Trust the WARD certificate authority on Android

README.md

@@ -46,6 +46,8 @@ the development computer's LAN address, such as `http://192.168.1.20:8080`.
 Enter the same API token when connecting. The app stores its connection settings
 in its private application data and excludes them from Android backups. Cleartext
 HTTP is permitted only in debug builds; use HTTPS for non-local deployments.
+The release app trusts Android's system roots and the bundled public WARD root
+CA used by the project's private PKI.
 
 Tap a grid tile to open the vertical player. Long-press to select videos for a
 manual collection. The pager prepares neighboring pages to reduce startup latency.

android/app/src/main/AndroidManifest.xml

@@ -4,6 +4,7 @@
     <application
         android:allowBackup="false"
         android:label="Short Form Video"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:supportsRtl="true"
         android:theme="@style/Theme.ShortFormVideo"
         android:usesCleartextTraffic="${usesCleartextTraffic}">

android/app/src/main/res/raw/ward_root_ca.crt

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICdDCCAfmgAwIBAgIRAKfU9Zw+Js/brHgEQsGh6kMwCgYIKoZIzj0EAwMweTEL
+MAkGA1UEBhMCVVMxETAPBgNVBAgTCE1pc3NvdXJpMREwDwYDVQQHEwhDb2x1bWJp
+YTENMAsGA1UEChMEV0FSRDEcMBoGA1UECxMTS2VlcGVyIG9mIHRoZSBTZWFsczEX
+MBUGA1UEAxMOV0FSRCBIaWdoIFNlYWwwHhcNMjYwNzE0MTkwNzE1WhcNNDYwNzE0
+MTkwNzE1WjB5MQswCQYDVQQGEwJVUzERMA8GA1UECBMITWlzc291cmkxETAPBgNV
+BAcTCENvbHVtYmlhMQ0wCwYDVQQKEwRXQVJEMRwwGgYDVQQLExNLZWVwZXIgb2Yg
+dGhlIFNlYWxzMRcwFQYDVQQDEw5XQVJEIEhpZ2ggU2VhbDB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABIAy+1J1e+aAhuIwoeDhVMffxfVSPz9SF2oeYAIVo20Oy7lLf2e1
+Bxl4v2jI70gE6RvEQZIun9hCCdndaYlQBfNeTsq2WyATaswqwPoXzy8F+k0A0L3I
+WNB5Q3+ziXbb7aNFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C
+AQEwHQYDVR0OBBYEFBT8E6uVkuXG2FDBlO1Aj7oSXmWoMAoGCCqGSM49BAMDA2kA
+MGYCMQC1buh+feqK1d0bxtx1kRIIpSvmcwmDzHQfy+/nM7rtRpAYfvY6qfif4YAR
+6QWU42gCMQDGjjSuDynEUJGUROnvgqzbVPr+QkbiQMHFZ9qkFHDYtxFq6otl/+Xa
+0oqfuT+Sqz8=
+-----END CERTIFICATE-----

android/app/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config>
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="@raw/ward_root_ca" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>