# tlskit

The HTTP/TLS client shared by the Android 2.2/2.3 apps: [Plexamp Lite](https://git.anosanube.ovh/xocko/plexamp-lite),
[Podlite](https://git.anosanube.ovh/xocko/podlite), [Noticias Lite](https://git.anosanube.ovh/xocko/noticias-lite)
and [Calendar Lite](https://git.anosanube.ovh/xocko/calendar-lite).

Android 2.x's own SSL stops at TLS 1.0 and lacks today's root certificates, so modern `https://` servers
(Let's Encrypt, Pangolin, Cloudflare…) refuse it. This kit brings its own TLS 1.2 instead:

- `net/Http.java`: a small HTTP/1.1 client on Bouncy Castle TLS 1.2 (renamed to `com.minamp.bc`, so it
  doesn't clash with the old copy inside Android), with keep-alive pooling, session resumption and
  chunked bodies
- `net/CertVerifier.java`: host name, validity dates and the chain up to a bundled Mozilla root; optionally one
  pinned leaf certificate (SHA-256) for self-signed servers, with the fingerprint shown so the user can confirm it
- `net/AssetRoots.java` + `roots/`: Mozilla's root store (121 roots) as `assets/roots/<sha1(subject)>-<n>.der`
- `net/Threads.java`: threads with a 256 KB stack. Network work on Android 2.x must run on one, or the
  handshake overflows the default stack
- `net/DiagLog.java`: connection log, with tokens removed from URLs

## Use

```sh
./install.sh <app dir> <java package>      # e.g. ./install.sh ../noticias-lite org.freshmini.net
```

It copies `net/` into the app under that package and `roots/` into the app's `assets/`. Calendar Lite keeps
its copy under `android/org/gingercal/net` (copy by hand there). The apps carry copies, not a dependency:
when changing the kit, change it here and reinstall it into every app.

The Bouncy Castle sources come from Plexamp Lite's `tools/setup_toolchain.sh` (`~/android-toolchain/bcsrc`);
roots are regenerated with its `tools/make_roots.py`.

## Test

`test/KitTest.java` runs the client on a desktop JVM against real servers (FreshRSS, Nextcloud,
Audiobookshelf).