tlskit/README.md

tlskit

The HTTP/TLS client shared by the Android 2.2/2.3 apps: Plexamp Lite, Podlite, Noticias Lite and Calendar Lite.

Android 2.x's own SSL stops at TLS 1.0 and lacks today's root certificates, so modern https:// servers (Let's Encrypt, Pangolin, Cloudflare…) refuse it. This kit brings its own TLS 1.2 instead:

• net/Http.java: a small HTTP/1.1 client on Bouncy Castle TLS 1.2 (renamed to com.minamp.bc, so it doesn't clash with the old copy inside Android), with keep-alive pooling, session resumption and chunked bodies
• net/CertVerifier.java: host name, validity dates and the chain up to a bundled Mozilla root; optionally one pinned leaf certificate (SHA-256) for self-signed servers, with the fingerprint shown so the user can confirm it
• net/AssetRoots.java + roots/: Mozilla's root store (121 roots) as assets/roots/<sha1(subject)>-<n>.der
• net/Threads.java: threads with a 256 KB stack. Network work on Android 2.x must run on one, or the handshake overflows the default stack
• net/DiagLog.java: connection log, with tokens removed from URLs

Use

./install.sh <app dir> <java package>      # e.g. ./install.sh ../noticias-lite org.freshmini.net

It copies net/ into the app under that package and roots/ into the app's assets/. Calendar Lite keeps its copy under android/org/gingercal/net (copy by hand there). The apps carry copies, not a dependency: when changing the kit, change it here and reinstall it into every app.

The Bouncy Castle sources come from Plexamp Lite's tools/setup_toolchain.sh (~/android-toolchain/bcsrc); roots are regenerated with its tools/make_roots.py.

Test

test/KitTest.java runs the client on a desktop JVM against real servers (FreshRSS, Nextcloud, Audiobookshelf).