Barry Deen
3d3c6e12ef
Replaces the Google Drive backup flow (#528) with deterministic key derivation. The user's Nostr identity IS their Google account — no encrypted blobs to store, no backup events to publish, nothing for Google or any third party to retain. privkey = SHA-256("wisp-account-v1:" || sub || ":" || accountIndex) Properties: - Same Google account always derives the same nsec on any device - No backup to lose: signing in regenerates the keys - No `drive.appdata` OAuth scope, no scary Drive consent dialog - Anyone with access to the Google account can derive every nsec. Bounded by Google account security — same trade-off as #528, with a much simpler attack surface and no third-party storage layer Discovery on sign-in: - Derive candidate keypairs for indices 0..15 from the user's `sub` - One REQ to relay.damus.io, relay.primal.net, nos.lol, nostr.wine, relay.wisp.talk, relay.ditto.pub asking for kind 0/3/10002 events from those pubkeys - Pubkeys with any activity = "in use" accounts that go in the chooser; avatar + display name come from the same kind-0 events - "Create another account" derives the next-unused index Code shrinkage: DriveBackupService is gone, BackupCrypto's encryption helpers are gone, the play-services-auth dependency is gone, and the Drive-related ProGuard rules are gone. The whole flow is ~200 fewer lines than #528 and easier to audit — the derivation is one line of SHA-256. Splash button switches to Google's dark-mode brand variant (#131314 container, full-color G, #8E918F stroke) per Sign in with Google spec. No migration needed: nobody is on the #528 flow yet.
71 lines
1.8 KiB
Prolog
71 lines
1.8 KiB
Prolog
# kotlinx.serialization
|
|
-keepattributes *Annotation*, InnerClasses
|
|
-dontnote kotlinx.serialization.AnnotationsKt
|
|
|
|
-keepclassmembers @kotlinx.serialization.Serializable class ** {
|
|
*** Companion;
|
|
}
|
|
-if @kotlinx.serialization.Serializable class **
|
|
-keepclassmembers class <1>$Companion {
|
|
kotlinx.serialization.KSerializer serializer(...);
|
|
}
|
|
-if @kotlinx.serialization.Serializable class ** {
|
|
static **$* *;
|
|
}
|
|
-keepclassmembers class <2>$<3> {
|
|
kotlinx.serialization.KSerializer serializer(...);
|
|
}
|
|
|
|
# secp256k1-kmp JNI
|
|
-keep class fr.acinq.secp256k1.** { *; }
|
|
|
|
# Bouncy Castle
|
|
-keep class org.bouncycastle.** { *; }
|
|
-dontwarn org.bouncycastle.**
|
|
|
|
# OkHttp — keep class names so crash stack traces are readable
|
|
-keep class okhttp3.** { *; }
|
|
-keep class okio.** { *; }
|
|
-dontwarn okhttp3.internal.platform.**
|
|
-dontwarn org.conscrypt.**
|
|
-dontwarn org.bouncycastle.**
|
|
-dontwarn org.openjsse.**
|
|
|
|
# Coil
|
|
-dontwarn coil3.**
|
|
|
|
# AndroidX Security (EncryptedSharedPreferences)
|
|
-keep class androidx.security.crypto.** { *; }
|
|
|
|
# ExoPlayer / Media3
|
|
-dontwarn androidx.media3.**
|
|
|
|
# ZXing
|
|
-keep class com.google.zxing.** { *; }
|
|
|
|
# CameraX
|
|
-keep class androidx.camera.** { *; }
|
|
-dontwarn androidx.camera.**
|
|
|
|
# ML Kit
|
|
-keep class com.google.mlkit.** { *; }
|
|
-dontwarn com.google.mlkit.**
|
|
|
|
# ObjectBox
|
|
-keep class io.objectbox.** { *; }
|
|
-dontwarn io.objectbox.**
|
|
-keep class com.wisp.app.db.** { *; }
|
|
|
|
# Breez SDK Spark (UniFFI bindings)
|
|
-keep class breez_sdk_spark.** { *; }
|
|
-dontwarn breez_sdk_spark.**
|
|
# JNA (used by Breez SDK UniFFI)
|
|
-keep class com.sun.jna.** { *; }
|
|
-dontwarn com.sun.jna.**
|
|
|
|
# Credential Manager + Google Identity
|
|
-keep class androidx.credentials.** { *; }
|
|
-dontwarn androidx.credentials.**
|
|
-keep class com.google.android.libraries.identity.googleid.** { *; }
|
|
-dontwarn com.google.android.libraries.identity.googleid.**
|