From 518324a58cf47caf07e59c3456ccc53c729fa287 Mon Sep 17 00:00:00 2001
From: Nicholas Ward <nicholas@noreply.local>
Date: Tue, 22 Sep 2026 11:27:27 -0500
Subject: [PATCH] Trust the WARD certificate authority on Android

---
 README.md                                        |  2 ++
 android/app/src/main/AndroidManifest.xml         |  1 +
 android/app/src/main/res/raw/ward_root_ca.crt    | 16 ++++++++++++++++
 .../src/main/res/xml/network_security_config.xml |  9 +++++++++
 4 files changed, 28 insertions(+)
 create mode 100644 android/app/src/main/res/raw/ward_root_ca.crt
 create mode 100644 android/app/src/main/res/xml/network_security_config.xml

diff --git a/README.md b/README.md
index 54ceb3e..889bee8 100644
--- a/README.md
+++ b/README.md
@@ -46,6 +46,8 @@ the development computer's LAN address, such as `http://192.168.1.20:8080`.
 Enter the same API token when connecting. The app stores its connection settings
 in its private application data and excludes them from Android backups. Cleartext
 HTTP is permitted only in debug builds; use HTTPS for non-local deployments.
+The release app trusts Android's system roots and the bundled public WARD root
+CA used by the project's private PKI.
 
 Tap a grid tile to open the vertical player. Long-press to select videos for a
 manual collection. The pager prepares neighboring pages to reduce startup latency.
diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index 2bbc592..f2e2a17 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -4,6 +4,7 @@
     <application
         android:allowBackup="false"
         android:label="Short Form Video"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:supportsRtl="true"
         android:theme="@style/Theme.ShortFormVideo"
         android:usesCleartextTraffic="${usesCleartextTraffic}">
diff --git a/android/app/src/main/res/raw/ward_root_ca.crt b/android/app/src/main/res/raw/ward_root_ca.crt
new file mode 100644
index 0000000..e373fff
--- /dev/null
+++ b/android/app/src/main/res/raw/ward_root_ca.crt
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICdDCCAfmgAwIBAgIRAKfU9Zw+Js/brHgEQsGh6kMwCgYIKoZIzj0EAwMweTEL
+MAkGA1UEBhMCVVMxETAPBgNVBAgTCE1pc3NvdXJpMREwDwYDVQQHEwhDb2x1bWJp
+YTENMAsGA1UEChMEV0FSRDEcMBoGA1UECxMTS2VlcGVyIG9mIHRoZSBTZWFsczEX
+MBUGA1UEAxMOV0FSRCBIaWdoIFNlYWwwHhcNMjYwNzE0MTkwNzE1WhcNNDYwNzE0
+MTkwNzE1WjB5MQswCQYDVQQGEwJVUzERMA8GA1UECBMITWlzc291cmkxETAPBgNV
+BAcTCENvbHVtYmlhMQ0wCwYDVQQKEwRXQVJEMRwwGgYDVQQLExNLZWVwZXIgb2Yg
+dGhlIFNlYWxzMRcwFQYDVQQDEw5XQVJEIEhpZ2ggU2VhbDB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABIAy+1J1e+aAhuIwoeDhVMffxfVSPz9SF2oeYAIVo20Oy7lLf2e1
+Bxl4v2jI70gE6RvEQZIun9hCCdndaYlQBfNeTsq2WyATaswqwPoXzy8F+k0A0L3I
+WNB5Q3+ziXbb7aNFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C
+AQEwHQYDVR0OBBYEFBT8E6uVkuXG2FDBlO1Aj7oSXmWoMAoGCCqGSM49BAMDA2kA
+MGYCMQC1buh+feqK1d0bxtx1kRIIpSvmcwmDzHQfy+/nM7rtRpAYfvY6qfif4YAR
+6QWU42gCMQDGjjSuDynEUJGUROnvgqzbVPr+QkbiQMHFZ9qkFHDYtxFq6otl/+Xa
+0oqfuT+Sqz8=
+-----END CERTIFICATE-----
diff --git a/android/app/src/main/res/xml/network_security_config.xml b/android/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 0000000..80291cb
--- /dev/null
+++ b/android/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <base-config>
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="@raw/ward_root_ca" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>