Map<String, Any>
 )

Follow-up:

  • Consider removing even in-memory “plain*” fields in release builds.
  • Add per-INS allowlist if you ever need content in debug.

Also applies to: 98-114, 39-63

} catch (e: Exception) {
Log.e("APDULogger", "Error logging to analytics", e)
}
}
}

data class APDULogEntry(
val timestamp: Long,
val commandHex: String,
val responseHex: String,
val statusWord: Int,
val statusWordHex: String,
val commandLength: Int,
val responseLength: Int,
val dataLength: Int,
val isWrapped: Boolean,
val plainCommandHex: String?,
val plainResponseHex: String?,
val plainCommandLength: Int?,
val plainResponseLength: Int?,
val plainDataLength: Int?,
val context: Map<String, Any>
)
Loading
Loading